From f0ddbb0ba653da1936af46c5b6978b919a99f6a6 Mon Sep 17 00:00:00 2001 From: Wesley Shields Date: Fri, 16 Sep 2022 21:32:46 -0400 Subject: [PATCH 1/2] Add OP_OF_FOUND_AT. Add support for "any of them at 0" constructs to the language. This allows users to avoid using long or chains like "$a at 0 or $b at 0" and also is a nicer way to write "for any of them: ($ at 0)". --- libyara/exec.c | 75 +++ libyara/grammar.c | 984 ++++++++++++++++++------------------ libyara/grammar.y | 20 + libyara/include/yara/exec.h | 1 + tests/test-rules.c | 22 + 5 files changed, 623 insertions(+), 479 deletions(-) diff --git a/libyara/exec.c b/libyara/exec.c index d1c51d6fa9..c82cf02db4 100644 --- a/libyara/exec.c +++ b/libyara/exec.c @@ -1674,6 +1674,81 @@ int yr_execute_code(YR_SCAN_CONTEXT* context) push(r1); break; + case OP_OF_FOUND_AT: + YR_DEBUG_FPRINTF( + 2, stderr, "- case OP_OF_FOUND_AT: // %s()\n", __FUNCTION__); + + found = 0; + count = 0; + + pop(r2); // Match location + pop(r1); // First string + + // Match location must be defined. + if (is_undef(r2)) + { + // Remove all the strings. + while (!is_undef(r1)) pop(r1); + // Remove the quantifier at the bottom of the stack. + pop(r1); + r1.i = YR_UNDEFINED; + push(r1); + break; + } + + while (!is_undef(r1)) + { +#if YR_PARANOID_EXEC + ensure_within_rules_arena(r1.p); +#endif + match = context->matches[r1.s->idx].head; + + while (match != NULL) + { + // String match at the desired location? + if (match->base + match->offset == r2.i) + { + found++; + break; + } + + // If current match is past desired location, we can stop as matches + // are sorted by offset in increasing order, so all remaining + // matches are past it. + if (match->base + match->offset > r2.i) + break; + + match = match->next; + } + + count++; + pop(r1); + } + + pop(r2); // Quantifier X in expressions like "X of string_set in range" + + // Quantifier is "all". + if (is_undef(r2)) + { + r1.i = found >= count ? 1 : 0; + } + // Quantifier is 0 or none. This is a special case in which we want + // exactly 0 strings matching. More information at: + // https://github.com/VirusTotal/yara/issues/1695 + else if (r2.i == 0) + { + r1.i = found == 0 ? 1 : 0; + } + // In all other cases the number of strings matching should be at least + // the amount specified by the quantifier. + else + { + r1.i = found >= r2.i ? 