VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Closes #928.

Browse Source
This commit is contained in:
Victor M. Alvarez
2018-08-08 15:18:42 +02:00
parent 2c511d98b4
commit d545b69ca3
6 changed files with 972 additions and 950 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/compiler.c
+27 -22
View File
@@ -545,6 +545,8 @@ YR_API int yr_compiler_add_file(
const char* namespace_,
const char* file_name)
{
int result;
// Don't allow yr_compiler_add_file() after
// yr_compiler_get_rules() has been called.
@@ -555,21 +557,23 @@ YR_API int yr_compiler_add_file(
assert(compiler->errors == 0);
if (file_name != NULL)
_yr_compiler_push_file_name(compiler, file_name);
if (namespace_ != NULL)
compiler->last_error = _yr_compiler_set_namespace(compiler, namespace_);
else
compiler->last_error = _yr_compiler_set_namespace(compiler, "default");
if (compiler->last_error != ERROR_SUCCESS)
{
compiler->errors++;
return compiler->errors;
}
if (compiler->last_error == ERROR_SUCCESS && file_name != NULL)
compiler->last_error = _yr_compiler_push_file_name(compiler, file_name);
return yr_lex_parse_rules_file(rules_file, compiler);
if (compiler->last_error != ERROR_SUCCESS)
return ++compiler->errors;
result = yr_lex_parse_rules_file(rules_file, compiler);
if (file_name != NULL)
_yr_compiler_pop_file_name(compiler);
return result;
}
@@ -579,6 +583,8 @@ YR_API int yr_compiler_add_fd(
const char* namespace_,
const char* file_name)
{
int result;
// Don't allow yr_compiler_add_fd() after
// yr_compiler_get_rules() has been called.
@@ -589,21 +595,23 @@ YR_API int yr_compiler_add_fd(
assert(compiler->errors == 0);
if (file_name != NULL)
_yr_compiler_push_file_name(compiler, file_name);
if (namespace_ != NULL)
compiler->last_error = _yr_compiler_set_namespace(compiler, namespace_);
else
compiler->last_error = _yr_compiler_set_namespace(compiler, "default");
if (compiler->last_error != ERROR_SUCCESS)
{
compiler->errors++;
return compiler->errors;
}
if (compiler->last_error == ERROR_SUCCESS && file_name != NULL)
compiler->last_error = _yr_compiler_push_file_name(compiler, file_name);
return yr_lex_parse_rules_fd(rules_fd, compiler);
if (compiler->last_error != ERROR_SUCCESS)
return ++compiler->errors;
result = yr_lex_parse_rules_fd(rules_fd, compiler);
if (file_name != NULL)
_yr_compiler_pop_file_name(compiler);
return result;
}
@@ -628,10 +636,7 @@ YR_API int yr_compiler_add_string(
compiler->last_error = _yr_compiler_set_namespace(compiler, "default");
if (compiler->last_error != ERROR_SUCCESS)
{
compiler->errors++;
return compiler->errors;
}
return ++compiler->errors;
return yr_lex_parse_rules_string(rules_string, compiler);
