mirror of
git://source.winehq.org/git/wine.git
synced 2024-10-14 15:39:05 +00:00
dbghelp: Protect PE's COFF table reading against bogus values in NTHEADER.
This commit is contained in:
parent
df710826e1
commit
516fc78a2b
|
@ -171,6 +171,25 @@ unsigned pe_get_map_size(const struct image_section_map* ism)
|
|||
return ism->fmap->u.pe.sect[ism->sidx].shdr.SizeOfRawData;
|
||||
}
|
||||
|
||||
/******************************************************************
|
||||
* pe_is_valid_pointer_table
|
||||
*
|
||||
* Checks whether the PointerToSymbolTable and NumberOfSymbols in file_header contain
|
||||
* valid information.
|
||||
*/
|
||||
static BOOL pe_is_valid_pointer_table(const IMAGE_NT_HEADERS* nthdr, const void* mapping)
|
||||
{
|
||||
DWORD64 offset;
|
||||
|
||||
/* is the iSym table inside file image ? */
|
||||
offset = (DWORD64)nthdr->FileHeader.PointerToSymbolTable;
|
||||
offset += (DWORD64)nthdr->FileHeader.NumberOfSymbols * sizeof(IMAGE_SYMBOL);
|
||||
if (offset > (DWORD64)nthdr->OptionalHeader.SizeOfImage) return FALSE;
|
||||
/* is string table (following iSym table) inside file image ? */
|
||||
offset += *(DWORD*)((const char*)mapping + offset);
|
||||
return offset <= (DWORD64)nthdr->OptionalHeader.SizeOfImage;
|
||||
}
|
||||
|
||||
/******************************************************************
|
||||
* pe_map_file
|
||||
*
|
||||
|
@ -208,6 +227,8 @@ static BOOL pe_map_file(HANDLE file, struct image_file_map* fmap, enum module_ty
|
|||
fmap->u.pe.sect[i].mapped = IMAGE_NO_MAP;
|
||||
}
|
||||
if (nthdr->FileHeader.PointerToSymbolTable && nthdr->FileHeader.NumberOfSymbols)
|
||||
{
|
||||
if (pe_is_valid_pointer_table(nthdr, mapping))
|
||||
{
|
||||
/* FIXME ugly: should rather map the relevant content instead of copying it */
|
||||
const char* src = (const char*)mapping +
|
||||
|
@ -220,6 +241,14 @@ static BOOL pe_map_file(HANDLE file, struct image_file_map* fmap, enum module_ty
|
|||
memcpy(dst, src, sz);
|
||||
fmap->u.pe.strtable = dst;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* we have bad information here, wipe it out */
|
||||
fmap->u.pe.ntheader.FileHeader.PointerToSymbolTable = 0;
|
||||
fmap->u.pe.ntheader.FileHeader.NumberOfSymbols = 0;
|
||||
fmap->u.pe.strtable = NULL;
|
||||
}
|
||||
}
|
||||
else fmap->u.pe.strtable = NULL;
|
||||
}
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue