{"action":"opened","issue":{"url":"https://api.github.com/repos/plusvic/yara/issues/297","labels_url":"https://api.github.com/repos/plusvic/yara/issues/297/labels{/name}","comments_url":"https://api.github.com/repos/plusvic/yara/issues/297/comments","events_url":"https://api.github.com/repos/plusvic/yara/issues/297/events","html_url":"https://github.com/plusvic/yara/issues/297","id":68797448,"number":297,"title":"Using \"pe\" module on certain files causes hang","user":{"login":"arbor-jjones","id":3845193,"avatar_url":"https://avatars.githubusercontent.com/u/3845193?v=3","gravatar_id":"","url":"https://api.github.com/users/arbor-jjones","html_url":"https://github.com/arbor-jjones","followers_url":"https://api.github.com/users/arbor-jjones/followers","following_url":"https://api.github.com/users/arbor-jjones/following{/other_user}","gists_url":"https://api.github.com/users/arbor-jjones/gists{/gist_id}","starred_url":"https://api.github.com/users/arbor-jjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arbor-jjones/subscriptions","organizations_url":"https://api.github.com/users/arbor-jjones/orgs","repos_url":"https://api.github.com/users/arbor-jjones/repos","events_url":"https://api.github.com/users/arbor-jjones/events{/privacy}","received_events_url":"https://api.github.com/users/arbor-jjones/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-15T22:08:28Z","updated_at":"2015-04-15T22:08:28Z","closed_at":null,"body":"When run on many files, I am experiencing hangs when running on files with rules using the \"pe\" module.\r\n\r\nExample files:\r\nSha256: 391a1b5c0e802abef56c3e3a3cc849c395a23d0652fbb47dc5c3a5543103330c\r\nSha256: 08e6cdc3d5bdc60d952b52530a1e3b46cd4666f4641023dfa9a4a1c95298af87\r\n\r\nGDB backtrace after issuing ctrl-c on  08e6cdc3d5bdc60d952b52530a1e3b46cd4666f4641023dfa9a4a1c95298af87:\r\n\r\n0x0000000000416e93 in strcmp_w (w_str=0x7ffff7fe6380 \"i\", str=0x43baee \"ileInfo\",\r\n    str@entry=0x43bae7 \"StringFileInfo\") at strutils.c:175\r\n175\t  while (*w_str != 0 && *str != 0 && *w_str == *str)\r\n(gdb) where\r\n#0  0x0000000000416e93 in strcmp_w (w_str=0x7ffff7fe6380 \"i\", str=0x43baee \"ileInfo\",\r\n    str@entry=0x43bae7 \"StringFileInfo\") at strutils.c:175\r\n#1  0x000000000041ce88 in pe_parse_version_info (rsrc_data=rsrc_data@entry=0x7ffff7fe62c0,\r\n    pe=pe@entry=0x708bb0) at modules/pe.c:639\r\n#2  0x000000000041d1d1 in pe_collect_resources (rsrc_data=0x7ffff7fe62c0, rsrc_type=16, rsrc_id=1,\r\n    rsrc_language=1033, type_string=<optimized out>, name_string=<optimized out>,\r\n    lang_string=<optimized out>, pe=0x708bb0) at modules/pe.c:769\r\n#3  0x000000000041ca88 in _pe_iterate_resources (pe=0x708bb0, resource_dir=0x43baee,\r\n    rsrc_data=0x7ffff7fe6200 \"\", rsrc_tree_level=2, type=0x0, id=0x2c000, language=0x7ffffffdd9a0,\r\n    type_string=0x0, name_string=0x0, lang_string=0x0, callback=0x41d000 <pe_collect_resources>,\r\n    callback_data=0x708bb0) at modules/pe.c:510\r\n#4  0x000000000041ca15 in _pe_iterate_resources (pe=0x708bb0, resource_dir=0x43baee,\r\n    rsrc_data=0x7ffff7fe6200 \"\", rsrc_tree_level=1, type=0x0, id=0x2c000, language=0x7ffffffdd9a0,\r\n    type_string=0x0, name_string=0x0, lang_string=0x0, callback=0x41d000 <pe_collect_resources>,\r\n    callback_data=0x708bb0) at modules/pe.c:485\r\n#5  0x000000000041ca15 in _pe_iterate_resources (pe=0x708bb0, resource_dir=0x43baee,\r\n    resource_dir@entry=0x7ffff7fe6200, rsrc_data=0x7ffff7fe6200 \"\", rsrc_tree_level=0, type=0x0,\r\n    id=0x2c000, language=language@entry=0x7ffffffdd9a0, type_string=type_string@entry=0x0,\r\n    name_string=name_string@entry=0x0, lang_string=lang_string@entry=0x0,\r\n    callback=callback@entry=0x41d000 <pe_collect_resources>,\r\n    callback_data=callback_data@entry=0x708bb0) at modules/pe.c:485\r\n#6  0x000000000041cd5d in pe_iterate_resources (pe=pe@entry=0x708bb0,\r\n    callback=callback@entry=0x41d000 <pe_collect_resources>,\r\n    callback_data=callback_data@entry=0x708bb0) at modules/pe.c:571\r\n#7  0x000000000041ded3 in pe_parse_header (pe=pe@entry=0x708bb0, base_address=0,\r\n    flags=<optimized out>) at modules/pe.c:1232\r\n#8  0x000000000041fb92 in pe__load (context=0x7fffffffe020, module_object=0x70b3b0,\r\n    module_data=<optimized out>, module_data_size=<optimized out>) at modules/pe.c:2080\r\n#9  0x00000000004098b8 in yr_modules_load (module_name=0x706199 \"pe\",\r\n    context=context@entry=0x7fffffffe020) at modules.c:164\r\n#10 0x000000000042b550 in yr_execute_code (rules=rules@entry=0x704280,\r\n    context=context@entry=0x7fffffffe020, timeout=timeout@entry=1000000,\r\n    start_time=start_time@entry=1429135627) at exec.c:755\r\n#11 0x0000000000414d50 in yr_rules_scan_mem_blocks (rules=rules@entry=0x704280,\r\n    block=<optimized out>, block@entry=0x7fffffffe0d0, flags=flags@entry=0,\r\n    callback=callback@entry=0x4045f0 <callback>, user_data=user_data@entry=0x7fffffffe670,\r\n    timeout=timeout@entry=1000000) at rules.c:425\r\n#12 0x0000000000414ed9 in yr_rules_scan_mem (timeout=1000000, user_data=0x7fffffffe670,\r\n    callback=0x4045f0 <callback>, flags=0, buffer_size=<optimized out>, buffer=<optimized out>,\r\n    rules=0x704280) at rules.c:515\r\n#13 yr_rules_scan_file (rules=0x704280, filename=<optimized out>, flags=0,\r\n    callback=callback@entry=0x4045f0 <callback>, user_data=0x7fffffffe670, timeout=1000000)\r\n    at rules.c:540\r\n#14 0x0000000000402ee5 in main (argc=<optimized out>, argv=0x7fffffffe358) at yara.c:1043"}}