VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
7.95k stars 1.42k forks source link

Global rules are not handled properly on master #2022

Closed vthib closed 7 months ago

vthib commented 7 months ago

Global rules with string matches do not seem to behave properly anymore, and even if they do not match, normal rules that match are returned.

Steps to reproduce the behavior:

with this file:

global rule g1 {
    strings:
        $ = "g1"
    condition: all of them
}

rule foo {
    strings:
        $ = "foo"
    condition: all of them
}

and an input foo, the foo rule is reported as matching, but should not, since the global rule did not match.

yara 4.3.1 does not have the bug, not does yara 4.4.0, but master has it.

Bisecting seems to indicate this commit introduced the regression: https://github.com/VirusTotal/yara/commit/b26b00019f851f66bbd34e069adc53c31a38852a