* BUGFIX: Escape new new and carriage return characters when printing file paths (credits to: Rajesh Pangare). * BUGFIX: Avoid infinite loop while iterating Mach-O regions. * BUGFIX: High memory consumption while parsing corrupted PE files. * BUGFIX: Issue while parsing imports in 32-bits PE files. * BUGFIX: Integer overflow while parsing ELF files. Contributors: @gremat, @roblabla, @shanehuntley, @wxsBSD

* Increase the limit for the maximum number of rows in dotnet module (608fb3d). * Limit resource names to 1000 character at most (3f5b4c7). * Recover from syntax error at the end of an included file (4fc1ff82). * BUGFIX: Crash while parsing PE Rich headers with certain files (cbc982d). * BUGFIX: Segfault with regular expressions that matched the zero-length string (8616165). * BUGFIX: Mitigate stack overflow when scanning very deep directory trees (2a9f61d). * BUGFIX: Fix regression introduced in 6209630 (44fd094).

Allow spaces in regexp repetition operators (e.g: `{n, m}`). BUGFIX: `matches` operator was not matching empty strings (#c80cd9d). BUGFIX: Several bugs in array type handling in `dotnet` module (#2064). BUGFIX: Fix issue while parsing .NET files (5bf72f2). BUGFIX: Fix issues while parsing PE resources (c009195, 4793b49). BUGFIX: Infinite loop while parsing corrupt PE files (e453eb1). BUGFIX: OOM errors while parsing corrupt PE files (4b9b4c0, 1be9811). BUGFIX: Build issue in Alpine Linux due to `pread64` not found (#2050). BUGFIX: Issue while parsing rich header in some PE files (4793b49).

* Unreferenced strings are allowed if their identifier start with` _` (#1941) * New command-line option `--disable-console-logs` for disabling the output of the console module (#1915) * New command-line option `--strict-escape` that raises warnings on unknown escape sequences (#1880). * Improve performance by avoiding the execution of rule conditions that can't match (#1927) * Add callback message `CALLBACK_MSG_TOO_SLOW_SCANNING` for notifying about slow rules (#1921). * Expose function RVA in `pe.export_details`(#1882). * BUGFIX: Fix issues in the computation of `imphash` in `pe` module (#1944). Credits to the NSHC ThreatRecon team! BUGFIX: Fix multiple out-of-bound memory reads in `dex` module (#1949, #1951). * BUGFIX: Fix memory alignment issues (#1930). * BUGFIX: Some strings with the wide and ascii modifiers not matching as they should (#1933). * BUGFIX: Some rules not matching when `--fast-scan` is used (4de3d57) * BUGFIX: Properly list memory regions while scanning processes in Mac OS. (#2033) * BUGFIX: RFC5652 countersignatures are now correctly parsed in `pe` module (#2034) * BUGFIX: Fix potential DoS due to crashes in authenticode parser with malformed files (#2034). Credits to Bahaa Naamneh! * BUGFIX: Fix SIGSEGV in `magic` module when `libmagic` returns null pointer (3342aa0) * BUGFIX: Prevent infinite recursion while following symlinks (923368e) Thanks to: @mgoffin, @wxsBSD, @cblichmann, @secDre4mer, @vthib, @regeciovad, @kylereedmsft, @TommYDeeee, @humpalum, @metthal

* New `lnk` module (https://github.com/VirusTotal/yara/pull/1732). * Unreferenced strings are allowed if their identifier start with` _` (https://github.com/VirusTotal/yara/pull/1941) * New command-line option `--disable-console-logs` for disabling the output of the console module (https://github.com/VirusTotal/yara/pull/1915) * Improve performance by avoiding the execution of rule conditions that can't match (https://github.com/VirusTotal/yara/pull/1927) * Add callback message `CALLBACK_MSG_TOO_SLOW_SCANNING` for notifying about slow rules (https://github.com/VirusTotal/yara/pull/1921). * BUGFIX: Fix issues in the computation of `imphash` in `pe` module (https://github.com/VirusTotal/yara/pull/1944). Credits to the NSHC ThreatRecon team! BUGFIX: Fix multiple out-of-bound memory reads in `dex` module (https://github.com/VirusTotal/yara/pull/1949, https://github.com/VirusTotal/yara/pull/1951). * BUGFIX: Fix memory alignment issues (https://github.com/VirusTotal/yara/pull/1930). * BUGFIX: Some strings with the wide and ascii modifiers not matching as they should (https://github.com/VirusTotal/yara/issues/1933). * BUGFIX: Some rules not matching when `--fast-scan` is used (https://github.com/VirusTotal/yara/commit/4de3d574bae5973c711095c1c755166c07dec322) Thanks to: @mgoffin, @wxsBSD, @cblichmann, @secDre4mer, @vthib, @regeciovad, @kylereedmsft

BUGFIX: assertion triggered with certain hex patterns when scanning arbitrary files (https://github.com/VirusTotal/yara/commit/bcc631299c9eba3af1fbf6e8a466650185e94988). Reported by Huawei Central Software Institute Security Team.

BUGFIX: Functions `import_rva` and `import_delayed_rva` are now case-insensitive (#1904) BUGFIX: Fix heap-related issue in `dotnet` module on Windows (#1902) BUGFIX: Fix heap corruption with certain rules that have very long string sets (67cccf0)

* Added a not operator for bytes in hex strings. Example: `{01 ~02 03}` (#1676). * `for` statement can iterate over sets of literal strings (e.g. `for any s in ("a", "b"): (pe.imphash() == s)`) (#1787). * `of` statement can be used with `at` (e.g. `any of them at 0`) (#1790). * Added the `--print-xor-key` (`-X` in short form) command-line option that prints the XOR key for xored strings (#1745). * Implement the `--skip-larger` command-line option in Windows (#1678). * Add parsing of .NET user types from .NET metadata stream in "dotnet" module (#1605). * Improve certificate parsing and validation in "pe" module (#1623). * Add `telfhash()` function to "elf" module (#1624). * Add `to_int()` and `to_string()` functions to "math" module (#1767). * Improve error reporting on certain edge cases (#1709, #1722). * BUGFIX: Fix multiple memory alignment issues causing crashes in non-x86 platforms (#1724). * BUGFIX: Fix implementation of `math.serial_correlation`(#1771). * BUGFIX: Fix infinite recursion in `dotnet` module (#1794). * BUGFIX: Fix SIGFPE when dividing INT64_MIN by -1 (c2557fc). * BUGFIX: Fix several endianess issues (#1884, #1874, #1855). Thanks to @shanehuntley, @1ndahous3, @HoundThe, @wxsBSD, @vthib, @eeyss01.