From e1e7172561359070817c3c75df932669ecf56bf5 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Tue, 15 Mar 2022 21:30:46 -0700
Subject: [PATCH] Make ReadArbitraryRange safer

---
 .../Microsoft/NE/NewExecutable.cs             | 24 ++++++++++++-------
 .../Microsoft/PE/PortableExecutable.cs        | 24 ++++++++++++-------
 BurnOutSharp/Scanner.cs                       |  2 +-
 3 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/BurnOutSharp/ExecutableType/Microsoft/NE/NewExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/NE/NewExecutable.cs
index cf77e17c..52ad2b36 100644
--- a/BurnOutSharp/ExecutableType/Microsoft/NE/NewExecutable.cs
+++ b/BurnOutSharp/ExecutableType/Microsoft/NE/NewExecutable.cs
@@ -164,16 +164,24 @@ namespace BurnOutSharp.ExecutableType.Microsoft.NE
         /// <returns></returns>
         public byte[] ReadArbitraryRange(int rangeStart = -1, int length = -1)
         {
-            // If we have a source stream, use that
-            if (this._sourceStream != null)
-                return ReadArbitraryRangeFromSourceStream(rangeStart, length);
+            try
+            {
+                // If we have a source stream, use that
+                if (this._sourceStream != null)
+                    return ReadArbitraryRangeFromSourceStream(rangeStart, length);
 
-            // If we have a source array, use that
-            if (this._sourceArray != null)
-                return ReadArbitraryRangeFromSourceArray(rangeStart, length);
+                // If we have a source array, use that
+                if (this._sourceArray != null)
+                    return ReadArbitraryRangeFromSourceArray(rangeStart, length);
 
-            // Otherwise, return null
-            return null;
+                // Otherwise, return null
+                return null;
+            }
+            catch (Exception ex)
+            {
+                // TODO: How to handle this differently?
+                return null;
+            }
         }
 
         /// <summary>
diff --git a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs
index deb7a628..a87b01c2 100644
--- a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs
+++ b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs
@@ -554,16 +554,24 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
         /// <returns></returns>
         public byte[] ReadArbitraryRange(int rangeStart = -1, int length = -1)
         {
-            // If we have a source stream, use that
-            if (this._sourceStream != null)
-                return ReadArbitraryRangeFromSourceStream(rangeStart, length);
+            try
+            {
+                // If we have a source stream, use that
+                if (this._sourceStream != null)
+                    return ReadArbitraryRangeFromSourceStream(rangeStart, length);
 
-            // If we have a source array, use that
-            if (this._sourceArray != null)
-                return ReadArbitraryRangeFromSourceArray(rangeStart, length);
+                // If we have a source array, use that
+                if (this._sourceArray != null)
+                    return ReadArbitraryRangeFromSourceArray(rangeStart, length);
 
-            // Otherwise, return null
-            return null;
+                // Otherwise, return null
+                return null;
+            }
+            catch (Exception ex)
+            {
+                // TODO: How to handle this differently?
+                return null;
+            }
         }
 
         /// <summary>
diff --git a/BurnOutSharp/Scanner.cs b/BurnOutSharp/Scanner.cs
index 595734dc..5d8e3cb6 100644
--- a/BurnOutSharp/Scanner.cs
+++ b/BurnOutSharp/Scanner.cs
@@ -254,7 +254,7 @@ namespace BurnOutSharp
             if (!File.Exists(file))
                 return null;
 
-            // Initialze the protections found
+            // Initialize the protections found
             var protections = new ConcurrentDictionary<string, ConcurrentQueue<string>>();
 
             // Get the extension for certain checks