Skip to content

Add check that the resource file offset is valid#982

Merged
PeterMatula merged 5 commits intoavast:masterfrom
HoundThe:resource_detection
Aug 25, 2021
Merged

Add check that the resource file offset is valid#982
PeterMatula merged 5 commits intoavast:masterfrom
HoundThe:resource_detection

Conversation

@HoundThe
Copy link
Copy Markdown
Member

@HoundThe HoundThe commented Jul 5, 2021

Addresses partially #963

Add check that the file offset of a Resource is actually somewhere inside section physical data

Sample that has such invalid offsets:
8a8154c36977c3f47a65c329a6dd93c58b8aff6050a4a748f4c610310daf0d8b

If this fix is wanted, there are few things to consider:

  • This means that offset 0 is considered bad. If 0 offsets could be valid (But I think they are not?) then the feedback about invalid offset should be changed
  • For the offset 0 entries, the hash is calculated, which is unnecessary and could be misleading. This needs to be addressed too before possible merging.

@metthal
Copy link
Copy Markdown
Member

metthal commented Aug 5, 2021

For the offset 0 entries, the hash is calculated, which is unnecessary and could be misleading. This needs to be addressed too before possible merging.

Good point, could this be please incorporated into these changes?

@HoundThe
Copy link
Copy Markdown
Member Author

HoundThe commented Aug 6, 2021

I've added a flag that represents the offset validity, so invalid offsets are not exported to the output at all.

@PeterMatula
Copy link
Copy Markdown
Collaborator

lets run TC tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants