Closed wxsBSD closed 1 year ago
The file tests/data/tiny_empty_import_name
wasn't added in the PR. Interesting enough, the tests are failing with a memory leak that doesn't seem related to the change done here.
Oops, I forgot to add it! Will do so as soon as I'm able.
Please don't merge this yet. There are other problems raised in the linked issue that are being looked into.
The file
tests/data/tiny_empty_import_name
wasn't added in the PR. Interesting enough, the tests are failing with a memory leak that doesn't seem related to the change done here.
Actually, the memory leak was because of my changes. I was not calling yr_free()
if the import had an invalid name.
I also discovered that if we failed to allocate a new IMPORT_FUNCTION
we would free the name (correctly) but then continue without incrementing the thunk pointer or function index, which would cause an infinite loop. I've fixed that too.
I think this can be reviewed and merged now.
If an import has an empty name skip processing it. This is consistent with the behavior of pefile (https://github.com/erocarrera/pefile/blob/593d094e35198dad92aaf040bef17eb800c8a373/pefile.py#L5871-L5872).
Add a test case which is just the tiny test file with the first import name set to all NULL bytes. I tested that pefile calculates the imphash of it, which matches what YARA now calculates too:
Fixes #1943