From f3fc7fca924296b2908fb223e3183126d55b9404 Mon Sep 17 00:00:00 2001 From: daladim Date: Tue, 3 Aug 2021 17:57:15 +0200 Subject: [PATCH 1/2] PE: import directory can have null size (but not a null pointer) --- src/read/pe/file.rs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/read/pe/file.rs b/src/read/pe/file.rs index 429db9b7..bff8d34f 100644 --- a/src/read/pe/file.rs +++ b/src/read/pe/file.rs @@ -84,7 +84,7 @@ where pub fn data_directory(&self, id: usize) -> Option<&'data pe::ImageDataDirectory> { self.data_directories .get(id) - .filter(|d| d.size.get(LE) != 0) + .filter(|d| d.virtual_address.get(LE) != 0) } fn data_at(&self, va: u32) -> Option> { @@ -224,7 +224,14 @@ where Some(data_dir) => data_dir, None => return Ok(Vec::new()), }; - let mut import_descriptors = data_dir.data(self.data, &self.common.sections).map(Bytes)?; + + // The size declared in the IMAGE_DIRECTORY_ENTRY_IMPORT is ignored by the Windows loader + // Hence, we'll parse the list until a null entry, without restricting the read to this declared size + // (i.e. we're not using `data_dir.data()`) + let mut import_descriptors = self.common.sections + .pe_data_at(self.data, data_dir.virtual_address.get(LE)) + .map(Bytes) + .ok_or(read::Error("Unable to read PE import descriptors"))?; let mut imports = Vec::new(); loop { let import_desc = import_descriptors From d878d3e0fa671e469beb3993fe2fb716125b94ef Mon Sep 17 00:00:00 2001 From: daladim Date: Wed, 4 Aug 2021 10:40:01 +0200 Subject: [PATCH 2/2] [minor] rustfmt --- src/read/pe/file.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/read/pe/file.rs b/src/read/pe/file.rs index bff8d34f..a154d656 100644 --- a/src/read/pe/file.rs +++ b/src/read/pe/file.rs @@ -228,7 +228,9 @@ where // The size declared in the IMAGE_DIRECTORY_ENTRY_IMPORT is ignored by the Windows loader // Hence, we'll parse the list until a null entry, without restricting the read to this declared size // (i.e. we're not using `data_dir.data()`) - let mut import_descriptors = self.common.sections + let mut import_descriptors = self + .common + .sections .pe_data_at(self.data, data_dir.virtual_address.get(LE)) .map(Bytes) .ok_or(read::Error("Unable to read PE import descriptors"))?;