Implement test cases for issue #1631

test.yar

@@ -0,0 +1,12 @@
+    import "pe"
+    rule test
+    {
+        condition:
+            for any rdata in (0..pe.number_of_sections-1): (
+                for any idx in (0..pe.data_directories[12].size):(
+                    for any i in (0..50): (
+                        i == pe.sections[rdata].virtual_address+idx*8
+                    )
+                )
+            )
+    }

tests/test-rules.c

@@ -76,6 +76,14 @@ static void test_boolean_operators()
 
   assert_false_rule("rule test { condition: false or false }", NULL);
 
+  assert_true_rule("rule test { condition: not var_false }", NULL);
+
+  assert_true_rule("rule test { condition: var_true }", NULL);
+
+  assert_false_rule("rule test { condition: var_false }", NULL);
+
+  assert_false_rule("rule test { condition: not var_true }", NULL);
+
   assert_false_rule(
       "import \"tests\" rule test { condition: not tests.undefined.i }", NULL);
 
@@ -269,6 +277,10 @@ static void test_arithmetic_operators()
 
   assert_true_rule("rule test { condition: 0o755 == 493 }", NULL);
 
+  // Test cases for issue #1631.
+  assert_true_rule("rule test { condition: var_one*3 == 3}", NULL);
+  assert_true_rule("rule test { condition: var_zero*3 == 0}", NULL);
+
   // TODO: This should return ERROR_INTEGER_OVERFLOW, but right now it returns
   // ERROR_SYNTAX_ERROR because after the lexer aborts with
   // ERROR_INTEGER_OVERFLOW the parser finds an unexpected end fails with error:

tests/util.c

@@ -403,6 +403,12 @@ int compile_rule(char* string, YR_RULES** rules)
 
   yr_compiler_set_callback(compiler, _compiler_callback, &warnings);
 
+  // Define some variables that will be used in test cases.
+  yr_compiler_define_integer_variable(compiler, "var_zero", 0);
+  yr_compiler_define_integer_variable(compiler, "var_one", 1);
+  yr_compiler_define_boolean_variable(compiler, "var_true", 1);
+  yr_compiler_define_boolean_variable(compiler, "var_false", 0);
+
   if (yr_compiler_add_string(compiler, string, NULL) != 0)
   {
     result = compiler->last_error;
@@ -515,7 +521,11 @@ int matches_blob(
 
   if (scan_result != ERROR_SUCCESS)
   {
-    fprintf(stderr, "failed to scan using rule << %s >>: error: %d\n", rule, scan_result);
+    fprintf(
+        stderr,
+        "failed to scan using rule << %s >>: error: %d\n",
+        rule,
+        scan_result);
     exit(EXIT_FAILURE);
   }
 
@@ -592,12 +602,16 @@ int capture_string(char* rule, char* string, char* expected_string)
   f.found = 0;
   f.expected = expected_string;
 
-  int scan_result = yr_rules_scan_mem(rules, (uint8_t*)string, strlen(string), 0,
-      capture_matches, &f, 0);
+  int scan_result = yr_rules_scan_mem(
+      rules, (uint8_t*) string, strlen(string), 0, capture_matches, &f, 0);
 
   if (scan_result != ERROR_SUCCESS)
   {
-    fprintf(stderr, "failed to scan using rule << %s >>: error %d\n", rule, scan_result);
+    fprintf(
+        stderr,
+        "failed to scan using rule << %s >>: error %d\n",
+        rule,
+        scan_result);
     exit(EXIT_FAILURE);
   }