SIGSEGV: segmentation violation on .ScanMem

[treussart]

Hi

I have a service crash due to a memory access problem with cgo :

SIGSEGV: segmentation violation
PC=0x7f52780c6d90 m=6 sigcode=2 addr=0x7f52780c6d90
signal arrived during cgo execution

goroutine 243 gp=0xc000147a40 m=6 mp=0xc000143008 [syscall]:
runtime.cgocall(0xb91250, 0xc0000ff8e0)
	/usr/local/go/src/runtime/cgocall.go:157 +0x4b fp=0xc0000ff8b8 sp=0xc0000ff880 pc=0x40ab0b
github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_mem(0x7f5274d0b650, 0xc000880000, 0x1175b)
	_cgo_gotypes.go:1827 +0x4b fp=0xc0000ff8e0 sp=0xc0000ff8b8 pc=0xb3c8eb
github.com/hillu/go-yara/v4.(*Scanner).ScanMem.func2(0xc00086a540?, 0xc000880000, {0xc000880000?, 0x1175b, 0xc0000ff960?})
	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:159 +0x5a fp=0xc0000ff918 sp=0xc0000ff8e0 pc=0xb45c3a
github.com/hillu/go-yara/v4.(*Scanner).ScanMem(0xc00086a540, {0xc000880000, 0x1175b, 0x12000})
	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:159 +0x65 fp=0xc0000ff970 sp=0xc0000ff918 pc=0xb45b65
/antivirus/scanner/pkg/yara.(*Client).Scan(0xc0000a6280, {0x1179fb8, 0xc000d1e240}, {0xc000880000, 0x1175b, 0x12000})

if yara.Scanner is reused concurrently, a SIGSEGV will occur.

YARA_VERSION = 4.5.1
github.com/hillu/go-yara/v4 v4.3.2

[hillu]

@treussart This might have been caused by data structures being freed too early by the GC. I have just tagged v4.3.3.
Would you please try if the bug can still be reproduced using the new version? Thanks!

[treussart]

Hi, no the tag doesn't fix the issue.
To reproduce this code example may help:
main

	rules, err := compiler.GetRules()
	if err != nil {
		logger.Fatal().Err(err).Msg("compiler.GetRules")
	}
	scanner, err := yara.NewScanner(rules)
	if err != nil {
		logger.Fatal().Err(err).Msg("yara.NewScanner")
	}

	handler := &Handler{
		config:  config,
		logger:  logger,
		scanner: scanner,
	}

handler

body, err := io.ReadAll(io.LimitReader(c.Request.Body, h.config.MaxSize))
var result yara.MatchRules
err = h.scanner.SetCallback(&result).ScanMem(body)

If I move 'yara.NewScanner(rules)' in the handler, then it works.

[hillu]

@treussart Thank you. Can you provide a self-contained example that produces the segfault? Preferrably without involving http at all.

[treussart]

package main

import (
	"errors"
	"flag"
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/hillu/go-yara/v4"
	"github.com/rs/zerolog"
)

var ErrDirectoryNotFound = errors.New("directory not found")

func main() {
	logger := zerolog.New(os.Stdout).With().Timestamp().Logger()

	rulesPath := flag.String("rules", "/yara/rules", "path of rules")
	goodWarePath := flag.String("files", "/goodwares", "path of files to be analyzed")
	flag.Parse()

	compiler, err := searchForYaraFiles(logger, *rulesPath)
	if err != nil {
		logger.Fatal().Err(err).Msg("searchForYaraFiles")
	}
	rules, err := compiler.GetRules()
	if err != nil {
		logger.Fatal().Err(err).Msg("compiler.GetRules")
	}
	scanner, err := yara.NewScanner(rules)
	if err != nil {
		logger.Fatal().Err(err).Msg("yara.NewScanner")
	}

	scanFiles(logger, scanner, *goodWarePath)
}

// searchForYaraFiles search *.yar file by walking recursively from specified input path
func searchForYaraFiles(logger zerolog.Logger, path string) (*yara.Compiler, error) {
	compiler, err := yara.NewCompiler()
	if err != nil {
		return nil, fmt.Errorf("yara.NewCompiler: %w", err)
	}

	info, err := os.Stat(path)
	if os.IsNotExist(err) {
		return nil, fmt.Errorf("os.Stat: %w", err)
	}
	if !info.IsDir() {
		return nil, ErrDirectoryNotFound
	}
	counter := 0

	err = filepath.Walk(path, func(walk string, info os.FileInfo, err error) error {
		if err != nil {
			return fmt.Errorf("filepath.Walk func: %w", err)
		}
		if info.IsDir() || strings.HasPrefix(info.Name(), ".") || (!strings.HasSuffix(info.Name(), ".yara") && !strings.HasSuffix(info.Name(), ".yar")) {
			return nil
		}
		file, err := os.OpenFile(walk, os.O_RDONLY, info.Mode())
		if err != nil {
			return fmt.Errorf("os.OpenFile %s: %w", walk, err)
		}
		namespace := strings.TrimPrefix(walk, path)
		err = compiler.AddFile(file, namespace)
		if err != nil {
			return fmt.Errorf("compiler.AddFile %s namespace: %s: %w", file.Name(), namespace, err)
		}
		counter++
		return nil
	})
	if err != nil {
		return nil, fmt.Errorf("filepath.Walk: %w", err)
	}
	logger.Info().Msgf("compiler.AddFile %d rules", counter)
	return compiler, nil
}

func scanFiles(logger zerolog.Logger, scanner *yara.Scanner, path string) {
	err := filepath.Walk(path, func(walk string, info os.FileInfo, err error) error {
		if err != nil {
			return fmt.Errorf("filepath.Walk func: %w", err)
		}
		if info.IsDir() || strings.HasPrefix(info.Name(), ".") {
			return nil
		}
                 // without goroutine -> no SIGSEGV
		go analyse(logger, scanner, walk)

		return nil
	})
	if err != nil {
		logger.Fatal().Err(err).Msg("filepath.Walk error")
	}
}

func analyse(logger zerolog.Logger, scanner *yara.Scanner, walk string) {
	data, err := os.ReadFile(walk)
	if err != nil {
		logger.Fatal().Err(err).Msg("os.ReadFile error")
	}

	var result yara.MatchRules
	err = scanner.SetCallback(&result).ScanMem(data)
	if err != nil {
		logger.Error().Err(err).Msg("scanner.ScanMem error")
	}
	if len(result) > 0 {
		logger.Info().Str("Result rule", result[0].Rule).Msg("scanner match rule")
	}
}