Fix an edge case in .to_win32pe #18094
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When the entry point is after the payload, there woud occassionally be cases where `poff` and `eidx` to be invalid, causing `entry` to be truncated. `poff` should never be negative and `eidx` should reserve the 256 bytes that `entry` may occupy.
zeroSteiner
commented
Jun 13, 2023
Comment on lines
+331
to
+332
| poff -= [256, poff].min | ||
| eidx = rand(block[1] - (poff + payload.length + 256)) + poff + payload.length |
There was a problem hiding this comment.
These two lines are the real fix for the boundary issues.
zeroSteiner
commented
Jun 13, 2023
Comment on lines
+309
to
311
| if payload.length + 256 >= block[1] | ||
| raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+257} found:#{block[1]})" | ||
| end |
There was a problem hiding this comment.
This was switched to ensure that block[1] is greater than payload.length + 256. 256 is the max size of the entry as you can see on L324. 5 bytes are reserved for the jump instruction.
This should prevent future calls to rand() from receiving 0 in the event that payload.length + 256 == block[1]. When Ruby's rand() function is called with 0, it will return a float which is unexpected.
adfoster-r7
approved these changes
Jun 14, 2023
Release NotesFixes an edgecase with |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When the entry point is after the payload, there would occasionally be cases where
poffandeidxto be invalid, causingentryto be truncated.poffshould never be negative andeidxshould reserve the 256 bytes thatentrymay occupy.Testing
rand()calls to initializeelocto 1 andpoffto 100. This would have triggered the bug every time.