From 2e64b4c12d3ecc9accedb066bd9b77f97e20be38 Mon Sep 17 00:00:00 2001
From: "Victor M. Alvarez" <vmalvarez@virustotal.com>
Date: Thu, 22 May 2025 18:51:07 +0200
Subject: [PATCH] fix: escape new line and carriage returns characters when
 printing file names.

Matches on files whose name contains such characters are not properly printed.
---
 cli/yara.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/cli/yara.c b/cli/yara.c
index cf913eb1..e5902cb9 100644
--- a/cli/yara.c
+++ b/cli/yara.c
@@ -810,7 +810,7 @@ static char cescapes[] = {
     0, 0, 0, 0, 0, 0, 0, 0,   0,   0,   0,   0,   0,   0,   0, 0,
 };
 
-static void print_escaped(const uint8_t* data, size_t length)
+static void print_escaped_data(const uint8_t* data, size_t length)
 {
   for (size_t i = 0; i < length; i++)
   {
@@ -835,6 +835,20 @@ static void print_escaped(const uint8_t* data, size_t length)
   }
 }
 
+void print_escaped_file_path(const char_t* str) {
+    for (size_t i = 0; str[i] != '\0'; ++i) {
+        if (str[i] == _T('\n')) {
+            _tprintf(_T("\\n"));
+        } else if (str[i] == _T('\r')) {
+            _tprintf(_T("\\r"));
+        }
+        else {
+            _tprintf(_T("%c"), str[i]);
+        }
+    }
+    _tprintf(_T("\n"));
+}
+
 static void print_hex_string(const uint8_t* data, int length)
 {
   for (int i = 0; i < min(64, length); i++)
@@ -1098,7 +1112,7 @@ static int handle_message(
         else
         {
           _tprintf(_T("%" PF_S "=\""), meta->identifier);
-          print_escaped((uint8_t*) (meta->string), strlen(meta->string));
+          print_escaped_data((uint8_t*) (meta->string), strlen(meta->string));
           _tprintf(_T("\""));
         }
       }
@@ -1106,7 +1120,7 @@ static int handle_message(
       _tprintf(_T("] "));
     }
 
-    _tprintf(_T("%s\n"), ((CALLBACK_ARGS*) data)->file_path);
+    print_escaped_file_path(((CALLBACK_ARGS*) data)->file_path);
 
     // Show matched strings.