fix(pe): Avoid parsing an empty byte buffer

rabbitstack · rabbitstack · commit 1c5bd119ebd8 · 2024-10-16T20:45:50.000+02:00
Prevent parsing the PE byte buffer if it is empty.
diff --git a/pkg/pe/parser.go b/pkg/pe/parser.go
@@ -177,6 +177,9 @@ func ParseFileWithConfig(path string, config Config) (*PE, error) {
 
 // ParseBytes tries to parse the PE from the given byte slice and parser options.
 func ParseBytes(data []byte, opts ...Option) (*PE, error) {
+	if len(data) == 0 || va.Zeroed(data) {
+		return nil, ErrEmptyVArea
+	}
 	return parse("", data, opts...)
 }
 
@@ -195,9 +198,6 @@ func ParseMem(pid uint32, base uintptr, changeProtection bool, opts ...Option) (
 	}
 	defer windows.Close(process)
 	area := va.ReadArea(process, base, MaxHeaderSize, MinHeaderSize, changeProtection)
-	if len(area) == 0 || va.Zeroed(area) {
-		return nil, ErrEmptyVArea
-	}
 	return ParseBytes(area, opts...)
 }
 

Original file line number	Diff line number	Diff line change
`@@ -177,6 +177,9 @@ func ParseFileWithConfig(path string, config Config) (*PE, error) {`
`177`	`177`
`178`	`178`	`// ParseBytes tries to parse the PE from the given byte slice and parser options.`
`179`	`179`	`func ParseBytes(data []byte, opts ...Option) (*PE, error) {`
	`180`	`+ if len(data) == 0 \|\| va.Zeroed(data) {`
	`181`	`+ return nil, ErrEmptyVArea`
	`182`	`+ }`
`180`	`183`	`return parse("", data, opts...)`
`181`	`184`	`}`
`182`	`185`
`@@ -195,9 +198,6 @@ func ParseMem(pid uint32, base uintptr, changeProtection bool, opts ...Option) (`
`195`	`198`	`}`
`196`	`199`	`defer windows.Close(process)`
`197`	`200`	`area := va.ReadArea(process, base, MaxHeaderSize, MinHeaderSize, changeProtection)`
`198`		`- if len(area) == 0 \|\| va.Zeroed(area) {`
`199`		`- return nil, ErrEmptyVArea`
`200`		`- }`
`201`	`201`	`return ParseBytes(area, opts...)`
`202`	`202`	`}`
`203`	`203`