fix: ignore resource entries with offset 0

This is for compatibility with YARA, that does the same.
VirusTotal · May 6, 2024 · c09d64f · c09d64f
1 parent 8ccad97
commit c09d64f
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 14 deletions.
diff --git a/lib/src/modules/pe/parser.rs b/lib/src/modules/pe/parser.rs
@@ -1450,8 +1450,7 @@ impl<'a> PE<'a> {
                     if let Ok((_, rsrc_entry)) =
                         Self::parse_rsrc_entry(entry_data)
                     {
-                        if rsrc_entry.size > 0
-                            && (rsrc_entry.size as usize) < self.data.len()
+                        if rsrc_entry.size > 0 && rsrc_entry.offset > 0 && (rsrc_entry.size as usize) < self.data.len()
                         {
                             resources.push(Resource {
                                 type_id: ids.0,

diff --git a/...es/pe/tests/testdata/468052beb89bfb145169920f647472753c45756d672bee7fffed75279ed9c20a.out b/...es/pe/tests/testdata/468052beb89bfb145169920f647472753c45756d672bee7fffed75279ed9c20a.out
@@ -42,7 +42,7 @@ number_of_rva_and_sizes: 16
 number_of_sections: 7
 number_of_imported_functions: 0
 number_of_delayed_imported_functions: 0
-number_of_resources: 148
+number_of_resources: 145
 number_of_version_infos: 0
 number_of_imports: 0
 number_of_delayed_imports: 0
@@ -234,10 +234,6 @@ resources:
   - length: 32765
     rva: 3291412832
     type: 842240
-  - length: 2
-    rva: 0
-    offset: 0
-    type: 842400
   - length: 32765
     rva: 2710209520
     type: 657648
@@ -309,9 +305,6 @@ resources:
     type: 0
   - length: 32765
     rva: 2710207392
-  - length: 768
-    rva: 0
-    offset: 0
   - length: 32765
     rva: 2710207280
     type: 0
@@ -542,10 +535,6 @@ resources:
   - length: 32765
     rva: 3291296560
     type: 0
-  - length: 1
-    rva: 0
-    offset: 0
-    type: 147092
   - length: 32765
     rva: 2710207936
     type: 120944