[Forensics-changes] [yara] 358/368: Put variable declarations at the beginning of code blocks

Hilko Bengen bengen at moszumanska.debian.org
Sat Jul 1 10:30:58 UTC 2017


This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.5.0
in repository yara.

commit 2a19ada34112ae0210fcb010e7b1550410d5035e
Author: Victor M. Alvarez <plusvic at gmail.com>
Date:   Sat Jul 2 18:05:00 2016 +0200

    Put variable declarations at the beginning of code blocks
---
 libyara/modules/math.c |  7 +++----
 libyara/modules/pe.c   | 15 +++++++++------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/libyara/modules/math.c b/libyara/modules/math.c
index 1c38b3d..0a5638c 100644
--- a/libyara/modules/math.c
+++ b/libyara/modules/math.c
@@ -209,15 +209,14 @@ define_function(data_deviation)
     if (offset >= block->base &&
         offset < block->base + block->size)
     {
+      size_t data_offset = (size_t)(offset - block->base);
+      size_t data_len = (size_t)yr_min(
+          length, (size_t)(block->size - data_offset));
       uint8_t* block_data = block->fetch_data(block);
 
       if (block_data == NULL)
         return_float(UNDEFINED);
 
-      size_t data_offset = (size_t) (offset - block->base);
-      size_t data_len = (size_t) yr_min(
-        length, (size_t) (block->size - data_offset));
-
       total_len += data_len;
       offset += data_len;
       length -= data_len;
diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c
index 0529003..14d2245 100644
--- a/libyara/modules/pe.c
+++ b/libyara/modules/pe.c
@@ -420,10 +420,6 @@ int64_t pe_rva_to_offset(
       if (rva >= section->VirtualAddress &&
           section_rva <= section->VirtualAddress)
       {
-        section_rva = section->VirtualAddress;
-        section_offset = section->PointerToRawData;
-        section_raw_size = section->SizeOfRawData;
-
         // Round section_offset
         //
         // Rounding everything less than 0x200 to 0 as discussed in
@@ -434,8 +430,13 @@ int64_t pe_rva_to_offset(
         //
         // If FileAlignment is >= 0x200, it is apparently ignored (see
         // Ero Carreras's pefile.py, PE.adjust_FileAlignment).
+
         int alignment = yr_min(OptionalHeader(pe, FileAlignment), 0x200);
 
+        section_rva = section->VirtualAddress;
+        section_offset = section->PointerToRawData;
+        section_raw_size = section->SizeOfRawData;
+
         if (alignment)
         {
           int rest = section_offset % alignment;
@@ -2514,12 +2515,14 @@ int module_load(
 
   foreach_memory_block(iterator, block)
   {
-    uint8_t* block_data = block->fetch_data(block);
+	PIMAGE_NT_HEADERS32 pe_header;
+
+	uint8_t* block_data = block->fetch_data(block);
 
     if (block_data == NULL)
       continue;
 
-    PIMAGE_NT_HEADERS32 pe_header = pe_get_header(block_data, block->size);
+    Ppe_header = pe_get_header(block_data, block->size);
 
     if (pe_header != NULL)
     {

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git



More information about the forensics-changes mailing list