[bug] All files encoded as PE image after the first one; introduced in `d94ead3` commit

[XakerTwo]

@raltnoeder, hi

thank you for reviewing part of my code, but looks like you missed a small detail in that particular commit and introduced a bug.

the issue is in the function parse_file_argS() due to simplification of the if statement. Function itself process ALL file arguments, not the individual one.

let me show and explain with a simplified version of this function

code before change

void parse_file_args(char **f_args, int f_count, char *os_attr, struct list_node **file)
{
	bool is_pe; //initial value does not matter - it will be explicitly set for each loop iteration
	
	//loop over each of the files (f_args)
	//each is set of name:hash":pe" values, where ":pe" present only when file is PE image
	while (f_count--)
	{
		arg_p = f_args[f_count];
		
		// ...
		
		// at this point arg_p point to the next char after the hash
		
		// if 3rd value present (char, arg_p points to, is not NULL)
		if (*arg_p)
		{
			// check value and exit in case it's invalid
			
			//set is_pe flag
			is_pe = true;
		}
		//if 3rd value NOT present
		else
		{
			//reset is_pe flag
			is_pe = false;
		}
		
		// ...
		
		//store data
		file_data->is_pe = is_pe;
	} //end of loop
} //end of function

code after change

void parse_file_args(char **f_args, int f_count, char *os_attr, struct list_node **file)
{
	bool is_pe = false; //initial is_pe reset
	
	while (f_count--)
	{
		arg_p = f_args[f_count];
		
		// ...
		
		// at this point arg_p point to the next char after the hash
		
		if (*arg_p)
		{
			// check value and exit in case it's invalid
			
			is_pe = true;
		}
		//no is_pe reset
		
		// ...
		
		//store data
		file_data->is_pe = is_pe;
	}
}

now try(in mind or on paper) the following input "file_1:hash1" "file_2:hash2:PE" "file_3:hash3" with both versions

file_3 should be determined as not PE image, but will it so?

[johannesthoma]

Hi, thanks for pointing that out. Are you able to fix this and send a pull request? That would help a lot ... if not I can also fix it but not today.

Thanks and Best wishes,

• Johannes

[XakerTwo]

done