Skip to content

Fix rdi_decompressed_size_from_parsed to account for 8-byte alignment padding#801

Open
portbuster1337 wants to merge 1 commit into
EpicGames:masterfrom
portbuster1337:fix/rdi-decompressed-size-alignment
Open

Fix rdi_decompressed_size_from_parsed to account for 8-byte alignment padding#801
portbuster1337 wants to merge 1 commit into
EpicGames:masterfrom
portbuster1337:fix/rdi-decompressed-size-alignment

Conversation

@portbuster1337

Copy link
Copy Markdown

Bug

rdi_decompressed_size_from_parsed computes the decompressed size as:

decompressed_size = raw_data_size + sum(unpacked_size - encoded_size)

This formula assumes sections are packed tightly in the decompressed buffer. However, rdi_decompress_parsed aligns each section's data to 8-byte boundaries with padding, so the actual decompressed buffer is larger than the formula predicts. When callers (radbin.c, dbg_info.c) use this function to allocate the output buffer, the buffer may be too small, causing a heap buffer overflow.

Fix

Replicate the exact layout computation from rdi_decompress_parsed to compute the correct decompressed size:

off = data_section_off + sizeof(RDI_Section) * sections_count;
off = align_up(off, 8);
for each section:
    off += section.unpacked_size;
    off = align_up(off, 8);
return off;

… padding

The previous formula raw_data_size + sum(unpacked_size - encoded_size)
assumes sections are packed tightly in the decompressed buffer, but
rdi_decompress_parsed aligns each section's data to 8-byte boundaries.
This could cause a heap buffer overflow when the decompressed buffer
is allocated based on the underestimated size.

Compute the exact decompressed layout size by replicating the same
alignment logic used in rdi_decompress_parsed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant