From 12566310ea02003ec0e58c939a886523d4a2cd69 Mon Sep 17 00:00:00 2001
From: secDre4mer <61268450+secDre4mer@users.noreply.github.com>
Date: Wed, 15 Nov 2023 23:50:23 +0100
Subject: [PATCH] fix: check mmap result (#2003)

* fix: check mmap result

Check if mmap failed (return value MAP_FAILED) and, if yes, exit.

* feat: fallback to pread() if file mmap failed

* fix: initialize zero buffer for uninitialized mapping
---
 libyara/proc/linux.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/libyara/proc/linux.c b/libyara/proc/linux.c
index 813b858b..bac99fc2 100644
--- a/libyara/proc/linux.c
+++ b/libyara/proc/linux.c
@@ -218,8 +218,16 @@ YR_API const uint8_t* yr_process_fetch_memory_block_data(YR_MEMORY_BLOCK* block)
         fd,
         proc_info->map_offset);
     close(fd);
+    if (context->buffer == MAP_FAILED)
+    {
+      // Notify the code below that we couldn't read from the file
+      // fallback to pread() from the process
+      fd = -1;
+    }
+    context->buffer_size = block->size;
   }
-  else
+
+  if (fd < 0)
   {
     context->buffer = mmap(
         NULL,
@@ -228,17 +236,14 @@ YR_API const uint8_t* yr_process_fetch_memory_block_data(YR_MEMORY_BLOCK* block)
         MAP_PRIVATE | MAP_ANONYMOUS,
         -1,
         0);
-  }
-
-  if (context->buffer != NULL)
-  {
+    if (context->buffer == MAP_FAILED)
+    {
+      context->buffer = NULL;
+      context->buffer_size = 0;
+      goto _exit;
+    }
     context->buffer_size = block->size;
   }
-  else
-  {
-    context->buffer_size = 0;
-    goto _exit;
-  }
 
   // If mapping can't be accessed through the filesystem, read everything from
   // target process VM.