Browse code

added additional malformed yara string detection

Kevin Lin authored on 2015/02/13 05:12:19
Showing 1 changed files
... ...
@@ -3105,6 +3105,7 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
3105 3105
 
3106 3106
     if (str_error > 0) {
3107 3107
         cli_warnmsg("load_oneyara: clamav does not support %d input strings for %s, skipping\n", str_error, rule->id);
3108
+        yara_malform++;
3108 3109
         ytable_delete(&ytable);
3109 3110
         (*sigs)--;
3110 3111
         return CL_SUCCESS; /* TODO - kill signature instead? */