On Fri, 15 Sept 2023 at 18:02, Viktor Prutyanov <vik...@daynix.com> wrote:
>
> PE export name check introduced in d399d6b179 isn't reliable enough,
> because a page with the export directory may be not present for some
> reason. On the other hand, elf2dmp retrieves the PDB name in any case.
> It can be also used to check that a PE image is the kernel image. So,
> check PDB name when searching for Windows kernel image.
>
> Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2165917
>
> Signed-off-by: Viktor Prutyanov <vik...@daynix.com>
> ---
> contrib/elf2dmp/main.c | 93 +++++++++++++++---------------------------
> 1 file changed, 33 insertions(+), 60 deletions(-)
Hi; Coverity points out a bug in this code (CID 1521598):
> -static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
> - char *hash, struct va_space *vs)
> +static bool pe_check_pdb_name(uint64_t base, void *start_addr,
> + struct va_space *vs, OMFSignatureRSDS *rsds)
> {
> const char sign_rsds[4] = "RSDS";
sign_rsds[] is not NUL-terminated...
> IMAGE_DEBUG_DIRECTORY debug_dir;
> - OMFSignatureRSDS rsds;
> - char *pdb_name;
> - size_t pdb_name_sz;
> - size_t i;
> + char pdb_name[sizeof(PDB_NAME)];
>
> if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
> &debug_dir, sizeof(debug_dir), vs)) {
> eprintf("Failed to get Debug Directory\n");
> - return 1;
> + return false;
> }
>
> if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
> - return 1;
> + eprintf("Debug Directory type is not CodeView\n");
> + return false;
> }
>
> if (va_space_rw(vs,
> base + debug_dir.AddressOfRawData,
> - &rsds, sizeof(rsds), 0)) {
> - return 1;
> + rsds, sizeof(*rsds), 0)) {
> + eprintf("Failed to resolve OMFSignatureRSDS\n");
> + return false;
> }
>
> - printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
> -
> - if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
> - return 1;
> + if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
> + eprintf("CodeView signature is \'%.4s\', \'%s\' expected\n",
> + rsds->Signature, sign_rsds);
...but in this printf() we pass sign_rsds to a "%s" format
specifier, which requires NUL termination.
If you want to print a non-NUL-terminated string you need
to do the same thing we do for rsds->Signature, which is
give it a precision which is the correct length so printf
doesn't read off the end (i.e. "%.4s").
thanks
-- PMM
