[Forensics-changes] [yara] 332/415: Fix bug in chained strings matching

[Hilko Bengen]

This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to branch debian
in repository yara.

commit 19bcae90035a10f50709aece564123567d880d62
Author: Victor Manuel Alvarez <vmalvarez at virustotal.com>
Date:   Sun Dec 22 12:53:22 2013 +0100

    Fix bug in chained strings matching
---
 libyara/rules.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libyara/rules.c b/libyara/rules.c
index f0ec53d..82fefbe 100644
--- a/libyara/rules.c
+++ b/libyara/rules.c
@@ -459,8 +459,14 @@ int _yr_scan_handle_chained_matches(
 
       while (match != NULL)
       {
-        _yr_scan_update_match_chain_length(
-            tidx, matching_string->chained_to, match, 1);
+        ending_offset = match->offset + match->length;
+
+        if (ending_offset + matching_string->chain_gap_max >= match_offset &&
+            ending_offset + matching_string->chain_gap_min <= match_offset)
+        {
+          _yr_scan_update_match_chain_length(
+              tidx, matching_string->chained_to, match, 1);
+        }
 
         match = match->next;
       }

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git