From 11d373319f518a78bdee37ee98ad369d2e362458 Mon Sep 17 00:00:00 2001
From: C3pa <41503714+C3pa@users.noreply.github.com>
Date: Sat, 10 May 2025 11:52:00 +0200
Subject: [PATCH] pattern/pe: Check for `imageNameRVA` in `pe.hexpat` before
 reading `imageName` (#372)

---
 patterns/pe.hexpat | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/patterns/pe.hexpat b/patterns/pe.hexpat
index 8817465..b57a918 100644
--- a/patterns/pe.hexpat
+++ b/patterns/pe.hexpat
@@ -396,7 +396,9 @@ struct ExportsTable {
 	if (directoryTable.ordinalTableRVA > relativeVirtualDifference()) {
 		u16 exportOrdinalTable[directoryTable.namePointersAmount] @ directoryTable.ordinalTableRVA - relativeVirtualDifference();
 	}
-	char imageName[] @ directoryTable.imageNameRVA - relativeVirtualDifference() [[format("formatNullTerminatedString")]];
+	if (directoryTable.imageNameRVA > relativeVirtualDifference()) {
+		char imageName[] @ directoryTable.imageNameRVA - relativeVirtualDifference() [[format("formatNullTerminatedString")]];
+	}
 	$ = addressof(this)+coffHeader.optionalHeader.directories[0].size;
 };