Add arithmetic checks when using nom take
puffyCid opened this issue · comments
What new feature do you think would be cool to add to artemis?
Add checks when using nom take()
function and applying a size adjustment. Ex: take(size-adjust)
If size is smaller than adjust nom will panic due to the negative number. And the panic will crash artemis :/
Describe the solution you'd like
Add if blocks
to always make sure original value is larger than adjustments
Additional context
There are not too many instances where adjusts are used in artemis. so it should be easy to add.
From artemis-core/src
grep adjust -R * | grep "\- " | grep take
artifacts/os/windows/ese/pages/leaf.rs: let (input, fixed) = take(variable_data_offset - adjust_offset)(input)?;
artifacts/os/windows/shimdb/tags/stringref.rs: let (string_entry, _) = take(offset - adjust_offset)(stringtable_data)?;
artifacts/os/windows/shellitems/beef/beef0004.rs: let (remaining_data, input) = take(sig_size - adjust_size)(input)?;
artifacts/os/windows/shellitems/items.rs: let (remaining_input, input) = take(size - adjust_size)(input)?;
artifacts/os/windows/shellitems/variable.rs: let (input, _) = take(input.len() - beef_adjust)(data)?;
artifacts/os/windows/shortcuts/shellitems.rs: let (remaining_input, shellitem_data) = take(item_size - adjust_size)(shell_input)?;
artifacts/os/windows/shortcuts/network.rs: let (remaining_input, input) = take(size - adjust_size)(input)?;
artifacts/os/windows/shortcuts/location.rs: let (remaining_input, input) = take(size - adjust_size)(input)?;
artifacts/os/windows/shortcuts/volume.rs: let (remaining_input, input) = take(size - adjust_size)(input)?;
artifacts/os/windows/shortcuts/extras/property.rs: let (property_tracker, _) = take(sig_start.len() - adjust_start)(data)?;
artifacts/os/windows/shortcuts/extras/tracker.rs: let (tracker_start, _) = take(sig_start.len() - adjust_start)(data)?;
artifacts/os/windows/shortcuts/extras/environment.rs: let (env_data, _) = take(sig_start.len() - adjust_start)(data)?;
artifacts/os/windows/securitydescriptor/acl.rs: let (remaining_input, input) = take(size - adjust_size)(input)?;
artifacts/os/windows/securitydescriptor/acl.rs: let (input, ace_entry_data) = take(size - adjust_entry_size)(input)?;
artifacts/os/windows/registry/hbin.rs: let (input, _) = take(size - adjust_cell_size)(input)?;
artifacts/os/windows/registry/hbin.rs: let (input, cell_data) = take(size - adjust_cell_size)(input)?;
artifacts/os/windows/registry/cell.rs: let (_, list_data) = take(size - adjust_cell_size)(list_data)?;
artifacts/os/windows/registry/cell.rs: let (_, mut list_data) = take(size - adjust_cell_size)(list_data)?;
artifacts/os/windows/registry/cell.rs: let (_, vk_data) = take(size - adjust_cell_size)(vk_data)?;
artifacts/os/windows/registry/keys/data.rs: let (_, allocated_data) = take(data_cell_size - adjust_cell_size)(input)?;
artifacts/os/windows/registry/keys/data.rs: let (_, allocated_data) = take(data_cell_size - adjust_cell_size)(input)?;
artifacts/os/windows/registry/keys/data.rs: let (_, allocated_data) = take(data_cell_size - adjust_cell_size)(data)?;
artifacts/os/windows/propertystore/store.rs: let (remaining_data, store_data) = take(size - size_adjust)(input)?;