search

VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
648 stars 179 forks source link

Unescaped Metadata Crashes Python #135

Closed malvidin closed 4 years ago

malvidin commented 4 years ago

This issue doesn't impact YARA significantly, but this rule crashes the Python interpeter. Any rule that contains metadata values that can be unescaped to [\x80-\xFF] can be used to crash any yara-python based system that doesn't specifically check for this. The rule compiles with no errors, but if the rule is run against anything, Python crashes. This was tested with yara-python 3.11.0 with Python 3.8 on Windows 10 and Ubuntu 16.04.1.

https://github.com/VirusTotal/yara/issues/1242

import yara
python_killer = yara.compile(source=r'rule test_rule { meta: kill_python = "\x80" condition: false }')
match= python_killer.match(data='')
wxsBSD commented 4 years ago

I have a pretty good idea what is going on. I'll see if I can't get a fix up tonight.