From 149be9504bb9daa3a1c0855d8b2ded870180cc4e Mon Sep 17 00:00:00 2001
From: Egor Tensin <Egor.Tensin@gmail.com>
Date: Fri, 19 May 2017 13:18:20 +0300
Subject: hardening

---
 include/pdb/symbol.hpp | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/include/pdb/symbol.hpp b/include/pdb/symbol.hpp
index 8cb66d1..12061bd 100644
--- a/include/pdb/symbol.hpp
+++ b/include/pdb/symbol.hpp
@@ -5,13 +5,18 @@
 
 #pragma once
 
+#include "address.hpp"
 #include "module.hpp"
 
+#include <safeint.h>
+
 #include <Windows.h>
 #include <DbgHelp.h>
 
+#include <cstddef>
 #include <cstring>
 
+#include <stdexcept>
 #include <string>
 
 namespace pdb
@@ -31,7 +36,9 @@ namespace pdb
         explicit SymbolInfo(const Raw& raw)
             : SymbolInfo{}
         {
-            std::memcpy(buffer, &raw, raw.SizeOfStruct + raw.NameLen - 1);
+            if (raw.SizeOfStruct != sizeof(raw))
+                throw std::runtime_error{"unexpected symbol structure size"};
+            std::memcpy(buffer, &raw, calc_size(raw));
         }
 
         explicit operator Raw&() { return raw; }
@@ -66,7 +73,22 @@ namespace pdb
         bool is_function() const { return get_type() == Type::Function; }
 
     private:
-        unsigned char buffer[sizeof(Raw) + MAX_SYM_NAME - 1];
+        static std::size_t calc_size(const Raw& raw)
+        {
+            try
+            {
+                msl::utilities::SafeInt<std::size_t> size{raw.SizeOfStruct};
+                size += raw.NameLen;
+                size -= 1;
+                return size;
+            }
+            catch (const msl::utilities::SafeIntException&)
+            {
+                throw std::runtime_error{"symbol name is too long"};
+            }
+        }
+
+        unsigned char buffer[sizeof(Raw) + MAX_SYM_NAME - 1] = {0};
         Address displacement = 0;
 
     protected:
-- 
cgit v1.2.3