Do not abort resource iteration too early when some entry is truncated.

Failing to parse some resource directory does not mean that we can't keep parsing other directories. For instance, with file `0a65e22cdff348be11739122906355af728f6247fb849f98d69a6f6d51103071` YARA was aborting the parsing too early and extracted a single resource, while the file has more resources that could be parsed correctly.
VirusTotal · Mar 6, 2024 · 9490a0c · 9490a0c
1 parent 4793b49
commit 9490a0c
Showing 1 changed file with 0 additions and 11 deletions.
diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c
@@ -454,10 +454,7 @@ static int _pe_iterate_resources(
   for (i = 0; i < total_entries; i++)
   {
     if (!struct_fits_in_pe(pe, entry, IMAGE_RESOURCE_DIRECTORY_ENTRY))
-    {
-      result = RESOURCE_ITERATOR_ABORTED;
       break;
-    }
 
     switch (rsrc_tree_level)
     {
@@ -496,10 +493,6 @@ static int _pe_iterate_resources(
             callback,
             callback_data);
       }
-      else
-      {
-        result = RESOURCE_ITERATOR_ABORTED;
-      }
     }
     else
     {
@@ -521,10 +514,6 @@ static int _pe_iterate_resources(
           result = RESOURCE_ITERATOR_ABORTED;
         }
       }
-      else
-      {
-        result = RESOURCE_ITERATOR_ABORTED;
-      }
     }
 
     if (result == RESOURCE_ITERATOR_ABORTED)