- 30 Jun, 2021 1 commit
-
-
* Release GIL when compiling rules. The compilation is a blocking operation and can be potentially CPU intensive. There is no reason to hold GIL. * Lock the GIL in callback to prevent segmentation fault. To be uniform with other callbacks and to prevent the SIGSEGV we have to lock the GIL while we want to interact with python objects. The callback is called from a C code releases GIL. Other callback functions use the same locking strategy.
Oliver Nemček authored
-
- 21 Jun, 2021 1 commit
-
-
namespace identifier to the callback
Marek Milkovič authored
-
- 26 Apr, 2021 1 commit
-
-
Victor M. Alvarez authored
-
- 16 Apr, 2021 1 commit
-
-
Because the function was initializing pid as 0, when the user passed pid=0 as an argument it was indistinguishable from not pid being passed at all. Closes https://github.com/VirusTotal/yara/issues/1480
Victor M. Alvarez authored
-
- 18 Mar, 2021 2 commits
-
-
Victor M. Alvarez authored
-
Victor M. Alvarez authored
-
- 16 Mar, 2021 2 commits
-
-
Victor M. Alvarez authored
-
The previous commit was still wrong.
Victor M. Alvarez authored
-
- 15 Mar, 2021 1 commit
-
-
As pointed out by Arnim Rupp (@2d4d) in #172, the fix in #175 was not complete as there's was no performance gain when the callback was not provided, which is the most common case.
Victor M. Alvarez authored
-
- 12 Mar, 2021 4 commits
-
-
This function has grown too much, so it was split in multiple functions in order to make it easier to understand.
Victor M. Alvarez authored -
Now the rule identifier is printed as part of the warning message, the string identifier is not descriptive enough in many cases.
Victor M. Alvarez authored -
* When building on macos I noticed that libcrypto was not found when using has_function(). This is because the compiler used to compile the check program is not being told about the library and include paths. Fix it by passing those into the has_function() check where appropriate. * Improve callback performance for non-matching case.
Wesley Shields authored -
Victor M. Alvarez authored
-
- 23 Feb, 2021 2 commits
-
-
Add support for a "warnings_callback" argument to Rules.match(). If provided the function definition needs to be: def warnings_callback(warning_type, message) The callback will be called with a warning type of yara.WARNING_TOO_MANY_MATCHES and the message will be a string indicating which rule caused the warning. I think a warning type and a message is reasonably flexible in case we introduce other runtime warnings in the future. If a callback is not provided we print a warning on stderr using the normal python warning system. It's worth noting the function I'm using was introduced in python 3.2. I can switch it to something more portable if you don't want to pull support for 2.x yet. While I'm here, also chase the renaming of rules_list_head and other list variables so that it can compile with latest yara master.
Wesley Shields authored -
When compiling YARA without Python bindings, stdbool.h is actually used if it can be used. However Python bindings completely ignore it resulting in YARA defining its own bool type with sizeof(bool) == sizeof(int). However before [#1377](https://github.com/VirusTotal/yara/pull/1377), this can result in different compilation units using different sizes of bool type and chaos ensues.
Marek Milkovič authored
-
- 03 Feb, 2021 2 commits
-
-
Joachim Metz authored
-
Victor M. Alvarez authored
-
- 27 Jan, 2021 1 commit
-
-
Victor M. Alvarez authored
-
- 18 Jan, 2021 1 commit
-
-
Victor M. Alvarez authored
-
- 14 Jan, 2021 1 commit
-
-
Victor M. Alvarez authored
-
- 04 Jan, 2021 4 commits
-
-
Victor M. Alvarez authored
-
Victor M. Alvarez authored
-
Victor M. Alvarez authored
-
Victor M. Alvarez authored
-
- 24 Dec, 2020 2 commits
-
-
Victor M. Alvarez authored
-
Victor M. Alvarez authored
-
- 19 Oct, 2020 2 commits
-
-
Victor M. Alvarez authored
-
Dominika Regéciová authored
-
- 02 Sep, 2020 1 commit
-
-
* Allow a Py_buffer as data for Rules_match This makes rules matching compatible with data objects `PyArg_ParseTuple` does not consider read-only (even though they might actually be), such a memoryviews. The main change is replacing the `s#` formatter with `s*` and replacing the `(pointer, length)` pair with a `Py_buffer` object accordingly. Additional care must be taken to release the `Py_buffer` on every error path. * Rules_match: zero-initialize data PyArg_ParseTupleAndKeywords does not initialize optional fields unless they are passed, which means we need to zero-initialize the data buffer to be sure the later NULL checks always work. This commit also gets rid of the unneeded has_data flag. * Add test for matching on a memoryview
Jan Teske authored
-
- 26 Jun, 2020 1 commit
-
-
Victor M. Alvarez authored
-
- 12 Jun, 2020 1 commit
-
-
This is regression in introduced in #140. When a string in the metadata section contains invalid UTF-8 characters the behavior Python 2 is leave the string exactly as it appears in YARA, in Python 3 however the invalid characters are removed because Python 3 strings are not handled as bytes like in Python 2, they most have a valid encoding. PR #140 was an attempt to homogenize the behavior in both versions of Python, but it introduced this other issue.
Victor M. Alvarez authored
-
- 15 May, 2020 2 commits
-
-
Victor M. Alvarez authored
-
Victor M. Alvarez authored
-
- 29 Apr, 2020 1 commit
-
-
Victor M. Alvarez authored
-
- 23 Apr, 2020 5 commits
-
-
* Support a "is_global" and "is_private" member on Rules. When writing linters it is currently impossible to know (via rule introspection) if a given rule is private or global. We have banned global rules for our use case and we have to resort to a janky regex against our rules files to know if anyone is about to commit a global rule. I figure exposing these two flags via python will be useful for programatically checking those bits. I'm not very pleased with the name "is_global" - I wanted to go with just "global" and "private" but "global" is a reserved keyword and rule.global breaks the python interpreter. I'm open to changing the member names if you have any suggestions. * Decrement reference counts on global and private. * Update global and private checks after API changes.
Wesley Shields authored -
Victor M. Alvarez authored
-
* Upgrade YARA submodule and adapt to new API. * Upgrade YARA and adapt to API changes. * Fix build in Appveyor (#131) * The precompiled OpenSSL is now extracted from the NuGet package generated by https://ci.appveyor.com/project/plusvic/openssl. * OpenSSL was upgraded to version 1.1.1.
Victor M. Alvarez authored -
Victor M. Alvarez authored
-
* Handle invalid unicode in metadata values. In #135 it was brought up that you can crash the python interpreter if you have invalid unicode in a metadata value. This is my attempt to fix that by attempting to create a string, and if that fails falling back to a bytes object. On the weird chance that the bytes object fails to create I added a safety check so that we don't add a NULL ptr to the dictionary (this is how the crash was manifesting). It's debatable if we want to ONLY add strings as metadata, and NOT fallback to bytes. If we don't fall back to bytes the only other option I see is to silently drop that metadata on the floor. The tradeoff here is that now you may end up with a string or a bytes object in your metadata dictionary, which is less than ideal IMO. I'm open to suggestions on this one. Fixes #135 * Add error handling to conversion to Unicode Metadata test accepts stripped or original characters * Remove 'or' clause from tests and add another NULL test check. Co-authored-by: malvidin <malvidin@gmail.com>
Wesley Shields authored
-
- 21 Apr, 2020 1 commit
-
-
Karthikeyan Singaravelan authored
-