mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
jmestwa-coder
be24a74f22
The set iterators in yr_execute_code read the enumeration item count from the compiled rules and use it unchecked: - int_enum sizes the iterator allocation with it and then pops that many values off the stack - string_set and text_string_set repeat the same pattern - a .yrc loaded through yr_rules_load can carry a count past the stack depth, so the allocation is undersized and the loop runs off the value stack Bounded each count against the current stack depth. test-iterators saves `for any i in (1,2,3)`, bumps the stored count from 3 to 255 and scans: ASAN reports an out-of-bounds read in yr_execute_code before the change, clean after.