Ignore resource directory entries that with offset == 0.

VirusTotal · Apr 19, 2024 · 1242223 · 1242223
1 parent b680038
commit 1242223
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c
@@ -457,6 +457,9 @@ static int _pe_iterate_resources(
 
   for (i = 0; i < total_entries; i++)
   {
+    if (yr_le32toh(entry->OffsetToData) == 0)
+      continue;
+
     switch (rsrc_tree_level)
     {
     case 0: