Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PE: import directory can have null size (but not a null pointer) #341

Merged
merged 2 commits into from
Aug 5, 2021
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions src/read/pe/file.rs
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ where
pub fn data_directory(&self, id: usize) -> Option<&'data pe::ImageDataDirectory> {
self.data_directories
.get(id)
.filter(|d| d.size.get(LE) != 0)
.filter(|d| d.virtual_address.get(LE) != 0)
}

fn data_at(&self, va: u32) -> Option<Bytes<'data>> {
Expand Down Expand Up @@ -224,7 +224,16 @@ where
Some(data_dir) => data_dir,
None => return Ok(Vec::new()),
};
let mut import_descriptors = data_dir.data(self.data, &self.common.sections).map(Bytes)?;

// The size declared in the IMAGE_DIRECTORY_ENTRY_IMPORT is ignored by the Windows loader
// Hence, we'll parse the list until a null entry, without restricting the read to this declared size
// (i.e. we're not using `data_dir.data()`)
let mut import_descriptors = self
.common
.sections
.pe_data_at(self.data, data_dir.virtual_address.get(LE))
.map(Bytes)
.ok_or(read::Error("Unable to read PE import descriptors"))?;
let mut imports = Vec::new();
loop {
let import_desc = import_descriptors
Expand Down