1 : 0; + } + + push(r1); + break; + case OP_FILESIZE: r1.i = context->file_size; YR_DEBUG_FPRINTF( diff --git a/libyara/grammar.c b/libyara/grammar.c index 9a242f2276..d0de010396 100644 --- a/libyara/grammar.c +++ b/libyara/grammar.c @@ -877,16 +877,16 @@ union yyalloc /* YYFINAL -- State number of the termination state. */ #define YYFINAL 2 /* YYLAST -- Last index in YYTABLE. */ -#define YYLAST 468 +#define YYLAST 476 /* YYNTOKENS -- Number of terminals. */ #define YYNTOKENS 84 /* YYNNTS -- Number of nonterminals. */ #define YYNNTS 54 /* YYNRULES -- Number of rules. */ -#define YYNRULES 167 +#define YYNRULES 168 /* YYNSTATES -- Number of states. */ -#define YYNSTATES 273 +#define YYNSTATES 275 /* YYMAXUTOK -- Last valid token kind. */ #define YYMAXUTOK 319 @@ -950,14 +950,14 @@ static const yytype_int16 yyrline[] = 888, 889, 893, 894, 908, 912, 1007, 1055, 1116, 1161, 1162, 1166, 1201, 1254, 1296, 1319, 1325, 1331, 1343, 1353, 1363, 1373, 1383, 1393, 1403, 1413, 1427, 1442, 1453, 1528, - 1566, 1470, 1694, 1705, 1716, 1735, 1754, 1766, 1772, 1778, - 1777, 1823, 1822, 1866, 1873, 1880, 1887, 1894, 1901, 1908, - 1912, 1920, 1921, 1946, 1966, 1994, 2068, 2096, 2104, 2113, - 2156, 2171, 2190, 2200, 2199, 2208, 2222, 2223, 2228, 2238, - 2253, 2252, 2265, 2266, 2271, 2304, 2329, 2377, 2384, 2390, - 2396, 2406, 2410, 2418, 2430, 2444, 2451, 2458, 2483, 2495, - 2507, 2519, 2534, 2546, 2561, 2604, 2625, 2660, 2695, 2729, - 2754, 2771, 2781, 2791, 2801, 2811, 2831, 2851 + 1566, 1470, 1694, 1705, 1716, 1735, 1754, 1766, 1786, 1792, + 1798, 1797, 1843, 1842, 1886, 1893, 1900, 1907, 1914, 1921, + 1928, 1932, 1940, 1941, 1966, 1986, 2014, 2088, 2116, 2124, + 2133, 2176, 2191, 2210, 2220, 2219, 2228, 2242, 2243, 2248, + 2258, 2273, 2272, 2285, 2286, 2291, 2324, 2349, 2397, 2404, + 2410, 2416, 2426, 2430, 2438, 2450, 2464, 2471, 2478, 2503, + 2515, 2527, 2539, 2554, 2566, 2581, 2624, 2645, 2680, 2715, + 2749, 2774, 2791, 2801, 2811, 2821, 2831, 2851, 2871 }; #endif @@ -1018,7 +1018,7 @@ yysymbol_name (yysymbol_kind_t yysymbol) #define yypact_value_is_default(Yyn) \ ((Yyn) == YYPACT_NINF) -#define YYTABLE_NINF (-137) +#define YYTABLE_NINF (-138) #define yytable_value_is_error(Yyn) \ 0 @@ -1027,34 +1027,34 @@ yysymbol_name (yysymbol_kind_t yysymbol) STATE-NUM. */ static const yytype_int16 yypact[] = { - -172, 121, -172, -39, -172, 2, -172, -172, 185, -172, + -172, 121, -172, -39, -172, 2, -172, -172, 151, -172, -172, -172, -172, 24, -172, -172, -172, -172, -38, 59, - 16, -172, 65, 95, -172, 29, 108, 107, 47, -172, - 48, 107, -172, 120, 126, 22, -172, 71, 120, -172, - 77, 80, -172, -172, -172, -172, 141, -6, -172, 66, - -172, -172, 140, 151, 162, -172, -16, 142, 112, 117, + 16, -172, 65, 95, -172, 29, 109, 112, 55, -172, + 71, 112, -172, 130, 163, 22, -172, 101, 130, -172, + 116, 118, -172, -172, -172, -172, 178, -5, -172, 66, + -172, -172, 177, 174, 179, -172, -16, 162, 120, 123, -172, -172, 124, -172, -172, -172, -172, -172, -172, -172, - 132, -172, -172, 66, 66, 200, 200, 66, 104, -172, - 90, -172, 179, -172, 279, -172, -172, -172, 200, 143, - 143, 200, 200, 200, 200, 7, 378, -172, -172, -172, - -172, 