Fix issue with matches operator not matching empty strings

The `matches` operator was returning false if the left operand was an empty strings. So, `"" matches <some regexp>` was returning false regardless of the regexp used. However, some regexp *do* match the empty strings, like for example `/foo|/`.
This commit is contained in:
Victor M. Alvarez
2024-03-20 15:47:37 +01:00
parent 87485021cf
commit c80cd9debf
2 changed files with 4 additions and 7 deletions
-7
View File
@@ -1967,13 +1967,6 @@ int yr_execute_code(YR_SCAN_CONTEXT* context)
ensure_defined(r2);
ensure_defined(r1);
if (r1.ss->length == 0)
{
r1.i = false;
push(r1);
break;
}
result = yr_re_exec(
context,
(uint8_t*) r2.re->code,
+4
View File
@@ -2953,6 +2953,10 @@ static void test_matches_operator()
assert_false_rule(
"rule test { condition: \"foo\\nbar\" matches /foo.*bar/ }", NULL);
assert_true_rule("rule test { condition: \"\" matches /foo|/ }", NULL);
assert_true_rule("rule test { condition: \"\" matches /a||b/ }", NULL);
YR_DEBUG_FPRINTF(1, stderr, "} // %s()\n", __FUNCTION__);
}