Browse code

fix to yara integration with nocase patterns

Kevin Lin authored on 2015/02/11 00:08:15
Showing 2 changed files
... ...
@@ -555,6 +555,8 @@ void cli_ac_free(struct cli_matcher *root)
555 555
         }
556 556
     }
557 557
 
558
+    /* TODO - free the pattlists somewhere! */
559
+
558 560
     for(i = 0; i < root->ac_nodes; i++)
559 561
         mpool_free(root->mempool, root->ac_nodetable[i]);
560 562
 
... ...
@@ -2860,6 +2860,8 @@ static int cli_loadyara(FILE *fs, const char *dbname, struct cl_engine *engine,
2860 2860
                 char *trigger = PCRE_BYPASS;
2861 2861
                 allstringsize += strlen(trigger);
2862 2862
                 allstringsize += (strlen(string->string)+2); /* 2 from delimiters */
2863
+            } else if (STRING_IS_NO_CASE(string)) {
2864
+                allstringsize += (strlen(string->string)+2); /* 2 from delimiter+option */
2863 2865
             } else {
2864 2866
                 allstringsize += strlen(string->string);
2865 2867
             }