90, 144, 239, 66, 214, 200, -172, -172, -35, - 204, 200, 200, 200, 200, 200, 200, 200, 200, 200, - 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, - 200, 200, 200, 157, 85, 133, 221, 378, 200, -172, - -172, 187, 289, 321, 340, -172, -4, 200, -172, -172, - 150, 147, 135, -172, 299, 66, 66, -172, 222, 198, - -172, -172, 378, 378, 378, 378, 378, 378, 378, 378, - 378, 378, 378, 378, 378, 26, 26, 388, 398, 139, - 127, 127, -172, -172, -35, -172, -172, -172, -172, 158, - 159, 180, -172, -172, -172, -172, -172, -172, -172, -172, - -172, -172, -172, 177, -172, -172, -172, -172, -33, 183, - 4, -172, 66, -172, 208, -172, 5, 250, 143, -172, - -172, 245, 243, 244, 200, -172, -172, -172, -172, -9, - 254, 135, -172, -172, -47, -172, 202, 51, -172, -172, - -48, 189, 193, 359, 188, 200, 104, -172, -172, -172, - -172, -172, 5, -172, -172, 250, 256, -172, -172, -172, - -172, 66, 52, 177, -172, -172, 195, 23, -172, 200, - -172, -172, 378 + 132, -172, -172, 66, 66, 198, 198, 66, 103, -172, + 110, -172, 168, -172, 277, -172, -172, -172, 198, 129, + 129, 198, 198, 198, 198, 7, 376, -172, -172, -172, + -172, 110, 140, 237, 66, 197, 198, -172, -172, -35, + 199, 198, 198, 198, 198, 198, 198, 198, 198, 198, + 198, 198, 198, 198, 198, 198, 198, 198, 198, 198, + 198, 198, 198, 157, 85, 111, 216, 376, 198, -172, + -172, 186, 287, 319, 338, -172, -4, 198, -172, -172, + 144, 142, 139, -172, 297, 66, 66, -172, 215, -15, + -172, -172, 376, 376, 376, 376, 376, 376, 376, 376, + 376, 376, 376, 376, 376, 26, 26, 386, 396, 406, + 117, 117, -172, -172, -35, -172, -172, -172, -172, 149, + 153, 154, -172, -172, -172, -172, -172, -172, -172, -172, + -172, -172, -172, 176, -172, -172, -172, -172, -33, 158, + 4, -172, 66, -172, 181, -172, 20, 225, 198, 129, + -172, -172, 240, 238, 239, 198, -172, -172, -172, -172, + -9, 249, 139, -172, -172, 46, -172, 193, 53, -172, + 376, -172, -48, 183, 184, 357, 188, 198, 103, -172, + -172, -172, -172, -172, 20, -172, -172, 225, 247, -172, + -172, -172, -172, 66, 76, 176, -172, -172, 191, 23, + -172, 198, -172, -172, 376 }; /* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM. @@ -1067,40 +1067,40 @@ static const yytype_uint8 yydefact[] = 0, 24, 23, 13, 25, 0, 15, 0, 0, 11, 0, 14, 26, 0, 0, 0, 27, 0, 16, 33, 0, 0, 29, 28, 31, 32, 0, 35, 34, 0, - 12, 30, 0, 0, 0, 65, 85, 149, 151, 153, - 145, 146, 0, 147, 73, 142, 143, 138, 139, 140, - 0, 75, 76, 0, 0, 0, 0, 0, 154, 167, - 17, 74, 0, 137, 109, 41, 55, 62, 0, 0, - 0, 0, 0, 0, 0, 0, 136, 97, 98, 155, - 164, 0, 74, 109, 69, 0, 0, 101, 99, 0, + 12, 30, 0, 0, 0, 65, 85, 150, 152, 154, + 146, 147, 0, 148, 73, 143, 144, 139, 140, 141, + 0, 75, 76, 0, 0, 0, 0, 0, 155, 168, + 17, 74, 0, 138, 110, 41, 55, 62, 0, 0, + 0, 0, 0, 0, 0, 0, 137, 98, 99, 156, + 