ITADN

ERROR_TOO_MANY_RE_FIBERS when matching rules

#2190Closedmichelcrypt4d4mus 创建于 2026-01-17
bug
### Describe the Bug When running `yara` against some files with a rule that compiles fine I run into internal error 46 (`ERROR_TOO_MANY_RE_FIBERS`). This is happening across multiple platforms. The exact error given by the `yara` command line tool is: ``` error scanning analyzing-malicious-document-files.pdf: string "$reg1" in rule "invalid_trailer_structure" caused error: 46 ``` ### To Reproduce This is the rule that is causing the error: ```yara rule invalid_trailer_structure : PDF { meta: author = "Glenn Edwards (@hiddenillusion), @malvidin" version = "0.2" weight = 1 strings: $magic = "%PDF" // Required for a valid PDF $reg0 = /trailer[ \r\n]*<<.{0,1000}\/Size\b/s $reg1 = /\/Root\b.{0,1000}[ \r\n]*.{0,500}startxref[ \r\n]*.{0,500}[ \r\n]*%%EOF/s condition: $magic in (0..1024) and not ($reg0 or $reg1) } ``` when I run it against [this file](https://github.com/michelcrypt4d4mus/pdfalyzer/blob/master/doc/analyzing-malicious-document-files.pdf). assuming you've saved the rule as `broken_rule.yara` and downloaded the file then the command to reproduce is: ```bash yara broken_rule.yara analyzing-malicious-document-files.pdf ``` ### Expected Behavior I would say "should not crash" but I'm not enough of an expert to know if that's a reasonable request here. ### Please complete the following information: - OS: encountered on both `ubuntu-latest` in github workflows as well as macOS - YARA version: 4.5.2
关闭于 2026-01-23 1 条评论