mustangV / yara-project

Automatically exported from code.google.com/p/yara-project
Apache License 2.0
0 stars 0 forks source link

[BUG] RegExp variables are not released! #60

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
Hi! I discovered that when you create a variable that uses regular expressions 
the variable is not released and can be used in the next rules as it was a 
global variable, like in the following example:

rule test1
{   
     strings:
       $global = /MZ[0-9]{4,6}\x00/

     condition:
         $global at 0
}

rule test2
{   
     condition:
       $global
}

This will not give out any error and test2 will work with the $global variable 
defined in rule test1.

Tested with Yara 1.5 and Yara 1.6 (156 latest from svn!) under Windows 7 (x64)

Greetings! 

Original issue reported on code.google.com by golgotr...@gmail.com on 13 Aug 2012 at 12:41

GoogleCodeExporter commented 8 years ago
The problem was occurring with any kind of strings, not only with regular 
expressions. It was because the second rule doesn't had the "strings" section 
and strings defined in the previous rule were being used. Fixed in r157.

Original comment by plus...@gmail.com on 14 Aug 2012 at 4:59