{"action":"created","issue":{"url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2015","repository_url":"https://api.github.com/repos/x64dbg/x64dbg","labels_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2015/labels{/name}","comments_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2015/comments","events_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2015/events","html_url":"https://github.com/x64dbg/x64dbg/issues/2015","id":355978661,"node_id":"MDU6SXNzdWUzNTU5Nzg2NjE=","number":2015,"title":"Debugger crashed on command 'yara'","user":{"login":"cozil","id":22441291,"node_id":"MDQ6VXNlcjIyNDQxMjkx","avatar_url":"https://avatars3.githubusercontent.com/u/22441291?v=4","gravatar_id":"","url":"https://api.github.com/users/cozil","html_url":"https://github.com/cozil","followers_url":"https://api.github.com/users/cozil/followers","following_url":"https://api.github.com/users/cozil/following{/other_user}","gists_url":"https://api.github.com/users/cozil/gists{/gist_id}","starred_url":"https://api.github.com/users/cozil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cozil/subscriptions","organizations_url":"https://api.github.com/users/cozil/orgs","repos_url":"https://api.github.com/users/cozil/repos","events_url":"https://api.github.com/users/cozil/events{/privacy}","received_events_url":"https://api.github.com/users/cozil/received_events","type":"User","site_admin":false},"labels":[{"id":327885452,"node_id":"MDU6TGFiZWwzMjc4ODU0NTI=","url":"https://api.github.com/repos/x64dbg/x64dbg/labels/bug","name":"bug","color":"fbca04","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-08-31T13:22:41Z","updated_at":"2018-10-31T02:56:15Z","closed_at":null,"author_association":"NONE","body":"Debugger crashed while running command 'yara' with only one argument.\r\n\r\nI looked into the source code, and found an issue:\r\n\r\n```\r\n    if(IsArgumentsLessThan(argc, 2))\r\n        return false;\r\n    duint addr = 0;\r\n    SELECTIONDATA sel;\r\n    GuiSelectionGet(GUI_DISASSEMBLY, &sel);\r\n    addr = sel.start;\r\n\r\n    duint base = 0;\r\n    duint size = 0;\r\n    duint mod = ModBaseFromName(argv[2]);\r\n```\r\n\r\nargv[2] is not available while running command 'yara' with only one argument.\r\nShould check if argc > 2 before use it.\r\n"},"comment":{"url":"https://api.github.com/repos/x64dbg/x64dbg/issues/comments/434543568","html_url":"https://github.com/x64dbg/x64dbg/issues/2015#issuecomment-434543568","issue_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2015","id":434543568,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNDU0MzU2OA==","user":{"login":"balintf","id":21298783,"node_id":"MDQ6VXNlcjIxMjk4Nzgz","avatar_url":"https://avatars3.githubusercontent.com/u/21298783?v=4","gravatar_id":"","url":"https://api.github.com/users/balintf","html_url":"https://github.com/balintf","followers_url":"https://api.github.com/users/balintf/followers","following_url":"https://api.github.com/users/balintf/following{/other_user}","gists_url":"https://api.github.com/users/balintf/gists{/gist_id}","starred_url":"https://api.github.com/users/balintf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/balintf/subscriptions","organizations_url":"https://api.github.com/users/balintf/orgs","repos_url":"https://api.github.com/users/balintf/repos","events_url":"https://api.github.com/users/balintf/events{/privacy}","received_events_url":"https://api.github.com/users/balintf/received_events","type":"User","site_admin":false},"created_at":"2018-10-31T02:56:15Z","updated_at":"2018-10-31T02:56:15Z","author_association":"CONTRIBUTOR","body":"> To make it clear: `if(IsArgumentsLessThan(argc, 2))` already checks the number of arguments. The real cause is Yara.\r\n\r\nThis only checks that the `yara` command was given at least one argument, but the cause of the crash is that x64dbg uses the second argument at argv[2], which is only valid if argc > 2. By adding checks before argv[2] usages and some default values for the argc == 2 case, I was able to get the yara command working with only one argument.\r\n\r\n> To solve this issue: remove yara from x64dbg.\r\nDo you mean remove it from the 64 bit version, or remove it entirely from x64dbg? Could you elaborate on why do you think yara should be removed? (I don't use it personally, but some might find it useful)\r\n"}}
{"actor":{"display_login":"balintf"}}