retdec-fileinfo reads invalid memory when parsing a 138 B file

[s3rvac]

retdec-fileinfo reads invalid memory when parsing a 138 B file.

Steps to reproduce

$ retdec-fileinfo FILE

where FILE is 447360831D2F44DA6CB38D49812DA0921F18C37052FBBA424DE19290563250F8.

Expected output

retdec-fileinfo prints results from the analysis (or error if the file is invalid).

Actual output

retdec-fileinfo crashes:

Segmentation fault

Stacktrace from valgrind

Invalid read of size 8
   at 0x483C924: memmove (vg_replace_strmem.c:1270)
   by 0x71D503: PeLib::ImageLoader::captureOptionalHeader32(unsigned char*, unsigned char*, unsigned char*) (ImageLoader.cpp:2228)
   by 0x71B749: PeLib::ImageLoader::captureNtHeaders(std::vector<unsigned char, std::allocator<unsigned char> >&) (ImageLoader.cpp:1607)
   by 0x719F17: PeLib::ImageLoader::Load(std::vector<unsigned char, std::allocator<unsigned char> >&, bool) (ImageLoader.cpp:861)
   by 0x71A247: PeLib::ImageLoader::Load(std::istream&, long, bool) (ImageLoader.cpp:954)
   by 0x53D5A0: retdec::fileformat::(anonymous namespace)::isPe(std::istream&) (format_detection.cpp:133)
   by 0x53DAEB: retdec::fileformat::detectFileFormat(std::istream&, bool) (format_detection.cpp:270)
   by 0x53DC90: retdec::fileformat::detectFileFormat(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (format_detection.cpp:305)
   by 0x4EE5D4: main (fileinfo.cpp:443)
 Address 0x575d938 is 14 bytes after a block of size 138 alloc'd
   at 0x4835DEF: operator new(unsigned long) (vg_replace_malloc.c:334)
   by 0x484047: __gnu_cxx::new_allocator<unsigned char>::allocate(unsigned long, void const*) (new_allocator.h:114)
   by 0x483FBC: std::allocator_traits<std::allocator<unsigned char> >::allocate(std::allocator<unsigned char>&, unsigned long) (alloc_traits.h:444)
   by 0x483F4F: std::_Vector_base<unsigned char, std::allocator<unsigned char> >::_M_allocate(unsigned long) (stl_vector.h:343)
   by 0x51DB47: std::vector<unsigned char, std::allocator<unsigned char> >::_M_default_append(unsigned long) (vector.tcc:635)
   by 0x51CFC4: std::vector<unsigned char, std::allocator<unsigned char> >::resize(unsigned long) (stl_vector.h:937)
   by 0x71A17C: PeLib::ImageLoader::Load(std::istream&, long, bool) (ImageLoader.cpp:935)
   by 0x53D5A0: retdec::fileformat::(anonymous namespace)::isPe(std::istream&) (format_detection.cpp:133)
   by 0x53DAEB: retdec::fileformat::detectFileFormat(std::istream&, bool) (format_detection.cpp:270)
   by 0x53DC90: retdec::fileformat::detectFileFormat(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (format_detection.cpp:305)
   by 0x4EE5D4: main (fileinfo.cpp:443)

The complete output is here: valgrind-output.txt.

My configuration

• Current master (commit 6f9f518)
• 64b Debian, GCC 9.2, Debug build

[ladislav-zezula]

https://github.com/avast/retdec/tree/LZ_issue_838
avast/retdec-regression-tests#69