mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Wesley Shields
c05325e1b2
Fix an issue with the TOO_MANY_MATCHES warning where it would set the STRING_FLAGS_DISABLED bit on the string, but it would never be reset when the scanner was used to scan another file. This meant that a string that caused TOO_MANY_MATCHES would be disabled permanently for the lifetime of that scanner, when the intention was to only disable it for that one scan. A future scan should have the string re-enabled until it matches too many times again. I decided to fix this by using a bitmask for each string in the rules. This allows me to very quickly reset them all without having to touch every string to unset the STRING_FLAGS_DISABLED flag. This also returns the STRING_FLAGS_DISABLED flag to it's original meaning, which was that the string was disabled permanently because it is causing serious performance problems. I added a test for all this too.