From bdf5ef4da3d58d1904c288cfde154c8d9ee4bdf3 Mon Sep 17 00:00:00 2001
From: pancake <pancake@nopcode.org>
Date: Mon, 30 Oct 2017 13:30:02 +0100
Subject: [PATCH] Fix two bugs in the mdmp loader (read overflow and double
 free)

---
 libr/bin/format/mdmp/mdmp.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/libr/bin/format/mdmp/mdmp.c b/libr/bin/format/mdmp/mdmp.c
index 6446f6d628..c1d51d056d 100644
--- a/libr/bin/format/mdmp/mdmp.c
+++ b/libr/bin/format/mdmp/mdmp.c
@@ -106,11 +106,11 @@ void r_bin_mdmp_free(struct r_bin_mdmp_obj *obj) {
 	r_list_free (obj->pe32_bins);
 	r_list_free (obj->pe64_bins);
 
-	sdb_free (obj->kv);
+	// fails because sub-sdb of this instance doesnt handle refs properly
+	// better leak than crash
+	//sdb_free (obj->kv);
 	r_buf_free (obj->b);
 
-	memset (obj, 0, sizeof (struct r_bin_mdmp_obj));
-
 	R_FREE (obj);
 
 	return;
@@ -728,7 +728,9 @@ static bool r_bin_mdmp_init_pe_bins(struct r_bin_mdmp_obj *obj) {
 		if (!(paddr = r_bin_mdmp_get_paddr (obj, module->base_of_image))) {
 			continue;
 		}
-		buf = r_buf_new_with_bytes (obj->b->buf + paddr, module->size_of_image);
+		ut32 left = 0;
+		const ut8 *b = r_buf_get_at (obj->b, paddr, &left);
+		buf = r_buf_new_with_bytes (b, R_MIN (left, module->size_of_image));
 		dup = false;
 		if (check_pe32_bytes (buf->buf, module->size_of_image)) {
 			r_list_foreach(obj->pe32_bins, it_dup, pe32_dup) {