search

VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
659 stars 179 forks source link

proper error reporting for internal error 30 #55

Closed jbremer closed 2 years ago

jbremer commented 7 years ago

This commit implements a proper exception which replaces "internal error: 30", an error identifying the fact that a string of a rule has reached 1 million matches. In other words, it's way too generic. By reporting the rule name & string identifier users of software using Yara should be able to fix their Yara rules (or at least be able to quickly identify which rules are affected).

This PR depends on functionality found in https://github.com/VirusTotal/yara/pull/717. Furthermore, aside from a quick test no additional testing has been done to ensure this commit works properly - so please verify all of that. Also the way the exception is thrown is a little bit ugly since it's outside of the handle_error() method. You may move it there, but at the handle_error() context the YR_SCAN_CONTEXT structure is long gone and other methods of propagating error metadata should be deviced. I'll leave that up to you, though.

Thanks!

plusvic commented 2 years ago

This is already obsolete as YARA handles internal error 30 differently.