[Forensics-changes] [yara] 117/160: Fix bug introduced in previous commit

[Hilko Bengen]

This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.4.0
in repository yara.

commit 0643f46c6cbd179c9218240f0da3463d9dc9c212
Author: Victor M. Alvarez <plusvic at gmail.com>
Date:   Fri May 8 21:55:41 2015 +0200

    Fix bug introduced in previous commit
---
 libyara/scan.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/libyara/scan.c b/libyara/scan.c
index c1f2bd0..f78e83a 100644
--- a/libyara/scan.c
+++ b/libyara/scan.c
@@ -526,18 +526,6 @@ int _yr_scan_verify_chained_string_match(
           match->prev = NULL;
           match->next = NULL;
 
-          if (string->matches[tidx].count == 0)
-          {
-            // If this is the first match for the string, put the string in the
-            // list of strings whose flags needs to be cleared after the scan.
-
-            FAIL_ON_ERROR(yr_arena_write_data(
-                context->matching_strings_arena,
-                &string,
-                sizeof(string),
-                NULL));
-          }
-
           FAIL_ON_ERROR(_yr_scan_add_match_to_list(
               match, &string->matches[tidx]));
         }
@@ -547,6 +535,19 @@ int _yr_scan_verify_chained_string_match(
     }
     else
     {
+      if (matching_string->matches[tidx].count == 0 &&
+          matching_string->unconfirmed_matches[tidx].count == 0)
+      {
+        // If this is the first match for the string, put the string in the
+        // list of strings whose flags needs to be cleared after the scan.
+
+        FAIL_ON_ERROR(yr_arena_write_data(
+            context->matching_strings_arena,
+            &matching_string,
+            sizeof(matching_string),
+            NULL));
+      }
+
       FAIL_ON_ERROR(yr_arena_allocate_memory(
           context->matches_arena,
           sizeof(YR_MATCH),

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git