Do not abort resource iteration too early when some entry is truncated.

Failing to parse some resource directory does not mean that we can't keep parsing other directories. For instance, with file `0a65e22cdff348be11739122906355af728f6247fb849f98d69a6f6d51103071` YARA was aborting the parsing too early and extracted a single resource, while the file has more resources that could be parsed correctly.
This commit is contained in:
Victor M. Alvarez
2024-03-06 12:00:27 +01:00
parent 4793b49dd7
commit 9490a0c00c
-11
View File
@@ -454,10 +454,7 @@ static int _pe_iterate_resources(
for (i = 0; i < total_entries; i++)
{
if (!struct_fits_in_pe(pe, entry, IMAGE_RESOURCE_DIRECTORY_ENTRY))
{
result = RESOURCE_ITERATOR_ABORTED;
break;
}
switch (rsrc_tree_level)
{
@@ -496,10 +493,6 @@ static int _pe_iterate_resources(
callback,
callback_data);
}
else
{
result = RESOURCE_ITERATOR_ABORTED;
}
}
else
{
@@ -521,10 +514,6 @@ static int _pe_iterate_resources(
result = RESOURCE_ITERATOR_ABORTED;
}
}
else
{
result = RESOURCE_ITERATOR_ABORTED;
}
}
if (result == RESOURCE_ITERATOR_ABORTED)