fix(PE): IMAGE_LOAD_CONFIG_DIR reader

Author: Dax89

mz/pe/dirs/config.c

@@ -2,61 +2,83 @@
 #include <string.h>
 
 static bool _pe_read_config_dir32(RDReader* r, PELoadConfigDirectory32* v) {
+    *v = (PELoadConfigDirectory32){0}; // keep missing fields = 0
+
     rd_reader_read_le32(r, &v->Size);
-    rd_reader_read_le32(r, &v->TimeDateStamp);
-    rd_reader_read_le16(r, &v->MajorVersion);
-    rd_reader_read_le16(r, &v->MinorVersion);
-    rd_reader_read_le32(r, &v->GlobalFlagsClear);
-    rd_reader_read_le32(r, &v->GlobalFlagsSet);
-    rd_reader_read_le32(r, &v->CriticalSectionDefaultTimeout);
-    rd_reader_read_le32(r, &v->DeCommitFreeBlockThreshold);
-    rd_reader_read_le32(r, &v->DeCommitTotalFreeThreshold);
-    rd_reader_read_le32(r, &v->LockPrefixTable);
-    rd_reader_read_le32(r, &v->MaximumAllocationSize);
-    rd_reader_read_le32(r, &v->VirtualMemoryThreshold);
-    rd_reader_read_le32(r, &v->ProcessHeapFlags);
-    rd_reader_read_le32(r, &v->ProcessAffinityMask);
-    rd_reader_read_le16(r, &v->CSDVersion);
-    rd_reader_read_le16(r, &v->Reserved1);
-    rd_reader_read_le32(r, &v->EditList);
-    rd_reader_read_le32(r, &v->SecurityCookie);
-    rd_reader_read_le32(r, &v->SEHandlerTable);
-    rd_reader_read_le32(r, &v->SEHandlerCount);
-    rd_reader_read_le32(r, &v->GuardCFCheckFunctionPointer);
-    rd_reader_read_le32(r, &v->Reserved2);
-    rd_reader_read_le32(r, &v->GuardCFFunctionTable);
-    rd_reader_read_le32(r, &v->GuardCFFunctionCount);
-    rd_reader_read_le32(r, &v->GuardFlags);
+    if(rd_reader_has_error(r) || v->Size < 4) return false;
+
+    if(v->Size >= 64) {
+        rd_reader_read_le32(r, &v->TimeDateStamp);
+        rd_reader_read_le16(r, &v->MajorVersion);
+        rd_reader_read_le16(r, &v->MinorVersion);
+        rd_reader_read_le32(r, &v->GlobalFlagsClear);
+        rd_reader_read_le32(r, &v->GlobalFlagsSet);
+        rd_reader_read_le32(r, &v->CriticalSectionDefaultTimeout);
+        rd_reader_read_le32(r, &v->DeCommitFreeBlockThreshold);
+        rd_reader_read_le32(r, &v->DeCommitTotalFreeThreshold);
+        rd_reader_read_le32(r, &v->LockPrefixTable);
+        rd_reader_read_le32(r, &v->MaximumAllocationSize);
+        rd_reader_read_le32(r, &v->VirtualMemoryThreshold);
+        rd_reader_read_le32(r, &v->ProcessHeapFlags);
+        rd_reader_read_le32(r, &v->ProcessAffinityMask);
+        rd_reader_read_le16(r, &v->CSDVersion);
+        rd_reader_read_le16(r, &v->Reserved1);
+        rd_reader_read_le32(r, &v->EditList);
+        rd_reader_read_le32(r, &v->SecurityCookie);
+    }
+
+    if(v->Size >= 72) {
+        rd_reader_read_le32(r, &v->SEHandlerTable);
+        rd_reader_read_le32(r, &v->SEHandlerCount);
+    }
+
+    if(v->Size >= 92) {
+        rd_reader_read_le32(r, &v->GuardCFCheckFunctionPointer);
+        rd_reader_read_le32(r, &v->Reserved2);
+        rd_reader_read_le32(r, &v->GuardCFFunctionTable);
+        rd_reader_read_le32(r, &v->GuardCFFunctionCount);
+        rd_reader_read_le32(r, &v->GuardFlags);
+    }
 
