* Add mach_absolute_time()-based stopwatch for macOS
Unbreak on macOS releases before 10.12 Sierra, lacking clock_gettime(),
by adding an mach_absolute_time()-based implementation of stopwatch.
Prefer the mach_absolute_time()-based implementation to clock_gettime()
for now. Only check for clock_gettime() in ./configure on non-Mach
platforms.
* Fix Mach stopwatch to yield micros not picos
First execution of ./bootstrap.sh fails on CentOS 7 because of libtool (v2.4.2, most recent version available in package repo) when AC_CONFIG_AUX_DIR is not set.
Some functions in "hash" module (like sha256, sha1, md5) were returning ERROR_WRONG_ARGUMENTS upon receiving negative offsets or lengths. In those cases a more appropriate behaviour is returning an UNDEFINED value, as ERROR_WRONG_ARGUMENTS makes YARA abort the scanning.
* Improve rules profiling. The most relevant changes are:
* Stop using time() and difftime() for measuring time. Use yr_stopwatch_elapsed_ns instead.
* clock_ticks field in YR_RULE and YR_STRING structures has been renamed to time_cost.
* When the time_cost for some YR_STRING structure is incremented, it's incremented for its associated YR_RULE structure too. Iterating over the YR_STRING structures is not necessary for computing the total cost for some YR_STRING.
* A time_cost field was added to the YR_RULES structure. The ratio between YR_RULES structure's time_cost and YR_RULE structure's time_cost offers a better measure of how costly a rule is.
This commit reduces YARA's memory footprint by:
* Stripping relocation information from those arena don't need to be relocated. This apply particularly to arenas created by yr_arena_load_stream, which implies that those arenas can't be saved back with yr_arena_save_stream.
* Reduce the default amount of matching data hold in YR_MATCH structures.
The size of the buffer used by _yr_atoms_case_insensitive was correct for MAX_ATOM_SIZE == 4 but the formula for calculating it was incorrect. That caused a buffer-overflow when increasing MAX_ATOM_SIZE. This fixes the formula for calculating the buffer size and reduces memory consumption by using uint8_t instead of int for the atom lengths stored in the buffer.
* Do not use thread local storage for storing fiber pools in regexp engine.
The regexp engine maintains a fiber pool for each thread that executes the yr_re_exec function. The fiber pool was stored using thread local storage (TLS), but this design as proven to be a bad decision, as each thread was responsible for freeing its own fiber pool and this was problematic in languages like Go, where the runtime can create multiple threads but the programmer don't have full control of such threads. Now the fiber pool is stored in the YR_SCAN_CONTEXT structure.
* Remove re_match macro and make calls to yr_re_match explicit in modules.
wesinator