fix: set pe.entry_point to -1 when not found

vthib · Jan 28, 2023 · a1caa7b · a1caa7b
1 parent 1b0d582
commit a1caa7b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/boreal/src/module/pe.rs b/boreal/src/module/pe.rs
@@ -1188,6 +1188,7 @@ impl Pe {
                 "entry_point",
                 sections
                     .and_then(|sections| va_to_file_offset(mem, &sections, ep))
+                    .map_or(-1, i64::from)
                     .into(),
             ),
             ("entry_point_raw", ep.into()),

diff --git a/boreal/tests/it/pe.rs b/boreal/tests/it/pe.rs
@@ -272,8 +272,6 @@ fn test_coverage_pe_libyara_33fc70f9() {
         33fc70f99be6d2833ae48852d611c8048d0c053ed0b2c626db4dbe902832a08b",
         &[
             "pe.rich_signature",
-            // FIXME: this difference should not be
-            "pe.entry_point",
             #[cfg(not(feature = "authenticode"))]
             "pe.number_of_signatures",
         ],
@@ -491,6 +489,20 @@ fn test_coverage_pe_1561_32_section1() {
     );
 }
 
+#[test]
+fn test_coverage_pe_c6f9709f() {
+    compare_module_values_on_file(
+        Pe::default(),
+        "tests/assets/libyara/data/\
+         c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba_0h_410h",
+        &[
+            "pe.rich_signature",
+            #[cfg(not(feature = "authenticode"))]
+            "pe.number_of_signatures",
+        ],
+    );
+}
+
 #[test]
 #[cfg(feature = "hash")]
 fn test_imphash() {