save() results in "internal error : 58"

[fishfacegit]

Saving rules in memory to a buffer does not work.

rule = """rule apt_rule_rc4 {
                    strings: 
                        $rc4key = { DE AD BE EF DE AD BE EF DE AD BE EF DE AD BE EF }
                    condition:
                        $rc4key
                }"""
        rules = yara.compile(source=rule)
        data = StringIO()
        rules.save(file=data)

Traceback (most recent call last):
  File "/home/james/src/analysis/yara_rules_collector.py", line 67, in __compileCustom
    rules.save(file=data)
yara.Error: internal error: 58

data = BytesIO() results inSegmentation fault (core dumped)

[plusvic]

With StringIO the error is expected because StringIO shouldn't be used with binary data. However, with BytesIO it should work, and there's even a test case for that.

Can you provide more information about the segmentation fault? It's something that you reproduce? If so, please provide as many details as you can.

[wwwab123]

With StringIO the error is expected because StringIO shouldn't be used with binary data. However, with BytesIO it should work, and there's even a test case for that.

Can you provide more information about the segmentation fault? It's something that you reproduce? If so, please provide as many details as you can.

Hello everybody,

I encountered the same problem. The documents of Yara states that using StringIO, but here it is also said that BytesIO should be used. Should we use StringIO or BytesIO? Are there any mistakes in the document?

And I found that the StringIO code provided on the document is very outdated. Now it should be written as follows: ‘’’ from io import StringIO buff = StringIO() ‘’’

The documents URLs: https://yara.readthedocs.io/en/stable/yarapython.html https://github.com/VirusTotal/yara/blob/master/docs/yarapython.rst

[wwwab123]

https://github.com/VirusTotal/yara-python/issues/192

I see a similar issues, which says in Python 3.x we may need to use io.BytesIO() instead of io.StringIO().

So the outdated documents misled us..

[plusvic]

Documentation was updated.