PR from Yara 23-12-24 (#8)

* Fix bug when parsing imports from 32bit PE. (VirusTotal#2119)

There is a bug when parsing [1] which turns out to be incorrectly checking the
number of successfully parsed imported functions and not the number of parsed
attempts. This particular sample is badly malformed and is causing excessive
loops in the parser while attempting to parse invalid data. With this fix it
will finish in a few seconds on my laptop.

[1]: 9c8e4dfa84b1ce7e919964978d33eada266d58b2aacdbef44b0618cc178ea421

* Upgrade `upload-artifact` action to v4

* fix: large memory consumption while parsing corrupted PE. (VirusTotal#2120)

After VirusTotal#2119 `yara` is consuming a large amount of memory while parsing 9bddb45c44d9c25a4f97ef800cb110de5e6a15349bac05d389c8bda37902f25a. That's because after the change it doesn't limit the total number of imported functions, only the total number of parsing attempts, but the count is reset with each import entry. This file has a large number of entries and a large number of functions per entry, the total number of functions is very high.

It turns out that we must limit both the total number of correctly parsed functions (for cases like this one), and the total number of parsing attempts (for cases like the one VirusTotal#2119 was aiming to solve).

* Remove dotnet configure instructions since it's enabled by default now (VirusTotal#2122)

* Upgrade to `actions/cache@v4`.

GitHub is deprecating versions 2 and 3.

* Fix typo in documentation.

* Rename cache trying to solve issue with Bazel build

* Disable cache in Bazel build workflow

* Add Corelight to list of YARA users (VirusTotal#2124)

---------

Co-authored-by: Wesley Shields <[email protected]>
Co-authored-by: Victor M. Alvarez <[email protected]>
Co-authored-by: zdwg42 <[email protected]>
Co-authored-by: signalblur <[email protected]>

.github/workflows/build.yml

@@ -110,15 +110,15 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       # Caches and restores the bazelisk download directory.
-      - name: Cache bazelisk download
-        uses: actions/cache@v2
-        env:
-          cache-name: bazel-cache
-        with:
-          path: ~/.cache/bazelisk
-          key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.ref }}
-          restore-keys: |
-            ${{ runner.os }}-${{ env.cache-name }}-development
+      # - name: Cache bazelisk download
+      #   uses: actions/cache@v4
+      #   env:
+      #     cache-name: bazel-cache
+      #   with:
+      #     path: ~/.cache/bazelisk
+      #     key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.ref }}
+      #     restore-keys: |
+      #       ${{ runner.os }}-${{ env.cache-name }}
       - uses: actions/checkout@v2
       - name: Build
         run: bazel build @jansson//... //tests/...

.github/workflows/oss-fuzz.yml

@@ -18,7 +18,7 @@ jobs:
         fuzz-seconds: 600
         dry-run: false
     - name: Upload Crash
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: artifacts

README.md

@@ -70,6 +70,7 @@ awesome list of [YARA-related stuff](https://github.com/InQuest/awesome-yara).
 * [Cloudina Security](https://cloudina.co.uk)
 * [Cofense](https://cofense.com)
 * [Conix](https://www.conix.fr)
+* [Corelight](https://corelight.com/products/yara)
 * [CounterCraft](https://www.countercraft.eu)
 * [Cuckoo Sandbox](https://github.com/cuckoosandbox/cuckoo)
 * [Cyber Triage](https://www.cybertriage.com)

docs/gettingstarted.rst

@@ -48,7 +48,6 @@ The following modules are not compiled into YARA by default:
 
 * cuckoo
 * magic
-* dotnet
 
 If you plan to use them you must pass the corresponding ``--enable-<module
 name>`` arguments to the ``configure`` script.
@@ -57,8 +56,7 @@ For example::
 
     ./configure --enable-cuckoo
     ./configure --enable-magic
-    ./configure --enable-dotnet
-    ./configure --enable-cuckoo --enable-magic --enable-dotnet
+    ./configure --enable-cuckoo --enable-magic
 
 Modules usually depend on external libraries, depending on the modules you
 choose to install you'll need the following libraries:

docs/modules/math.rst

@@ -97,7 +97,7 @@ file and create signatures based on those results.
     Returns true if the *test* value is between *lower* and *upper* values. The
     comparisons are inclusive.
 
-    *Example: math.in_range(math.deviation(0, filesize, math.MEAN_BYTES), 63.9, 64,1)*
+    *Example: math.in_range(math.deviation(0, filesize, math.MEAN_BYTES), 63.9, 64.1)*
 
 .. c:function:: max(int, int)
 
@@ -151,9 +151,9 @@ file and create signatures based on those results.
     the process address space. The returned value is a float between 0 and 1.
     *offset* and *size* are optional; if left empty, the complete file is searched.
 
-    
+
     *Example: math.percentage(0xFF, filesize-1024, filesize) >= 0.9*
-    
+
     *Example: math.percentage(0x4A) >= 0.4*
 
 .. c:function:: mode(offset, size)

libyara/modules/pe/pe.c

@@ -849,7 +849,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor(
 
     while (struct_fits_in_pe(pe, thunks64, IMAGE_THUNK_DATA64) &&
            yr_le64toh(thunks64->u1.Ordinal) != 0 &&
-           parsed_imports < MAX_PE_IMPORTS)
+           parsed_imports < MAX_PE_IMPORTS &&
+           *num_function_imports < MAX_PE_IMPORTS)
     {
       char* name = NULL;
       uint16_t ordinal = 0;
@@ -939,6 +940,7 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor(
 
     while (struct_fits_in_pe(pe, thunks32, IMAGE_THUNK_DATA32) &&
            yr_le32toh(thunks32->u1.Ordinal) != 0 &&
+           parsed_imports < MAX_PE_IMPORTS &&
            *num_function_imports < MAX_PE_IMPORTS)
     {
       char* name = NULL;