mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2026-06-02 07:31:43 +08:00
GP-5502 added extra typeinfo validation by checking that typeinfoname is a string
This commit is contained in:
@@ -2335,6 +2335,12 @@ public class RTTIGccClassRecoverer extends RTTIClassRecoverer {
|
|||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// test to see if there is a string at the typeinfo name location in the would be
|
||||||
|
// typeinfo structure
|
||||||
|
if (!hasStringAtTypeinfoNameLocation(typeinfoAddress)) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
Data newStructure = null;
|
Data newStructure = null;
|
||||||
String specialTypeinfoNamespaceName = null;
|
String specialTypeinfoNamespaceName = null;
|
||||||
|
|
||||||
@@ -2430,6 +2436,36 @@ public class RTTIGccClassRecoverer extends RTTIClassRecoverer {
|
|||||||
return typeinfos;
|
return typeinfos;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Method to validate the second member of the typeinfo struct is a string
|
||||||
|
* @param typeinfoAddress the address of the potential typeinfo struct
|
||||||
|
* @return true if what is pointed to by the typeinfoName pointer is a valid string, false otherwise
|
||||||
|
*/
|
||||||
|
private boolean hasStringAtTypeinfoNameLocation(Address typeinfoAddress) {
|
||||||
|
|
||||||
|
// first get the referenced address and verify it is an address
|
||||||
|
Address typeinfoNameAddress =
|
||||||
|
extendedFlatAPI.getPointer(typeinfoAddress.add(defaultPointerSize));
|
||||||
|
if (typeinfoNameAddress == null) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// get defined string if defined already
|
||||||
|
String definedString = getDefinedStringAt(typeinfoNameAddress);
|
||||||
|
if (definedString != null) {
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
// get string from memory if not defined to see if ascii there
|
||||||
|
String stringInMem = getStringFromMemory(typeinfoNameAddress);
|
||||||
|
if (stringInMem != null) {
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
return false;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
private GccTypeinfo getTypeinfo(String namespaceName, List<GccTypeinfo> typeinfos)
|
private GccTypeinfo getTypeinfo(String namespaceName, List<GccTypeinfo> typeinfos)
|
||||||
throws CancelledException {
|
throws CancelledException {
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user