libclamav/pe: Use endian wrapper in more places.

[sebastianas]

A few user of VirtualAddress and Size in cli_exe_info::pe_image_data_dir don't use the endian wrapper while other places do. This leads to testsuite failures on big endian machines.

Use the endian wrapper in all places across pe.c for the two members.

Signed-off-by: Sebastian Andrzej Siewior sebastian@breakpoint.cc

[val-ms]

This looks really good to me. Thank you @sebastianas! I will spend more time with it, testing, etc as soon as I am able.

[val-ms]

This change makes sense to me. Thank you for tracking down the endianness issues and submitting this PR.

I almost feel like it would make more sense to do it when we populate the peinfo->dirs
here:

clamav/libclamav/pe.c

Line 5041 in a85f853

read = fmap_readn(map, peinfo->dirs, at, data_dirs_size);

in the same way that we do with peinfo->nsections, here:

clamav/libclamav/pe.c

Line 4735 in a85f853

peinfo->nsections = EC16(file_hdr->NumberOfSections);

or peinfo->e_lfanew, here:

clamav/libclamav/pe.c

Line 4560 in a85f853

peinfo->e_lfanew = EC32(peinfo->e_lfanew);

Just for consistency it feels better to assume that all fields in the struct cli_exe_info peinfo have been switched to the correct endianess.

If it's not too much trouble, can you change it to fix the endianness when populating peinfo->dirs? If you're swamped, I can give it a go and tack it on to this branch. You've contributed a whole ton recently.

Best,
Micah

[val-ms]

This looks great to me. I tried to be as thorough as I could in reviewing the code changes.
Testing went well (at least on the little endian devices we have in our pipelines). Will merge.

[sebastianas]

On 2023-03-17 11:31:57 [-0700], Micah Snyder wrote: Merged #814 into main.

Could this also go into the rel/1.0 branch? It is a regression coming from the previous LTS (0.103.8). Sebastian

[val-ms]

Sure let's do that. But I did find that we messed up something and coverity is angry:

And for the other variable:

I had put in a ticket for us to try to solve that next week, but if you want to help you're welcome to.
When we get that fix we can cherry-pick both commits for PR targeting the dev/1.0.2 branch.