Skip to content

Commit cccf3d4

Browse files
plusvicplusvic
committed
Fix security issues:
* Multiple out-of-bounds read in "dotnet" module. * Multiple out-of-bounds reads in "macho" module. * Integer overflow in "macho" module. Credits to Luis Merino from X41 D-SEC GmbH for finding the issues in "macho" module, and to OSS-Fuzz for finding the "dotnet" issues.
1 parent 1595e53 commit cccf3d4

File tree

6 files changed

+1341
-1212
lines changed

6 files changed

+1341
-1212
lines changed

‎.clang-format

+158
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
# clang-format configuration applied to all source files in this project.
2+
# Requires clang-format version 10.0.0 or newer.
3+
---
4+
Language: Cpp
5+
BasedOnStyle: Google
6+
AccessModifierOffset: -1
7+
AlignAfterOpenBracket: AlwaysBreak
8+
AlignConsecutiveAssignments: false
9+
AlignConsecutiveDeclarations: false
10+
AlignConsecutiveMacros: true
11+
AlignEscapedNewlines: Left
12+
AlignOperands: true
13+
AlignTrailingComments: true
14+
AllowAllArgumentsOnNextLine: true
15+
AllowAllConstructorInitializersOnNextLine: true
16+
AllowAllParametersOfDeclarationOnNextLine: false
17+
AllowShortBlocksOnASingleLine: false
18+
AllowShortCaseLabelsOnASingleLine: false
19+
AllowShortFunctionsOnASingleLine: Inline
20+
AllowShortLambdasOnASingleLine: All
21+
AllowShortIfStatementsOnASingleLine: Never
22+
AllowShortLoopsOnASingleLine: true
23+
AlwaysBreakAfterDefinitionReturnType: None
24+
AlwaysBreakAfterReturnType: None
25+
AlwaysBreakBeforeMultilineStrings: false
26+
AlwaysBreakTemplateDeclarations: Yes
27+
BinPackArguments: false
28+
BinPackParameters: false
29+
BraceWrapping:
30+
AfterCaseLabel: false
31+
AfterClass: false
32+
AfterControlStatement: true
33+
AfterEnum: false
34+
AfterFunction: true
35+
AfterNamespace: false
36+
AfterObjCDeclaration: false
37+
AfterStruct: true
38+
AfterUnion: false
39+
AfterExternBlock: false
40+
BeforeCatch: true
41+
BeforeElse: true
42+
IndentBraces: false
43+
SplitEmptyFunction: true
44+
SplitEmptyRecord: true
45+
SplitEmptyNamespace: true
46+
BreakBeforeBinaryOperators: None
47+
BreakBeforeBraces: Allman
48+
BreakBeforeInheritanceComma: false
49+
BreakInheritanceList: BeforeColon
50+
BreakBeforeTernaryOperators: true
51+
BreakConstructorInitializersBeforeComma: false
52+
BreakConstructorInitializers: BeforeColon
53+
BreakAfterJavaFieldAnnotations: false
54+
BreakStringLiterals: true
55+
ColumnLimit: 80
56+
CommentPragmas: '^ IWYU pragma:'
57+
CompactNamespaces: false
58+
ConstructorInitializerAllOnOneLineOrOnePerLine: true
59+
ConstructorInitializerIndentWidth: 4
60+
ContinuationIndentWidth: 4
61+
Cpp11BracedListStyle: true
62+
DerivePointerAlignment: true
63+
DisableFormat: false
64+
ExperimentalAutoDetectBinPacking: false
65+
FixNamespaceComments: true
66+
IncludeBlocks: Preserve
67+
IncludeCategories:
68+
- Regex: '^<ext/.*\.h>'
69+
Priority: 2
70+
- Regex: '^<.*\.h>'
71+
Priority: 1
72+
- Regex: '^<.*'
73+
Priority: 2
74+
- Regex: '.*'
75+
Priority: 3
76+
IncludeIsMainRegex: '([-_](test|unittest))?$'
77+
