mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
This commit implements the "%" operator and extends the grammar to recognize it for string sets. The grammar now recognizes "50% of them" or variations on that. The percentage number must be between 1 and 100 (inclusive) or the compiler will return an error. The implementation uses a new opcode (OP_OF_PERCENT) and this is because the stack for these looks different from a typical "for_expression _OF_ string set" rule. In the "for_expression" case (which uses OP_OF) the stack looks like this (assuming two strings $a and $b): $a $b undefined <-- end of list 2 <-- for_expression The OP_OF operation checks each of the strings until it hits the end of list and then compares the number found to whatever is left on the stack (2 in this case). The new grammar causes a stack at runtime which looks like this: 50 <-- percent number $b $a undefined <-- end of list The OP_OF operator won't work in this case because the percent number is sitting on the top of the stack compared to the for_expression sitting at the bottom of the stack. I also cleaned up a minor oversight in compiler.c when printing the ERROR_INVALID_MODIFIER message. It is the same as the other compiler errors so I just moved it into the same set of fallthrough case statements. Lastly, add some test cases to make sure this is working as intended. Co-authored-by: Wesley Shields <[email protected]>