165, 0, 74, 110, 69, 0, 0, 102, 100, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 36, 38, 40, 86, 0, 87, - 148, 0, 0, 0, 0, 88, 0, 0, 110, 141, - 0, 70, 71, 66, 0, 0, 0, 125, 123, 92, - 93, 77, 78, 80, 82, 79, 81, 83, 84, 107, - 108, 103, 105, 104, 106, 165, 166, 163, 161, 162, - 156, 157, 158, 159, 0, 160, 47, 44, 43, 48, + 149, 0, 0, 0, 0, 88, 0, 0, 111, 142, + 0, 70, 71, 66, 0, 0, 0, 126, 124, 92, + 93, 77, 78, 80, 82, 79, 81, 83, 84, 108, + 109, 104, 106, 105, 107, 166, 167, 164, 162, 163, + 157, 158, 159, 160, 0, 161, 47, 44, 43, 48, 51, 53, 45, 46, 42, 61, 58, 57, 59, 60, - 56, 64, 63, 0, 150, 152, 144, 113, 0, 0, - 0, 68, 0, 67, 102, 100, 0, 0, 0, 94, - 95, 0, 0, 0, 0, 123, 112, 122, 90, 0, - 0, 72, 128, 129, 0, 126, 134, 0, 132, 96, - 0, 0, 0, 0, 0, 0, 115, 111, 116, 118, - 114, 124, 0, 135, 131, 0, 0, 49, 52, 54, - 119, 0, 0, 120, 127, 133, 0, 0, 117, 0, - 50, 91, 121 + 56, 64, 63, 0, 151, 153, 145, 114, 0, 0, + 0, 68, 0, 67, 103, 101, 0, 0, 0, 0, + 94, 95, 0, 0, 0, 0, 124, 113, 123, 90, + 0, 0, 72, 129, 130, 0, 127, 135, 0, 133, + 97, 96, 0, 0, 0, 0, 0, 0, 116, 112, + 117, 119, 115, 125, 0, 136, 132, 0, 0, 49, + 52, 54, 120, 0, 0, 121, 128, 134, 0, 0, + 118, 0, 50, 91, 122 }; /* YYPGOTO[NTERM-NUM]. */ static const yytype_int16 yypgoto[] = { - -172, -172, 272, 274, -172, -172, -172, -172, -172, -172, - -172, -172, -172, -172, 257, -172, 249, -172, -172, -172, - -172, -172, -172, -172, -172, -172, 60, -172, -172, 181, + -172, -172, 264, 268, -172, -172, -172, -172, -172, -172, + -172, -172, -172, -172, 241, -172, 235, -172, -172, -172, + -172, -172, -172, -172, -172, -172, 45, -172, -172, 175, -49, -74, -172, -172, -172, -172, -172, -172, -172, -172, - -89, -172, -172, -171, -172, -172, 38, 109, -172, -172, - 37, 240, -172, -65 + -89, -172, -172, -171, -172, -172, 32, 104, -172, -172, + 30, 219, -172, -65 }; /* YYDEFGOTO[NTERM-NUM]. */ @@ -1109,9 +1109,9 @@ static const yytype_int16 yydefgoto[] = 0, 1, 6, 7, 18, 34, 26, 29, 41, 8, 16, 20, 22, 31, 32, 38, 39, 52, 53, 54, 134, 194, 135, 200, 136, 202, 78, 150, 151, 79, - 101, 81, 146, 244, 156, 155, 209, 210, 247, 248, - 139, 262, 226, 159, 216, 234, 235, 160, 217, 237, - 238, 82, 83, 84 + 101, 81, 146, 246, 156, 155, 209, 210, 249, 250, + 139, 264, 227, 159, 216, 235, 236, 160, 217, 238, + 239, 82, 83, 84 }; /* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM. If @@ -1120,60 +1120,61 @@ static const yytype_int16 yydefgoto[] = static const yytype_int16 yytable[] = { 80, 140, 55, 102, 157, 96, 157, 207, 145, 5, - 99, 100, 103, 219, 88, -39, -37, 232, -89, 256, - 89, 233, 12, 137, 97, 98, 141, 142, 143, 144, - 152, 257, 251, 208, 9, 17, 252, 227, 19, 42, - 229, 154, 43, 158, -89, 225, 162, 163, 164, 165, + 99, 100, 103, 220, 