In "src/pe_raw_to_virtual.cpp", line 94 ("sections_raw_to_virtual"):

[habanada]

I'm currently working on a Delphi port and noticed the following:

The header copy is validated with "validate_ptr(payload, destBufferSize, payload, hdrsSize)", which - since "field_bgn == buffer_bgn" - only checks "hdrsSize <= destBufferSize" and never checks "hdrsSize" against the actual source buffer size ("payloadSize"), so a crafted "SizeOfHeaders" larger than "payloadSize" but smaller than "destBufferSize" causes "memcpy(destBuffer, payload, hdrsSize)" to read past the end of "payload". The check should validate against "payloadSize" instead?