When compiling without static libraries the recently
introduced change prevented compilation.
As it looks like a forgotten debug settings, revert this
pariticular line
Signed-off-by: Konrad Weihmann <[email protected]>
This removes 3 unused bytes at the end of each SIZED_STRING. Those 3 bytes are not initialized by alloc_sized_string and cause MemorySanitizer to fail with use-of-uninitialized-value.
This cuts the condition evaluation program generated from the
signature-base[1] ruleset from 429053 to 329558 bytes, saving 23.1%
[1] https://github.com/Neo23x0/signature-base
Before this change if the identifier $a was used in 100 rules, the text string "$a" would appear 100 times in the compiled rules. After this change it is saved once and referenced from multiple places. The same happens with module names, literal strings used in the rules and so on.
These flags prevent crashes while reading from memory-mapped files in MacOS. MAP_RESILIENT_MEDIA prevents crashes while reading from a file in removable media that becomes unavailable, while MAP_RESILIENT_CODESIGN prevents crashes when reading binaries whose digital signature is invalid.
Closes#1309
This does't occur often, as this kind of errors are catch during compilation. However, this may occur when you try to use rules that were compiled with a version of YARA that has support for OpenSSL with another version that doesn't have it. That's because YARA with OpenSSL supports some fields in the "pe" module that are not allowed by YARA without OpenSSL. The compiled rules are valid for YARA with OpenSSL, but the fields won't be found when they are used without OpenSSL support.
Closes#1288
This does't occur often, as this kind of errors are catch during compilation. However, this may occur when you try to use rules that were compiled with a version of YARA that has support for OpenSSL with another version that doesn't have it. That's because YARA with OpenSSL supports some fields in the "pe" module that are not allowed by YARA without OpenSSL. The compiled rules are valid for YARA with OpenSSL, but the fields won't be found when they are used without OpenSSL support.
The bug was triggered by digitally signed malformed PE file
md5: fd6d7a3b087e9a0d6d4abafb47701da0
To reproduce run any rule that does import "pe", but the
effects may vary depending on your memory state.
As buffer IDs are non-negative number it makes more sense to declare them as uint32_t, which is coherent with the definition of YR_ARENA_REF, which is:
struct YR_ARENA_REF
{
uint32_t buffer_id;
uint32_t offset;
};
Ԝеѕ