'none' new token doesn't work as expected

[lupiotte]

Hello,

From my understanding the "none" statement ("none" keyword https://github.com/VirusTotal/yara/pull/1559/files ) doesn't work as I expect ;). Indeed even if a string appear in a scanned file the expression using "none" will report a true condition.
I have leveraged different version yara-v4.2.1-1934-win64 / yara-master-1798-win64 / yara-4.2.0 with the same issue.
Test done via official precompiled binaries (only x64 version tested) and executed under Windows environement (W10).

BTW you haven't included in your testing rules tests (tests/test-rules.c) which should have highlighted this issue.

Something like:

assert_false_rule(
"rule test { strings: $a = "dummy1" $b = "dummy2" $c = "ssi" "
"condition: none of them }",
TEXT_1024_BYTES "mississippi");

assert_false_rule(
"rule test { strings: $a1 = "dummy1" $b1 = "dummy2" $b2 = "ssi""
"condition: none of ($a*, $b*) }",
TEXT_1024_BYTES "mississippi");

Hope it's help.

Originally posted by @lupiotte in #1559 (comment)

[wxsBSD]

I think you're right about this. I should have a fix up very soon.

[wxsBSD]

At least in my defense this has nothing to do with the none keyword. You can get the same behavior with 0 of them as a condition. ;)

I think this is actually a long standing bug, but either way a fix is incoming!