mirror of
https://github.com/QuasarApp/pe-parse.git
synced 2025-05-08 17:49:32 +00:00
I've noticed this in one (otherwise valid) EFI image. What happens is the section specifies an invalid PointerToRawData, which the bounded buffer abstraction catches and returns NULL. However, the SizeOfRawData is still in the structure (and probably invalid too). I saw two ways to fix this. If sectionData ends up being NULL we can set SizeOfRawData to 0, but that would be truncating what is otherwise specified in the file. The other option is to teach dump-prog and pepy about this and adjust accordingly. This involves checking for a data being a NULL pointer in dump-prog when printing sections. In pepy it required roughly the same check. I went with option 2.