From c80cd9debf327c29bb824e9a107667d29714eaa7 Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Wed, 20 Mar 2024 15:47:37 +0100 Subject: [PATCH] Fix issue with `matches` operator not matching empty strings The `matches` operator was returning false if the left operand was an empty strings. So, `"" matches ` was returning false regardless of the regexp used. However, some regexp *do* match the empty strings, like for example `/foo|/`. --- libyara/exec.c | 7 ------- tests/test-rules.c | 4 ++++ 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/libyara/exec.c b/libyara/exec.c index a2dd38d4..f324eb8e 100644 --- a/libyara/exec.c +++ b/libyara/exec.c @@ -1967,13 +1967,6 @@ int yr_execute_code(YR_SCAN_CONTEXT* context) ensure_defined(r2); ensure_defined(r1); - if (r1.ss->length == 0) - { - r1.i = false; - push(r1); - break; - } - result = yr_re_exec( context, (uint8_t*) r2.re->code, diff --git a/tests/test-rules.c b/tests/test-rules.c index ad44896b..ac00384f 100644 --- a/tests/test-rules.c +++ b/tests/test-rules.c @@ -2953,6 +2953,10 @@ static void test_matches_operator() assert_false_rule( "rule test { condition: \"foo\\nbar\" matches /foo.*bar/ }", NULL); + assert_true_rule("rule test { condition: \"\" matches /foo|/ }", NULL); + + assert_true_rule("rule test { condition: \"\" matches /a||b/ }", NULL); + YR_DEBUG_FPRINTF(1, stderr, "} // %s()\n", __FUNCTION__); }