Browse code

bb11684 - consistently set file size for yara condition handling.

Steven Morgan authored on 2016/11/09 01:38:57
Showing 1 changed files
... ...
@@ -776,12 +776,12 @@ static int yara_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data
776 776
     int rc;
777 777
     YR_SCAN_CONTEXT context = {0};
778 778
  
779
+    context.fmap = *ctx->fmap;
780
+    context.file_size = (*ctx->fmap)->len;
779 781
     if (target_info != NULL) {
780
-        context.file_size = target_info->fsize;
781 782
         if (target_info->status == 1)   
782 783
             context.entry_point = target_info->exeinfo.ep;
783 784
     }
784
-    context.fmap = *ctx->fmap;
785 785
 
786 786
     rc = yr_execute_code(ac_lsig, acdata, &context, 0, 0);
787 787