Skip to content

Commit 19c3fb5

Browse files
committed
Fix bug when parsing imports from 32bit PE.
There is a bug when parsing [1] which turns out to be incorrectly checking the number of successfully parsed imported functions and not the number of parsed attempts. This particular sample is badly malformed and is causing excessive loops in the parser while attempting to parse invalid data. With this fix it will finish in a few seconds on my laptop. [1]: 9c8e4dfa84b1ce7e919964978d33eada266d58b2aacdbef44b0618cc178ea421
1 parent 548ba3d commit 19c3fb5

File tree

1 file changed

+1
-1
lines changed
  • libyara/modules/pe

1 file changed

+1
-1
lines changed

libyara/modules/pe/pe.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -939,7 +939,7 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor(
939939

940940
while (struct_fits_in_pe(pe, thunks32, IMAGE_THUNK_DATA32) &&
941941
yr_le32toh(thunks32->u1.Ordinal) != 0 &&
942-
*num_function_imports < MAX_PE_IMPORTS)
942+
parsed_imports < MAX_PE_IMPORTS)
943943
{
944944
char* name = NULL;
945945
uint16_t ordinal = 0;

0 commit comments

Comments
 (0)