VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.33k stars 1.45k forks source link

fix issues with modules fetch of memory blocks in some situations #2025

Closed vthib closed 10 months ago

vthib commented 10 months ago

Some modules functions (from hash and math) can access multiple memory blocks, as long as those are contiguous. For example, when hashing between offsets 0..1000, blocks that cover this range will be fetched.

This logic however is a bit buggy on the boundary: if the fetched range ends exactly at the end of a block, the iteration keeps going instead of ending. This can result in two situations:

This is fixed by modifying the condition to detect if there are still more bytes to fetch.