trailofbits / trailofbits/pe-parse

Error parsing resource id with invalid unicode characters

Open
#160 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
911
Forks
171
PR merge metrics
No merged PRs in 30d

Description

Seems to be an error parsing invalid Unicode resource ids in parse_resource_id function.

Here is a sample file that triggers the error. invalid-utf16-rsid.exe.zip.

Parse of sample file with dump-pe:

ser@user-pc:~/pe-parse$ ./build/dump-pe/dump-pe invalid-utf16-rsid.exe 
terminate called after throwing an instance of 'std::range_error'
  what():  wstring_convert::to_bytes
Aborted (core dumped)

Here is a backtrace generated with dump-pe:

#0  __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007fa6cbc4e859 in __GI_abort () at abort.c:79
#2  0x00007fa6cc023911 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#3  0x00007fa6cc02f38c in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#4  0x00007fa6cc02f3f7 in std::terminate() () from /lib/x86_64-linux-gnu/libstdc++.so.6
#5  0x00007fa6cc02f6a9 in __cxa_throw () from /lib/x86_64-linux-gnu/libstdc++.so.6
#6  0x00007fa6cc026454 in std::__throw_range_error(char const*) () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00007fa6cc19aa95 in std::__cxx11::wstring_convert<std::codecvt_utf8<char16_t, 1114111ul, (std::codecvt_mode)0>, char16_t, std::allocator<char16_t>, std::allocator<char> >::to_bytes (this=0x7ffd4a5efd18, __first=<optimized out>, __last=<optimized out>) at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/locale_conv.h:360
#8  0x00007fa6cc19a87d in std::__cxx11::wstring_convert<std::codecvt_utf8<char16_t, 1114111ul, (std::codecvt_mode)0>, char16_t, std::allocator<char16_t>, std::allocator<char> >::to_bytes (this=<optimized out>, __wstr=u"蔀࿀삔쒃༜삶\xd8f7郃邐襕菥ᣬӇ․䀕ᅫ") at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/locale_conv.h:346
#9  peparse::from_utf16 (u=u"蔀࿀삔쒃༜삶\xd8f7郃邐襕菥ᣬӇ․䀕ᅫ") at /home/user/pe-parse/pe-parser-library/src/unicode_codecvt.cpp:34
#10 0x00007fa6cc1886fe in peparse::parse_resource_id (data=0xdfab60, id=<optimized out>, result=Python Exception <class 'gdb.error'> There is no member named _M_dataplus.: 
) at /home/user/pe-parse/pe-parser-library/src/parse.cpp:637
#11 0x00007fa6cc188ecf in peparse::parse_resource_table (sectionData=0xdfab60, o=<optimized out>, virtaddr=<optimized out>, depth=0x0, dirent=<optimized out>, rsrcs=std::vector of length 0, capacity 0) at /home/user/pe-parse/pe-parser-library/src/parse.cpp:719
#12 0x00007fa6cc189c58 in peparse::getResources (b=<optimized out>, fileBegin=<optimized out>, secs=..., rsrcs=std::vector of length 0, capacity 0) at /home/user/pe-parse/pe-parser-library/src/parse.cpp:872
#13 0x00007fa6cc195883 in peparse::ParsePEFromBuffer (buffer=<optimized out>) at /home/user/pe-parse/pe-parser-library/src/parse.cpp:2398
#14 0x0000000000403276 in main (argc=0x2, argv=<optimized out>) at /home/user/pe-parse/dump-pe/main.cpp:313

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with parse_resource_id in pe-parser-library/src/parse.cpp and the from_utf16 conversion in pe-parser-library/src/unicode_codecvt.cpp. Reproduce the failure with the linked invalid-utf16-rsid.exe sample using dump-pe. Done means the sample no longer aborts with std::range_error while parsing its resource ID.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.