[Forensics-changes] [yara] 05/160: Add yr_rules_load_stream API

Hilko Bengen bengen at moszumanska.debian.org
Sat Jul 1 10:29:11 UTC 2017


This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.4.0
in repository yara.

commit eb726b7d3d4ff185e19ad8540ca8bfaa01aae0af
Author: Hilko Bengen <bengen at debian.org>
Date:   Fri Feb 6 01:58:13 2015 +0100

    Add yr_rules_load_stream API
---
 libyara/include/yara/rules.h |  5 +++++
 libyara/libyara.sym          |  1 +
 libyara/rules.c              | 47 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 53 insertions(+)

diff --git a/libyara/include/yara/rules.h b/libyara/include/yara/rules.h
index da069e7..b8b814c 100644
--- a/libyara/include/yara/rules.h
+++ b/libyara/include/yara/rules.h
@@ -93,6 +93,11 @@ YR_API int yr_rules_load(
     YR_RULES** rules);
 
 
+YR_API int yr_rules_load_stream(
+    YR_STREAM* stream,
+    YR_RULES** rules);
+
+
 YR_API int yr_rules_destroy(
     YR_RULES* rules);
 
diff --git a/libyara/libyara.sym b/libyara/libyara.sym
index 0c45c77..fde7cb9 100644
--- a/libyara/libyara.sym
+++ b/libyara/libyara.sym
@@ -23,6 +23,7 @@ yr_rules_scan_file
 yr_rules_scan_proc
 yr_rules_save
 yr_rules_load
+yr_rules_load_stream
 yr_rules_destroy
 yr_rules_define_integer_variable
 yr_rules_define_boolean_variable
diff --git a/libyara/rules.c b/libyara/rules.c
index 3b692f9..0791bdd 100644
--- a/libyara/rules.c
+++ b/libyara/rules.c
@@ -650,6 +650,53 @@ YR_API int yr_rules_load(
 }
 
 
+YR_API int yr_rules_load_stream(
+  YR_STREAM* stream,
+  YR_RULES** rules)
+{
+  YR_RULES* new_rules;
+  YARA_RULES_FILE_HEADER* header;
+
+  int result;
+
+  new_rules = (YR_RULES*) yr_malloc(sizeof(YR_RULES));
+
+  if (new_rules == NULL)
+    return ERROR_INSUFICIENT_MEMORY;
+
+  result = yr_arena_load_stream(stream, &new_rules->arena);
+
+  if (result != ERROR_SUCCESS)
+  {
+    yr_free(new_rules);
+    return result;
+  }
+
+  header = (YARA_RULES_FILE_HEADER*) yr_arena_base_address(new_rules->arena);
+  new_rules->automaton = header->automaton;
+  new_rules->code_start = header->code_start;
+  new_rules->externals_list_head = header->externals_list_head;
+  new_rules->rules_list_head = header->rules_list_head;
+  new_rules->tidx_mask = 0;
+
+  #if _WIN32
+  new_rules->mutex = CreateMutex(NULL, FALSE, NULL);
+
+  if (new_rules->mutex == NULL)
+    return ERROR_INTERNAL_FATAL_ERROR;
+  #else
+  result = pthread_mutex_init(&new_rules->mutex, NULL);
+
+  if (result != 0)
+    return ERROR_INTERNAL_FATAL_ERROR;
+  #endif
+
+  *rules = new_rules;
+
+  return ERROR_SUCCESS;
+}
+
+
 YR_API int yr_rules_destroy(
     YR_RULES* rules)
 {

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git



More information about the forensics-changes mailing list