}
libyara/grammar.c
+790 -780
View File
File diff suppressed because it is too large Load Diff
libyara/grammar.h
+106 -104
View File
@@ -45,118 +45,120 @@ extern int yara_yydebug;
# define YYTOKENTYPE
enum yytokentype
{
_EOF_ = 0,
_DOT_DOT_ = 258,
_RULE_ = 259,
_PRIVATE_ = 260,
_GLOBAL_ = 261,
_META_ = 262,
_STRINGS_ = 263,
_CONDITION_ = 264,
_IDENTIFIER_ = 265,
_STRING_IDENTIFIER_ = 266,
_STRING_COUNT_ = 267,
_STRING_OFFSET_ = 268,
_STRING_LENGTH_ = 269,
_STRING_IDENTIFIER_WITH_WILDCARD_ = 270,
_NUMBER_ = 271,
_DOUBLE_ = 272,
_INTEGER_FUNCTION_ = 273,
_TEXT_STRING_ = 274,
_HEX_STRING_ = 275,
_REGEXP_ = 276,
_ASCII_ = 277,
_WIDE_ = 278,
_XOR_ = 279,
_NOCASE_ = 280,
_FULLWORD_ = 281,
_AT_ = 282,
_FILESIZE_ = 283,
_ENTRYPOINT_ = 284,
_ALL_ = 285,
_ANY_ = 286,
_IN_ = 287,
_OF_ = 288,
_FOR_ = 289,
_THEM_ = 290,
_MATCHES_ = 291,
_CONTAINS_ = 292,
_IMPORT_ = 293,
_TRUE_ = 294,
_FALSE_ = 295,
_OR_ = 296,
_AND_ = 297,
_NOT_ = 298,
_EQ_ = 299,
_NEQ_ = 300,
_LT_ = 301,
_LE_ = 302,
_GT_ = 303,
_GE_ = 304,
_SHIFT_LEFT_ = 305,
_SHIFT_RIGHT_ = 306,
UNARY_MINUS = 307
_END_OF_FILE_ = 0,
_END_OF_INCLUDED_FILE_ = 258,
_DOT_DOT_ = 259,
_RULE_ = 260,
_PRIVATE_ = 261,
_GLOBAL_ = 262,
_META_ = 263,
_STRINGS_ = 264,
_CONDITION_ = 265,
_IDENTIFIER_ = 266,
_STRING_IDENTIFIER_ = 267,
_STRING_COUNT_ = 268,
_STRING_OFFSET_ = 269,
_STRING_LENGTH_ = 270,
_STRING_IDENTIFIER_WITH_WILDCARD_ = 271,
_NUMBER_ = 272,
_DOUBLE_ = 273,
_INTEGER_FUNCTION_ = 274,
_TEXT_STRING_ = 275,
_HEX_STRING_ = 276,
_REGEXP_ = 277,
_ASCII_ = 278,
_WIDE_ = 279,
_XOR_ = 280,
_NOCASE_ = 281,
_FULLWORD_ = 282,
_AT_ = 283,
_FILESIZE_ = 284,
_ENTRYPOINT_ = 285,
_ALL_ = 286,
_ANY_ = 287,
_IN_ = 288,
_OF_ = 289,
_FOR_ = 290,
_THEM_ = 291,
_MATCHES_ = 292,
_CONTAINS_ = 293,
_IMPORT_ = 294,
_TRUE_ = 295,
_FALSE_ = 296,
_OR_ = 297,
_AND_ = 298,
_NOT_ = 299,
_EQ_ = 300,
_NEQ_ = 301,
_LT_ = 302,
_LE_ = 303,
_GT_ = 304,
_GE_ = 305,
_SHIFT_LEFT_ = 306,
_SHIFT_RIGHT_ = 307,
UNARY_MINUS = 308
};
#endif
/* Tokens. */
#define _EOF_ 0
#define _DOT_DOT_ 258
#define _RULE_ 259
#define _PRIVATE_ 260
#define _GLOBAL_ 261
#define _META_ 262
#define _STRINGS_ 263
#define _CONDITION_ 264
#define _IDENTIFIER_ 265
#define _STRING_IDENTIFIER_ 266
#define _STRING_COUNT_ 267
#define _STRING_OFFSET_ 268
#define _STRING_LENGTH_ 269
#define _STRING_IDENTIFIER_WITH_WILDCARD_ 270
#define _NUMBER_ 271
#define _DOUBLE_ 272
#define _INTEGER_FUNCTION_ 273
#define _TEXT_STRING_ 274
#define _HEX_STRING_ 275
#define _REGEXP_ 276
#define _ASCII_ 277
#define _WIDE_ 278
#define _XOR_ 279
#define _NOCASE_ 280
#define _FULLWORD_ 281
#define _AT_ 282
#define _FILESIZE_ 283
