Skip to content

fix infinite loop in yaramods tokenizer - #295

Open
mikicaivosevic wants to merge 1 commit into
avast:masterfrom
mikicaivosevic:master
Open

mikicaivosevic wants to merge 1 commit into
avast:masterfrom
mikicaivosevic:master

Conversation

@mikicaivosevic

Copy link
Copy Markdown

printf '/*\xff' > poc.yar - parsing poc.yar never returns. 100% CPU, flat memory (~9.5 MB constant), no exception, no allocation growth. Only SIGKILL ends it.

$ pip install yaramod # 4.8.1
$ cat poc.py

import yaramod
open('poc.yar', 'wb').write(b'/*\xff')
yaramod.Yaramod().parse_file('poc.yar')   <-- never returns

$ python poc.py
hangs indefinitely; 100% of one core;

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants