fix: add sanity check that prevents parsing corrupted resources in PE…

… files
VirusTotal · Nov 15, 2023 · 30de7fe · 30de7fe
1 parent 6d4cc03
commit 30de7fe
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/yara-x/src/modules/pe/parser.rs b/yara-x/src/modules/pe/parser.rs
@@ -765,7 +765,8 @@ impl<'a> PE<'a> {
     fn parse_rsrc_dir(input: &[u8]) -> IResult<&[u8], usize> {
         map(
             tuple((
-                le_u32, // characteristics
+                // characteristics must be 0
+                verify(le_u32, |characteristics| *characteristics == 0),
                 le_u32, // timestamp
                 le_u16, // major_version
                 le_u16, // minor_version