From a230b39fbc1a4c6559d6153a43bcb7e5110ec784 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Tue, 9 Sep 2025 13:51:40 -0400 Subject: [PATCH] Make relocation block parsing safer --- .../Deserializers/PortableExecutable.cs | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/SabreTools.Serialization/Deserializers/PortableExecutable.cs b/SabreTools.Serialization/Deserializers/PortableExecutable.cs index ab3e1e0b..ecf57e14 100644 --- a/SabreTools.Serialization/Deserializers/PortableExecutable.cs +++ b/SabreTools.Serialization/Deserializers/PortableExecutable.cs @@ -329,19 +329,22 @@ namespace SabreTools.Serialization.Deserializers obj.PageRVA = data.ReadUInt32LittleEndian(); obj.BlockSize = data.ReadUInt32LittleEndian(); - if (obj.BlockSize == 0) - return null; + if (obj.BlockSize <= 8) + return obj; - var entries = new List(); - int totalSize = 8; - while (totalSize < obj.BlockSize && data.Position < data.Length) + // Guard against invalid block sizes + if (obj.BlockSize % 2 != 0) + return obj; + + int entryCount = ((int)obj.BlockSize - 8) / 2; + obj.TypeOffsetFieldEntries = new BaseRelocationTypeOffsetFieldEntry[entryCount]; + for (int i = 0; i < obj.TypeOffsetFieldEntries.Length; i++) { - var entry = ParseBaseRelocationTypeOffsetFieldEntry(data); - entries.Add(entry); - totalSize += 2; - } + if (data.Position + 2 >= data.Length) + break; - obj.TypeOffsetFieldEntries = [.. entries]; + obj.TypeOffsetFieldEntries[i] = ParseBaseRelocationTypeOffsetFieldEntry(data); + } return obj; }