IndentCaseLabels: false
78+
IndentPPDirectives: None
79+
IndentWidth: 2
80+
IndentWrappedFunctionNames: false
81+
JavaScriptQuotes: Leave
82+
JavaScriptWrapImports: true
83+
KeepEmptyLinesAtTheStartOfBlocks: false
84+
MacroBlockBegin: "^\
85+
begin_declarations|\
86+
begin_struct.*$"
87+
MacroBlockEnd: "^\
88+
end_declarations|\
89+
end_struct.*$"
90+
MaxEmptyLinesToKeep: 1
91+
NamespaceIndentation: None
92+
ObjCBinPackProtocolList: Never
93+
ObjCBlockIndentWidth: 2
94+
ObjCSpaceAfterProperty: false
95+
ObjCSpaceBeforeProtocolList: true
96+
PenaltyBreakAssignment: 100
97+
PenaltyBreakBeforeFirstCallParameter: 1
98+
PenaltyBreakComment: 300
99+
PenaltyBreakFirstLessLess: 120
100+
PenaltyBreakString: 1000
101+
PenaltyBreakTemplateDeclaration: 10
102+
PenaltyExcessCharacter: 1000000
103+
PenaltyReturnTypeOnItsOwnLine: 1000
104+
PointerAlignment: Left
105+
RawStringFormats:
106+
- Language: Cpp
107+
Delimiters:
108+
- cc
109+
- CC
110+
- cpp
111+
- Cpp
112+
- CPP
113+
- 'c++'
114+
- 'C++'
115+
CanonicalDelimiter: ''
116+
BasedOnStyle: google
117+
- Language: TextProto
118+
Delimiters:
119+
- pb
120+
- PB
121+
- proto
122+
- PROTO
123+
EnclosingFunctions:
124+
- EqualsProto
125+
- EquivToProto
126+
- PARSE_PARTIAL_TEXT_PROTO
127+
- PARSE_TEST_PROTO
128+
- PARSE_TEXT_PROTO
129+
- ParseTextOrDie
130+
- ParseTextProtoOrDie
131+
CanonicalDelimiter: ''
132+
BasedOnStyle: google
133+
ReflowComments: true
134+
SortIncludes: true
135+
SortUsingDeclarations: true
136+
SpaceAfterCStyleCast: true
137+
SpaceAfterLogicalNot: false
138+
SpaceAfterTemplateKeyword: true
139+
SpaceBeforeAssignmentOperators: true
140+
SpaceBeforeCpp11BracedList: false
141+
SpaceBeforeCtorInitializerColon: true
142+
SpaceBeforeInheritanceColon: true
143+
SpaceBeforeParens: ControlStatements
144+
SpaceBeforeRangeBasedForLoopColon: true
145+
SpaceInEmptyParentheses: false
146+
SpacesBeforeTrailingComments: 2
147+
SpacesInAngles: false
148+
SpacesInContainerLiterals: true
149+
SpacesInCStyleCastParentheses: false
150+
SpacesInParentheses: false
151+
SpacesInSquareBrackets: false
152+
Standard: Auto
153+
StatementMacros:
154+
- Q_UNUSED
155+
- QT_REQUIRE_VERSION
156+
TabWidth: 8
157+
UseTab: Never
158+
...

‎configure.ac

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
AC_INIT([yara], [4.0.2], [[email protected]])
1+
AC_INIT([yara], [4.0.3], [[email protected]])
22

33
AM_SILENT_RULES([yes])
44
AC_CONFIG_SRCDIR([cli/yara.c])

‎libyara/Makefile.am

+1-1
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ dist_noinst_DATA = pb/yara.proto
144144

145145
lib_LTLIBRARIES = libyara.la
146146

147-
libyara_la_LDFLAGS = -version-number 4:0:2
147+
libyara_la_LDFLAGS = -version-number 4:0:3
148148

149149
BUILT_SOURCES = \
150150
lexer.c \

‎libyara/include/yara/libyara.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3434

3535
#define YR_MAJOR_VERSION 4
3636
#define YR_MINOR_VERSION 0
37-
#define YR_MICRO_VERSION 2
37+
#define YR_MICRO_VERSION 3
3838

3939
#define version_str(s) _version_str(s)
4040
#define _version_str(s) #s

0 commit comments

Comments
 (0)