mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Scott Knight
793fc55358
The current Mach-O parsing code attempts to call macho_rva_to_offset while parsing load commands and before it has set number_of_segments. Since macho_rva_to_offset uses number_of_segments this can result in it using a number_of_segments that is uninitialized and is just a random large number. In turn yara runs a really long time. This adds a test binary based on this post https://codegolf.stackexchange.com/questions/102471/smallest-possible-runnable-mach-o-executable/154685#154685 It has two load commands. The first is a LC_UNIXTHREAD command and the second is a LC_SEGMENT command. It's a valid 386 Mach-O binary. It reproduces this error.