Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 16/23] pefile: Parse a PE binary to find a key and a signature contained therein | Date | Wed, 31 Oct 2012 00:59:26 +0000 |
| |
Kees Cook <keescook@chromium.org> wrote:
> This multiplication can push the cursor out of bounds. (n_data_dirents > is unverified). > ... > Both of these cases of n_sections multiplications can wrap. > Ultimately, you can end up with cursor close to zero, but n_sections > being giant.
Good points. I wonder if I should limit these to some low number, or just check that they don't exceed header_size, which also needs checking as you said.
> ... (Also, do you want a "break" in there after the first .keylist is found, > or is this intentionally "use last key list"?)
I hadn't considered that. Inserting a break is probably best, if only to curtail the processing time slightly.
David
| |