portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix OOB read in OMF format plugin (#6336)

Browse source 
* Fix OOB read of section due to invalid bounds check.
* Move array offset to variable for readability.
This commit is contained in:
Rot127 2026-05-11 15:53:51 +00:00 committed by GitHub
parent 478dfbf895
commit e6d0937c8a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
librz/bin/format/omf/omf.c
View file

@ -706,12 +706,13 @@ bool rz_bin_omf_get_entry(rz_bin_omf_obj *obj, RzBinAddr *addr) {
}
while (ct_sym < obj->nb_symbol) {
if (!strcmp(obj->symbols[ct_sym]->name, "_start")) {
if (obj->symbols[ct_sym]->seg_idx - 1 > obj->nb_section) {
size_t sec_arr_offset = obj->symbols[ct_sym]->seg_idx - 1;
if (sec_arr_offset >= obj->nb_section) {
RZ_LOG_ERROR("Invalid segment index for symbol _start\n");
return false;
}
addr->vaddr = obj->sections[obj->symbols[ct_sym]->seg_idx - 1]->vaddr + obj->symbols[ct_sym]->offset + OMF_BASE_ADDR;
data = obj->sections[obj->symbols[ct_sym]->seg_idx - 1]->data;
addr->vaddr = obj->sections[sec_arr_offset]->vaddr + obj->symbols[ct_sym]->offset + OMF_BASE_ADDR;
data = obj->sections[sec_arr_offset]->data;
while (data) {
offset += data->size;
if (obj->symbols[ct_sym]->offset < offset) {