commit 4b811d93486f36bc8beaad15ceda5734f15e232e
author Marcus Meissner <marcus@jet.franken.de> Mon Oct 31 21:03:05 2005 +0000
committer Alexandre Julliard <julliard@winehq.org> Mon Oct 31 21:03:05 2005 +0000
tree 3d5dd664fbd96af6e1380d407e4806cef28bd861
parent 21883d794af54f49c5597b33e5b390479962bd8f

Do not overflow the stackbased "nt" struct when reading non-conforming
PE files.

server/mapping.c

diff --git a/server/mapping.c b/server/mapping.c
index 984fa7c..92546c2 100644
--- a/server/mapping.c
+++ b/server/mapping.c
@@ -206,7 +206,7 @@
     IMAGE_SECTION_HEADER *sec = NULL;
     struct fd *fd;
     off_t pos;
-    int unix_fd, size;
+    int unix_fd, size, toread;
 
     /* load the headers */
 
@@ -225,8 +225,8 @@
     pos += sizeof(nt.FileHeader);
     /* zero out Optional header in the case it's not present or partial */
     memset(&nt.OptionalHeader, 0, sizeof(nt.OptionalHeader));
-    if (pread( unix_fd, &nt.OptionalHeader, nt.FileHeader.SizeOfOptionalHeader,
-               pos ) != nt.FileHeader.SizeOfOptionalHeader) goto error;
+    toread = min( sizeof(nt.OptionalHeader), nt.FileHeader.SizeOfOptionalHeader );
+    if (pread( unix_fd, &nt.OptionalHeader, toread, pos ) != toread) goto error;
     pos += nt.FileHeader.SizeOfOptionalHeader;
 
     /* load the section headers */