Browse code

bb11567 - Improve YARA rule handling in files containing unsupported YARA features.

Steven Morgan authored on 2017/08/25 06:19:29
Showing 1 changed files
... ...
@@ -3984,7 +3984,7 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,
3984 3984
     YR_COMPILER compiler;
3985 3985
     YR_NAMESPACE ns;
3986 3986
     YR_RULE *rule;
3987
-    unsigned int sigs = 0, rules = 0;
3987
+    unsigned int sigs = 0, rules = 0, rule_errors = 0;
3988 3988
     int rc;
3989 3989
 
3990 3990
     UNUSEDPARAM(dbio);
... ...
@@ -4021,6 +4021,7 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,
4021 4021
     rc = yr_lex_parse_rules_file(fs, &compiler);
4022 4022
     if (rc > 0) { /* rc = number of errors */
4023 4023
         /* TODO - handle the various errors? */
4024
+#ifdef YARA_FINISHED
4024 4025
         cli_errmsg("cli_loadyara: failed to parse rules file %s, error count %i\n", filename, rc);
4025 4026
         if (compiler.sz_arena != NULL)
4026 4027
             yr_arena_destroy(compiler.sz_arena);
... ...
@@ -4033,12 +4034,12 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,
4033 4033
         if (compiler.metas_arena != NULL)
4034 4034
             yr_arena_destroy(compiler.metas_arena);
4035 4035
         _yr_compiler_pop_file_name(&compiler);
4036
-#ifdef YARA_FINISHED
4037 4036
         return CL_EMALFDB;
4038 4037
 #else
4039 4038
         if (compiler.last_result == ERROR_INSUFICIENT_MEMORY)
4040 4039
             return CL_EMEM;
4041
-        return CL_SUCCESS;
4040
+        rule_errors = rc;
4041
+        rc = CL_SUCCESS;
4042 4042
 #endif
4043 4043
     }
4044 4044
 
... ...
@@ -4058,6 +4059,9 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,
4058 4058
         }
4059 4059
     }
4060 4060
 
4061
+    if (0 != rule_errors)
4062
+        cli_warnmsg("cli_loadyara: failed to parse or load %u yara rules from file %s, successfully loaded %u rules.\n", rule_errors+rules-sigs, filename, sigs);
4063
+
4061 4064
     yr_arena_append(engine->yara_global->the_arena, compiler.sz_arena);
4062 4065
     yr_arena_append(engine->yara_global->the_arena, compiler.rules_arena);
4063 4066
     yr_arena_append(engine->yara_global->the_arena, compiler.strings_arena);