diff -pruN 4.2.1-1/configure.ac 4.2.2-1/configure.ac --- 4.2.1-1/configure.ac 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/configure.ac 2022-06-30 09:06:13.000000000 +0000 @@ -1,4 +1,4 @@ -AC_INIT([yara], [4.2.0], [vmalvarez@virustotal.com]) +AC_INIT([yara], [4.2.2], [vmalvarez@virustotal.com]) AM_SILENT_RULES([yes]) AC_CONFIG_SRCDIR([cli/yara.c]) diff -pruN 4.2.1-1/debian/changelog 4.2.2-1/debian/changelog --- 4.2.1-1/debian/changelog 2022-04-26 19:12:49.000000000 +0000 +++ 4.2.2-1/debian/changelog 2022-08-01 19:37:47.000000000 +0000 @@ -1,3 +1,19 @@ +yara (4.2.2-1) unstable; urgency=medium + + [ Debian Janitor ] + * Trim trailing whitespace. + * Use secure copyright file specification URI. + * Bump debhelper from old 12 to 13. + debian/rules: Drop --fail-missing + argument to dh_missing, which is now the default. + * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, + Repository-Browse. + * Update standards version to 4.6.0, no changes needed. + + [ Hilko Bengen ] + * New upstream version 4.2.2 + + -- Hilko Bengen Mon, 01 Aug 2022 21:37:47 +0200 + yara (4.2.1-1) unstable; urgency=medium * New upstream version 4.2.1 @@ -374,7 +390,7 @@ yara (3.5.0+dfsg-9) unstable; urgency=me * Add patches for CVE-2016-10210, CVE-2016-10211, CVE-2017-5923, CVE-2017-5924 (Closes: #859821) - + -- Hilko Bengen Sun, 09 Apr 2017 13:02:37 +0200 yara (3.5.0+dfsg-8) unstable; urgency=medium diff -pruN 4.2.1-1/debian/control 4.2.2-1/debian/control --- 4.2.1-1/debian/control 2022-04-26 19:02:40.000000000 +0000 +++ 4.2.2-1/debian/control 2022-08-01 19:37:17.000000000 +0000 @@ -3,14 +3,14 @@ Section: utils Priority: optional Maintainer: Debian Security Tools Uploaders: Hilko Bengen -Build-Depends: debhelper-compat (= 12), +Build-Depends: debhelper-compat (= 13), python3-sphinx, flex, bison, pkg-config, libjansson-dev, libmagic-dev, libssl-dev, -Standards-Version: 4.5.0 +Standards-Version: 4.6.0 Homepage: https://virustotal.github.io/yara/ Vcs-Git: https://salsa.debian.org/pkg-security-team/yara.git Vcs-Browser: https://salsa.debian.org/pkg-security-team/yara diff -pruN 4.2.1-1/debian/copyright 4.2.2-1/debian/copyright --- 4.2.1-1/debian/copyright 2022-04-26 19:02:40.000000000 +0000 +++ 4.2.2-1/debian/copyright 2022-08-01 19:37:17.000000000 +0000 @@ -1,4 +1,4 @@ -Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: yara Source: https://virustotal.github.io/yara/ diff -pruN 4.2.1-1/debian/rules 4.2.2-1/debian/rules --- 4.2.1-1/debian/rules 2022-04-26 19:02:40.000000000 +0000 +++ 4.2.2-1/debian/rules 2022-08-01 19:37:17.000000000 +0000 @@ -23,7 +23,7 @@ override_dh_autoreconf: dh_autoreconf override_dh_missing: - dh_missing -X.la --fail-missing + dh_missing -X.la override_dh_install: dh_install -X.la diff -pruN 4.2.1-1/debian/upstream/metadata 4.2.2-1/debian/upstream/metadata --- 4.2.1-1/debian/upstream/metadata 1970-01-01 00:00:00.000000000 +0000 +++ 4.2.2-1/debian/upstream/metadata 2022-08-01 19:37:17.000000000 +0000 @@ -0,0 +1,5 @@ +--- +Bug-Database: https://github.com/VirusTotal/yara/issues +Bug-Submit: https://github.com/VirusTotal/yara/issues/new +Repository: https://github.com/VirusTotal/yara.git +Repository-Browse: https://github.com/VirusTotal/yara diff -pruN 4.2.1-1/libyara/arena.c 4.2.2-1/libyara/arena.c --- 4.2.1-1/libyara/arena.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/arena.c 2022-06-30 09:06:13.000000000 +0000 @@ -434,8 +434,8 @@ int yr_arena_ptr_to_ref(YR_ARENA* arena, (uint8_t*) address < arena->buffers[i].data + arena->buffers[i].used) { ref->buffer_id = i; - ref->offset = (yr_arena_off_t)( - (uint8_t*) address - arena->buffers[i].data); + ref->offset = + (yr_arena_off_t) ((uint8_t*) address - arena->buffers[i].data); return 1; } @@ -583,7 +583,7 @@ int yr_arena_load_stream(YR_STREAM* stre YR_ARENA_BUFFER* b = &new_arena->buffers[ref.buffer_id]; if (ref.buffer_id >= new_arena->num_buffers || - ref.offset > b->used - sizeof(void*)) + ref.offset > b->used - sizeof(void*) || b->data == NULL) { yr_arena_release(new_arena); return ERROR_CORRUPT_FILE; diff -pruN 4.2.1-1/libyara/include/yara/libyara.h 4.2.2-1/libyara/include/yara/libyara.h --- 4.2.1-1/libyara/include/yara/libyara.h 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/include/yara/libyara.h 2022-06-30 09:06:13.000000000 +0000 @@ -34,7 +34,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBI #define YR_MAJOR_VERSION 4 #define YR_MINOR_VERSION 2 -#define YR_MICRO_VERSION 0 +#define YR_MICRO_VERSION 2 #define version_str(s) _version_str(s) #define _version_str(s) #s diff -pruN 4.2.1-1/libyara/modules/dex/dex.c 4.2.2-1/libyara/modules/dex/dex.c --- 4.2.1-1/libyara/modules/dex/dex.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/modules/dex/dex.c 2022-06-30 09:06:13.000000000 +0000 @@ -418,7 +418,7 @@ static int64_t dex_get_integer( const char* pattern, int64_t index) { - if (index == YR_UNDEFINED) + if (index == YR_UNDEFINED || index < 0) return YR_UNDEFINED; // Impose a reasonably large limit to table indexes. @@ -434,7 +434,7 @@ static SIZED_STRING* dex_get_string( const char* pattern, int64_t index) { - if (index == YR_UNDEFINED) + if (index == YR_UNDEFINED || index < 0) return NULL; // Impose a reasonably large limit to table indexes. @@ -619,7 +619,7 @@ uint32_t load_encoded_field( { #ifdef DEBUG_DEX_MODULE printf( - "[DEX]\tFIELD_NAME %s NAME_IDX 0x%x\n", field_name->c_string, name_idx); + "[DEX]\tFIELD_NAME %s NAME_IDX 0x%llx\n", field_name->c_string, name_idx); #endif set_sized_string( @@ -643,7 +643,7 @@ uint32_t load_encoded_field( { #ifdef DEBUG_DEX_MODULE printf( - "[DEX]\tCLASS_NAME %s CLASS_IDX 0x%x DESCRIPTOR_IDX 0x%x\n", + "[DEX]\tCLASS_NAME %s CLASS_IDX 0x%llx DESCRIPTOR_IDX 0x%llx\n", class_name->c_string, class_idx, descriptor_idx); @@ -748,7 +748,7 @@ uint32_t load_encoded_method( return 0; #ifdef DEBUG_DEX_MODULE - printf("[DEX]\tNAME_IDX 0x%x\n", name_idx); + printf("[DEX]\tNAME_IDX 0x%llx\n", name_idx); #endif #ifdef DEBUG_DEX_MODULE @@ -768,7 +768,7 @@ uint32_t load_encoded_method( { #ifdef DEBUG_DEX_MODULE printf( - "[DEX]\tMETHOD_NAME %s NAME_IDX 0x%x\n", + "[DEX]\tMETHOD_NAME %s NAME_IDX 0x%llx\n", method_name->c_string, name_idx); #endif @@ -794,7 +794,7 @@ uint32_t load_encoded_method( { #ifdef DEBUG_DEX_MODULE printf( - "[DEX]\tCLASS_NAME %s CLASS_IDX 0x%x DESCRIPTOR_IDX:0x%x\n", + "[DEX]\tCLASS_NAME %s CLASS_IDX 0x%llx DESCRIPTOR_IDX:0x%llx\n", class_name->c_string, class_idx, descriptor_idx); @@ -821,7 +821,7 @@ uint32_t load_encoded_method( { #ifdef DEBUG_DEX_MODULE printf( - "[DEX]\tPROTO_NAME %s CLASS_IDX 0x%x DESCRIPTOR_IDX:0x%x\n", + "[DEX]\tPROTO_NAME %s CLASS_IDX 0x%llx DESCRIPTOR_IDX:0x%llx\n", proto_name->c_string, class_idx, descriptor_idx); @@ -842,7 +842,7 @@ uint32_t load_encoded_method( #endif if (struct_fits_in_dex( - dex, dex->data + encoded_method.code_off, sizeof(code_item_t))) + dex, dex->data + encoded_method.code_off, code_item_t)) { code_item_t* code_item = (code_item_t*) (dex->data + encoded_method.code_off); @@ -954,7 +954,7 @@ void dex_parse(DEX* dex, uint64_t base_a if (!fits_in_dex( dex, - dex->data + yr_le32toh(string_id_item->string_data_offset), + dex->data + yr_le32toh(string_id_item->string_data_offset) + 1, value)) continue; @@ -967,8 +967,8 @@ void dex_parse(DEX* dex, uint64_t base_a set_integer(value, dex->object, "string_ids[%i].size", i); set_sized_string( - (const char*) (( - dex->data + yr_le32toh(string_id_item->string_data_offset) + 1)), + (const char*) ( + dex->data + yr_le32toh(string_id_item->string_data_offset) + 1), value, dex->object, "string_ids[%i].value", @@ -1124,6 +1124,9 @@ void dex_parse(DEX* dex, uint64_t base_a map_item_t* map_item = (map_item_t*) (dex->data + yr_le32toh(dex_header->map_offset) + sizeof(uint32_t) + i * sizeof(map_item_t)); + if (!struct_fits_in_dex(dex, map_item, map_item_t)) + return; + set_integer( yr_le16toh(map_item->type), dex->object, diff -pruN 4.2.1-1/libyara/modules/dotnet/dotnet.c 4.2.2-1/libyara/modules/dotnet/dotnet.c --- 4.2.1-1/libyara/modules/dotnet/dotnet.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/modules/dotnet/dotnet.c 2022-06-30 09:06:13.000000000 +0000 @@ -1637,6 +1637,7 @@ static bool dotnet_is_dotnet(PE* pe) int64_t metadata_root = pe_rva_to_offset( pe, yr_le32toh(cli_header->MetaData.VirtualAddress)); + offset = metadata_root; if (!struct_fits_in_pe(pe, pe->data + metadata_root, NET_METADATA)) return false; @@ -1650,7 +1651,7 @@ static bool dotnet_is_dotnet(PE* pe) // Also make sure it fits in pe. uint32_t md_len = yr_le32toh(metadata->Length); if (md_len == 0 || md_len > 255 || md_len % 4 != 0 || - !fits_in_pe(pe, pe->data + offset, md_len)) + !fits_in_pe(pe, pe->data + offset + sizeof(NET_METADATA), md_len)) { return false; } @@ -1667,7 +1668,7 @@ static bool dotnet_is_dotnet(PE* pe) int64_t entry_offset = pe_rva_to_offset( pe, yr_le32toh(pe->header->OptionalHeader.AddressOfEntryPoint)); - if (offset < 0 || !fits_in_pe(pe, pe->data + entry_offset, 2)) + if (entry_offset < 0 || !fits_in_pe(pe, pe->data + entry_offset, 2)) return false; const uint8_t* entry_data = pe->data + entry_offset; @@ -1721,7 +1722,7 @@ void dotnet_parse_com(PE* pe) md_len = yr_le32toh(metadata->Length); if (md_len == 0 || md_len > 255 || md_len % 4 != 0 || - !fits_in_pe(pe, pe->data + offset, md_len)) + !fits_in_pe(pe, pe->data + offset + sizeof(NET_METADATA), md_len)) { return; } diff -pruN 4.2.1-1/libyara/modules/hash/hash.c 4.2.2-1/libyara/modules/hash/hash.c --- 4.2.1-1/libyara/modules/hash/hash.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/modules/hash/hash.c 2022-06-30 09:06:13.000000000 +0000 @@ -35,7 +35,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBI #define MODULE_NAME hash - typedef struct _CACHE_KEY { int64_t offset; @@ -43,7 +42,6 @@ typedef struct _CACHE_KEY } CACHE_KEY; - const uint32_t crc32_tab[] = { 0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988, @@ -89,7 +87,6 @@ const uint32_t crc32_tab[] = { 0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94, 0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d}; - static void digest_to_ascii( unsigned char* digest, char* digest_ascii, @@ -103,7 +100,6 @@ static void digest_to_ascii( digest_ascii[digest_length * 2] = '\0'; } - static char* get_from_cache( YR_OBJECT* module_object, const char* ns, @@ -131,7 +127,6 @@ static char* get_from_cache( return result; } - static int add_to_cache( YR_OBJECT* module_object, const char* ns, @@ -166,7 +161,6 @@ static int add_to_cache( return result; } - define_function(string_md5) { unsigned char digest[YR_MD5_LEN]; @@ -192,7 +186,6 @@ define_function(string_md5) return_string(digest_ascii); } - define_function(string_sha256) { unsigned char digest[YR_SHA256_LEN]; @@ -218,7 +211,6 @@ define_function(string_sha256) return_string(digest_ascii); } - define_function(string_sha1) { unsigned char digest[YR_SHA1_LEN]; @@ -244,7 +236,6 @@ define_function(string_sha1) return_string(digest_ascii); } - define_function(string_checksum32) { size_t i; @@ -252,7 +243,7 @@ define_function(string_checksum32) SIZED_STRING* s = sized_string_argument(1); uint32_t checksum = 0; - for (i = 0; i < s->length; i++) checksum += (uint8_t)(s->c_string[i]); + for (i = 0; i < s->length; i++) checksum += (uint8_t) (s->c_string[i]); YR_DEBUG_FPRINTF( 2, @@ -265,7 +256,6 @@ define_function(string_checksum32) return_integer(checksum); } - define_function(data_md5) { yr_md5_ctx md5_context; @@ -298,11 +288,10 @@ define_function(data_md5) { YR_DEBUG_FPRINTF( 2, stderr, "} // %s() = YR_UNDEFINED // block == NULL\n", __FUNCTION__); + return_string(YR_UNDEFINED); } - yr_md5_init(&md5_context); - if (offset < 0 || length < 0 || offset < block->base) { YR_DEBUG_FPRINTF( @@ -310,6 +299,7 @@ define_function(data_md5) stderr, "} // %s() = YR_UNDEFINED // bad offset / length\n", __FUNCTION__); + return_string(YR_UNDEFINED); } @@ -323,9 +313,12 @@ define_function(data_md5) "} // %s() = %s (cached)\n", __FUNCTION__, cached_ascii_digest); + return_string(cached_ascii_digest); } + yr_md5_init(&md5_context); + foreach_memory_block(iterator, block) { // if desired block within current block @@ -336,9 +329,9 @@ define_function(data_md5) if (block_data != NULL) { - size_t data_offset = (size_t)(offset - block->base); + size_t data_offset = (size_t) (offset - block->base); size_t data_len = (size_t) yr_min( - length, (size_t)(block->size - data_offset)); + length, (size_t) (block->size - data_offset)); offset += data_len; length -= data_len; @@ -361,6 +354,9 @@ define_function(data_md5) stderr, "} // %s() = YR_UNDEFINED // past_first_block\n", __FUNCTION__); + + yr_md5_final(digest, &md5_context); + return_string(YR_UNDEFINED); } @@ -368,6 +364,8 @@ define_function(data_md5) break; } + yr_md5_final(digest, &md5_context); + if (!past_first_block) { YR_DEBUG_FPRINTF( @@ -375,11 +373,10 @@ define_function(data_md5) stderr, "} // %s() = YR_UNDEFINED // !past_first_block\n", __FUNCTION__); + return_string(YR_UNDEFINED); } - yr_md5_final(digest, &md5_context); - digest_to_ascii(digest, digest_ascii, YR_MD5_LEN); FAIL_ON_ERROR( @@ -389,7 +386,6 @@ define_function(data_md5) return_string(digest_ascii); } - define_function(data_sha1) { yr_sha1_ctx sha_context; @@ -422,11 +418,10 @@ define_function(data_sha1) { YR_DEBUG_FPRINTF( 2, stderr, "} // %s() = YR_UNDEFINED // block == NULL\n", __FUNCTION__); + return_string(YR_UNDEFINED); } - yr_sha1_init(&sha_context); - if (offset < 0 || length < 0 || offset < block->base) { YR_DEBUG_FPRINTF( @@ -434,6 +429,7 @@ define_function(data_sha1) stderr, "} // %s() = YR_UNDEFINED // bad offset / length\n", __FUNCTION__); + return_string(YR_UNDEFINED); } @@ -448,9 +444,12 @@ define_function(data_sha1) "} // %s() = %s (cached)\n", __FUNCTION__, cached_ascii_digest); + return_string(cached_ascii_digest); } + yr_sha1_init(&sha_context); + foreach_memory_block(iterator, block) { // if desired block within current block @@ -460,7 +459,7 @@ define_function(data_sha1) if (block_data != NULL) { - size_t data_offset = (size_t)(offset - block->base); + size_t data_offset = (size_t) (offset - block->base); size_t data_len = (size_t) yr_min( length, (size_t) block->size - data_offset); @@ -485,6 +484,8 @@ define_function(data_sha1) stderr, "} // %s() = YR_UNDEFINED // past_first_block\n", __FUNCTION__); + + yr_sha1_final(digest, &sha_context); return_string(YR_UNDEFINED); } @@ -492,6 +493,8 @@ define_function(data_sha1) break; } + yr_sha1_final(digest, &sha_context); + if (!past_first_block) { YR_DEBUG_FPRINTF( @@ -499,11 +502,10 @@ define_function(data_sha1) stderr, "} // %s() = YR_UNDEFINED // !past_first_block\n", __FUNCTION__); + return_string(YR_UNDEFINED); } - yr_sha1_final(digest, &sha_context); - digest_to_ascii(digest, digest_ascii, YR_SHA1_LEN); FAIL_ON_ERROR( @@ -513,7 +515,6 @@ define_function(data_sha1) return_string(digest_ascii); } - define_function(data_sha256) { yr_sha256_ctx sha256_context; @@ -546,11 +547,10 @@ define_function(data_sha256) { YR_DEBUG_FPRINTF( 2, stderr, "} // %s() = YR_UNDEFINED // block == NULL\n", __FUNCTION__); + return_string(YR_UNDEFINED); } - yr_sha256_init(&sha256_context); - if (offset < 0 || length < 0 || offset < block->base) { YR_DEBUG_FPRINTF( @@ -558,6 +558,7 @@ define_function(data_sha256) stderr, "} // %s() = YR_UNDEFINED // bad offset / length\n", __FUNCTION__); + return_string(YR_UNDEFINED); } @@ -572,9 +573,12 @@ define_function(data_sha256) "} // %s() = %s (cached)\n", __FUNCTION__, cached_ascii_digest); + return_string(cached_ascii_digest); } + yr_sha256_init(&sha256_context); + foreach_memory_block(iterator, block) { // if desired block within current block @@ -584,7 +588,7 @@ define_function(data_sha256) if (block_data != NULL) { - size_t data_offset = (size_t)(offset - block->base); + size_t data_offset = (size_t) (offset - block->base); size_t data_len = (size_t) yr_min(length, block->size - data_offset); offset += data_len; @@ -608,6 +612,8 @@ define_function(data_sha256) stderr, "} // %s() = YR_UNDEFINED // past_first_block\n", __FUNCTION__); + + yr_sha256_final(digest, &sha256_context); return_string(YR_UNDEFINED); } @@ -615,6 +621,8 @@ define_function(data_sha256) break; } + yr_sha256_final(digest, &sha256_context); + if (!past_first_block) { YR_DEBUG_FPRINTF( @@ -622,11 +630,10 @@ define_function(data_sha256) stderr, "} // %s() = YR_UNDEFINED // !past_first_block\n", __FUNCTION__); + return_string(YR_UNDEFINED); } - yr_sha256_final(digest, &sha256_context); - digest_to_ascii(digest, digest_ascii, YR_SHA256_LEN); FAIL_ON_ERROR( @@ -636,7 +643,6 @@ define_function(data_sha256) return_string(digest_ascii); } - define_function(data_checksum32) { int64_t offset = integer_argument(1); // offset where to start @@ -673,7 +679,7 @@ define_function(data_checksum32) { size_t i; - size_t data_offset = (size_t)(offset - block->base); + size_t data_offset = (size_t) (offset - block->base); size_t data_len = (size_t) yr_min(length, block->size - data_offset); offset += data_len; @@ -707,7 +713,6 @@ define_function(data_checksum32) return_integer(checksum); } - define_function(string_crc32) { size_t i; @@ -729,7 +734,6 @@ define_function(string_crc32) return_integer(checksum ^ 0xFFFFFFFF); } - define_function(data_crc32) { int64_t offset = integer_argument(1); // offset where to start @@ -766,7 +770,7 @@ define_function(data_crc32) { size_t i; - size_t data_offset = (size_t)(offset - block->base); + size_t data_offset = (size_t) (offset - block->base); size_t data_len = (size_t) yr_min(length, block->size - data_offset); offset += data_len; @@ -803,7 +807,6 @@ define_function(data_crc32) return_integer(checksum ^ 0xFFFFFFFF); } - begin_declarations declare_function("md5", "ii", "s", data_md5); declare_function("md5", "s", "s", string_md5); @@ -821,7 +824,6 @@ begin_declarations declare_function("crc32", "s", "i", string_crc32); end_declarations - int module_initialize(YR_MODULE* module) { YR_DEBUG_FPRINTF(2, stderr, "- %s() {}\n", __FUNCTION__); @@ -829,7 +831,6 @@ int module_initialize(YR_MODULE* module) return ERROR_SUCCESS; } - int module_finalize(YR_MODULE* module) { YR_DEBUG_FPRINTF(2, stderr, "- %s() {}\n", __FUNCTION__); @@ -837,7 +838,6 @@ int module_finalize(YR_MODULE* module) return ERROR_SUCCESS; } - int module_load( YR_SCAN_CONTEXT* context, YR_OBJECT* module_object, @@ -855,7 +855,6 @@ int module_load( return ERROR_SUCCESS; } - int module_unload(YR_OBJECT* module_object) { YR_DEBUG_FPRINTF(2, stderr, "- %s() {}\n", __FUNCTION__); diff -pruN 4.2.1-1/libyara/object.c 4.2.2-1/libyara/object.c --- 4.2.1-1/libyara/object.