Docker Deployment and Cgo Cfunc_string_matches about go-yara HOT 13 CLOSED

Can you reproduce the crash every time, given the same sample and ruleset?

from go-yara.

yes I can reproduce it every time and interesting so, its exactly this everytime [signal SIGSEGV: segmentation violation code=0x1 addr=0x2f pc=0xcd3e97]

from go-yara.

Great! Can you strip down the application you deploy using Docker into something I could use for trying to reproduce the issue? Also, I'd need access to the sample. (Putting it into an encrypted ZIP file and attaching it to the issue might work.)

from go-yara.

Yup ill create a recreatable dockerfile and post it here!

from go-yara.

Hello again! Created a repo to replicate the issue I'm seeing. If you have any questions lemme know https://github.com/PimmyTrousers/DockerYaraMock

from go-yara.

Thanks.

from go-yara.

FWIW, I've been having the same issue (contacted @hillu over email about it).
I am not running the Yara scanner in a docker container, and it also crashes in the same place with a rather large ruleset.

from go-yara.

@hillu I believe I have a fix for this. #57

from go-yara.

@PimmyTrousers I believe that your build setup might be to blame for the crash. I noticed that you install libyara-dev which pulls in the libyara3 shared library package. If libyara-dev is replaced by the packages that are needed to build the Debian yara package, the problem goes away.

There are two other things that my PR (PimmyTrousers/DockerYaraMock#1) does:

1. Run ldconfig after make install otherwise yarac cannot be run.
2. Run configure with the same parameters as is done in the Debian yara package; otherwise the ruleset cannot be compiled because it relies on modules that have to be enable explicitly.

Both steps indicate that libyara.so.3 from the distribution was used previously.

from go-yara.

@PimmyTrousers Ping? Can I close this issue?

from go-yara.

Yes we can close the issue. You were right. You're fix was correct :) Thanks for the fix!

from go-yara.

@hillu Is there any way to avoid this issue, without either compiling directly on the production server or using a statically linked binary?
Would compiling with the same version as the libyara3 installed on the production server work?

from go-yara.

@botherder Compiling with the same libyara3 version should work.

from go-yara.