fix: issues in big-endian platforms

.github/workflows/tests.yaml

@@ -1,12 +1,24 @@
 name: Tests
 on:
   pull_request:
+    types: [ opened, reopened ]
   push:
 jobs:
   test:
     name: Test
     env:
       CARGO_TERM_COLOR: always
+      # For some builds, we use cross to test on 32-bit and big-endian
+      # systems.
+      CARGO: cargo
+      # When CARGO is set to CROSS, TARGET is set to `--target matrix.target`.
+      # Note that we only use cross on Linux, so setting a target on a
+      # different OS will just use normal cargo.
+      TARGET: ""
+      # Bump this as appropriate. We pin to a version to make sure CI
+      # continues to work as cross releases in the past have broken things
+      # in subtle ways.
+      CROSS_VERSION: v0.2.5
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -52,6 +64,11 @@ jobs:
           #   rust: stable-x86_64-gnu
           #   args: ""
 
+          - build: stable-s390x
+            os: ubuntu-latest
+            rust: stable
+            target: s390x-unknown-linux-gnu
+
           - build: constant-folding-off
             os: ubuntu-latest
             rust: stable
@@ -74,10 +91,20 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
 
-      - name: Run cargo test
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --all-targets ${{ matrix.args }}
+      - name: Install and configure Cross
+        if: matrix.os == 'ubuntu-latest' && matrix.target != ''
+        run: |
+          dir="$RUNNER_TEMP/cross-download"
+          mkdir "$dir"
+          echo "$dir" >> $GITHUB_PATH
+          cd "$dir"
+          curl -LO "https://github.com/cross-rs/cross/releases/download/$CROSS_VERSION/cross-x86_64-unknown-linux-musl.tar.gz"
+          tar xf cross-x86_64-unknown-linux-musl.tar.gz
+          echo "CARGO=cross" >> $GITHUB_ENV
+          echo "TARGET=--target ${{ matrix.target }}" >> $GITHUB_ENV
+
+      - name: Run tests
+        run: ${{ env.CARGO }} test --release --verbose --workspace --all-targets ${{ matrix.args }} $TARGET
         env:
           RUSTFLAGS: -Awarnings # Allow all warnings
+

Cargo.toml

@@ -46,7 +46,6 @@ lazy_static = "1.4.0"
 line-span = "0.1.3"
 linkme = "0.3"
 log = "0.4"
-memx = "0.1.28"
 num = "0.4.0"
 pest = "2.5.5"
 pest_derive = "2.5.5"

yara-x/Cargo.toml

@@ -56,7 +56,6 @@ itertools = { workspace = true }
 lazy_static = { workspace = true }
 linkme = { workspace = true }
 log = { workspace = true, optional = true }
-memx = { workspace = true }
 protobuf = { workspace = true }
 rustc-hash = { workspace = true }
 regex = { workspace = true }

yara-x/src/scanner/context.rs

@@ -745,7 +745,7 @@ fn verify_literal_match(
     let match_found = if flags.contains(SubPatternFlags::Nocase) {
         pattern.eq_ignore_ascii_case(&scanned_data[atom_pos..match_end])
     } else {
-        memx::memeq(&scanned_data[atom_pos..match_end], pattern.as_bytes())
+        &scanned_data[atom_pos..match_end] == pattern.as_bytes()
     };
 
     if match_found {
@@ -922,7 +922,7 @@ fn verify_xor_match(
         }
     }
 
-    if memx::memeq(&scanned_data[match_range.clone()], pattern.as_bytes()) {
+    if &scanned_data[match_range.clone()] == pattern.as_bytes() {
         Some(Match { range: match_range, xor_key: Some(key) })
     } else {
         None

yara-x/src/wasm/mod.rs

@@ -789,13 +789,15 @@ fn lookup_field(
 ) -> TypeValue {
     let mut store_ctx = caller.as_context_mut();
 
-    let lookup_indexes_ptr =
+    let mem_ptr =
         store_ctx.data_mut().main_memory.unwrap().data_ptr(&mut store_ctx);
 
+    let lookup_indexes_ptr =
+        unsafe { mem_ptr.offset(LOOKUP_INDEXES_START as isize) };
+
     let lookup_indexes = unsafe {
         std::slice::from_raw_parts::<i32>(
-            lookup_indexes_ptr.offset(LOOKUP_INDEXES_START as isize)
-                as *const i32,
+            lookup_indexes_ptr as *const i32,
             num_lookup_indexes as usize,
         )
     };
@@ -817,8 +819,17 @@ fn lookup_field(
         let mut final_field = None;
 
         for field_index in lookup_indexes {
+            // Integers in WASM memory are always stored as little-endian
+            // regardless of the endianness of the host platform. If we
+            // are in a big-endian platform the integers needs to be swapped
+            // for obtaining the original value.
+            let field_index = if cfg!(target_endian = "big") {
+                field_index.swap_bytes()
+            } else {
+                *field_index
+            };
             let field =
-                structure.field_by_index(*field_index as usize).unwrap();
+                structure.field_by_index(field_index as usize).unwrap();
             final_field = Some(field);
             if let TypeValue::Struct(s) = &field.type_value {
                 structure = s