dnrops
/
radare2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix double free when loading malformed PE file 

FMI: https://corkami.googlecode.com/svn/trunk/src/PE/lfanew_relocW7.asm
This commit is contained in:
pancake 2013-07-03 11:57:37 +02:00
parent e8b35ce98d
commit 7cb31941a6
4 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libr/bin/bin.c
View File

@ -150,7 +150,7 @@ static int r_bin_init_items(RBin *bin, int dummy) {
RBinArch *a = &bin->cur;
RBinObject *o = a->o;
a->curplugin = NULL;
// DEBUG eprintf ("LOAD\n");
r_list_foreach (bin->plugins, it, plugin) {
if ((dummy && !strncmp (plugin->name, "any", 5)) ||
(!dummy && (plugin->check && plugin->check (&bin->cur)))) {
@ -158,14 +158,15 @@ static int r_bin_init_items(RBin *bin, int dummy) {
break;
}
}
cp = bin->cur.curplugin;
cp = a->curplugin;
if (minlen<0) {
if (cp && cp->minstrlen)
minlen = cp->minstrlen;
else minlen = -minlen;
}
if (!cp || !cp->load || !cp->load (a)) {
r_buf_free (a->buf);
// already freed in format/pe/pe.c:r_bin_pe_free()
// r_buf_free (a->buf);
a->buf = r_buf_mmap (bin->cur.file, 0);
a->size = a->buf? a->buf->length: 0;
o->strings = get_strings (a, minlen);

1
libr/bin/format/pe/pe.c
View File

@ -727,6 +727,7 @@ void* PE_(r_bin_pe_free)(struct PE_(r_bin_pe_obj_t)* bin) {
free (bin->import_directory);
free (bin->delay_import_directory);
r_buf_free (bin->b);
bin->b = NULL;
free (bin);
return NULL;
}

3
libr/bin/p/bin_any.c
View File

@ -1,4 +1,4 @@
/* radare - LGPL - Copyright 2009-2011 - nibble */
/* radare - LGPL - Copyright 2009-2013 - nibble */
#include <r_types.h>
#include <r_util.h>
@ -11,6 +11,7 @@ static int load(RBinArch *arch) {
static int destroy(RBinArch *arch) {
r_buf_free (arch->buf);
arch->buf = NULL;
return R_TRUE;
}

2
r2-bindings/node-ffi/examples/r2irc.js
View File

@ -10,7 +10,7 @@ var irc;
var nick = OPT.nick || "r2bot"
var channel = OPT.channel || "#radare"
var host = OPT.host || "irc.freenode.net"
var port = OPT.port || 6697
var port = OPT.port || 6667
var owner = OPT.owner || "pancake";
var file = OPT.file || "/bin/ls"
var limit = OPT.limit || 10;