OllyDbg "INT3 AT" Format String Vulnerability

POC = Proof Of Concept

[TQN]

I found another bugs of OllyDbg. Wait for your ideas.

The first bug relate to Progress function and vsprintf function. Progress function is an export function of OllyDbg and used in OllyDbg PDK. Rename an EXE file with new name is %s%s%%s.exe. Open it with OllyDbg, and OllyDbg will crash at 004A74CF. The Progress function crash with parameter is:
void Progress(int promille,char *format,...);
promille = 1
format = 'Analysing %s%s%s%s$press SPACE to interrupt'.
The Progress function call _vsprintf function at 0043188E:

.text:00431881 loc_431881:                             ; CODE XREF: _Progress+5E
.text:00431881 push    esi                             ; arglist
.text:00431882 lea     eax, [ebp+format]
.text:00431888 push    eax                             ; format = 'Analysing %s%s%s%s'
.text:00431889 push    offset byte_4E3818              ; buffer
.text:0043188E call    _vsprintf

Another bug relate to long EXE file name. Rename an EXE file with a long new name (greater than 240). Open it with OllyDbg, and OllyDbg will crash.

Regards,
TQN

[MaRKuS-DJM]

Entry of routine: 4A6EBC

004A6F0F |. 80FB 25 |CMP BL,25
004A6F12 |. 75 08 |JNZ SHORT OLLYDBG.004A6F1C
004A6F14 |. 8A1E |MOV BL,BYTE PTR DS:[ESI]
004A6F16 |. 80FB 25 |CMP BL,25
004A6F19 |. 75 38 |JNZ SHORT OLLYDBG.004A6F53
25h = "%"
this routine is called from nearly everywhere. if there would be a way to fix it, olly would handle all this %s strings.