{"action":"closed","issue":{"url":"https://api.github.com/repos/plusvic/yara/issues/321","labels_url":"https://api.github.com/repos/plusvic/yara/issues/321/labels{/name}","comments_url":"https://api.github.com/repos/plusvic/yara/issues/321/comments","events_url":"https://api.github.com/repos/plusvic/yara/issues/321/events","html_url":"https://github.com/plusvic/yara/issues/321","id":91184312,"number":321,"title":"memory-mapped file access can lead to crash due to uncaught exception/signal","user":{"login":"hillu","id":173211,"avatar_url":"https://avatars.githubusercontent.com/u/173211?v=3","gravatar_id":"","url":"https://api.github.com/users/hillu","html_url":"https://github.com/hillu","followers_url":"https://api.github.com/users/hillu/followers","following_url":"https://api.github.com/users/hillu/following{/other_user}","gists_url":"https://api.github.com/users/hillu/gists{/gist_id}","starred_url":"https://api.github.com/users/hillu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hillu/subscriptions","organizations_url":"https://api.github.com/users/hillu/orgs","repos_url":"https://api.github.com/users/hillu/repos","events_url":"https://api.github.com/users/hillu/events{/privacy}","received_events_url":"https://api.github.com/users/hillu/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-26T07:59:31Z","updated_at":"2015-06-30T19:35:41Z","closed_at":"2015-06-30T19:35:41Z","body":"Yara crashes on Windows and Linux systems while scanning files that cannot be read due to filesystem corruption: The memory mapping operation (CreateFileMapping()+MapViewOfFile() or mmap()) was successful, but an exception (Windows: EXCEPTION_IN_PAGE_ERROR, Unix: SIGBUS) is thrown as soon as data that cannot be read from disk is accessed. This is documented behavior -- see [Reading and Writing From a File View](https://msdn.microsoft.com/en-us/library/windows/desktop/aa366801%28v=vs.85%29.aspx) and the mmap(2) manpage. In my opinion, libyara should catch those errors because how files are accessed is an implementation detail that the user does not need to be concerned with.\r\n\r\nOn Unix systems, it is possible to trigger SIGBUS by truncating the file while yara is scanning. I have also been able to trigger EXCEPTION_ACCESS_VIOLATION (instead of EXCEPTION_IN_PAGE_ERROR) in a yara process running under Wine by doing the same. I have not yet found an easy way to trigger this problem on a \"real\" Windows system."}}