16 Commits (b30d9c54b242aee062ae52d93e6714714d591f8e)

Author	SHA1	Message	Date
Micah Snyder	f33095155b	Yara: Fix crash with partially loaded yara files ... Yara rule files may contain multiple signatures. If one of the signatures fails to load because of a parse error in the yara rule condition, the rest of the rules still load. This is fine, but it seems that something isn't properly cleaned up, so there end up being runtime crashes when running the correctly loaded rules as a result. Specifically, the crash occurs because of an assert() that expects the operation stack to be empty and it is not. A simple fix is to print an error or debug message instead of crashing. It's not the right fix, but it at least prevents crash. Resolves: https://bugzilla.clamav.net/show_bug.cgi?id=12077 Also fixed a bunch of warnings in the yara module caused by comparing different integer types.	4 years ago
Micah Snyder	c9a070c9d3	More cleanup re: variables possibly used before initialized.	7 years ago
Steven Morgan	4522932cf3	fix result of yara matches operator when running in ClamAV.	8 years ago
Sebastian Andrzej Siewior	c0525b368b	libclamav: yara: avoid unaliged access to 64bit variable ... The derefence of an unaligned 64bit variable results in a SIGBUS abort on 32bit SPARC. ARMv5 CPUs seem to perform the load but load garbish. This memcpy() workaround forces the compiler to do something that works on even if the data was not properly aligned. For X86 it means no change. ARM on other hand will produce slightly different code depending on the CPU used. Patch-Name: libclamav-yara-avoid-unaliged-access-to-64bit-variab.patch Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Signed-off-by: Mickey Sola <msola@sourcefire.com>	9 years ago
Kevin Lin	27e257bf15	bb#11356 - fixed an issue regarding yara_exec OP_OF	10 years ago
Steven Morgan	7665e02d5b	Add support for YARA private rules and referencing other rules in a YARA condition.	10 years ago
Steven Morgan	d03c18bed3	Fix YARA arena management, improve error reporting, clean up some code.	10 years ago
Steven Morgan	0c56c8f52e	YARA: turn off error message	10 years ago
Steven Morgan	c9f0bba431	YARA: support condition data access functions int8, int16, int32, uint8, uint16, and uint32.	10 years ago
Steven Morgan	fbbd113cad	YARA: support string offsets (@str[n] notation) in YARA condition.	10 years ago
Steven Morgan	3c0cea48ba	YARA: support for YARA condition 'in' clauses.	10 years ago
Steven Morgan	b7999b89c9	YARA: capture offsets in matcher and use for processing YARA condition 'at' clauses.	10 years ago
Steven Morgan	263ed89af0	YARA: handle string counting.	10 years ago
Steven Morgan	e10659a6e1	YARA: implement basic string matching, temporarily disable simple YARA condition to lsig conversions.	10 years ago
Steven Morgan	d25549807f	Add YARA condition evaluation function. Add support for YARA 'of' clauses.	10 years ago
Steven Morgan	ebf3953f75	add YARA condition processor (preliminary/work in progress)	10 years ago