From 183817cb48686180fef63bf0fb9e496bf012efae Mon Sep 17 00:00:00 2001
From: Michael Messner <m1k3@s3cur1ty.de>
Date: Mon, 5 Oct 2026 17:36:05 +0200
Subject: [PATCH] adjust regex

---
 config/bin_version_identifiers/dnsmasq.json     |  4 ++--
 config/bin_version_identifiers/ez-ipupdate.json |  4 ++--
 config/bin_version_identifiers/lua_cjson.json   |  2 +-
 modules/S09_firmware_base_version_check.sh      |  5 ++++-
 tests/modules/s09_bin_version_identifiers.bats  |  5 +++--
 tests/scripts/bin_version_testdata/README.md    | 10 +++++-----
 6 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/config/bin_version_identifiers/dnsmasq.json b/config/bin_version_identifiers/dnsmasq.json
index 2ac30a07..6735c780 100644
--- a/config/bin_version_identifiers/dnsmasq.json
+++ b/config/bin_version_identifiers/dnsmasq.json
@@ -8,8 +8,8 @@
   ],
   "grep_commands": [
     "^[dD]nsmasq\\ version\\ [0-9]\\.[0-9]+",
-    "dnsmasq-[0-9]\\.[0-9]+",
-    "dnsmasq\\ [0-9]\\.[0-9]+"
+    "dnsmasq-[0-9]\\.[0-9]+$",
+    "dnsmasq\\ [0-9]\\.[0-9]+$"
   ],
   "vendor_names": [
     "dnsmasq",
diff --git a/config/bin_version_identifiers/ez-ipupdate.json b/config/bin_version_identifiers/ez-ipupdate.json
index a8e8d68c..2479f0ad 100644
--- a/config/bin_version_identifiers/ez-ipupdate.json
+++ b/config/bin_version_identifiers/ez-ipupdate.json
@@ -7,7 +7,7 @@
     "GPL-2.0-only"
   ],
   "grep_commands": [
-    "[0-9](\\.[0-9]+)+?\\ -\\ $Id:\\ ez-ipupdate.c,v\\ [0-9]\\.[0-9]+",
+    "[0-9](\\.[0-9]+)+?\\ -\\ \\$Id:\\ ez-ipupdate.c,v\\ [0-9]\\.[0-9]+",
     "ez-ipupdate:\\ -\\ [0-9](\\.[0-9]+)+?"
   ],
   "vendor_names": [
@@ -17,7 +17,7 @@
     "ez-ipupdate"
   ],
   "version_extraction": [
-    "sed -r 's/([0-9](\\.[0-9]+)+?)\\ -\\ $Id:\\ ez-ipupdate.c,v\\ [0-9]\\.[0-9]+/::ez-ipupdate:\\1/'",
+    "sed -r 's/([0-9](\\.[0-9]+)+?)\\ -\\ \\$Id:\\ ez-ipupdate.c,v\\ [0-9]\\.[0-9]+/::ez-ipupdate:\\1/'",
     "sed -r 's/ez-ipupdate:\\ -\\ ([0-9](\\.[0-9]+)+?)/::ez-ipupdate:\\1/'"
   ],
   "affected_paths": [
diff --git a/config/bin_version_identifiers/lua_cjson.json b/config/bin_version_identifiers/lua_cjson.json
index eb70d6f3..1fa2dbe4 100644
--- a/config/bin_version_identifiers/lua_cjson.json
+++ b/config/bin_version_identifiers/lua_cjson.json
@@ -7,7 +7,7 @@
       "LGPL-3.0-only OR GPL-2.0-only"
    ],
    "grep_commands": [
-      "'\"^lua_cjson\\.c$\"AND\"^Memory\\ allocation\\ error\\ in\\ CJSON\\ protected\\ call$\"AND\"^[0-9]\\.[0-9](\\.[0-9]){0,1}+$\"'"
+      "'\"^lua_cjson\\.c$\"AND\"^Memory\\ allocation\\ error\\ in\\ CJSON\\ protected\\ call$\"AND\"^[0-9]\\.[0-9](\\.[0-9]){0,1}$\"'"
    ],
    "vendor_names": [
       "lua"
diff --git a/modules/S09_firmware_base_version_check.sh b/modules/S09_firmware_base_version_check.sh
index 54198f98..14c72fb9 100755
--- a/modules/S09_firmware_base_version_check.sh
+++ b/modules/S09_firmware_base_version_check.sh
@@ -980,7 +980,10 @@ create_minimal_binary_corpus() {
       lVERSION_IDENTIFIER="${lVERSION_IDENTIFIER%\"}"
     fi
 
