Catch decompression error due to overflow.

.github/workflows/go.yml

@@ -0,0 +1,21 @@
+name: Test
+on: [pull_request]
+jobs:
+  build:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Set up Go 1.25
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.25
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+         submodules: true
+
+    - name: Test
+      run: |
+        go test -v -race ./...

cmd/prefetch.go

@@ -7,10 +7,18 @@ import (
 	"os"
 
 	cli "github.com/jawher/mow.cli"
-	"www.velocidex.com/golang/binparsergen"
 	"www.velocidex.com/golang/go-prefetch"
 )
 
+func FatalIfError(err error, format string, args ...interface{}) {
+	if err != nil {
+		format += ": %v\n"
+		args = append(args, err)
+		fmt.Printf(format, args...)
+		os.Exit(1)
+	}
+}
+
 func main() {
 	// create an app
 	app := cli.App("prefetch", "parse pf files")
@@ -23,10 +31,10 @@ func main() {
 		cmd.Action = func() {
 			for _, arg := range *file {
 				fd, err := os.Open(arg)
-				binparsergen.FatalIfError(err, fmt.Sprintf("Open file: %v", err))
+				FatalIfError(err, fmt.Sprintf("Open file: %v", err))
 
 				prefetch_obj, err := prefetch.LoadPrefetch(fd)
-				binparsergen.FatalIfError(err, fmt.Sprintf("Parsing Error: %v", err))
+				FatalIfError(err, fmt.Sprintf("Parsing Error: %v", err))
 
 				serialized_content, _ := json.MarshalIndent(prefetch_obj, " ", " ")
 				fmt.Println(string(serialized_content))
@@ -40,20 +48,20 @@ func main() {
 		cmd.Action = func() {
 			profile := prefetch.NewPrefetchProfile()
 			reader, err := os.Open(*file)
-			binparsergen.FatalIfError(err, fmt.Sprintf("OpenFile: %v", err))
+			FatalIfError(err, fmt.Sprintf("OpenFile: %v", err))
 
 			header := profile.MAMHeader(reader, 0)
 			if header.Signature() == "MAM\x04" {
 				// Need to decompress it in memory.
 				data := make([]byte, header.UncompressedSize())
 				n, err := reader.ReadAt(data, int64(header.Size()))
 				if err != io.EOF {
-					binparsergen.FatalIfError(err, fmt.Sprintf("Open file: %v", err))
+					FatalIfError(err, fmt.Sprintf("Open file: %v", err))
 				}
 
 				decompressed, err := prefetch.LZXpressHuffmanDecompressWithFallback(
 					data[:n], int(header.UncompressedSize()))
-				binparsergen.FatalIfError(err, fmt.Sprintf("Open file: %v", err))
+				FatalIfError(err, fmt.Sprintf("Open file: %v", err))
 
 				os.Stdout.Write(decompressed)
 			}

fixtures/CALC.EXE-3FBEF7FD.pf.golden

@@ -1,5 +1,6 @@
 {
   "Executable": "CALC.EXE",
+  "Path": "",
   "FileSize": 47848,
   "Hash": "0x3FBEF7FD",
   "Version": "Win10",

fixtures/LIVECOMM.EXE-D546E475.pf.golden

@@ -1,5 +1,6 @@
 {
   "Executable": "LIVECOMM.EXE",
+  "Path": "",
   "FileSize": 36456,
   "Hash": "0xD546E475",
   "Version": "Win8.1",

fixtures/MSMSGS.EXE-2B6052DE.pf.golden

@@ -1,5 +1,6 @@
 {
   "Executable": "MSMSGS.EXE",
+  "Path": "",
   "FileSize": 21366,
   "Hash": "0x2B6052DE",
   "Version": "WinXP",

fixtures/PING.EXE-B29F6629.pf.golden

@@ -1,5 +1,6 @@
 {
   "Executable": "PING.EXE",
+  "Path": "",
   "FileSize": 11216,
   "Hash": "0xB29F6629",
   "Version": "Vista",

go.mod

@@ -1,13 +1,18 @@
 module www.velocidex.com/golang/go-prefetch
 
-go 1.14
+go 1.25
 
 require (
 	github.com/davecgh/go-spew v1.1.1
-	github.com/jawher/mow.cli v1.1.0
+	github.com/jawher/mow.cli v1.2.0
 	github.com/sebdah/goldie v1.0.0
-	github.com/stretchr/testify v1.3.0
-	golang.org/x/sys v0.0.0-20200720211630-cb9d2d5c5666
-	gopkg.in/yaml.v2 v2.2.2 // indirect
-	www.velocidex.com/golang/binparsergen v0.1.0
+	github.com/stretchr/testify v1.8.1
+	golang.org/x/sys v0.37.0
+)
+
+require (
+	github.com/kr/pretty v0.1.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,21 +1,34 @@
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/jawher/mow.cli v1.1.0 h1:NdtHXRc0CwZQ507wMvQ/IS+Q3W3x2fycn973/b8Zuk8=
-github.com/jawher/mow.cli v1.1.0/go.mod h1:aNaQlc7ozF3vw6IJ2dHjp2ZFiA4ozMIYY6PyuRJwlUg=
+github.com/jawher/mow.cli v1.2.0 h1:e6ViPPy+82A/NFF/cfbq3Lr6q4JHKT9tyHwTCcUQgQw=
+github.com/jawher/mow.cli v1.2.0/go.mod h1:y+pcA3jBAdo/GIZx/0rFjw/K2bVEODP9rfZOfaiq8Ko=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/sebdah/goldie v1.0.0 h1:9GNhIat69MSlz/ndaBg48vl9dF5fI+NBB6kfOxgfkMc=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-golang.org/x/sys v0.0.0-20200720211630-cb9d2d5c5666 h1:gVCS+QOncANNPlmlO1AhlU3oxs4V9z+gTtPwIk3p2N8=
-golang.org/x/sys v0.0.0-20200720211630-cb9d2d5c5666/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-www.velocidex.com/golang/binparsergen v0.1.0 h1:oNsMHGnlb4jrGwxKxqqmsics6FgYin3HR5UNtLXc8S0=
-www.velocidex.com/golang/binparsergen v0.1.0/go.mod h1:UC43Ecj0mjsidlClTYZ3H4dXdyv7CVI0HsYi4yY3qtc=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

lzxpress.go

@@ -301,7 +301,7 @@ func LZXpressHuffmanDecompressChunk(
 				}
 
 				srcI := i + int(offset)
-				if srcI >= len(output) {
+				if srcI >= len(output) || i >= len(output) {
 					return int(bstr.index),
 						i, errors.New("Decompression error - exceeded chunk length")
 				}