88, 218, -39, -37, -89, 258, + 89, 219, 12, 137, 97, 98, 141, 142, 143, 144, + 152, 259, 233, 208, 9, 17, 234, 228, 19, 42, + 230, 154, 43, 158, -89, 226, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, - 176, 177, 178, 179, 180, 181, 182, 183, 185, 245, + 176, 177, 178, 179, 180, 181, 182, 183, 185, 247, 21, 44, 45, 203, 107, 108, 24, 55, 56, 57, - 58, 59, 185, 60, 61, 62, 63, 230, 64, 46, + 58, 59, 185, 60, 61, 62, 63, 231, 64, 46, 23, 186, 129, 130, 131, 132, 147, 65, 66, 67, - 68, 69, 271, 25, 70, 27, 214, 215, 187, 188, - 189, 190, 191, 192, 193, 71, 72, 28, 30, 73, - 74, 2, 3, 33, 4, 35, -18, -18, -18, 239, - 254, 268, 37, 75, 255, 269, 40, 76, 231, 195, - 249, 107, 108, 55, 77, 57, 58, 59, 47, 60, - 61, 62, 63, 49, 64, 50, 196, 197, 51, 243, - 85, 198, 199, 65, 66, 67, 68, 69, 55, 5, - 57, 58, 59, 86, 60, 61, 62, 63, 90, 64, - 263, 224, 104, 87, 105, 106, -74, -74, 65, 66, - 13, 14, 15, 91, 184, 131, 132, 147, 92, 75, - 124, 125, 93, 76, 272, 129, 130, 131, 132, 147, - 94, 55, 267, 57, 58, 59, 109, 60, 61, 62, - 63, 138, 64, 148, 75, 153, 64, 201, 76, 211, - 212, 65, 66, -130, 218, 94, 221, 222, 124, 125, + 68, 69, 273, 25, 70, 27, 214, 215, 187, 188, + 189, 190, 191, 192, 193, 71, 72, 195, 28, 73, + 74, 2, 3, 30, 4, 253, -18, -18, -18, 254, + 241, 33, 256, 75, 196, 197, 257, 76, 232, 198, + 199, 251, 37, 55, 77, 57, 58, 59, 35, 60, + 61, 62, 63, 240, 64, 270, 13, 14, 15, 271, + 245, 107, 108, 65, 66, 67, 68, 69, 55, 5, + 57, 58, 59, 40, 60, 61, 62, 63, 47, 64, + 225, 104, 265, 105, 106, 131, 132, 147, 65, 66, + -74, -74, 49, 50, 184, 51, 86, 85, 90, 75, + 87, 91, 93, 76, 92, 109, 274, 138, 153, 55, + 94, 57, 58, 59, 269, 60, 61, 62, 63, 148, + 64, 64, 201, 211, 75, 212, -131, 222, 76, 65, + 66, 223, 224, 108, 229, 94, 237, 124, 125, 126, + 127, 128, 129, 130, 131, 132, 147, 124, 125, 126, + 127, 128, 129, 130, 131, 132, 147, 242, 243, 244, + 252, 255, 260, 261, 268, 75, 263, 10, 204, 76, + 272, 11, 36, 48, -137, 248, 94, 110, 111, 112, + 113, 114, 115, 116, 117, 161, 266, 267, 221, 95, + 0, 0, 118, 119, 120, 121, 122, 123, 124, 125, + 126, 127, 128, 129, 130, 131, 132, 133, 0, 0, + 0, 0, 0, 0, -137, 0, 149, 110, 111, 112, + 113, 114, 115, 116, 117, 0, 0, 0, 0, 0, + 0, 0, 118, 119, 120, 121, 122, 123, 124, 125, + 126, 127, 128, 129, 130, 131, 132, 133, 124, 125, 126, 127, 128, 129, 130, 131, 132, 147, 124, 125, - 126, 127, 128, 129, 130, 131, 132, 147, 223, 228, - 108, 236, 240, 241, 242, 250, 261, 75, 258, 204, - 253, 76, 259, 266, 270, 10, -136, 11, 94, 110, - 111, 112, 113, 114, 115, 116, 117, 48, 36, 246, - 264, 161, 265, 220, 118, 119, 120, 121, 122, 123, - 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, - 95, 0, 0, 0, 0, 0, -136, 0, 149, 110, - 111, 112, 113, 114, 115, 