[Forensics-changes] [yara] 81/160: Minor style changes
Hilko Bengen
bengen at moszumanska.debian.org
Sat Jul 1 10:29:20 UTC 2017
This is an automated email from the git hooks/post-receive script.
bengen pushed a commit to annotated tag v3.4.0
in repository yara.
commit afd24972e9114c356c825a4b715bd07653c3a6fa
Author: Victor M. Alvarez <plusvic at gmail.com>
Date: Tue Apr 21 10:41:25 2015 +0200
Minor style changes
---
libyara/modules/pe.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c
index 9824515..365d38f 100644
--- a/libyara/modules/pe.c
+++ b/libyara/modules/pe.c
@@ -520,6 +520,7 @@ int _pe_iterate_resources(
lang_string,
callback,
callback_data);
+
if (result == RESOURCE_ITERATOR_ABORTED)
return RESOURCE_ITERATOR_ABORTED;
}
@@ -811,6 +812,7 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor(
return NULL;
int num_functions = 0;
+
if (IS_64BITS_PE(pe))
{
PIMAGE_THUNK_DATA64 thunks64 = (PIMAGE_THUNK_DATA64)(pe->data + offset);
@@ -849,7 +851,7 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor(
IMPORTED_FUNCTION* imported_func = (IMPORTED_FUNCTION*)
yr_calloc(1, sizeof(IMPORTED_FUNCTION));
- if (!imported_func)
+ if (imported_func == NULL)
continue;
imported_func->name = name;
@@ -863,6 +865,7 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor(
tail = imported_func;
}
+
num_functions++;
thunks64++;
}
@@ -905,7 +908,7 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor(
IMPORTED_FUNCTION* imported_func = (IMPORTED_FUNCTION*)
yr_calloc(1, sizeof(IMPORTED_FUNCTION));
- if (!imported_func)
+ if (imported_func == NULL)
continue;
imported_func->name = name;
@@ -919,10 +922,12 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor(
tail = imported_func;
}
+
num_functions++;
thunks32++;
}
}
+
return head;
}
@@ -978,14 +983,18 @@ IMPORTED_DLL* pe_parse_imports(
PIMAGE_IMPORT_DESCRIPTOR imports = (PIMAGE_IMPORT_DESCRIPTOR) \
(pe->data + offset);
+
int num_imports = 0;
+
while (struct_fits_in_pe(pe, imports, IMAGE_IMPORT_DESCRIPTOR) &&
imports->Name != 0 && num_imports < MAX_PE_IMPORTS)
{
uint64_t offset = pe_rva_to_offset(pe, imports->Name);
+
if (offset != 0 && offset < pe->data_size)
{
char* dll_name = (char *) (pe->data + offset);
+
if (!pe_valid_dll_name(dll_name, pe->data_size - offset))
break;
@@ -1013,9 +1022,11 @@ IMPORTED_DLL* pe_parse_imports(
}
}
}
+
num_imports++;
imports++;
}
+
return head;
}
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git
More information about the forensics-changes
mailing list