basic sanity checks when loading the thunk import table

radareorg · May 26, 2014 · 8c7984e · 8c7984e
1 parent 90df619
commit 8c7984e
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 7 deletions.
diff --git a/libr/bin/format/xbe/xbe.h b/libr/bin/format/xbe/xbe.h
@@ -10,6 +10,8 @@
 #define XBE_EP_CHIHIRO 0x40B5C16E
 #define XBE_KP_CHIHIRO 0x2290059D
 
+#define XBE_MAX_THUNK 366
+
 typedef struct {
 	ut32 magic;
 	ut8  signature[0x100];

diff --git a/libr/bin/p/bin_xbe.c b/libr/bin/p/bin_xbe.c
@@ -197,7 +197,7 @@ static RList* symbols(RBinFile *arch)
 	r_bin_xbe_obj_t *obj = arch->o->bin_obj;
 	RList *ret = r_list_new();
 	int i, found = R_FALSE;
-	ut32 thunk_addr[366];
+	ut32 thunk_addr[XBE_MAX_THUNK];
 	ut32 kt_addr = obj->header->kernel_thunk_addr ^ obj->kt_key;
 	xbe_section sect;
 
@@ -226,13 +226,18 @@ static RList* symbols(RBinFile *arch)
 			return NULL;
 		}
 
-		snprintf(sym->name, R_BIN_SIZEOF_STRINGS, "kt.%s\n", kt_name[thunk_addr[i] ^ 0x80000000]);
-		sym->vaddr = (obj->header->kernel_thunk_addr ^ obj->kt_key) + (4 * i);
-		sym->paddr = sym->vaddr - obj->header->base;
-		sym->size = 4;
-		sym->ordinal = i;
+		const ut32 thunk_index = thunk_addr[i] ^ 0x80000000;
 
-		r_list_append(ret, sym);
+		// Basic sanity checks
+		if (thunk_addr[i]&0x80000000 && thunk_index <= XBE_MAX_THUNK) {
+			snprintf(sym->name, R_BIN_SIZEOF_STRINGS, "kt.%s\n", kt_name[thunk_index]);
+			sym->vaddr = (obj->header->kernel_thunk_addr ^ obj->kt_key) + (4 * i);
+			sym->paddr = sym->vaddr - obj->header->base;
+			sym->size = 4;
+			sym->ordinal = i;
+
+			r_list_append(ret, sym);
+		}
 	}
 
 	return ret;