fix: fix YR_STRING conversion that was picking only the first string

src/internals/string.rs

@@ -51,9 +51,8 @@ impl<'a> From<(&'a YR_SCAN_CONTEXT, &'a YR_STRING)> for YrString<'a> {
         let identifier = unsafe { CStr::from_ptr(string.get_identifier()) }
             .to_str()
             .unwrap();
-        let matches = unsafe { context.matches.as_ref() }
-            .map(|matches| MatchIterator::from(matches).map(Match::from).collect())
-            .unwrap_or_else(Vec::new);
+        let matches = unsafe { &*context.matches.offset(string.idx as isize) };
+        let matches = MatchIterator::from(matches).map(Match::from).collect();
 
         YrString {
             identifier,

tests/tests.rs

@@ -107,17 +107,24 @@ fn test_compile_fd_rules() {
 #[test]
 fn test_scan_mem() {
     let rules = get_default_rules();
-    let result = rules.scan_mem("I love Rust!".as_bytes(), 10);
+    let result = rules.scan_mem("I love Rust! And go is ok".as_bytes(), 10);
 
     let result = result.expect("Should be Ok");
-    let rule = &result[0];
-    assert_eq!(1, result.len());
-    assert_eq!("is_awesome", rule.identifier);
-    assert_eq!(1, rule.strings.len());
-    assert_eq!("$rust", rule.strings[0].identifier);
-    assert_eq!(1, rule.strings[0].matches.len());
-    assert_eq!(7, rule.strings[0].matches[0].offset);
-    assert_eq!(b"Rust", rule.strings[0].matches[0].data.as_slice());
+    assert_eq!(3, result.len());
+    {
+        let rule = &result[0];
+        assert_eq!("is_awesome", rule.identifier);
+        assert_eq!(1, rule.strings.len());
+        assert_eq!("$rust", rule.strings[0].identifier);
+        assert_eq!(1, rule.strings[0].matches.len());
+        assert_eq!(7, rule.strings[0].matches[0].offset);
+        assert_eq!(b"Rust", rule.strings[0].matches[0].data.as_slice());
+    }
+    {
+        let rule = &result[1];
+        assert_eq!("is_ok", rule.identifier);
+        assert_eq!(b"go", rule.strings[0].matches[0].data.as_slice());
+    }
 }
 
 #[test]