From 27e257bf1512fae52dac83a55e18fcbc0dfd4881 Mon Sep 17 00:00:00 2001
From: Kevin Lin <klin@sourcefire.com>
Date: Wed, 8 Jul 2015 12:16:03 -0400
Subject: [PATCH] bb#11356 - fixed an issue regarding yara_exec OP_OF

---
 libclamav/yara_exec.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/libclamav/yara_exec.c b/libclamav/yara_exec.c
index 1871fc938..dbd7ae836 100644
--- a/libclamav/yara_exec.c
+++ b/libclamav/yara_exec.c
@@ -754,14 +754,12 @@ int yr_execute_code(
           pop(r1);
         }
 #else
-        lsig_id = aclsig->id;
-        for (i = 0; i < aclsig->tdb.subsigs; i++) {
-            if (acdata->lsigsuboff_first[lsig_id][i] != CLI_OFF_NONE) {
-                found++;
-            }
-        }
         while (r1 != UNDEFINED)
         {
+          string = UINT64_TO_PTR(YR_STRING*, r1);
+          lsig_id = string->subsig_id;
+          if (acdata->lsigsuboff_first[aclsig->id][lsig_id] != CLI_OFF_NONE)
+            found++;
           count++;
           pop(r1);
         }