VirusTotal/yara v4.6.0

YARA v4.6.0

on GitHub

• Add yr_get_version to report the version of the library loaded at runtime (#2247).
• Expose nine more e_machine values in elf module (#2248).
• Sync yara man page with current CLI options (#2256).
• BUGFIX: Validate string, rule, and namespace indices in yr_rules_from_arena (c19fa61).
• BUGFIX: Fix C-stack overflow on deeply nested regex and hex string ASTs (034623f).
• BUGFIX: Fix integer overflow in console.log() string escaping (6de23b4).
• BUGFIX: Fix integer overflows in ELF symbol lowercasing and SIMPLE_STR (4908877).
• BUGFIX: Fix 32-bit integer overflow when allocating the VM stack (3aa7cd1).
• BUGFIX: Fix 32-bit integer overflow in _yr_compiler_default_include_callback (b325745).
• BUGFIX: Fix integer overflow and unchecked allocation in Authenticode digest formatting (5fb6a20).
• BUGFIX: Fix VM stack corruption when a disabled rule is used inside a rule set (6e6f996).
• BUGFIX: Harden regex anchor and match bounds checks and allow nullable repeats in _yr_re_fiber_sync (9f881b2).
• BUGFIX: Fix 32-bit match length truncation and notebook allocation overflow on chained strings (0bf3faf).
• BUGFIX: Fix infinite loop and fiber exhaustion on repeated zero-width assertions in regexes (f8e1ca2).
• BUGFIX: Prevent exponential memory and CPU growth on nested {n} regex repeats (c1e0dff).
• BUGFIX: Fix infinite loop/abort when compiling + regex quantifier over zero-code nodes (1cf79dd).
• BUGFIX: Validate compiled-rule external variables (#2244).
• BUGFIX: Reset entrypoint in yr_scanner_clean_matches (#2245).
• BUGFIX: Fix misaligned uint32_t load of map_list.size in dex module (#2249).
• BUGFIX: Request MD5 with -fips on OpenSSL 3 and handle failure in hash, pe, and elf modules (#2252).
• BUGFIX: Enforce arena buffer bounds invariant in every build (#2253).
• BUGFIX: Harden Authenticode parsing against malformed data (a37be98).
• BUGFIX: Validate arena buffer count (0cdff36).
• BUGFIX: Reject hex jump and repeat lengths that overflow an int (#2237).
• BUGFIX: Bound Aho-Corasick state and match indices on load (#2241).
• BUGFIX: Guard repeat-end against empty stack in _yr_re_fiber_sync (#2240).
• BUGFIX: Bound jump target within code section in yr_execute_code (#2236).
• BUGFIX: Reject unknown object type in yr_object_create (#2235).
• BUGFIX: Check stored digest length before comparing Authenticode digests (#2234).

Contributors: @0xdeadbab3 @dev-rehaann @Henglie @jmestwa-coder @M0nd0R @MarkAtwood @MRX-72 @munzzyy @Rakesh717 @wxsBSD, Hongduo Zhao, Ada Logics, and Anthropic