Skip to content

Commit

Permalink
Use image loader when loading corrupted resources
Browse files Browse the repository at this point in the history
When the resource tree doesn't have expected depth, we use different
path to load resources which didn't use loader but calculated offset
from RVA on it's own resulting in underflows on integers and completely
bogus offsets. Even though offsets are still kinda bogus, they make
sense and are within the file itself after this change.

Example file: f39f1ad9f97766618826d47c2d32529425e773659f5577fea06a82e21f13b064
  • Loading branch information
metthal authored and Peter Kubov committed Jan 19, 2022
1 parent 62d0d5f commit 4a5d9ef
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/fileformat/file_format/pe/pe_format.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1664,7 +1664,7 @@ void PeFormat::loadResourceNodes(std::vector<const PeLib::ResourceChild*> &nodes
continue;
}
auto resource = std::make_unique<Resource>();
resource->setOffset(leaf->getOffsetToData() - rva + formatParser->getResourceDirectoryOffset());
resource->setOffset(getImageLoader().getValidOffsetFromRva(leaf->getOffsetToData()));
resource->setSizeInFile(leaf->getSize());
resource->load(this);
resourceTable->addResource(std::move(resource));
Expand Down

0 comments on commit 4a5d9ef

Please sign in to comment.