Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/writingrules.rst
Original file line number Diff line number Diff line change
Expand Up @@ -717,6 +717,16 @@ Starting with version 3.3.0 these zero-width assertions are also recognized:
* - ``\B``
- Match except at a word boundary

.. warning:: The regular expression engine scans a limited amount of data
while evaluating a match. This limit is 4096 bytes by default and is
controlled by the ``YR_RE_SCAN_LIMIT`` constant defined in
*libyara/include/yara/limits.h*. A match that would require scanning
beyond this limit is not reported and no error is raised, which usually
shows up with wildcards or large repetitions: a regular expression like
``/foo.*bar/`` won't match if *foo* and *bar* are separated by more than
4096 bytes. If you need a larger limit you can define
``YR_RE_SCAN_LIMIT`` at compile time.


Private strings
---------------
Expand Down