PE raw section size vs virtual size

[sevaa]

Found a case where a PE section parser was thrown off by a mismatch between section's raw size and its virtual size. It would read the section bytes sequentially, encounter the padding zeroes in the end, and crash.

PE stores the size of the section in a loaded PE file in the second field of the section header, VirtualSize. Maybe the library should initialize section.bytes with a VirtualSize-sized blob instead. Note the case where VirtualSize is greater than SizeOfRawData ; in those cases the bytes should be zero padded.

The filebytes library surfaces that field as PhysicalAddress_or_VirtualSize. The doc at https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#section-table-section-headers doesn't mention the circumstances when this field can mean PhysicalAddress, but maybe the maintainers know something I don't.

[sashs]

Yes. I knew it, but I forgot it. I will look at this.