Merge pull request #908 from avast/LZ_issue_907

Lz issue 907
avast · Dec 18, 2020 · ed02e64 · ed02e64
2 parents 37dbfd1 + c9ddd13
commit ed02e64
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 4 deletions.
diff --git a/include/retdec/pelib/ImageLoader.h b/include/retdec/pelib/ImageLoader.h
@@ -204,7 +204,7 @@ class ImageLoader
 
 	std::uint64_t getSizeOfFile() const
 	{
-		return fileSize;
+		return savedFileSize;
 	}
 
 	std::uint64_t getOrdinalMask() const
@@ -451,7 +451,7 @@ class ImageLoader
 	PELIB_IMAGE_OPTIONAL_HEADER optionalHeader;         // 32/64-bit optional header
 	ByteBuffer rawFileData;                             // Loaded content of the image in case it couldn't have been mapped
 	LoaderError ldrError;
-	std::uint64_t fileSize;                             // Size of the raw file
+	std::uint64_t savedFileSize;                        // Size of the raw file
 	std::uint32_t windowsBuildNumber;
 	std::uint32_t ntSignature;
 	std::uint32_t maxSectionCount;

diff --git a/include/retdec/pelib/PeLibAux.h b/include/retdec/pelib/PeLibAux.h
@@ -162,6 +162,7 @@ namespace PeLib
 	const std::uint32_t PELIB_IMAGE_RESOURCE_DATA_IS_DIRECTORY = 0x80000000;
 	const std::uint32_t PELIB_IMAGE_RESOURCE_NAME_IS_STRING = 0x80000000;
 	const std::uint32_t PELIB_IMAGE_RESOURCE_RVA_MASK = 0x7FFFFFFF;
+	const std::uint16_t PELIB_MAX_RESOURCE_ENTRIES = 0xC000;            // Maximum number of resource directory entries we consider OK
 
 	enum : std::uint32_t
 	{

diff --git a/src/pelib/ImageLoader.cpp b/src/pelib/ImageLoader.cpp
@@ -872,7 +872,7 @@ int PeLib::ImageLoader::Load(
 	int fileError;
 
 	// Remember the size of the file for later use
-	fileSize = fileData.size();
+	savedFileSize = fileData.size();
 
 	// Check and capture DOS header
 	fileError = captureDosHeader(fileData);

diff --git a/src/pelib/ResourceDirectory.cpp b/src/pelib/ResourceDirectory.cpp
@@ -645,8 +645,17 @@ namespace PeLib
 		if(imageLoader.readImage(&header, uiRva, PELIB_IMAGE_RESOURCE_DIRECTORY::size()) != PELIB_IMAGE_RESOURCE_DIRECTORY::size())
 			return ERROR_INVALID_FILE;
 
-		// Add the total number of entries to the occupied range
+		// FE015EB24B7EEA2907698A6D7142198644A757066DA4EB8D3A4B63900008CF5E: Invalid root resource directory
+		// We artificially limit the allowed number of resource entries
+		if((header.NumberOfNamedEntries > PELIB_MAX_RESOURCE_ENTRIES) || (header.NumberOfIdEntries > PELIB_MAX_RESOURCE_ENTRIES))
+			return ERROR_INVALID_FILE;
+
+		// More checks for number of entries
 		unsigned int uiNumberOfEntries = header.NumberOfNamedEntries + header.NumberOfIdEntries;
+		if(uiNumberOfEntries > PELIB_MAX_RESOURCE_ENTRIES)
+			return ERROR_INVALID_FILE;
+
+		// Add the total number of entries to the occupied range
 		resDir->addOccupiedAddressRange(uiRva, uiRva + PELIB_IMAGE_RESOURCE_DIRECTORY::size() - 1);
 		uiRva += PELIB_IMAGE_RESOURCE_DIRECTORY::size();