feat: consistent empty hash behavior with imphash and more tests

VirusTotal · Mar 21, 2024 · 8517485 · 8517485
1 parent d882b29
commit 8517485
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/lib/src/modules/macho/mod.rs b/lib/src/modules/macho/mod.rs
@@ -272,8 +272,10 @@ fn dylib_hash(ctx: &mut ScanContext) -> Option<RuntimeString> {
     let mut dylibs_to_hash = &macho.dylibs;
 
     // if there are not any dylibs in the main Macho, the dylibs of the nested file should be hashed
-    if dylibs_to_hash.len() == 0 {
-        if macho.file.len() > 0 {
+    if dylibs_to_hash.is_empty() {
+        if macho.file.is_empty() {
+            return None;
+        } else {
             dylibs_to_hash = &macho.file[0].dylibs;
         }
     }

diff --git a/lib/src/modules/macho/tests/mod.rs b/lib/src/modules/macho/tests/mod.rs
@@ -333,4 +333,15 @@ fn test_macho_module() {
         "#,
         &tiny_universal_macho_data
     );
+
+    rule_true!(
+        r#"
+    import "macho"
+    rule macho_test {
+        condition:
+        not defined macho.dylib_hash()
+    }
+    "#,
+        &[]
+    );
 }