You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
If yara -r runs into a symlink to .. it's trapped in a endless loop. A common example of this is the Debian package of llvm which creates in /lib/llvm-11/build/ the following symlink:
$ mkdir -p /tmp/d1/d2
$ cd /tmp/d1/d2
$ ln -s .. d3
$ ln -s .. d4
$ echo"rule test { condition: filesize > 1MB }"> test.yar
$ $ yara -rn test.yar .test ./test.yar
test ./d4/d2/test.yar
test ./d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
test ./d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/d4/d2/test.yar
...
Expected behavior
Don't follow symlinks to ..
Please complete the following information:
OS: Linux
YARA version: 4.3.2
Additional context
This fixes to problem but there are probably more elegant solutions (I'm not a C coder ;)
The text was updated successfully, but these errors were encountered:
Describe the bug
If yara -r runs into a symlink to .. it's trapped in a endless loop. A common example of this is the Debian package of llvm which creates in /lib/llvm-11/build/ the following symlink:
To Reproduce
Expected behavior
Don't follow symlinks to ..
Please complete the following information:
Additional context
This fixes to problem but there are probably more elegant solutions (I'm not a C coder ;)
The text was updated successfully, but these errors were encountered: