Skip to content

Commit 17a15b0

Browse files
committed
fix: allow empty DLL names, as YARA does.
1 parent 306a730 commit 17a15b0

File tree

3 files changed

+466
-5
lines changed

3 files changed

+466
-5
lines changed

lib/src/modules/pe/parser.rs

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1450,7 +1450,9 @@ impl<'a> PE<'a> {
14501450
if let Ok((_, rsrc_entry)) =
14511451
Self::parse_rsrc_entry(entry_data)
14521452
{
1453-
if rsrc_entry.size > 0 && rsrc_entry.offset > 0 && (rsrc_entry.size as usize) < self.data.len()
1453+
if rsrc_entry.size > 0
1454+
&& rsrc_entry.offset > 0
1455+
&& (rsrc_entry.size as usize) < self.data.len()
14541456
{
14551457
resources.push(Resource {
14561458
type_id: ids.0,
@@ -2162,10 +2164,6 @@ impl<'a> PE<'a> {
21622164
// limit of 256 bytes, though.
21632165
let dll_name = self.str_at_rva(rva)?;
21642166

2165-
if dll_name.is_empty() {
2166-
return None;
2167-
}
2168-
21692167
for c in dll_name.chars() {
21702168
if c.is_ascii_control() {
21712169
return None;

0 commit comments

Comments
 (0)