VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
7.95k stars 1.42k forks source link

stop fetching memory blocks when an elf is found #1996

Closed vthib closed 7 months ago

vthib commented 8 months ago

When scanning multiple memory blocks, we should stop as soon as a valid elf is found. This was broken as the "break" applies to the switch, and not the outer loop. Fix this by reworking the code to remove the switch.

This bug had two repercutions:

vthib commented 7 months ago

@plusvic anything blocking this MR that I need to modify?