diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDescriptor.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDescriptor.java index 24c957fdcc..1395a92c6c 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDescriptor.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/DelayImportDescriptor.java @@ -84,6 +84,18 @@ public class DelayImportDescriptor implements StructConverter { if (thunksINT == null) { return; } + + // Warn if the INT and IAT declare different numbers of entries. These are parallel arrays + // so a length mismatch is malformed. The thunk lists include the trailing null terminator, + // so the import count is size() - 1. This only surfaces the discrepancy; it does not change + // import enumeration. + if (pIAT != 0 && pINT != 0 && thunksIAT.size() != thunksINT.size()) { + int intCount = Math.max(0, thunksINT.size() - 1); + int iatCount = Math.max(0, thunksIAT.size() - 1); + Msg.warn(this, "Delay-load INT/IAT import count mismatch for '%s': INT=%d IAT=%d" + .formatted(dllName != null ? dllName : "unknown DLL", intCount, iatCount)); + } + thunksBoundIAT = readThunks(ntHeader, reader, pBoundIAT, false); if (thunksBoundIAT == null) { return;