-    grep -o -a -E ".{0,300}${lVERSION_IDENTIFIER//[\^\$]/}.{0,300}" "${lBINARY_PATH}" >>"${lCORPUS_FILE_tmp}" || true
+    lVERSION_IDENTIFIER=${lVERSION_IDENTIFIER%$}
+    lVERSION_IDENTIFIER=${lVERSION_IDENTIFIER#^}
+
+    grep -o -a -E ".{0,300}${lVERSION_IDENTIFIER}.{0,300}" "${lBINARY_PATH}" >>"${lCORPUS_FILE_tmp}" || true
 
     lCORP_SIZE=$(wc -c <"${lCORPUS_FILE_tmp}")
     write_log "[*] Generated corpus for binary ${lBINARY_PATH} with size ${lCORP_SIZE} - rule ${lRULE_IDENTIFIER}/${lVERSION_IDENTIFIER}" "${lCORPUS_log}"
diff --git a/tests/modules/s09_bin_version_identifiers.bats b/tests/modules/s09_bin_version_identifiers.bats
index 7873001e..d556f854 100644
--- a/tests/modules/s09_bin_version_identifiers.bats
+++ b/tests/modules/s09_bin_version_identifiers.bats
@@ -489,10 +489,11 @@ bvi_static_rules() {
   local lBASENAME=""
   local lMODE=""
   local lMODE_ENTRY=""
-  local lMODE_COUNT="0"
-  local lPATH_COUNT="0"
+  local lMODE_COUNT=0
+  local lPATH_COUNT=0
   for lCFG_FILE in "${BIN_VERSION_CFG_ARR[@]}"; do
     lBASENAME="$(basename "${lCFG_FILE}" .json)"
+    lMODE_COUNT=0
 
     # one jq pass: affected_paths count|space separated parsing modes
     while IFS='|' read -r lPATH_COUNT lMODE; do
diff --git a/tests/scripts/bin_version_testdata/README.md b/tests/scripts/bin_version_testdata/README.md
index 4a72ddf7..ef4e5520 100644
--- a/tests/scripts/bin_version_testdata/README.md
+++ b/tests/scripts/bin_version_testdata/README.md
@@ -10,16 +10,16 @@ software versions by grepping the `strings` output of firmware binaries
 with the regex patterns defined in `config/bin_version_identifiers/*.json`.
 
 Instead of copying entire firmware binaries into the test suite (which can
-be 100+ MB), `../bin_version_testdata/*.bin` holds only the relevant byte
+be 100+ MB), `../../bin_version_testdata/*.bin` holds only the relevant byte
 windows around the grep matches. Every test bin is named
 `<identifier>_<grep id>.bin`, following the corpus naming of
 `create_minimal_binary_corpus` in
-`../../modules/S09_firmware_base_version_check.sh`.
+`../../../modules/S09_firmware_base_version_check.sh`.
 
 ## Statistics
 
-`../bin_version_testdata` is compared against all static rules of
-`../../config/bin_version_identifiers` by
+`../../bin_version_testdata` is compared against all static rules of
+`../../../config/bin_version_identifiers` by
 `../../modules/s09_bin_version_identifiers.bats`. It reports how many grep
 entries are matched by a test bin, how many are missing a test bin and which
 test bins are stale or orphaned.
@@ -40,4 +40,4 @@ The check mirrors `S09_firmware_base_version_check`:
 2. Leading/trailing `'` and surrounding `"` are stripped per element.
 3. Anchors are dropped, as the test bins are extracted as context windows
    around the matches.
-4. Each element is tested with `grep -a -q -o -E` against the test bin.
\ No newline at end of file
+4. Each element is tested with `grep -a -q -o -E` against the test bin.