#define _ENTRYPOINT_ 284
#define _ALL_ 285
#define _ANY_ 286
#define _IN_ 287
#define _OF_ 288
#define _FOR_ 289
#define _THEM_ 290
#define _MATCHES_ 291
#define _CONTAINS_ 292
#define _IMPORT_ 293
#define _TRUE_ 294
#define _FALSE_ 295
#define _OR_ 296
#define _AND_ 297
#define _NOT_ 298
#define _EQ_ 299
#define _NEQ_ 300
#define _LT_ 301
#define _LE_ 302
#define _GT_ 303
#define _GE_ 304
#define _SHIFT_LEFT_ 305
#define _SHIFT_RIGHT_ 306
#define UNARY_MINUS 307
#define _END_OF_FILE_ 0
#define _END_OF_INCLUDED_FILE_ 258
#define _DOT_DOT_ 259
#define _RULE_ 260
#define _PRIVATE_ 261
#define _GLOBAL_ 262
#define _META_ 263
#define _STRINGS_ 264
#define _CONDITION_ 265
#define _IDENTIFIER_ 266
#define _STRING_IDENTIFIER_ 267
#define _STRING_COUNT_ 268
#define _STRING_OFFSET_ 269
#define _STRING_LENGTH_ 270
#define _STRING_IDENTIFIER_WITH_WILDCARD_ 271
#define _NUMBER_ 272
#define _DOUBLE_ 273
#define _INTEGER_FUNCTION_ 274
#define _TEXT_STRING_ 275
#define _HEX_STRING_ 276
#define _REGEXP_ 277
#define _ASCII_ 278
#define _WIDE_ 279
#define _XOR_ 280
#define _NOCASE_ 281
#define _FULLWORD_ 282
#define _AT_ 283
#define _FILESIZE_ 284
#define _ENTRYPOINT_ 285
#define _ALL_ 286
#define _ANY_ 287
#define _IN_ 288
#define _OF_ 289
#define _FOR_ 290
#define _THEM_ 291
#define _MATCHES_ 292
#define _CONTAINS_ 293
#define _IMPORT_ 294
#define _TRUE_ 295
#define _FALSE_ 296
#define _OR_ 297
#define _AND_ 298
#define _NOT_ 299
#define _EQ_ 300
#define _NEQ_ 301
#define _LT_ 302
#define _LE_ 303
#define _GT_ 304
#define _GE_ 305
#define _SHIFT_LEFT_ 306
#define _SHIFT_RIGHT_ 307
#define UNARY_MINUS 308
/* Value type. */
#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
union YYSTYPE
{
#line 230 "grammar.y" /* yacc.c:1916 */
#line 237 "grammar.y" /* yacc.c:1916 */
EXPRESSION expression;
SIZED_STRING* sized_string;
@@ -167,7 +169,7 @@ union YYSTYPE
YR_META* meta;
YR_RULE* rule;
#line 171 "grammar.h" /* yacc.c:1916 */
#line 173 "grammar.h" /* yacc.c:1916 */
};
typedef union YYSTYPE YYSTYPE;
libyara/grammar.y
+12 -1
View File
@@ -119,7 +119,14 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
%lex-param {yyscan_t yyscanner}
%lex-param {YR_COMPILER* compiler}
%token _EOF_ 0 "end of file"
// Token that marks the end of the original file.
%token _END_OF_FILE_ 0 "end of file"
// Token that marks the end of included files, we can't use _END_OF_FILE_
// because bison stops parsing when it sees _END_OF_FILE_, we want to be
// be able to identify the point where an included file ends, but continuing
// parsing any content that follows.
%token _END_OF_INCLUDED_FILE_ "end of included file"
%token _DOT_DOT_ ".."