116, 117, 0, 0, 0, - 0, 0, 0, 0, 118, 119, 120, 121, 122, 123, - 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, + 126, 127, 128, 129, 130, 131, 132, 147, 0, 205, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 213, 124, 125, 126, 127, 128, 129, 130, 131, 132, 147, - 124, 125, 126, 127, 128, 129, 130, 131, 132, 147, - 0, 205, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 213, 124, 125, 126, 127, 128, 129, 130, 131, - 132, 147, 0, 0, 0, 0, 0, 0, 0, 0, - 206, 124, 125, 126, 127, 128, 129, 130, 131, 132, - 147, 0, 0, 0, 0, 0, 0, 0, 0, 149, - 124, 125, 126, 127, 128, 129, 130, 131, 132, 147, - 0, 0, 0, 0, 0, 0, 0, 0, 260, 124, - 125, 126, 127, 128, 129, 130, 131, 132, 147, 124, - 125, 0, 127, 128, 129, 130, 131, 132, 147, 124, - 125, 0, 0, 128, 129, 130, 131, 132, 147 + 0, 0, 0, 0, 0, 0, 0, 0, 206, 124, + 125, 126, 127, 128, 129, 130, 131, 132, 147, 0, + 0, 0, 0, 0, 0, 0, 0, 149, 124, 125, + 126, 127, 128, 129, 130, 131, 132, 147, 0, 0, + 0, 0, 0, 0, 0, 0, 262, 124, 125, 126, + 127, 128, 129, 130, 131, 132, 147, 124, 125, 0, + 127, 128, 129, 130, 131, 132, 147, 124, 125, 0, + 0, 128, 129, 130, 131, 132, 147, 124, 125, 0, + 0, 0, 129, 130, 131, 132, 147 }; static const yytype_int16 yycheck[] = { 49, 90, 11, 77, 39, 70, 39, 11, 1, 48, - 75, 76, 77, 184, 30, 21, 22, 12, 11, 67, - 36, 16, 20, 88, 73, 74, 91, 92, 93, 94, - 104, 79, 79, 37, 73, 11, 83, 208, 76, 17, + 75, 76, 77, 184, 30, 30, 21, 22, 11, 67, + 36, 36, 20, 88, 73, 74, 91, 92, 93, 94, + 104, 79, 12, 37, 73, 11, 16, 208, 76, 17, 36, 106, 20, 78, 37, 78, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 78, @@ -1181,42 +1182,43 @@ static const yytype_int16 yycheck[] = 14, 15, 147, 17, 18, 19, 20, 83, 22, 67, 74, 6, 66, 67, 68, 69, 70, 31, 32, 33, 34, 35, 79, 8, 38, 76, 155, 156, 23, 24, - 25, 26, 27, 28, 29, 49, 50, 9, 11, 53, - 54, 0, 1, 76, 3, 77, 5, 6, 7, 218, - 79, 79, 12, 67, 83, 83, 10, 71, 212, 6, - 229, 51, 52, 11, 78, 13, 14, 15, 77, 17, - 18, 19, 20, 76, 22, 75, 23, 24, 17, 224, - 20, 28, 29, 31, 32, 33, 34, 35, 11, 48, - 13, 14, 15, 22, 17, 18, 19, 20, 36, 22, - 245, 4, 78, 21, 80, 81, 51, 52, 31, 32, - 5, 6, 7, 81, 37, 68, 69, 70, 81, 67, - 61, 62, 78, 71, 269, 66, 67, 68, 69, 70, - 78, 11, 261, 13, 14, 15, 37, 17, 18, 19, - 20, 78, 22, 79, 67, 11, 22, 6, 71, 79, - 83, 31, 32, 11, 36, 78, 78, 78, 61, 62, + 25, 26, 27, 28, 29, 49, 50, 6, 9, 53, + 54, 0, 1, 11, 3, 79, 5, 6, 7, 83, + 219, 76, 79, 67, 23, 24, 83, 71, 212, 28, + 29, 230, 12, 11, 78, 13, 14, 15, 77, 17, + 18, 19, 20, 218, 22, 79, 5, 6, 7, 83, + 225, 51, 52, 31, 32, 33, 34, 35, 11, 48, + 13, 14, 15, 10, 17, 18, 19, 20, 77, 22, + 4, 78, 247, 80, 81, 68, 69, 70, 31, 32, + 51, 52, 76, 75, 37, 17, 22, 20, 36, 67, + 21, 81, 78, 71, 81, 37, 271, 78, 11, 11, + 