https://bugs.winehq.org/show_bug.cgi?id=38949
--- Comment #3 from André H. nerv@dawncrow.de --- (In reply to Sebastian Lackner from comment #2)
(In reply to Anastasius Focht from comment #1)
The content of some PE image directories is invalid before the UPX decompressor stub is run. You must take this possibility into account before trying to access these data structures.
Validating if the SecurityCookie is inside of the module should fix this, however I wonder if this is really a complete fix. Do we theoretically also need relocation of the SecurityCookie pointer?
Checking if the pointer is sane is one thing, but what about the decompressed exe, it also needs a random cookie value...