@@ -370,16 +370,12 @@ uint64_t pe_rva_to_offset(
370370 PE * pe ,
371371 uint64_t rva )
372372{
373- PIMAGE_SECTION_HEADER section ;
374- DWORD section_rva ;
375- DWORD section_offset ;
373+ PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION ( pe -> header ) ;
374+ DWORD section_rva = 0 ;
375+ DWORD section_offset = 0 ;
376376
377377 int i = 0 ;
378378
379- section = IMAGE_FIRST_SECTION (pe -> header );
380- section_rva = 0 ;
381- section_offset = 0 ;
382-
383379 while (i < min (pe -> header -> FileHeader .NumberOfSections , MAX_PE_SECTIONS ))
384380 {
385381 if ((uint8_t * ) section - \
@@ -565,6 +561,7 @@ int pe_iterate_resources(
565561 int type = -1 ;
566562 int id = -1 ;
567563 int language = -1 ;
564+
568565 uint8_t * type_string = NULL ;
569566 uint8_t * name_string = NULL ;
570567 uint8_t * lang_string = NULL ;
@@ -627,28 +624,21 @@ void pe_parse_version_info(
627624 PIMAGE_RESOURCE_DATA_ENTRY rsrc_data ,
628625 PE * pe )
629626{
630- PVERSION_INFO version_info ;
631- PVERSION_INFO string_file_info ;
632-
633- char key [64 ];
634- char value [256 ];
635-
636- size_t version_info_offset ;
637-
638- version_info_offset = pe_rva_to_offset (pe , rsrc_data -> OffsetToData );
627+ size_t version_info_offset = pe_rva_to_offset (pe , rsrc_data -> OffsetToData );
639628
640629 if (version_info_offset == 0 )
641630 return ;
642631
643- version_info = (PVERSION_INFO ) (pe -> data + version_info_offset );
632+ PVERSION_INFO version_info = (PVERSION_INFO ) (pe -> data + version_info_offset );
644633
645634 if (!fits_in_pe (pe , version_info -> Key , sizeof ("VS_VERSION_INFO" ) * 2 ))
646635 return ;
647636
648637 if (strcmp_w (version_info -> Key , "VS_VERSION_INFO" ) != 0 )
649638 return ;
650639
651- string_file_info = ADD_OFFSET (version_info , sizeof (VERSION_INFO ) + 86 );
640+ PVERSION_INFO string_file_info = ADD_OFFSET (
641+ version_info , sizeof (VERSION_INFO ) + 86 );
652642
653643 while (fits_in_pe (pe , string_file_info -> Key , sizeof ("StringFileInfo" ) * 2 ) &&
654644 strcmp_w (string_file_info -> Key , "StringFileInfo" ) == 0 &&
@@ -687,6 +677,9 @@ void pe_parse_version_info(
687677
688678 if (wide_string_fits_in_pe (pe , string_value ))
689679 {
680+ char key [64 ];
681+ char value [256 ];
682+
690683 strlcpy_w (key , string -> Key , sizeof (key ));
691684 strlcpy_w (value , string_value , sizeof (value ));
692685
@@ -759,10 +752,10 @@ int pe_collect_resources(
759752 else
760753 {
761754 set_integer (
762- rsrc_id ,
763- pe -> object ,
764- "resources[%i].id" ,
765- pe -> resources );
755+ rsrc_id ,
756+ pe -> object ,
757+ "resources[%i].id" ,
758+ pe -> resources );
766759 }
767760
768761 if (lang_string )
@@ -777,10 +770,10 @@ int pe_collect_resources(
777770 else
778771 {
779772 set_integer (
780- rsrc_language ,
781- pe -> object ,
782- "resources[%i].language" ,
783- pe -> resources );
773+ rsrc_language ,
774+ pe -> object ,
775+ "resources[%i].language" ,
776+ pe -> resources );
784777 }
785778
786779 // Resources we do extra parsing on
@@ -1317,6 +1310,7 @@ define_function(section_index_addr)
13171310{
13181311 YR_OBJECT * module = module ();
13191312 YR_SCAN_CONTEXT * context = scan_context ();
1313+
13201314 int64_t offset ;
13211315 int64_t size ;
13221316
@@ -1435,9 +1429,6 @@ define_function(exports)
14351429define_function (imphash )
14361430{
14371431 YR_OBJECT * module = module ();
1438- IMPORTED_DLL * dll = NULL ;
1439- IMPORTED_FUNCTION * func = NULL ;
1440-
14411432 MD5_CTX ctx ;
14421433
14431434 unsigned char digest [MD5_DIGEST_LENGTH ];
@@ -1453,7 +1444,7 @@ define_function(imphash)
14531444
14541445 MD5_Init (& ctx );
14551446
1456- dll = pe -> imported_dlls ;
1447+ IMPORTED_DLL * dll = pe -> imported_dlls ;
14571448
14581449 while (dll )
14591450 {
@@ -1477,12 +1468,13 @@ define_function(imphash)
14771468 // Allocate a new string to hold the dll name.
