hillu / go-yara

Go bindings for YARA
BSD 2-Clause "Simplified" License
350 stars 112 forks source link

fix: do not store rule object from compiler callback permanently #142

Closed secDre4mer closed 3 months ago

secDre4mer commented 5 months ago

The YR_RULE* pointer from the compiler callback originates from yr_arena_get_ptr, which refers to yr_arena_ref_to_ptr, which has the following comment:

This pointer is valid only until the next call to any of the functions that allocates space in the buffer where the data resides, like yr_arena_allocate_xxx and yr_arena_write_xxx.

Since the compiler may (and is highly likely to) allocate more data in the arena, we can not persistently store this pointer and may only use it during the callback (though this is sadly undocumented).