v3.10.0 - "nocase" setting does not produce a match, possibly due to incorrect case folding of unicode characters

[ardtex]

Adding "nocase" to a condition does not produce a match when unicode characters(in non-bmp range) are involved. This seems to be a regression from yara-python v3.6.3.

Command to run test -

1. Install yara-python v3.6.3
2. Extract attached zip file, cd into the folder
3. Run - python yara_unicode_test.py sample_data.txt sample_rule.txt
4. Check output (both rules produce a match)
5. Install yara-python v3.10.0
6. Run - python yara_unicode_test.py sample_data.txt sample_rule.txt
7. Check output (rule with nocase condition does not produce a match)

Test.zip

[wxsBSD]

I bisected this down to VirusTotal/yara@554b5df (issue VirusTotal/yara#765) but I'm not in a position to debug this further right now.

[plusvic]

Closing this bug and opening VirusTotal/yara#1117

[plusvic]

Fixed in VirusTotal/yara@6f3e22d