From c434efa82aaf2559db4d53f4cb5f3ab42af7e795 Mon Sep 17 00:00:00 2001
From: Max Altgelt <max.altgelt@nextron-systems.com>
Date: Mon, 13 Nov 2023 16:54:26 +0100
Subject: [PATCH] feat: fallback to pread() if file mmap failed

---
 libyara/proc/linux.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/libyara/proc/linux.c b/libyara/proc/linux.c
index 2eaeb3d9b3..f15c417074 100644
--- a/libyara/proc/linux.c
+++ b/libyara/proc/linux.c
@@ -218,8 +218,16 @@ YR_API const uint8_t* yr_process_fetch_memory_block_data(YR_MEMORY_BLOCK* block)
         fd,
         proc_info->map_offset);
     close(fd);
+    if (context->buffer == MAP_FAILED)
+    {
+      // Notify the code below that we couldn't read from the file
+      // fallback to pread() from the process
+      fd = -1;
+    }
+    context->buffer_size = block->size;
   }
-  else
+
+  if (fd == -1)
   {
     context->buffer = mmap(
         NULL,
@@ -228,23 +236,14 @@ YR_API const uint8_t* yr_process_fetch_memory_block_data(YR_MEMORY_BLOCK* block)
         MAP_PRIVATE | MAP_ANONYMOUS,
         -1,
         0);
-  }
-
-  if (context->buffer == MAP_FAILED)
-  {
-    context->buffer = NULL;
-    context->buffer_size = 0;
-    goto _exit;
-  }
-  else if (context->buffer != NULL)
-  {
+    if (context->buffer == MAP_FAILED)
+    {
+      context->buffer = NULL;
+      context->buffer_size = 0;
+      goto _exit;
+    }
     context->buffer_size = block->size;
   }
-  else // Should according to man page never happen
-  {
-    context->buffer_size = 0;
-    goto _exit;
-  }
 
   // If mapping can't be accessed through the filesystem, read everything from
   // target process VM.