From 9490a0c00c643e3044542c808d06df9bba812116 Mon Sep 17 00:00:00 2001
From: "Victor M. Alvarez" <vmalvarez@virustotal.com>
Date: Wed, 6 Mar 2024 12:00:27 +0100
Subject: [PATCH] Do not abort resource iteration too early when some entry is
 truncated.

Failing to parse some resource directory does not mean that we can't keep parsing other directories. For instance, with file `0a65e22cdff348be11739122906355af728f6247fb849f98d69a6f6d51103071` YARA was aborting the parsing too early and extracted a single resource, while the file has more resources that could be parsed correctly.
---
 libyara/modules/pe/pe.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c
index 59aa47ec..dd5c4248 100644
--- a/libyara/modules/pe/pe.c
+++ b/libyara/modules/pe/pe.c
@@ -454,10 +454,7 @@ static int _pe_iterate_resources(
   for (i = 0; i < total_entries; i++)
   {
     if (!struct_fits_in_pe(pe, entry, IMAGE_RESOURCE_DIRECTORY_ENTRY))
-    {
-      result = RESOURCE_ITERATOR_ABORTED;
       break;
-    }
 
     switch (rsrc_tree_level)
     {
@@ -496,10 +493,6 @@ static int _pe_iterate_resources(
             callback,
             callback_data);
       }
-      else
-      {
-        result = RESOURCE_ITERATOR_ABORTED;
-      }
     }
     else
     {
@@ -521,10 +514,6 @@ static int _pe_iterate_resources(
           result = RESOURCE_ITERATOR_ABORTED;
         }
       }
-      else
-      {
-        result = RESOURCE_ITERATOR_ABORTED;
-      }
     }
 
     if (result == RESOURCE_ITERATOR_ABORTED)