m4b / goblin

An impish, cross-platform binary parsing crate, written in Rust
MIT License
1.17k stars 156 forks source link

`pe::symbol::Symbol::name` skips the first 4 characters of a symbol's name #318

Closed SquareMan closed 2 years ago

SquareMan commented 2 years ago

This is a new issue in Goblin 0.5 and appears to have been introduced by #310

The beginning of a COFF object file's string table is the overall length of the string table. Symbol's name offsets are based on index 0 being the beginning of the string table, therefore including the length. #310 prevented this length from being parsed as strings, but in doing so has caused string lookups for symbols to be off by 4.

I've written this failing test to complement the one added in #310 that demonstrates the issue.

src/pe/mod.rs

    #[test]
    fn symbol_name_excludes_length() {
        let coff = Coff::parse(&COFF_FILE_SINGLE_STRING_IN_STRING_TABLE).unwrap();
        let strings = coff.strings;
        let symbols = coff
            .symbols
            .iter()
            .filter(|(_, name, _)| name.is_none())
            .map(|(_, _, sym)| sym.name(&strings).unwrap().to_owned())
            .collect::<Vec<_>>();
        assert_eq!(symbols, vec!["ExitProcess"])
    }

Is there insight as to where the root of the issue lies?