fix: allow empty DLL names, as YARA does.

VirusTotal · May 7, 2024 · 17a15b0 · 17a15b0
1 parent 306a730
commit 17a15b0
Show file tree

Hide file tree

Showing 3 changed files with 466 additions and 5 deletions.
diff --git a/lib/src/modules/pe/parser.rs b/lib/src/modules/pe/parser.rs
@@ -1450,7 +1450,9 @@ impl<'a> PE<'a> {
                     if let Ok((_, rsrc_entry)) =
                         Self::parse_rsrc_entry(entry_data)
                     {
-                        if rsrc_entry.size > 0 && rsrc_entry.offset > 0 && (rsrc_entry.size as usize) < self.data.len()
+                        if rsrc_entry.size > 0
+                            && rsrc_entry.offset > 0
+                            && (rsrc_entry.size as usize) < self.data.len()
                         {
                             resources.push(Resource {
                                 type_id: ids.0,
@@ -2162,10 +2164,6 @@ impl<'a> PE<'a> {
         // limit of 256 bytes, though.
         let dll_name = self.str_at_rva(rva)?;
 
-        if dll_name.is_empty() {
-            return None;
-        }
-
         for c in dll_name.chars() {
             if c.is_ascii_control() {
                 return None;

diff --git a/...pe/tests/testdata/c7dce6c950735bfcf2125be8eb1f3dd468eeb56a1c615c34f95bf38cb58b7d3a.in.zip b/...pe/tests/testdata/c7dce6c950735bfcf2125be8eb1f3dd468eeb56a1c615c34f95bf38cb58b7d3a.in.zip