VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

math.percentage returns undefined value when the passed value is outside the 0-255 range.

Browse Source
This commit is contained in:
Victor M. Alvarez
2023-12-28 17:34:23 +01:00
parent c6cc3311ce
commit a1015aa3a9
2 changed files with 40 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/modules/math/math.c
+8 -2
View File
@@ -658,10 +658,13 @@ define_function(count_global)
define_function(percentage_range)
{
uint8_t byte = (uint8_t) integer_argument(1);
int64_t byte = integer_argument(1);
int64_t offset = integer_argument(2);
int64_t length = integer_argument(3);
if (byte < 0 || byte > 255)
return_float(YR_UNDEFINED);
YR_SCAN_CONTEXT* context = yr_scan_context();
uint32_t* distribution = get_distribution(offset, length, context);
@@ -681,7 +684,10 @@ define_function(percentage_range)
define_function(percentage_global)
{
uint8_t byte = (uint8_t) integer_argument(1);
int64_t byte = integer_argument(1);
if (byte < 0 || byte > 255)
return_float(YR_UNDEFINED);
YR_SCAN_CONTEXT* context = yr_scan_context();
tests/test-math.c
+32
View File
@@ -127,6 +127,38 @@ int main(int argc, char** argv)
}",
"ABABCDEF");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.percentage(0x41, 0, 0) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.percentage(0x41, 10, 3) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.percentage(0x41, 0, -3) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.percentage(-1) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \