Skip to content

ntdll: Respect zero_bits when mapping a PE file.

Without the changes, the test passes or fails based on the binutils version being used. v2.35 (used on the Debian 11 testbot) gives 64-bit DLLs an image base under 4GB, and the test always passes. On a system with binutils 2.37 or later, 64-bit DLLs are based above 4GBs, and the test will fail.

This showed up under Wow64 when running the 64-bit Notepad++ installer (a 32-bit EXE), which runs 32-bit regsvr32 to register a 64-bit DLL. regsvr32 calls LoadLibraryExW() with LOAD_LIBRARY_AS_IMAGE_RESOURCE, which was returning a truncated pointer to the DLLs base address. Accessing this then crashed.

Edited by Brendan Shanks

Merge request reports

Loading