le: Fix segfault in le.c

rizinorg · Oct 17, 2023 · 4d018c0 · 4d018c0
1 parent 58ee80d
commit 4d018c0
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/librz/bin/format/le/le.c b/librz/bin/format/le/le.c
@@ -805,6 +805,12 @@ static RZ_OWN LE_page *le_load_pages(rz_bin_le_obj_t *bin) {
 	// assign object number to pages, calculate vaddr
 	for (ut32 oi = 0; oi < h->objcnt; oi++) {
 		LE_object *obj = &bin->objects[oi];
+		if (obj->page_tbl_idx > obj->page_tbl_entries) {
+			RZ_LOG_WARN("LE: object #%u page table index is greater than "
+					"entries count %u > %u, skipping its pages.\n",
+				oi + 1, obj->page_tbl_idx, obj->page_tbl_entries);
+			continue;
+		}
 		ut32 voff = 0;
 		LE_page *page = &le_pages[obj->page_tbl_idx - 1];
 		for (ut32 i = 0; i < obj->page_tbl_entries; i++, page++) {
@@ -1015,7 +1021,7 @@ static RzVector /*<LE_map>*/ *le_create_maps(rz_bin_le_obj_t *bin) {
 		LE_map m = { .obj_num = oi + 1 };
 		size_t len_before = rz_vector_len(le_maps);
 		ut32 beg = obj->page_tbl_idx - 1, end = beg + obj->page_tbl_entries;
-		for (ut32 pi = beg; pi != end; pi++) {
+		for (ut32 pi = beg; pi < end; pi++) {
 			LE_page *page = &bin->le_pages[pi];
 			m.first_page_num = pi + 1;
 			if (page->type == PAGE_LEGAL) {