n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
64 stars 23 forks source link

Fixing property parsing issue on Rust 1.78+ #129

Closed matterpreter closed 5 months ago

matterpreter commented 6 months ago

Rust introduced a change to std::slice::from_raw_parts() that breaks this crate. The panics caused by this change occur when parsing properties with the most prevalent being those of type TDH_INTYPE_UNICODESTRING in my testing.

To resolve this issue, this MR adds checks to validate the assertions made in std::slice::from_raw_parts() . These are:

  1. the pointer must not be NULL
  2. the pointer must be aligned
  3. the total size of the slice not to exceed isize::MAX

I focused on resolving the wide string conversion, but I also added a proposed fixed for arrays though I was unable to validate it.

Reference: