microsoft / libyara.NET

.NET wrapper for libyara built in C++ CLI used to easily incorporate yara into .NET projects

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Change in underlying library is causing our tests to fail

anda613 opened this issue · comments

Hello,
We have upgraded to 4.2.0 and now a test that used to run is failing on our build server. This test still runs on the development machines, however, which probably indicates some concurrency issues.
The test is below and it fails on our build server with the error:
Error Message:
libyaraNET.CompilationException : Error compiling rules.
too many strings in rule "SetRules" (limit: 0) on line 10 in file: C:\jenkins\workspace\nuget-yara\libs\lib-magnet-yara\Magnet.Yara\Magnet.Yara.Test\bin\x64\Release\netcoreapp3.1..\..\..\..\TestRules\SetRules.yar
Stack Trace:
at libyaraNET.Compiler.AddRuleFile(String path) in D:\a_work\7\s\libyara.NET\Compiler.h:line 71
at Magnet.Yara.Tests.LibYaraLibraryTests.MultiCompilerTest() in C:\jenkins\workspace\nuget-yara\libs\lib-magnet-yara\Magnet.Yara\Magnet.Yara.Test\LibYaraLibraryTests.cs:line 47
--- End of stack trace from previous location where exception was thrown ---

[Fact]
        public async Task MultiCompilerTest()
        {
            // one single context
            using var _context = new YaraContext();
            var disposables = new List<Compiler>();

            var ruleFiles = Directory.GetFiles(_testRulesFolder)
                .Where(x => x.Contains("IncludeDependency.yar") || x.Contains("UnrelatedSettRules.yar") ||
                            x.Contains("SetRules.yar")).ToList();

            // multiple compilers, one per rule file
            foreach (var testFile in ruleFiles)
            {
                var compiler = new Compiler();
                compiler.AddRuleFile(testFile);
                disposables.Add(compiler);
            }

            var scanResults = new ConcurrentBag<ScanResult>();

            var testFiles = new List<string>
            {
                Path.Combine(_testDataFolder, "SetRulesTestData.txt"),
                Path.Combine(_testDataFolder, "SetRulesTestData5.txt"),
                Path.Combine(_testDataFolder, "SetRulesTestData.txt"),
                Path.Combine(_testDataFolder, "SetRulesTestData5.txt"),
                Path.Combine(_testDataFolder, "SetRulesTestData.txt"),
                Path.Combine(_testDataFolder, "SetRulesTestData5.txt"),
            };

            // get all the rules from all the compilers
            var rulesDict = disposables.ToDictionary(x => x, x => x.GetRules());

            // only use one single scanner
            var scanner = new Scanner();
            var workTasks = testFiles.Select(testFile => Task.Run(() =>
                {
                    _outputHelper.WriteLine($"Start processing on {testFile}");
                    using var stream = File.OpenRead(testFile);
                    foreach (var rules in rulesDict.Values)
                    {
                        // scan using all the rules from all compilers against the single file
                        scanner.ScanMemory(stream.ReadToEnd(), rules).ForEach(x => scanResults.Add(x));
                    }

                    Task.Delay(2000);
                    _outputHelper.WriteLine($"Finished scanning {testFile}");
                }))
                .ToList();

            await Task.WhenAll(workTasks);
            foreach (Compiler compiler in disposables)
            {
                compiler.Dispose();
            }

            Assert.Equal(12, scanResults.Count);
        }

We use xunit.

Hi @anda613, would you be able to share the three .yar files in your unit test that I can use to repro the issue? Thanks!