78, 13, 14, 15, 263, 17, 18, 19, 20, 79, + 22, 22, 6, 79, 67, 83, 11, 78, 71, 31, + 32, 78, 78, 52, 76, 78, 11, 61, 62, 63, + 64, 65, 66, 67, 68, 69, 70, 61, 62, 63, + 64, 65, 66, 67, 68, 69, 70, 17, 20, 20, + 11, 68, 79, 79, 17, 67, 78, 3, 82, 71, + 79, 3, 31, 38, 37, 230, 78, 40, 41, 42, + 43, 44, 45, 46, 47, 110, 254, 257, 184, 70, + -1, -1, 55, 56, 57, 58, 59, 60, 61, 62, + 63, 64, 65, 66, 67, 68, 69, 70, -1, -1, + -1, -1, -1, -1, 37, -1, 79, 40, 41, 42, + 43, 44, 45, 46, 47, -1, -1, -1, -1, -1, + -1, -1, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 61, 62, - 63, 64, 65, 66, 67, 68, 69, 70, 78, 76, - 52, 11, 17, 20, 20, 11, 78, 67, 79, 82, - 68, 71, 79, 17, 79, 3, 37, 3, 78, 40, - 41, 42, 43, 44, 45, 46, 47, 38, 31, 229, - 252, 110, 255, 184, 55, 56, 57, 58, 59, 60, - 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, - 70, -1, -1, -1, -1, -1, 37, -1, 79, 40, - 41, 42, 43, 44, 45, 46, 47, -1, -1, -1, - -1, -1, -1, -1, 55, 56, 57, 58, 59, 60, - 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, - 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, - 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, - -1, 82, -1, -1, -1, -1, -1, -1, -1, -1, - -1, 82, 61, 62, 63, 64, 65, 66, 67, 68, - 69, 70, -1, -1, -1, -1, -1, -1, -1, -1, - 79, 61, 62, 63, 64, 65, 66, 67, 68, 69, - 70, -1, -1, -1, -1, -1, -1, -1, -1, 79, + 63, 64, 65, 66, 67, 68, 69, 70, 61, 62, + 63, 64, 65, 66, 67, 68, 69, 70, -1, 82, + -1, -1, -1, -1, -1, -1, -1, -1, -1, 82, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, -1, -1, -1, -1, -1, -1, -1, -1, 79, 61, - 62, 63, 64, 65, 66, 67, 68, 69, 70, 61, - 62, -1, 64, 65, 66, 67, 68, 69, 70, 61, - 62, -1, -1, 65, 66, 67, 68, 69, 70 + 62, 63, 64, 65, 66, 67, 68, 69, 70, -1, + -1, -1, -1, -1, -1, -1, -1, 79, 61, 62, + 63, 64, 65, 66, 67, 68, 69, 70, -1, -1, + -1, -1, -1, -1, -1, -1, 79, 61, 62, 63, + 64, 65, 66, 67, 68, 69, 70, 61, 62, -1, + 64, 65, 66, 67, 68, 69, 70, 61, 62, -1, + -1, 65, 66, 67, 68, 69, 70, 61, 62, -1, + -1, -1, 66, 67, 68, 69, 70 }; /* YYSTOS[STATE-NUM] -- The symbol kind of the accessing symbol of @@ -1244,13 +1246,13 @@ static const yytype_uint8 yystos[] = 137, 137, 137, 137, 37, 137, 6, 23, 24, 25, 26, 27, 28, 29, 105, 6, 23, 24, 28, 29, 107, 6, 109, 137, 82, 82, 79, 11, 37, 120, - 121, 79, 83, 82, 114, 114, 128, 132, 36, 127, - 131, 78, 78, 78, 4, 78, 126, 127, 76, 36, - 83, 115, 12, 16, 129, 130, 11, 133, 134, 124, - 17, 20, 20, 137, 117, 78, 110, 122, 123, 124, - 11, 79, 83, 68, 79, 83, 67, 79, 79, 79, - 79, 78, 125, 137, 130, 134, 17, 114, 79, 83, - 79, 79, 137 + 121, 79, 83, 82, 114, 114, 128, 132, 30, 36, + 127, 131, 78, 78, 78, 4, 78, 126, 127, 76, + 36, 83, 115, 12, 16, 129, 130, 11, 133, 134, + 137, 124, 17, 20, 20, 137, 117, 78, 