|
|
|
|
@ -5588,10 +5588,10 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin |
|
|
|
|
// and that the certificate table is the last thing in the file
|
|
|
|
|
// (according to the MS13-098 bulletin, this is a requirement)
|
|
|
|
|
if (fsize != EC32(dirs[4].Size) + EC32(dirs[4].VirtualAddress)) { |
|
|
|
|
cli_dbgmsg("cli_checkfp_pe: expected authenticode data at the end of the file\n"); |
|
|
|
|
if (flags & CL_CHECKFP_PE_FLAG_STATS) { |
|
|
|
|
flags ^= CL_CHECKFP_PE_FLAG_AUTHENTICODE; |
|
|
|
|
} else { |
|
|
|
|
cli_dbgmsg("cli_checkfp_pe: expected authenticode data at the end of the file\n"); |
|
|
|
|
free(exe_sections); |
|
|
|
|
if (hashctx) |
|
|
|
|
cl_hash_destroy(hashctx); |
|
|
|
|
|