     return !rd_reader_has_error(r);
 }
 
 static bool _pe_read_config_dir64(RDReader* r, PELoadConfigDirectory64* v) {
+    *v = (PELoadConfigDirectory64){0}; // keep missing fields = 0
+
     rd_reader_read_le32(r, &v->Size);
-    rd_reader_read_le32(r, &v->TimeDateStamp);
-    rd_reader_read_le16(r, &v->MajorVersion);
-    rd_reader_read_le16(r, &v->MinorVersion);
-    rd_reader_read_le32(r, &v->GlobalFlagsClear);
-    rd_reader_read_le32(r, &v->GlobalFlagsSet);
-    rd_reader_read_le32(r, &v->CriticalSectionDefaultTimeout);
-    rd_reader_read_le64(r, &v->DeCommitFreeBlockThreshold);
-    rd_reader_read_le64(r, &v->DeCommitTotalFreeThreshold);
-    rd_reader_read_le64(r, &v->LockPrefixTable);
-    rd_reader_read_le64(r, &v->MaximumAllocationSize);
-    rd_reader_read_le64(r, &v->VirtualMemoryThreshold);
-    rd_reader_read_le64(r, &v->ProcessAffinityMask);
-    rd_reader_read_le64(r, &v->ProcessHeapFlags);
-    rd_reader_read_le16(r, &v->CSDVersion);
-    rd_reader_read_le16(r, &v->Reserved1);
-    rd_reader_read_le64(r, &v->EditList);
-    rd_reader_read_le64(r, &v->SecurityCookie);
-    rd_reader_read_le64(r, &v->SEHandlerTable);
-    rd_reader_read_le64(r, &v->SEHandlerCount);
-    rd_reader_read_le64(r, &v->GuardCFCheckFunctionPointer);
-    rd_reader_read_le64(r, &v->Reserved2);
-    rd_reader_read_le64(r, &v->GuardCFFunctionTable);
-    rd_reader_read_le64(r, &v->GuardCFFunctionCount);
-    rd_reader_read_le32(r, &v->GuardFlags);
+    if(rd_reader_has_error(r) || v->Size < 4) return false;
+
+    if(v->Size >= 112) {
+        rd_reader_read_le32(r, &v->TimeDateStamp);
+        rd_reader_read_le16(r, &v->MajorVersion);
+        rd_reader_read_le16(r, &v->MinorVersion);
+        rd_reader_read_le32(r, &v->GlobalFlagsClear);
+        rd_reader_read_le32(r, &v->GlobalFlagsSet);
+        rd_reader_read_le32(r, &v->CriticalSectionDefaultTimeout);
+        rd_reader_read_le64(r, &v->DeCommitFreeBlockThreshold);
+        rd_reader_read_le64(r, &v->DeCommitTotalFreeThreshold);
+        rd_reader_read_le64(r, &v->LockPrefixTable);
+        rd_reader_read_le64(r, &v->MaximumAllocationSize);
+        rd_reader_read_le64(r, &v->VirtualMemoryThreshold);
+        rd_reader_read_le64(r, &v->ProcessAffinityMask);
+        rd_reader_read_le32(r, &v->ProcessHeapFlags);
+        rd_reader_read_le16(r, &v->CSDVersion);
+        rd_reader_read_le16(r, &v->Reserved1);
+        rd_reader_read_le64(r, &v->EditList);
+        rd_reader_read_le64(r, &v->SecurityCookie);
+    }
+
+    if(v->Size >= 148) {
+        rd_reader_read_le64(r, &v->SEHandlerTable);
+        rd_reader_read_le64(r, &v->SEHandlerCount);
+        rd_reader_read_le64(r, &v->GuardCFCheckFunctionPointer);
+        rd_reader_read_le64(r, &v->Reserved2);
+        rd_reader_read_le64(r, &v->GuardCFFunctionTable);
+        rd_reader_read_le64(r, &v->GuardCFFunctionCount);
+    }
+
+    if(v->Size >= 152) rd_reader_read_le32(r, &v->GuardFlags);
 
     return !rd_reader_has_error(r);
 }

mz/pe/dirs/config.h

@@ -7,17 +7,17 @@ typedef struct PELoadConfigDirectory32 {
     u16 MajorVersion, MinorVersion;
     u32 GlobalFlagsClear, GlobalFlagsSet, CriticalSectionDefaultTimeout;
     u32 DeCommitFreeBlockThreshold, DeCommitTotalFreeThreshold;
-    u32 LockPrefixTable; // VA
+    u32 LockPrefixTable;
     u32 MaximumAllocationSize, VirtualMemoryThreshold;
     u32 ProcessHeapFlags, ProcessAffinityMask;
     u16 CSDVersion, Reserved1;
-    u32 EditList;       // VA
-    u32 SecurityCookie; // VA
-    u32 SEHandlerTable; // VA
+    u32 EditList;
+    u32 SecurityCookie;
+    u32 SEHandlerTable;
     u32 SEHandlerCount;
-    u32 GuardCFCheckFunctionPointer; // VA
+    u32 GuardCFCheckFunctionPointer;
     u32 Reserved2;
-    u32 GuardCFFunctionTable; // VA
+    u32 GuardCFFunctionTable;
     u32 GuardCFFunctionCount, GuardFlags;
 } PELoadConfigDirectory32;
 
@@ -26,17 +26,18 @@ typedef struct PELoadConfigDirectory64 {
     u16 MajorVersion, MinorVersion;
     u32 GlobalFlagsClear, GlobalFlagsSet, CriticalSectionDefaultTimeout;
     u64 DeCommitFreeBlockThreshold, DeCommitTotalFreeThreshold;
-    u64 LockPrefixTable; // VA
+    u64 LockPrefixTable;
     u64 MaximumAllocationSize, VirtualMemoryThreshold;
-    u64 ProcessAffinityMask, ProcessHeapFlags;
+    u64 ProcessAffinityMask;
+    u32 ProcessHeapFlags;
     u16 CSDVersion, Reserved1;
-    u64 EditList;       // VA
-    u64 SecurityCookie; // VA
-    u64 SEHandlerTable; // VA
+    u64 EditList;
+    u64 SecurityCookie;
+    u64 SEHandlerTable;
     u64 SEHandlerCount;
-    u64 GuardCFCheckFunctionPointer; // VA
+    u64 GuardCFCheckFunctionPointer;
     u64 Reserved2;
-    u64 GuardCFFunctionTable; // VA
+    u64 GuardCFFunctionTable;
     u64 GuardCFFunctionCount;
     u32 GuardFlags;
 } PELoadConfigDirectory64;