Describe the bug
If yara -r runs into a symlink to .. it's trapped in a endless loop. A common example of this is the Debian package of llvm which creates in /lib/llvm-11/build/ the following symlink:
$ mkdir -p /tmp/d1/d2
$ cd /tmp/d1/d2
$ ln -s .. d3
$ ln -s .. d4
$ echo "rule test { condition: filesize > 1MB }" > test.yar
$ $ yara -rn test.yar .
test ./test.yar
test ./d4/d2/test.yar
test ./d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
...
Expected behavior
Don't follow symlinks to ..
Please complete the following information:
OS: Linux
YARA version: 4.3.2
Additional context
This fixes to problem but there are probably more elegant solutions (I'm not a C coder ;)
Describe the bug If yara -r runs into a symlink to .. it's trapped in a endless loop. A common example of this is the Debian package of llvm which creates in /lib/llvm-11/build/ the following symlink:
To Reproduce
Expected behavior Don't follow symlinks to ..
Please complete the following information:
Additional context This fixes to problem but there are probably more elegant solutions (I'm not a C coder ;)