mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Do not abort resource iteration too early when some entry is truncated.
Failing to parse some resource directory does not mean that we can't keep parsing other directories. For instance, with file `0a65e22cdff348be11739122906355af728f6247fb849f98d69a6f6d51103071` YARA was aborting the parsing too early and extracted a single resource, while the file has more resources that could be parsed correctly.
This commit is contained in:
@@ -454,10 +454,7 @@ static int _pe_iterate_resources(
|
||||
for (i = 0; i < total_entries; i++)
|
||||
{
|
||||
if (!struct_fits_in_pe(pe, entry, IMAGE_RESOURCE_DIRECTORY_ENTRY))
|
||||
{
|
||||
result = RESOURCE_ITERATOR_ABORTED;
|
||||
break;
|
||||
}
|
||||
|
||||
switch (rsrc_tree_level)
|
||||
{
|
||||
@@ -496,10 +493,6 @@ static int _pe_iterate_resources(
|
||||
callback,
|
||||
callback_data);
|
||||
}
|
||||
else
|
||||
{
|
||||
result = RESOURCE_ITERATOR_ABORTED;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
@@ -521,10 +514,6 @@ static int _pe_iterate_resources(
|
||||
result = RESOURCE_ITERATOR_ABORTED;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
result = RESOURCE_ITERATOR_ABORTED;
|
||||
}
|
||||
}
|
||||
|
||||
if (result == RESOURCE_ITERATOR_ABORTED)
|
||||
|
||||
Reference in New Issue
Block a user