From 5bf72f2fb04e5fd8eaad5ca4ee5c283314b9fd08 Mon Sep 17 00:00:00 2001
From: "Victor M. Alvarez" <vmalvarez@virustotal.com>
Date: Mon, 18 Mar 2024 20:21:12 +0100
Subject: [PATCH] Fix issue while parsing .NET resources

.NET resources can be found outside the current file. Before this change those resources were being ignored, but now they are included in the `resources` array. The `name` and `length` fields are kept undefined though. So, external resources have only the `name` field set.
---
 libyara/modules/dotnet/dotnet.c | 73 +++++++++++++--------------------
 1 file changed, 29 insertions(+), 44 deletions(-)

diff --git a/libyara/modules/dotnet/dotnet.c b/libyara/modules/dotnet/dotnet.c
index 3f6aa9c9..a44cc4f2 100644
--- a/libyara/modules/dotnet/dotnet.c
+++ b/libyara/modules/dotnet/dotnet.c
@@ -2932,10 +2932,6 @@ void dotnet_parse_tilde_2(
         index_size = 2;
 
       row_size = (4 + 4 + index_sizes.string + index_size);
-
-      // Using 'i' is insufficent since we may skip certain resources and
-      // it would give an inaccurate count in that case.
-      counter = 0;
       row_ptr = table_offset;
 
       // First DWORD is the offset.
@@ -2945,11 +2941,7 @@ void dotnet_parse_tilde_2(
           break;
 
         manifestresource_table = (PMANIFESTRESOURCE_TABLE) row_ptr;
-        resource_offset = yr_le32toh(manifestresource_table->Offset);
 
-        // Only set offset if it is in this file (implementation != 0).
-        // Can't use manifestresource_table here because the Name and
-        // Implementation fields are variable size.
         if (index_size == 4)
           implementation = yr_le32toh(
               *(DWORD*) (row_ptr + 4 + 4 + index_sizes.string));
@@ -2957,38 +2949,7 @@ void dotnet_parse_tilde_2(
           implementation = yr_le16toh(
               *(WORD*) (row_ptr + 4 + 4 + index_sizes.string));
 
-        if (implementation != 0)
-        {
-          row_ptr += row_size;
-          continue;
-        }
-
-        if (!fits_in_pe(
-                pe, pe->data + resource_base + resource_offset, sizeof(DWORD)))
-        {
-          row_ptr += row_size;
-          continue;
-        }
-
-        resource_size = yr_le32toh(
-            *(DWORD*) (pe->data + resource_base + resource_offset));
-
-        if (!fits_in_pe(
-                pe, pe->data + resource_base + resource_offset, resource_size))
-        {
-          row_ptr += row_size;
-          continue;
-        }
-
-        // Add 4 to skip the size.
-        yr_set_integer(
-            resource_base + resource_offset + 4,
-            pe->object,
-            "resources[%i].offset",
-            counter);
-
-        yr_set_integer(
-            resource_size, pe->object, "resources[%i].length", counter);
+        row_ptr += row_size;
 
         name = pe_get_dotnet_string(
             pe,
@@ -2997,13 +2958,37 @@ void dotnet_parse_tilde_2(
             DOTNET_STRING_INDEX(manifestresource_table->Name));
 
         if (name != NULL)
-          yr_set_string(name, pe->object, "resources[%i].name", counter);
+          yr_set_string(name, pe->object, "resources[%i].name", i);
 
-        row_ptr += row_size;
-        counter++;
+        // Only set offset and length if it is in this file, otherwise continue
+        // with the next resource.
+        if (implementation != 0)
+          continue;
+
+        resource_offset = yr_le32toh(manifestresource_table->Offset);
+
+        if (!fits_in_pe(
+                pe, pe->data + resource_base + resource_offset, sizeof(DWORD)))
+          continue;
+
+        resource_size = yr_le32toh(
+            *(DWORD*) (pe->data + resource_base + resource_offset));
+
+        if (!fits_in_pe(
+                pe, pe->data + resource_base + resource_offset, resource_size))
+          continue;
+
+        // Add 4 to skip the size.
+        yr_set_integer(
+            resource_base + resource_offset + 4,
+            pe->object,
+            "resources[%i].offset",
+            i);
+
+        yr_set_integer(resource_size, pe->object, "resources[%i].length", i);
       }
 
-      yr_set_integer(counter, pe->object, "number_of_resources");
+      yr_set_integer(i, pe->object, "number_of_resources");
 
       table_offset += row_size * num_rows;
       break;