VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

math.count returns undefined value when the passed value is outside the 0-255 range.

Browse Source
This commit is contained in:
Victor M. Alvarez
2023-12-28 16:44:48 +01:00
parent 923368eab3
commit c6cc3311ce
2 changed files with 95 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test-math.c
+33 -1
View File
@@ -71,6 +71,38 @@ int main(int argc, char** argv)
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
math.count(0x41, 4, 10) == 1 \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.count(0x41, 10, 3) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.count(0x41, 0, -3) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
condition: \
not defined math.count(-1) \
}",
"AABAAB");
assert_true_rule_blob(
"import \"math\" \
rule test { \
@@ -85,7 +117,7 @@ int main(int argc, char** argv)
condition: \
math.percentage(0x41) > 0.39 and math.percentage(0x41) < 0.41 \
}",
"ABAB"); // Blob matching includes terminating zero byte
"ABAB"); // Blob matching includes terminating zero byte
assert_true_rule_blob(
"import \"math\" \