Skip to content

Commit 8ee3ee7

Browse files
committed
fix(yara): Address ADS scanning leftovers
After moving from NTFS parser to overlapped I/O, the code for scanning the ADS content were not adapted accordingly.
1 parent 19ea556 commit 8ee3ee7

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

pkg/yara/scanner.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -262,8 +262,7 @@ func (s scanner) Scan(e *event.Event) (bool, error) {
262262
if err != nil {
263263
return false, nil
264264
}
265-
if n > 0 {
266-
data = data[:n]
265+
if len(data) > 0 {
267266
log.Debugf("scanning ADS %s. pid: %d", filename, e.PID)
268267
matches, err = s.scan(data)
269268
streamScans.Add(1)

0 commit comments

Comments
 (0)