Skip to content

Commit

Permalink
Limit resource names to 1000 character at most.
Browse files Browse the repository at this point in the history
Fixes high memory usage with corrupt files like bd15a7227770d89546e0a16e4c8da45937d970baa810827a7ceb17abd3138fec.
  • Loading branch information
plusvic committed May 29, 2024
1 parent 0e5b6bb commit 3f5b4c7
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions libyara/modules/pe/pe.c
Original file line number Diff line number Diff line change
Expand Up @@ -380,7 +380,6 @@ static void pe_parse_debug_directory(PE* pe)
// Return a pointer to the resource directory string or NULL.
// The callback function will parse this and call yr_set_sized_string().
// The pointer is guaranteed to have enough space to contain the entire string.

static const PIMAGE_RESOURCE_DIR_STRING_U parse_resource_name(
PE* pe,
const uint8_t* rsrc_data,
Expand All @@ -397,10 +396,13 @@ static const PIMAGE_RESOURCE_DIR_STRING_U parse_resource_name(

// A resource directory string is 2 bytes for the length and then a variable
// length Unicode string. Make sure we have at least 2 bytes.

if (!fits_in_pe(pe, pNameString, 2))
return NULL;

// Sanity check for strings that are excesively large.
if (pNameString->Length > 1000)
return NULL;

// Move past the length and make sure we have enough bytes for the string.
if (!fits_in_pe(
pe,
Expand Down

0 comments on commit 3f5b4c7

Please sign in to comment.