Enhance PE file Rich header detection with null and boundary checks

- Added null pointer and boundary checks in ExtractFeatures method
- Prevent potential buffer overread when searching for Rich header signature
- Improve robustness of feature extraction for PE file analysis

ai_anti_malware/ml.cpp

@@ -289,10 +289,12 @@ std::vector<double> MachineLearning::ExtractFeatures(const uint8_t* buffer,
         const uint32_t* richPtr = reinterpret_cast<const uint32_t*>(
             peBuffer + sizeof(IMAGE_DOS_HEADER));
         size_t maxLen = dosHeader->e_lfanew - sizeof(IMAGE_DOS_HEADER);
-        for (size_t i = 0; i < maxLen / 4 - 1; i++) {
-            if (richPtr[i] == 0x68636952) {  // "Rich"
-                peInfo.hasRich = true;
-                break;
+        if (maxLen > 0 && richPtr != nullptr) {
+            for (size_t i = 0; i < maxLen / 4 - 1; i++) {
+                if (richPtr[i] == 0x68636952) {  // "Rich"
+                    peInfo.hasRich = true;
+                    break;
+                }
             }
         }
     }