Pkgsrc changes:
* adapt PLIST
* remove patch which no longer applies
* apply patches for proper value domain for isxxxx() functions/macros
Upstream changes:
* time module (Wesley Shields)
* yara command-line tool now accept multiple rule files
* Allow a configurable limit for the number of strings per rule
(option --max-strings-per-rule)
* Implement integrity check for compiled rules
* Implement API for customizingimport statement (@edhoedt)
* Scan process memory in FreeBSD and OpenBDS (Hilko Bengen)
* BUGFIX: Negated character classes not working with case-insensitive
regexps (#765)
* BUGFIX: Multiple bugs while parsing ELF files (Nate Rosenblum)
* BUGFIX: Out-of-bounds access while parsing PE files.
* BUGFIX: Memory leaks while parsing invalid rules.
From the release notes for version 3.6.3:
* BUGFIX: Heap overflow (4a342f0)
* BUGFIX: Off-by-one NULL write in stack buffer (964d6c0)
* BUGFIX: Multiple issues in "dotnet" module (f40c14c, fc35e5f)
From the release notes for version 3.6.2:
* Increase RE_MAX_AST_LEVELS from 2000 to 6000.
* BUGFIX: Buffer overrun in regexp engine (issue #678)
* BUGFIX: Null pointer dereference in regexp engine (issue #682).
XXX pullup (security fixes)
In the release notes:
* BUGFIX: Stack overflow caused by uncontrolled recursiveness (CVE-2017-9304)
* BUGFIX: pe.overlay.size was undefined if the PE didn't have an overlay. Now it's set to 0 in those cases.
* BUGFIX: Fix initalization issue that could cause a crash if rules compiled with a 32bit yarac is used with a 64bit yara.
In the release notes:
* .NET module (Wesley Shields)
* New features for ELF module (Jacob Baines)
* Fix endianness issues (Hilko Bengen)
* Function yr_compiler_add_fd added to libyara
* MAX_THREADS limit can be arbitrarily increased (Emerson R. Wiley)
* Added --fail-on-warnings command-line option
* Multiple bug fixes
The release notes mention:
* Match length operator (http://yara.readthedocs.io/en/v3.5.0/writingrules.html#match-length)
* Performance improvements
* Less memory consumption while scanning processes
* Exception handling when scanning memory blocks
* Negative integers in meta fields
* Added the --stack-size command-argument
* Functions import_ordinal, is_dll, is_32bit and is_64bit added to PE module
* Functions rich_signature.toolid and rich_signature.version added to PE module
* Lots of bug fixes
The Python bindings are now released from a different tree, with the same
versioning apparently though.
"welcome to update" pettai@
The changes include:
* Short-circuit evaluation for conditions
* New yr_rules_save_stream/yr_rules_load_stream APIs.
* load() and save() methods in yara-python accept file-like objects
* Improvements to the PE and ELF modules
* Some performance improvements
* New command-line option --print-module-data
* Multiple bug fixes.
Problems found locating distfiles:
Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz
Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz
Package libidea: missing distfile libidea-0.8.2b.tar.gz
Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2
Package uvscan: missing distfile vlp4510e.tar.Z
Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden). All existing
SHA1 digests retained for now as an audit trail.
researchers to identify and classify malware samples. With YARA
you can create descriptions of malware families (or whatever you
want to describe) based on textual or binary patterns.