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/object.c 2022-06-30 09:06:13.000000000 +0000 @@ -57,6 +57,7 @@ int yr_object_create( size_t object_size = 0; assert(parent != NULL || object != NULL); + assert(identifier != NULL); switch (type) { diff -pruN 4.2.1-1/libyara/proc/linux.c 4.2.2-1/libyara/proc/linux.c --- 4.2.1-1/libyara/proc/linux.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/proc/linux.c 2022-06-30 09:06:13.000000000 +0000 @@ -406,7 +406,7 @@ YR_API YR_MEMORY_BLOCK* yr_process_get_n stderr, "- %s() {} = %p // .base=0x%" PRIx64 " .size=%" PRIu64 "\n", __FUNCTION__, - result, + context->current_block, context->current_block.base, context->current_block.size); diff -pruN 4.2.1-1/libyara/rules.c 4.2.2-1/libyara/rules.c --- 4.2.1-1/libyara/rules.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/libyara/rules.c 2022-06-30 09:06:13.000000000 +0000 @@ -333,6 +333,9 @@ int yr_rules_from_arena(YR_ARENA* arena, YR_SUMMARY* summary = (YR_SUMMARY*) yr_arena_get_ptr( arena, YR_SUMMARY_SECTION, 0); + if (summary == NULL) + return ERROR_CORRUPT_FILE; + // Now YR_RULES relies on this arena, let's increment the arena's // reference count so that if the original owner of the arena calls // yr_arena_destroy the arena is not destroyed. diff -pruN 4.2.1-1/tests/BUILD.bazel 4.2.2-1/tests/BUILD.bazel --- 4.2.1-1/tests/BUILD.bazel 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/tests/BUILD.bazel 2022-06-30 09:06:13.000000000 +0000 @@ -241,6 +241,7 @@ cc_test( data = [ "data/tiny", "data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171", + "data/bad_dotnet_pe", ], linkstatic = True, deps = [ Binary files 4.2.1-1/tests/data/bad_dotnet_pe and 4.2.2-1/tests/data/bad_dotnet_pe differ diff -pruN 4.2.1-1/tests/test-dotnet.c 4.2.2-1/tests/test-dotnet.c --- 4.2.1-1/tests/test-dotnet.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/tests/test-dotnet.c 2022-06-30 09:06:13.000000000 +0000 @@ -84,6 +84,15 @@ int main(int argc, char** argv) "tests/data/" "0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171"); + assert_false_rule( + "import \"dotnet\" \ + rule test { \ + condition: \ + dotnet.version == \"v4.0.30319\" \ + }", + "tests/data/" + "bad_dotnet_pe"); + yr_finalize(); YR_DEBUG_FPRINTF( diff -pruN 4.2.1-1/tests/test-magic.c 4.2.2-1/tests/test-magic.c --- 4.2.1-1/tests/test-magic.c 2022-04-26 07:21:15.000000000 +0000 +++ 4.2.2-1/tests/test-magic.c 2022-06-30 09:06:13.000000000 +0000 @@ -23,7 +23,7 @@ int main(int argc, char** argv) assert_true_rule_blob( "import \"magic\" rule test { condition: \ - magic.type() contains \"PE32\" and \ + magic.type() contains \"MS-DOS executable\" and \ magic.mime_type() == \"application/x-dosexec\" }", PE32_FILE); @@ -31,7 +31,7 @@ int main(int argc, char** argv) assert_true_rule_blob( "import \"magic\" rule test { condition: \ magic.type() contains \"Mach-O\" and \ - magic.mime_type() == \"application/x-mach-binary\" and \ + (magic.mime_type() == \"application/x-mach-binary\" or magic.mime_type() == \"application/octet-stream\") and \ magic.type() contains \"Mach-O\"}", MACHO_X86_FILE);