VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: escape new line and carriage returns characters when printing file names.

Browse Source 
Matches on files whose name contains such characters are not properly printed.
This commit is contained in:
Victor M. Alvarez
2025-05-22 18:51:07 +02:00
parent a7f351aab0
commit 2e64b4c12d
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/yara.c
+17 -3
View File
@@ -810,7 +810,7 @@ static char cescapes[] = {
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
};
static void print_escaped(const uint8_t* data, size_t length)
static void print_escaped_data(const uint8_t* data, size_t length)
{
for (size_t i = 0; i < length; i++)
{
@@ -835,6 +835,20 @@ static void print_escaped(const uint8_t* data, size_t length)
}
}
void print_escaped_file_path(const char_t* str) {
for (size_t i = 0; str[i] != '\0'; ++i) {
if (str[i] == _T('\n')) {
_tprintf(_T("\\n"));
} else if (str[i] == _T('\r')) {
_tprintf(_T("\\r"));
}
else {
_tprintf(_T("%c"), str[i]);
}
}
_tprintf(_T("\n"));
}
static void print_hex_string(const uint8_t* data, int length)
{
for (int i = 0; i < min(64, length); i++)
@@ -1098,7 +1112,7 @@ static int handle_message(
else
{
_tprintf(_T("%" PF_S "=\""), meta->identifier);
print_escaped((uint8_t*) (meta->string), strlen(meta->string));
print_escaped_data((uint8_t*) (meta->string), strlen(meta->string));
_tprintf(_T("\""));
}
}
@@ -1106,7 +1120,7 @@ static int handle_message(
_tprintf(_T("] "));
}
_tprintf(_T("%s\n"), ((CALLBACK_ARGS*) data)->file_path);
print_escaped_file_path(((CALLBACK_ARGS*) data)->file_path);
// Show matched strings.