OllyDbg "INT3 AT" Format String Vulnerability

[TQN]

I found another bugs of OllyDbg. Wait for your ideas.

The first bug relate to Progress function and vsprintf function. Progress function is an export function of OllyDbg and used in OllyDbg PDK. Rename an EXE file with new name is %s%s%%s.exe. Open it with OllyDbg, and OllyDbg will crash at 004A74CF. The Progress function crash with parameter is:
void Progress(int promille,char *format,...);
promille = 1
format = 'Analysing %s%s%s%s$press SPACE to interrupt'.
The Progress function call _vsprintf function at 0043188E:

.text:00431881 loc_431881:                             ; CODE XREF: _Progress+5E
.text:00431881 push    esi                             ; arglist
.text:00431882 lea     eax, [ebp+format]
.text:00431888 push    eax                             ; format = 'Analysing %s%s%s%s'
.text:00431889 push    offset byte_4E3818              ; buffer
.text:0043188E call    _vsprintf

Another bug relate to long EXE file name. Rename an EXE file with a long new name (greater than 240). Open it with OllyDbg, and OllyDbg will crash.

Regards,
TQN