Browse code

fix imphash 'thunk' processing due to unit test check1_clamscan fail.

Steven Morgan authored on 2017/03/10 05:11:56
Showing 1 changed files
... ...
@@ -2221,8 +2221,9 @@ static inline int hash_impfns(cli_ctx *ctx, void **hashctx, uint32_t *impsz, str
2221 2221
     void *imptbl = NULL;
2222 2222
 #endif
2223 2223
 
2224
-    thuoff = cli_rawaddr(image->u.OriginalFirstThunk, exe_sections, nsections, &err, fsize, hdr_size);
2225
-    if (err)
2224
+    if (image->u.OriginalFirstThunk)
2225
+        thuoff = cli_rawaddr(image->u.OriginalFirstThunk, exe_sections, nsections, &err, fsize, hdr_size);
2226
+    if (err || thuoff == 0)
2226 2227
         thuoff = cli_rawaddr(image->FirstThunk, exe_sections, nsections, &err, fsize, hdr_size);
2227 2228
     if (err) {
2228 2229
         cli_dbgmsg("scan_pe: invalid rva for image first thunk\n");