By default YARA installs an exception handler that captures SIGBUS and SIGSEGV signals during the time a scan is active. This has the purpose of capturing signals that can occur while reading from memory mapped files. However, this is a process-wide exception handler that seems to interfere with Golang's ability to detect null pointer accesses and produce memory dumps.
We have seen in production cases in which a Golang process that uses YARA enters an state in which the process does nothing but doesn't crash. We suspect it is somewhat related to the exception handler installed by YARA.
As a temporary measure this patch disables the installation of the exception handler during calls to ScanMem. Installing such handler doesn't make sense while scanning memory that is not backed by a mmaped filed.
By default YARA installs an exception handler that captures SIGBUS and SIGSEGV signals during the time a scan is active. This has the purpose of capturing signals that can occur while reading from memory mapped files. However, this is a process-wide exception handler that seems to interfere with Golang's ability to detect null pointer accesses and produce memory dumps.
We have seen in production cases in which a Golang process that uses YARA enters an state in which the process does nothing but doesn't crash. We suspect it is somewhat related to the exception handler installed by YARA.
As a temporary measure this patch disables the installation of the exception handler during calls to
ScanMem. Installing such handler doesn't make sense while scanning memory that is not backed by a mmaped filed.