%token _RULE_ "<rule>"
@@ -248,6 +255,10 @@ rules
| rules error rule /* on error skip until next rule..*/
| rules error import /* .. or import statement */
| rules error "include" /* .. or include statement */
| rules _END_OF_INCLUDED_FILE_
{
_yr_compiler_pop_file_name(compiler);
}
;
libyara/lexer.c
+35 -38
View File
@@ -1507,20 +1507,17 @@ case YY_STATE_EOF(comment):
#line 349 "lexer.l"
{
YR_COMPILER* compiler = yara_yyget_extra(yyscanner);
_yr_compiler_pop_file_name(compiler);
yara_yypop_buffer_state(yyscanner);
if (!YY_CURRENT_BUFFER)
{
yyterminate();
}
return _END_OF_INCLUDED_FILE_;
}
YY_BREAK
case 45:
YY_RULE_SETUP
#line 363 "lexer.l"
#line 360 "lexer.l"
{
yylval->c_string = yr_strdup(yytext);
@@ -1533,7 +1530,7 @@ YY_RULE_SETUP
YY_BREAK
case 46:
YY_RULE_SETUP
#line 374 "lexer.l"
#line 371 "lexer.l"
{
yylval->c_string = yr_strdup(yytext);
@@ -1546,7 +1543,7 @@ YY_RULE_SETUP
YY_BREAK
case 47:
YY_RULE_SETUP
#line 385 "lexer.l"
#line 382 "lexer.l"
{
yylval->c_string = yr_strdup(yytext);
@@ -1565,7 +1562,7 @@ YY_RULE_SETUP
YY_BREAK
case 48:
YY_RULE_SETUP
#line 402 "lexer.l"
#line 399 "lexer.l"
{
yylval->c_string = yr_strdup(yytext);
@@ -1584,7 +1581,7 @@ YY_RULE_SETUP
YY_BREAK
case 49:
YY_RULE_SETUP
#line 419 "lexer.l"
#line 416 "lexer.l"
{
yylval->c_string = yr_strdup(yytext);
@@ -1603,7 +1600,7 @@ YY_RULE_SETUP
YY_BREAK
case 50:
YY_RULE_SETUP
#line 436 "lexer.l"
#line 433 "lexer.l"
{
char* text = yytext;
@@ -1644,7 +1641,7 @@ YY_RULE_SETUP
YY_BREAK
case 51:
YY_RULE_SETUP
#line 475 "lexer.l"
#line 472 "lexer.l"
{
if (strlen(yytext) > 128)
@@ -1660,7 +1657,7 @@ YY_RULE_SETUP
YY_BREAK
case 52:
YY_RULE_SETUP
#line 489 "lexer.l"
#line 486 "lexer.l"
{
char *endptr;
@@ -1703,7 +1700,7 @@ YY_RULE_SETUP
YY_BREAK
case 53:
YY_RULE_SETUP
#line 529 "lexer.l"
#line 526 "lexer.l"
{
yylval->double_ = atof(yytext);
return _DOUBLE_;
@@ -1711,7 +1708,7 @@ YY_RULE_SETUP
YY_BREAK
case 54:
YY_RULE_SETUP
#line 534 "lexer.l"
#line 531 "lexer.l"
{
char *endptr;
@@ -1730,7 +1727,7 @@ YY_RULE_SETUP
YY_BREAK
case 55:
YY_RULE_SETUP
#line 550 "lexer.l"
#line 547 "lexer.l"
{
char *endptr;
@@ -1749,7 +1746,7 @@ YY_RULE_SETUP
YY_BREAK
case 56:
YY_RULE_SETUP
#line 567 "lexer.l"
#line 564 "lexer.l"
{ /* saw closing quote - all done */
alloc_sized_string(s, yyextra->lex_buf_len);
@@ -1765,7 +1762,7 @@ YY_RULE_SETUP
YY_BREAK
case 57:
YY_RULE_SETUP
#line 581 "lexer.l"
#line 578 "lexer.l"
{
lex_check_space_ok("\t", yyextra->lex_buf_len, YR_LEX_BUF_SIZE);
@@ -1775,7 +1772,7 @@ YY_RULE_SETUP
YY_BREAK
case 58:
YY_RULE_SETUP
#line 589 "lexer.l"
#line 586 "lexer.l"
{
lex_check_space_ok("\n", yyextra->lex_buf_len, YR_LEX_BUF_SIZE);
@@ -1785,7 +1782,7 @@ YY_RULE_SETUP
YY_BREAK
case 59:
YY_RULE_SETUP
#line 597 "lexer.l"
#line 594 "lexer.l"
{
lex_check_space_ok("\"", yyextra->lex_buf_len, YR_LEX_BUF_SIZE);
