Skip to content

Commit

Permalink
Populate dotnet.resources[x].offset and `dotnet.resources[x].length…
Browse files Browse the repository at this point in the history
…` even if falling outside of the file

Until now, these two fields were populated only when the offset and offset + length were within the file boundaries. This meant that the fields were undefined for some files that were truncated. For instance, 3323480fc4e35f73a8e93c4a0658c818d7e517df7ba15ba4cbb5cd2b6058cb0f.
  • Loading branch information
plusvic committed Apr 8, 2024
1 parent 9c26038 commit 80972f0
Showing 1 changed file with 0 additions and 4 deletions.
4 changes: 0 additions & 4 deletions libyara/modules/dotnet/dotnet.c
Expand Up @@ -2974,10 +2974,6 @@ void dotnet_parse_tilde_2(
resource_size = yr_le32toh(
*(DWORD*) (pe->data + resource_base + resource_offset));

if (!fits_in_pe(
pe, pe->data + resource_base + resource_offset, resource_size))
continue;

// Add 4 to skip the size.
yr_set_integer(
resource_base + resource_offset + 4,
Expand Down

0 comments on commit 80972f0

Please sign in to comment.