...
|
...
|
@@ -243,15 +243,15 @@ static int pefromupx (const char *src, uint32_t ssize, char *dst, uint32_t *dsiz
|
243
|
243
|
memcpy(newbuf+0xd0, pehdr,0xf8+0x28*sectcnt);
|
244
|
244
|
sections = pehdr+0xf8;
|
245
|
245
|
for (upd = 0; upd <sectcnt ; upd++) {
|
246
|
|
- int32_t offset1, offset2, offset3;
|
247
|
|
- offset1 = cli_readint32(sections+20);
|
248
|
|
- offset2 = cli_readint32(sections+16);
|
|
246
|
+ uint32_t offset1, offset2, offset3;
|
|
247
|
+ offset1 = (uint32_t)cli_readint32(sections+20);
|
|
248
|
+ offset2 = (uint32_t)cli_readint32(sections+16);
|
249
|
249
|
if (offset1 > foffset || offset2 > foffset || offset1 + offset2 > foffset) {
|
250
|
250
|
free(newbuf);
|
251
|
251
|
return 1;
|
252
|
252
|
}
|
253
|
253
|
|
254
|
|
- offset3 = cli_readint32(sections+12);
|
|
254
|
+ offset3 = (uint32_t)cli_readint32(sections+12);
|
255
|
255
|
if (offset3-upx0 > *dsize) {
|
256
|
256
|
free(newbuf);
|
257
|
257
|
return 1;
|