silverf0x / RpcView

RpcView is a free tool to explore and decompile Microsoft RPC interfaces
GNU General Public License v3.0
895 stars 247 forks source link

RpcDecompiler/InternalComplexTypesArrays.cpp processComplexArray, expression is always true #28

Closed hfiref0x closed 5 years ago

hfiref0x commented 5 years ago

There is an always true expression in RpcDecompiler/InternalComplexTypesArrays.cpp processComplexArray function.

There is a callbacksCalled array, declared as UINT16 https://github.com/silverf0x/RpcView/blob/c108da277be48accb3c6aaeb4af752a2028069bf/RpcDecompiler/internalComplexTypesArrays.cpp#L766

and initialized as https://github.com/silverf0x/RpcView/blob/c108da277be48accb3c6aaeb4af752a2028069bf/RpcDecompiler/internalComplexTypesArrays.cpp#L788

which is in result initialization with 0xffff values, because callbacksCalled it is an array of unsigned short values.

Next the following comparison is made https://github.com/silverf0x/RpcView/blob/c108da277be48accb3c6aaeb4af752a2028069bf/RpcDecompiler/internalComplexTypesArrays.cpp#L1046

Because it is always true and this code has no other references compiler will optimize out this expression resulting in https://github.com/silverf0x/RpcView/blob/c108da277be48accb3c6aaeb4af752a2028069bf/RpcDecompiler/internalComplexTypesArrays.cpp#L1048

will be always executed. I assume this wasn't catched because making this piece of code work require rare conditions to meet as "i" iterator was always 0 for me.

if(callbacksCalled[j] != (UINT16)-1) or equivalent type cast must be used to make this line actually work.