From 80972f0b4c9939ddbf83d3c1b4cbd218d6b389d1 Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Mon, 8 Apr 2024 12:04:17 +0200 Subject: [PATCH] Populate `dotnet.resources[x].offset` and `dotnet.resources[x].length` even if falling outside of the file Until now, these two fields were populated only when the offset and offset + length were within the file boundaries. This meant that the fields were undefined for some files that were truncated. For instance, 3323480fc4e35f73a8e93c4a0658c818d7e517df7ba15ba4cbb5cd2b6058cb0f. --- libyara/modules/dotnet/dotnet.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/libyara/modules/dotnet/dotnet.c b/libyara/modules/dotnet/dotnet.c index a44cc4f29e..ce7d9b4633 100644 --- a/libyara/modules/dotnet/dotnet.c +++ b/libyara/modules/dotnet/dotnet.c @@ -2974,10 +2974,6 @@ void dotnet_parse_tilde_2( resource_size = yr_le32toh( *(DWORD*) (pe->data + resource_base + resource_offset)); - if (!fits_in_pe( - pe, pe->data + resource_base + resource_offset, resource_size)) - continue; - // Add 4 to skip the size. yr_set_integer( resource_base + resource_offset + 4,