From 1242223b04f28ec88629ab1d0b2c18d0aeec16a8 Mon Sep 17 00:00:00 2001
From: "Victor M. Alvarez" <vmalvarez@virustotal.com>
Date: Fri, 19 Apr 2024 17:21:44 +0200
Subject: [PATCH] Ignore resource directory entries that with offset == 0.

---
 libyara/modules/pe/pe.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c
index 5b018dd788..cc0181d1e4 100644
--- a/libyara/modules/pe/pe.c
+++ b/libyara/modules/pe/pe.c
@@ -457,6 +457,9 @@ static int _pe_iterate_resources(
 
   for (i = 0; i < total_entries; i++)
   {
+    if (yr_le32toh(entry->OffsetToData) == 0)
+      continue;
+
     switch (rsrc_tree_level)
     {
     case 0: