fileformat/format_detection: make COFF format detection more strict.

fix #421
avast · Mar 4, 2019 · a5fa960 · a5fa960
1 parent a95fd46
commit a5fa960
Showing 1 changed file with 15 additions and 3 deletions.
diff --git a/src/fileformat/utils/format_detection.cpp b/src/fileformat/utils/format_detection.cpp
@@ -127,10 +127,22 @@ bool isCoff(std::istream& stream, const std::string &header)
 
 	std::error_code errorCode;
 	COFFObjectFile coff(buffer.get()->getMemBufferRef(), errorCode);
+	if (errorCode)
+	{
+		return false;
+	}
+
 	PELIB_IMAGE_FILE_MACHINE_ITERATOR it;
-	return !errorCode
-			&& it.isValidMachineCode(
-					static_cast<PELIB_IMAGE_FILE_MACHINE>(coff.getMachine()));
+	bool validMachineCode = it.isValidMachineCode(
+			static_cast<PELIB_IMAGE_FILE_MACHINE>(coff.getMachine()));
+	bool unknownMachineCode =
+			coff.getMachine() == PELIB_IMAGE_FILE_MACHINE::PELIB_IMAGE_FILE_MACHINE_UNKNOWN;
+	if (!validMachineCode
+			|| (unknownMachineCode && coff.getNumberOfSections() == 0))
+	{
+		return false;
+	}
+	return true;
 }
 
 /**