From 6711d057566f6e4e660e1539baa7777044a84046 Mon Sep 17 00:00:00 2001 From: houndthe Date: Thu, 8 Jul 2021 19:43:59 +0200 Subject: [PATCH] Add check that the typelib customattribute parent points to Assembly table to ignore random GUIDs --- src/fileformat/file_format/pe/pe_format.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/fileformat/file_format/pe/pe_format.cpp b/src/fileformat/file_format/pe/pe_format.cpp index 22dad022..e806e02a 100644 --- a/src/fileformat/file_format/pe/pe_format.cpp +++ b/src/fileformat/file_format/pe/pe_format.cpp @@ -2433,6 +2433,14 @@ void PeFormat::detectTypeLibId() for (std::size_t i = 1; i <= customAttributeTable->getNumberOfRows(); ++i) { auto customAttributeRow = customAttributeTable->getRow(i); + + // Check that the parent is index into Assembly table + MetadataTableType parent_table; + if (customAttributeRow->parent.getTable(parent_table) && parent_table != MetadataTableType::Assembly) + { + continue; + } + if (customAttributeRow->type.getIndex() == guidMemberRef) { // Its value is the TypeLib we are looking for