VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
648 stars 179 forks source link

Allow a Py_buffer as data for Rules_match #148

Closed teskje closed 4 years ago

teskje commented 4 years ago

This makes rules matching compatible with data objects PyArg_ParseTuple does not consider read-only (even though they might actually be), such a memoryviews. The main change is replacing the s# formatter with s* and replacing the (pointer, length) pair with a Py_buffer object accordingly. Additional care must be taken to release the Py_buffer on every error path.

Solves #147

googlebot commented 4 years ago

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

teskje commented 4 years ago

@googlebot I signed it!

googlebot commented 4 years ago

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

teskje commented 4 years ago

Thanks for your comments @plusvic! I addressed them and also added a test for matching against a memoryview.

teskje commented 4 years ago

I created this PR from the master branch of my fork and there seems to be no way to change the source branch except for opening a new PR. So I'm closing this one in favor of #152.