Fixed out-of-bounds read

avast · Oct 4, 2021 · 96d7c4a · 96d7c4a
1 parent 228bace
commit 96d7c4a
Showing 1 changed file with 20 additions and 18 deletions.
diff --git a/src/pelib/ImageLoader.cpp b/src/pelib/ImageLoader.cpp
@@ -1146,29 +1146,31 @@ std::uint32_t PeLib::ImageLoader::readWriteImage(
 	if(rva < rvaEnd)
 	{
 		std::uint8_t * bufferPtr = static_cast<std::uint8_t *>(buffer);
-		std::size_t pageIndex = rva / PELIB_PAGE_SIZE;
 
-		// The page index must be in range
-		if(pageIndex < pages.size())
+		while(rva < rvaEnd)
 		{
-			while(rva < rvaEnd)
-			{
-				PELIB_FILE_PAGE & page = pages[pageIndex++];
-				std::uint32_t offsetInPage = rva & (PELIB_PAGE_SIZE - 1);
-				std::uint32_t bytesInPage = PELIB_PAGE_SIZE - offsetInPage;
-
-				// Perhaps the last page loaded?
-				if(bytesInPage > (rvaEnd - rva))
-					bytesInPage = (rvaEnd - rva);
+			std::uint32_t offsetInPage = rva & (PELIB_PAGE_SIZE - 1);
+			std::uint32_t bytesInPage = PELIB_PAGE_SIZE - offsetInPage;
+			std::size_t pageIndex = rva / PELIB_PAGE_SIZE;
 
-				// Perform the read/write operation
-				ReadWrite(page, bufferPtr, offsetInPage, bytesInPage);
+			// Perhaps the last page loaded?
+			if(bytesInPage > (rvaEnd - rva))
+				bytesInPage = (rvaEnd - rva);
 
-				// Move pointers
-				bufferPtr += bytesInPage;
-				bytesRead += bytesInPage;
-				rva += bytesInPage;
+			// The page index must be in range
+			if(pageIndex < pages.size())
+			{
+				ReadWrite(pages[pageIndex], bufferPtr, offsetInPage, bytesInPage);
+			}
+			else
+			{
+				memset(bufferPtr, 0, bytesInPage);
 			}
+
+			// Move pointers
+			bufferPtr += bytesInPage;
+			bytesRead += bytesInPage;
+			rva += bytesInPage;
 		}
 	}