Browse code

bb#11356 - fixed an issue regarding yara_exec OP_OF

Kevin Lin authored on 2015/07/09 01:16:03
Showing 1 changed files
... ...
@@ -754,14 +754,12 @@ int yr_execute_code(
754 754
           pop(r1);
755 755
         }
756 756
 #else
757
-        lsig_id = aclsig->id;
758
-        for (i = 0; i < aclsig->tdb.subsigs; i++) {
759
-            if (acdata->lsigsuboff_first[lsig_id][i] != CLI_OFF_NONE) {
760
-                found++;
761
-            }
762
-        }
763 757
         while (r1 != UNDEFINED)
764 758
         {
759
+          string = UINT64_TO_PTR(YR_STRING*, r1);
760
+          lsig_id = string->subsig_id;
761
+          if (acdata->lsigsuboff_first[aclsig->id][lsig_id] != CLI_OFF_NONE)
762
+            found++;
765 763
           count++;
766 764
           pop(r1);
767 765
         }