Files
yara/libyara/include
Victor M. AlvarezandWesley Shields 32c969f1e4 Implement percent "%" operator for string sets. (#1434)
This commit implements the "%" operator and extends the grammar to
recognize it for string sets.

The grammar now recognizes "50% of them" or variations on that. The
percentage number must be between 1 and 100 (inclusive) or the compiler will
return an error.

The implementation uses a new opcode (OP_OF_PERCENT) and this is because the
stack for these looks different from a typical "for_expression _OF_ string set"
rule. In the "for_expression" case (which uses OP_OF) the stack looks like this
(assuming two strings $a and $b):

$a
$b
undefined <-- end of list
2 <-- for_expression

The OP_OF operation checks each of the strings until it hits the end of list and
then compares the number found to whatever is left on the stack (2 in this
case).

The new grammar causes a stack at runtime which looks like this:

50 <-- percent number
$b
$a
undefined <-- end of list

The OP_OF operator won't work in this case because the percent number is sitting
on the top of the stack compared to the for_expression sitting at the bottom of
the stack.

I also cleaned up a minor oversight in compiler.c when printing the
ERROR_INVALID_MODIFIER message. It is the same as the other compiler errors so I
just moved it into the same set of fallthrough case statements.

Lastly, add some test cases to make sure this is working as intended.

Co-authored-by: Wesley Shields <[email protected]>
2021-09-01 01:28:24 +02:00
..