go-yara icon indicating copy to clipboard operation
go-yara copied to clipboard

fix: do not store rule object from compiler callback permanently

Open secDre4mer opened this issue 1 year ago • 0 comments

The YR_RULE* pointer from the compiler callback originates from yr_arena_get_ptr, which refers to yr_arena_ref_to_ptr, which has the following comment:

This pointer is valid only until the next call to any of the functions that allocates space in the buffer where the data resides, like yr_arena_allocate_xxx and yr_arena_write_xxx.

Since the compiler may (and is highly likely to) allocate more data in the arena, we can not persistently store this pointer and may only use it during the callback (though this is sadly undocumented).

secDre4mer avatar Jan 26 '24 09:01 secDre4mer