| 标题 | JusticeRage Manalyze 0.9 Out-of-Bounds Read |
|---|
| 描述 | Manalyze contains an integer underflow in `PE::_parse_debug()` when parsing `IMAGE_DEBUG_TYPE_MISC` debug entries.
The `misc.Length` field is read from the attacker-controlled PE file and is used in the unsigned subtraction:
`misc.Length - misc_size`
where `misc_size` is 12 bytes.
When `misc.Length` is smaller than `misc_size`, the subtraction wraps around to a very large unsigned value. This value is subsequently passed as the maximum read size to the string parsing routine, allowing the parser to read beyond the declared `IMAGE_DEBUG_MISC` structure until a null byte or EOF is encountered.
A crafted PE file with `misc.Length=0` was used to reproduce the issue. In the 66,048-byte PoC, the parser read 65,496 bytes starting immediately after the 12-byte `IMAGE_DEBUG_MISC` header and incorporated the attacker-controlled data into the `Debug artifacts` output.
This behavior can expose file data located beyond the declared `IMAGE_DEBUG_MISC` structure and can cause excessive memory consumption when processing crafted PE files containing large amounts of non-null data.
Affected component: `manape / PE parser`
Affected function: `PE::_parse_debug()`
Affected structure: `IMAGE_DEBUG_MISC`
Trigger condition: `IMAGE_DEBUG_MISC.Length < IMAGE_DEBUG_MISC` header size
The issue was subsequently addressed upstream by adding bounds validation for `IMAGE_DEBUG_MISC.Length` and restricting the string parser to the declared debug data size.
Fix:
https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382
|
|---|
| 来源 | ⚠️ https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382 |
|---|
| 用户 | akbarov (UID 100866) |
|---|
| 提交 | 2026-08-28 23時09分 (23 日前) |
|---|
| 管理 | 2026-09-20 10時07分 (22 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408019 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_debug misc.Length 内存损坏] |
|---|
| 积分 | 20 |
|---|