Skip to content

Commit 4de3d57

Browse files
committed
Fix inconsistency with --fast-scan option.
Some rules were not matching when the `--fast-scan` flag was used, but they should. It happened with rules that contained statements like `any of <string_set> in <range>` or `any of <string_set> at <offset>`. With this type of expressions, the strings included in `<string_set>` can't be flagged with `STRING_FLAGS_SINGLE_MATCH` because we need to find all the occurrences of those strings. Finding only the first match is not enough because the condition can be true for some other occurrence of the string, but not with the first one.. With this change the flag `STRING_FLAGS_SINGLE_MATCH` is cleared for every string included in a string set. This is a radical way of fixing the issue, as the flag is cleared in other cases where this is not necessary, like in `any of <string_set>`, where finding the first occurrence of each string in the set is enough. But I don't want to add more complexity and correctness should prevail over performance.
1 parent 8f40272 commit 4de3d57

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

libyara/parser.c

+1
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ int yr_parser_emit_pushes_for_strings(
216216

217217
string->flags |= STRING_FLAGS_REFERENCED;
218218
string->flags &= ~STRING_FLAGS_FIXED_OFFSET;
219+
string->flags &= ~STRING_FLAGS_SINGLE_MATCH;
219220
matching++;
220221
}
221222
}

0 commit comments

Comments
 (0)