@@ -1795,7 +1792,7 @@ YY_RULE_SETUP
YY_BREAK
case 60:
YY_RULE_SETUP
#line 605 "lexer.l"
#line 602 "lexer.l"
{
lex_check_space_ok("\\", yyextra->lex_buf_len, YR_LEX_BUF_SIZE);
@@ -1805,7 +1802,7 @@ YY_RULE_SETUP
YY_BREAK
case 61:
YY_RULE_SETUP
#line 613 "lexer.l"
#line 610 "lexer.l"
{
int result;
@@ -1818,13 +1815,13 @@ YY_RULE_SETUP
YY_BREAK
case 62:
YY_RULE_SETUP
#line 624 "lexer.l"
#line 621 "lexer.l"
{ yytext_to_buffer; }
YY_BREAK
case 63:
/* rule 63 can match eol */
YY_RULE_SETUP
#line 627 "lexer.l"
#line 624 "lexer.l"
{
syntax_error("unterminated string");
}
@@ -1832,14 +1829,14 @@ YY_RULE_SETUP
case 64:
/* rule 64 can match eol */
YY_RULE_SETUP
#line 632 "lexer.l"
#line 629 "lexer.l"
{
syntax_error("illegal escape sequence");
}
YY_BREAK
case 65:
YY_RULE_SETUP
#line 637 "lexer.l"
#line 634 "lexer.l"
{
if (yyextra->lex_buf_len > 0)
@@ -1867,7 +1864,7 @@ YY_RULE_SETUP
YY_BREAK
case 66:
YY_RULE_SETUP
#line 663 "lexer.l"
#line 660 "lexer.l"
{
lex_check_space_ok("/", yyextra->lex_buf_len, YR_LEX_BUF_SIZE);
@@ -1877,7 +1874,7 @@ YY_RULE_SETUP
YY_BREAK
case 67:
YY_RULE_SETUP
#line 671 "lexer.l"
#line 668 "lexer.l"
{
lex_check_space_ok("\\.", yyextra->lex_buf_len, YR_LEX_BUF_SIZE);
@@ -1892,20 +1889,20 @@ YY_RULE_SETUP
YY_BREAK
case 68:
YY_RULE_SETUP
#line 684 "lexer.l"
#line 681 "lexer.l"
{ yytext_to_buffer; }
YY_BREAK
case 69:
/* rule 69 can match eol */
YY_RULE_SETUP
#line 687 "lexer.l"
#line 684 "lexer.l"
{
syntax_error("unterminated regular expression");
}
YY_BREAK
case 70:
YY_RULE_SETUP
#line 692 "lexer.l"
#line 689 "lexer.l"
{
yylval->sized_string = NULL;
@@ -1916,7 +1913,7 @@ YY_RULE_SETUP
YY_BREAK
case 71:
YY_RULE_SETUP
#line 701 "lexer.l"
#line 698 "lexer.l"
{
yylval->sized_string = NULL;
@@ -1928,7 +1925,7 @@ YY_RULE_SETUP
case 72:
/* rule 72 can match eol */
YY_RULE_SETUP
#line 710 "lexer.l"
#line 707 "lexer.l"
{
// Match hex-digits with whitespace or comments. The latter are stripped
// out by hex_lexer.l
@@ -1944,12 +1941,12 @@ YY_RULE_SETUP
case 73:
/* rule 73 can match eol */
YY_RULE_SETUP
#line 723 "lexer.l"
#line 720 "lexer.l"
/* skip whitespace */
YY_BREAK
case 74:
YY_RULE_SETUP
#line 725 "lexer.l"
#line 722 "lexer.l"
{
if (yytext[0] >= 32 && yytext[0] < 127)
@@ -1964,10 +1961,10 @@ YY_RULE_SETUP
YY_BREAK
case 75:
YY_RULE_SETUP
#line 737 "lexer.l"
#line 734 "lexer.l"
ECHO;
YY_BREAK
#line 1971 "lexer.c"
#line 1968 "lexer.c"
case YY_END_OF_BUFFER:
{
@@ -3097,7 +3094,7 @@ void yara_yyfree (void * ptr , yyscan_t yyscanner)
#define YYTABLES_NAME "yytables"
#line 737 "lexer.l"
#line 734 "lexer.l"
libyara/lexer.l
+2 -5
View File
@@ -348,15 +348,12 @@ include[ \t]+\" {
<<EOF>> {
YR_COMPILER* compiler = yyget_extra(yyscanner);
_yr_compiler_pop_file_name(compiler);
yypop_buffer_state(yyscanner);
if (!YY_CURRENT_BUFFER)
{
yyterminate();
}
return _END_OF_INCLUDED_FILE_;
}