yara 0.32.0

Rust bindings for VirusTotal/yara
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

use std::marker;
use std::slice;

use crate::Match;

/// Iterate over YR_MATCH in a YR_MATCHES
///
/// # Implementation notes
///
/// See `yr_string_matches_foreach` in Yara.
pub struct MatchIterator<'a> {
    head: *const yara_sys::YR_MATCH,
    _marker: marker::PhantomData<&'a yara_sys::YR_MATCH>,
}

impl<'a> From<&'a yara_sys::YR_MATCHES> for MatchIterator<'a> {
    fn from(matches: &'a yara_sys::YR_MATCHES) -> MatchIterator<'a> {
        MatchIterator {
            head: matches.head,
            _marker: marker::PhantomData,
        }
    }
}

impl<'a> Iterator for MatchIterator<'a> {
    type Item = &'a yara_sys::YR_MATCH;

    fn next(&mut self) -> Option<Self::Item> {
        while !self.head.is_null() {
            let m = unsafe { &*self.head };
            self.head = m.next;
            // Do not list private matches, see `yr_string_matches_foreach` in libyara.
            if !m.is_private {
                return Some(m);
            }
        }
        None
    }
}

impl From<&yara_sys::YR_MATCH> for Match {
    fn from(m: &yara_sys::YR_MATCH) -> Self {
        Match {
            base: m.base as usize,
            offset: m.offset as usize,
            length: m.match_length as usize,
            // Data can be null, notably when the match is empty, which can happen
            // in some edge cases when using regexes.
            data: if m.data.is_null() {
                Vec::new()
            } else {
                Vec::from(unsafe { slice::from_raw_parts(m.data, m.data_length as usize) })
            },
            xor_key: m.xor_key,
        }
    }
}