guard against undersized rich header in pe_parse_rich_signature (#2200)

When the backward scan in pe_parse_rich_signature finds a DanS marker only one to three dwords ahead of the Rich marker, rich_len ends up smaller than RICH_SIGNATURE. The unsigned subtraction rich_len - sizeof(RICH_SIGNATURE) then wraps and rich_count becomes a huge bogus value that drives the version_data allocation and copy loop. _rich_version already rejects rich_length < sizeof(RICH_SIGNATURE) for the same computation, so apply the same check before computing rich_count here.

tests/test-pe.c

@@ -635,6 +635,17 @@ int main(int argc, char** argv)
       }",
       "tests/data/weird_rich");
 
+  // The DanS marker sits one dword before Rich, so the header is shorter than
+  // RICH_SIGNATURE. This used to underflow the rich_count computation; now it
+  // is rejected and the file still parses as a PE.
+  assert_true_rule_file(
+      "import \"pe\" \
+      rule test { \
+        condition: \
+          pe.is_pe and pe.rich_signature.length == 4 \
+      }",
+      "tests/data/undersized_rich");
+
   assert_true_rule_file(
       "import \"pe\" \
       rule test { \