Memory leaks in yara command-line when nonexisting target file and `--scan-list` option used

Describe the bug By fuzzing, we found that yara have memory leaks if target file not exists and --scan-list option is used.

To Reproduce We built yara with address sanitizer:

CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure

The command input is,

yara <rule_file> "" --scan-list

Here,rule_file has no meaning in this report. Simply you can use an empty file.

Output

error: could not open file "".

=================================================================
==30513==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 5336 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff6d5f7c3 in yr_calloc libyara/mem.c:127
    #2 0x7ffff6d901a5 in yr_scanner_create libyara/scanner.c:212
    #3 0x5555555626c6 in main cli/yara.c:1590
    #4 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

Indirect leak of 15312 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
    #1 0x7ffff6d5f7dd in yr_malloc libyara/mem.c:132
    #2 0x7ffff6d457f0 in yr_hash_table_create libyara/hash.c:182
    #3 0x7ffff6d901d9 in yr_scanner_create libyara/scanner.c:217
    #4 0x5555555626c6 in main cli/yara.c:1590
    #5 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

Indirect leak of 232 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff6d5f7c3 in yr_calloc libyara/mem.c:127
    #2 0x7ffff6d904c6 in yr_scanner_create libyara/scanner.c:236
    #3 0x5555555626c6 in main cli/yara.c:1590
    #4 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

Indirect leak of 232 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff6d5f7c3 in yr_calloc libyara/mem.c:127
    #2 0x7ffff6d9039c in yr_scanner_create libyara/scanner.c:230
    #3 0x5555555626c6 in main cli/yara.c:1590
    #4 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

Indirect leak of 232 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff6d5f7c3 in yr_calloc libyara/mem.c:127
    #2 0x7ffff6d9042d in yr_scanner_create libyara/scanner.c:233
    #3 0x5555555626c6 in main cli/yara.c:1590
    #4 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

Indirect leak of 29 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff6d5f7c3 in yr_calloc libyara/mem.c:127
    #2 0x7ffff6d905ea in yr_scanner_create libyara/scanner.c:242
    #3 0x5555555626c6 in main cli/yara.c:1590
    #4 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

Indirect leak of 29 byte(s) in 29 object(s) allocated from:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff6d5f7c3 in yr_calloc libyara/mem.c:127
    #2 0x7ffff6d90558 in yr_scanner_create libyara/scanner.c:239
    #3 0x5555555626c6 in main cli/yara.c:1590
    #4 0x7ffff663dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

SUMMARY: AddressSanitizer: 21402 byte(s) leaked in 203 allocation(s).

Environment:

OS: Ubuntu 18.04
gcc: 7.5.0
YARA version: 4.3.0 (master branch, commit id 313ab8080ad26efdf626d84c3b7b62c151ff295f)

VirusTotal / yara

Memory leaks in yara command-line when nonexisting target file and `--scan-list` option used #1896