14781469
14791470 char * dll_name = (char * ) yr_malloc (dll_name_len + 1 );
1480- if (! dll_name )
1471+
1472+ if (!dll_name )
14811473 return ERROR_INSUFICIENT_MEMORY ;
14821474
14831475 strlcpy (dll_name , dll -> name , dll_name_len + 1 );
14841476
1485- func = dll -> functions ;
1477+ IMPORTED_FUNCTION * func = dll -> functions ;
14861478
14871479 while (func )
14881480 {
@@ -1494,10 +1486,10 @@ define_function(imphash)
14941486 char * final_name = (char * ) yr_malloc (final_name_len + 1 );
14951487
14961488 if (final_name == NULL )
1497- {
1498- yr_free (dll_name );
1499- break ;
1500- }
1489+ {
1490+ yr_free (dll_name );
1491+ break ;
1492+ }
15011493
15021494 sprintf (final_name , first ? "%s.%s" : ",%s.%s" , dll_name , func -> name );
15031495
@@ -1544,19 +1536,16 @@ define_function(imports)
15441536 YR_OBJECT * module = module ();
15451537 PE * pe = (PE * ) module -> data ;
15461538
1547- IMPORTED_DLL * imported_dll = NULL ;
1548- IMPORTED_FUNCTION * imported_func = NULL ;
1549-
15501539 if (!pe )
15511540 return_integer (UNDEFINED );
15521541
1553- imported_dll = pe -> imported_dlls ;
1542+ IMPORTED_DLL * imported_dll = pe -> imported_dlls ;
15541543
15551544 while (imported_dll != NULL )
15561545 {
15571546 if (strcasecmp (imported_dll -> name , dll_name ) == 0 )
15581547 {
1559- imported_func = imported_dll -> functions ;
1548+ IMPORTED_FUNCTION * imported_func = imported_dll -> functions ;
15601549
15611550 while (imported_func != NULL )
15621551 {
@@ -2114,7 +2103,8 @@ int module_load(
21142103}
21152104
21162105
2117- int module_unload (YR_OBJECT * module_object )
2106+ int module_unload (
2107+ YR_OBJECT * module_object )
21182108{
21192109 IMPORTED_DLL * dll = NULL ;
21202110 IMPORTED_DLL * next_dll = NULL ;
@@ -2132,12 +2122,14 @@ int module_unload(YR_OBJECT* module_object)
21322122 {
21332123 if (dll -> name )
21342124 yr_free (dll -> name );
2125+
21352126 func = dll -> functions ;
21362127
21372128 while (func )
21382129 {
21392130 if (func -> name )
21402131 yr_free (func -> name );
2132+
21412133 next_func = func -> next ;
21422134 yr_free (func );
21432135 func = next_func ;
0 commit comments