diff options
| author | Mason Reed <mason@vector35.com> | 2026-05-27 14:14:27 -0400 |
|---|---|---|
| committer | Mason Reed <35282038+emesare@users.noreply.github.com> | 2026-05-28 14:09:06 -0400 |
| commit | 0987f679b31655bcdf3254d2906d36fd9d393aee (patch) | |
| tree | 8c0c39639f6b9c8771d9789e6f0cac1efbcbf2ba /view/pe | |
| parent | 8c7b2472924e92198e0364e6df896c0a5c4f7e9f (diff) | |
[PE] Add a fast fail for malformed PE exception directory table size
Fixes https://github.com/Vector35/binaryninja/issues/1472
Diffstat (limited to 'view/pe')
| -rw-r--r-- | view/pe/peview.cpp | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/view/pe/peview.cpp b/view/pe/peview.cpp index 718822ba..a793eeb3 100644 --- a/view/pe/peview.cpp +++ b/view/pe/peview.cpp @@ -1753,10 +1753,15 @@ bool PEView::Init() } } - if (m_dataDirs[IMAGE_DIRECTORY_ENTRY_EXCEPTION].size % entrySize) + const auto& exceptionDir = m_dataDirs[IMAGE_DIRECTORY_ENTRY_EXCEPTION]; + if (exceptionDir.size % entrySize) throw PEFormatException("invalid table size"); - numExceptionEntries = m_dataDirs[IMAGE_DIRECTORY_ENTRY_EXCEPTION].size / entrySize; + const auto imageSize = GetEnd() - GetStart(); + if ((exceptionDir.virtualAddress > imageSize) + || (exceptionDir.size > (imageSize - exceptionDir.virtualAddress))) + throw PEFormatException("too many exception entries, table size exceeds available memory range"); + numExceptionEntries = exceptionDir.size / entrySize; // This DataVariable can end up creating a large array and rendering this in LinearView currently has performance implications // So instead we just create separate structures not in an array Ref<Structure> exceptionEntryStruct = exceptionEntryBuilder.Finalize(); |