Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix bug in yr_rules_from_arena causing allocation of bitmask of wrong size #1934

Merged
merged 1 commit into from
Aug 3, 2023

Conversation

1ndahous3
Copy link
Contributor

@1ndahous3 1ndahous3 commented Jul 21, 2023

There is a bug introduced in 1c309a8: the size of bitmask to allocate is calculated with undefined new_rules->num_rules value instead of passed summary->num_rules, so the YR_BITMASK_SIZE() is evaluated as random value, sometimes less then needed.

In my case new_rules->num_rules == 0 so YR_BITMASK_SIZE(new_rules->num_rules) == 1 and I get 4 (1 * sizeof(YR_BITMASK) ) bytes allocated for bitmask. After that I get heap corruption because of writing of first bit of non-allocated 5th byte for 128 rule (i == 128) here:

yara/libyara/rules.c

Lines 378 to 384 in 1c309a8

for (int i = 0; i < new_rules->num_rules; i++)
{
if (new_rules->rules_table[i].required_strings == 0)
{
yr_bitmask_set(new_rules->rule_evaluate_condition_flags, i);
}
}

@1ndahous3
Copy link
Contributor Author

@plusvic merge?

@plusvic plusvic merged commit 3c928f8 into VirusTotal:master Aug 3, 2023
9 checks passed
@1ndahous3 1ndahous3 deleted the bitmask_size branch August 4, 2023 05:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants