From 45aa1107b266f0131cf54609a2a3eba19578decb Mon Sep 17 00:00:00 2001 From: David Turland Date: Mon, 23 Dec 2024 20:37:42 +0000 Subject: [PATCH] hmm (#9) * Fix bug when parsing imports from 32bit PE. (#2119) There is a bug when parsing [1] which turns out to be incorrectly checking the number of successfully parsed imported functions and not the number of parsed attempts. This particular sample is badly malformed and is causing excessive loops in the parser while attempting to parse invalid data. With this fix it will finish in a few seconds on my laptop. [1]: 9c8e4dfa84b1ce7e919964978d33eada266d58b2aacdbef44b0618cc178ea421 * Upgrade `upload-artifact` action to v4 * fix: large memory consumption while parsing corrupted PE. (#2120) After #2119 `yara` is consuming a large amount of memory while parsing 9bddb45c44d9c25a4f97ef800cb110de5e6a15349bac05d389c8bda37902f25a. That's because after the change it doesn't limit the total number of imported functions, only the total number of parsing attempts, but the count is reset with each import entry. This file has a large number of entries and a large number of functions per entry, the total number of functions is very high. It turns out that we must limit both the total number of correctly parsed functions (for cases like this one), and the total number of parsing attempts (for cases like the one #2119 was aiming to solve). * Remove dotnet configure instructions since it's enabled by default now (#2122) * Upgrade to `actions/cache@v4`. GitHub is deprecating versions 2 and 3. * Fix typo in documentation. * Rename cache trying to solve issue with Bazel build * Disable cache in Bazel build workflow * Add Corelight to list of YARA users (#2124) --------- Co-authored-by: Wesley Shields Co-authored-by: Victor M. Alvarez Co-authored-by: zdwg42 Co-authored-by: signalblur <45216760+signalblur@users.noreply.github.com>