From 0987f679b31655bcdf3254d2906d36fd9d393aee Mon Sep 17 00:00:00 2001 From: Mason Reed Date: Wed, 27 May 2026 14:14:27 -0400 Subject: [PE] Add a fast fail for malformed PE exception directory table size Fixes https://github.com/Vector35/binaryninja/issues/1472 --- view/pe/peview.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/view/pe/peview.cpp b/view/pe/peview.cpp index 718822ba..a793eeb3 100644 --- a/view/pe/peview.cpp +++ b/view/pe/peview.cpp @@ -1753,10 +1753,15 @@ bool PEView::Init() } } - if (m_dataDirs[IMAGE_DIRECTORY_ENTRY_EXCEPTION].size % entrySize) + const auto& exceptionDir = m_dataDirs[IMAGE_DIRECTORY_ENTRY_EXCEPTION]; + if (exceptionDir.size % entrySize) throw PEFormatException("invalid table size"); - numExceptionEntries = m_dataDirs[IMAGE_DIRECTORY_ENTRY_EXCEPTION].size / entrySize; + const auto imageSize = GetEnd() - GetStart(); + if ((exceptionDir.virtualAddress > imageSize) + || (exceptionDir.size > (imageSize - exceptionDir.virtualAddress))) + throw PEFormatException("too many exception entries, table size exceeds available memory range"); + numExceptionEntries = exceptionDir.size / entrySize; // This DataVariable can end up creating a large array and rendering this in LinearView currently has performance implications // So instead we just create separate structures not in an array Ref exceptionEntryStruct = exceptionEntryBuilder.Finalize(); -- cgit v1.3.1