Skip to content

Commit 80972f0

Browse files
committed
Populate dotnet.resources[x].offset and dotnet.resources[x].length even if falling outside of the file
Until now, these two fields were populated only when the offset and offset + length were within the file boundaries. This meant that the fields were undefined for some files that were truncated. For instance, 3323480fc4e35f73a8e93c4a0658c818d7e517df7ba15ba4cbb5cd2b6058cb0f.
1 parent 9c26038 commit 80972f0

File tree

1 file changed

+0
-4
lines changed

1 file changed

+0
-4
lines changed

libyara/modules/dotnet/dotnet.c

-4
Original file line numberDiff line numberDiff line change
@@ -2974,10 +2974,6 @@ void dotnet_parse_tilde_2(
29742974
resource_size = yr_le32toh(
29752975
*(DWORD*) (pe->data + resource_base + resource_offset));
29762976

2977-
if (!fits_in_pe(
2978-
pe, pe->data + resource_base + resource_offset, resource_size))
2979-
continue;
2980-
29812977
// Add 4 to skip the size.
29822978
yr_set_integer(
29832979
resource_base + resource_offset + 4,

0 commit comments

Comments
 (0)