施耐德电气igs数据收集器多个漏洞

<剪断…>。text: 0047 ee69 mov连成一片,(eax + 1 ch);attacker-controlled大小。text: 0047 ee6c mov [ebp + DataSize],连成一片。text: 0047 ee72 mov edx, [ebp + var_2D8]。text: 0047 ee78 mov eax, [edx]。text: 0047 ee7a添加eax, [ebp + DataSize]。text: 0047 ee80 cmp eax, 7534 h。text: 0047 ee85签署int比较。text: 0047 ee85 0 xffffffff(1)能通过尺寸检查。text: 0047 ee85 jle短ok_47EEF1;attacker-controlled大小。text: 0047 ee85;(即。,0 xffffffff) <剪断…>。text: 0047 eef1 ok_47EEF1:;代码XREF: sn_receive_file + 225↑j。text: 0047 eef1 mov edx (ebp + DataSize);attacker-controlled大小。text: 0047 eef1;(即。,0 xffffffff)。text: 0047 eef7 edx推;大小。text: 0047 eef8 mov eax, [ebp + arg_0]。text: 0047 eefb添加eax, 20 h;' '。text: 0047 eefe eax推;Src。text: 0047 eeff mov连成一片,[ebp + var_2D8]。text: 0047 ef05 mov edx,[连成一片+ 14 h]。text: 0047 ef08 mov eax, [ebp + var_2D8]。text: 0047 ef0e添加edx, [eax]。text: 0047 ef10 edx推;void *。text: 0047 ef11叫memcpy <剪…>