From f056ecdcd50dbf881194ba6998e5e1d2e8cc10f3 Mon Sep 17 00:00:00 2001 From: John Reiser Date: Sun, 21 Jan 2018 10:20:53 -0800 Subject: [PATCH] pefile: Allow overlap of MZ header and PE header (h.nexepos==0x10) https://github.com/upx/upx/issues/169 This means .codebase is aliased to .nexepos, with both equal to 0x10. modified: pefile.cpp --- src/pefile.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pefile.cpp b/src/pefile.cpp index 7d3c10de..89fd6e81 100644 --- a/src/pefile.cpp +++ b/src/pefile.cpp @@ -164,7 +164,7 @@ int PeFile::readFileHeader() { unsigned const delta = (h.relocoffs >= 0x40) ? h.nexepos // new format exe - : (h.p512*512+h.m512 - h.m512 ? 512 : 0); + : (h.p512*512+h.m512 - h.m512 ? 512 : h.nexepos); if ((pe_offset + delta) < delta // wrap-around || (pe_offset + delta) > (unsigned)file_size) {