[Forensics-changes] [yara] 250/368: Add yr_filemap_unmap_fd() that leaves the filehandle open after scanning

Hilko Bengen bengen at moszumanska.debian.org
Sat Jul 1 10:30:44 UTC 2017


This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.5.0
in repository yara.

commit 094588c51cd53199e8e98d7703b5f662979ba164
Author: Hilko Bengen <bengen at hilluzination.de>
Date:   Thu Apr 7 22:22:09 2016 +0200

    Add yr_filemap_unmap_fd() that leaves the filehandle open after scanning
---
 libyara/filemap.c              | 36 ++++++++++++++++++++++++++----------
 libyara/include/yara/filemap.h |  4 ++++
 libyara/rules.c                |  2 +-
 3 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/libyara/filemap.c b/libyara/filemap.c
index e88f7db..aafdc22 100644
--- a/libyara/filemap.c
+++ b/libyara/filemap.c
@@ -311,7 +311,7 @@ YR_API int yr_filemap_map_ex(
 
 #ifdef WIN32
 
-YR_API void yr_filemap_unmap(
+YR_API void yr_filemap_unmap_fd(
     YR_MAPPED_FILE* pmapped_file)
 {
   if (pmapped_file->data != NULL)
@@ -320,29 +320,45 @@ YR_API void yr_filemap_unmap(
   if (pmapped_file->mapping != NULL)
     CloseHandle(pmapped_file->mapping);
 
-  if (pmapped_file->file != INVALID_HANDLE_VALUE)
-    CloseHandle(pmapped_file->file);
-
-  pmapped_file->file = INVALID_HANDLE_VALUE;
   pmapped_file->mapping = NULL;
   pmapped_file->data = NULL;
   pmapped_file->size = 0;
 }
 
+YR_API void yr_filemap_unmap(
+    YR_MAPPED_FILE* pmapped_file)
+{
+  yr_filemap_unmap_fd(pmapped_file);
+
+  if (pmapped_file->file != INVALID_HANDLE_VALUE)
+  {
+    CloseHandle(pmapped_file->file);
+    pmapped_file->file = INVALID_HANDLE_VALUE;
+  }
+}
+
 #else // POSIX
 
-YR_API void yr_filemap_unmap(
+YR_API void yr_filemap_unmap_fd(
     YR_MAPPED_FILE* pmapped_file)
 {
   if (pmapped_file->data != NULL)
     munmap(pmapped_file->data, pmapped_file->size);
 
-  if (pmapped_file->file != -1)
-    close(pmapped_file->file);
-
-  pmapped_file->file = -1;
   pmapped_file->data = NULL;
   pmapped_file->size = 0;
 }
 
+YR_API void yr_filemap_unmap(
+    YR_MAPPED_FILE* pmapped_file)
+{
+  yr_filemap_unmap_fd(pmapped_file);
+
+  if (pmapped_file->file != -1)
+    {
+      close(pmapped_file->file);
+      pmapped_file->file = -1;
+    }
+}
+
 #endif
diff --git a/libyara/include/yara/filemap.h b/libyara/include/yara/filemap.h
index 7d9b160..8d53c68 100644
--- a/libyara/include/yara/filemap.h
+++ b/libyara/include/yara/filemap.h
@@ -70,4 +70,8 @@ YR_API int yr_filemap_map_ex(
 YR_API void yr_filemap_unmap(
     YR_MAPPED_FILE* pmapped_file);
 
+
+YR_API void yr_filemap_unmap_fd(
+    YR_MAPPED_FILE* pmapped_file);
+
 #endif
diff --git a/libyara/rules.c b/libyara/rules.c
index 189fdf9..fdf391e 100644
--- a/libyara/rules.c
+++ b/libyara/rules.c
@@ -592,7 +592,7 @@ YR_API int yr_rules_scan_fd(
         user_data,
         timeout);
 
-    yr_filemap_unmap(&mfile);
+    yr_filemap_unmap_fd(&mfile);
   }
 
   return result;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git



More information about the forensics-changes mailing list