110, 122, + 123, 124, 11, 79, 83, 68, 79, 83, 67, 79, + 79, 79, 79, 78, 125, 137, 130, 134, 17, 114, + 79, 83, 79, 79, 137 }; /* YYR1[RULE-NUM] -- Symbol kind of the left-hand side of rule RULE-NUM. */ @@ -1265,14 +1267,14 @@ static const yytype_uint8 yyr1[] = 107, 107, 108, 108, 109, 110, 110, 110, 110, 111, 111, 112, 112, 113, 114, 115, 115, 115, 115, 115, 115, 115, 115, 115, 115, 115, 115, 115, 115, 116, - 117, 115, 115, 115, 115, 115, 115, 115, 115, 118, - 115, 119, 115, 115, 115, 115, 115, 115, 115, 115, - 115, 120, 120, 121, 121, 122, 122, 123, 123, 124, - 125, 125, 126, 128, 127, 127, 129, 129, 130, 130, - 132, 131, 133, 133, 134, 134, 135, 135, 136, 136, - 136, 137, 137, 137, 137, 137, 137, 137, 137, 137, + 117, 115, 115, 115, 115, 115, 115, 115, 115, 115, + 118, 115, 119, 115, 115, 115, 115, 115, 115, 115, + 115, 115, 120, 120, 121, 121, 122, 122, 123, 123, + 124, 125, 125, 126, 128, 127, 127, 129, 129, 130, + 130, 132, 131, 133, 133, 134, 134, 135, 135, 136, + 136, 136, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, 137, - 137, 137, 137, 137, 137, 137, 137, 137 + 137, 137, 137, 137, 137, 137, 137, 137, 137 }; /* YYR2[RULE-NUM] -- Number of symbols on the right-hand side of rule RULE-NUM. */ @@ -1287,14 +1289,14 @@ static const yytype_int8 yyr2[] = 1, 1, 0, 2, 1, 1, 3, 4, 4, 0, 1, 1, 3, 1, 1, 1, 1, 3, 3, 3, 3, 3, 3, 3, 3, 1, 3, 3, 3, 0, - 0, 9, 3, 3, 4, 4, 5, 2, 2, 0, - 4, 0, 4, 3, 3, 3, 3, 3, 3, 1, - 3, 3, 2, 1, 3, 1, 1, 3, 1, 5, - 1, 3, 1, 0, 4, 1, 1, 3, 1, 1, - 0, 4, 1, 3, 1, 2, 1, 1, 1, 1, - 1, 3, 1, 1, 4, 1, 1, 1, 3, 1, - 4, 1, 4, 1, 1, 2, 3, 3, 3, 3, - 3, 3, 3, 3, 2, 3, 3, 1 + 0, 9, 3, 3, 4, 4, 5, 5, 2, 2, + 0, 4, 0, 4, 3, 3, 3, 3, 3, 3, + 1, 3, 3, 2, 1, 3, 1, 1, 3, 1, + 5, 1, 3, 1, 0, 4, 1, 1, 3, 1, + 1, 0, 4, 1, 3, 1, 2, 1, 1, 1, + 1, 1, 3, 1, 1, 4, 1, 1, 1, 3, + 1, 4, 1, 4, 1, 1, 2, 3, 3, 3, + 3, 3, 3, 3, 3, 2, 3, 3, 1 }; @@ -1771,55 +1773,55 @@ yydestruct (const char *yymsg, case YYSYMBOL__IDENTIFIER_: /* "identifier" */ #line 312 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1775 "grammar.c" +#line 1777 "grammar.c" break; case YYSYMBOL__STRING_IDENTIFIER_: /* "string identifier" */ #line 316 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1781 "grammar.c" +#line 1783 "grammar.c" break; case YYSYMBOL__STRING_COUNT_: /* "string count" */ #line 313 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1787 "grammar.c" +#line 1789 "grammar.c" break; case YYSYMBOL__STRING_OFFSET_: /* "string offset" */ #line 314 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1793 "grammar.c" +#line 1795 "grammar.c" break; case YYSYMBOL__STRING_LENGTH_: /* "string length" */ #line 315 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1799 "grammar.c" +#line 1801 "grammar.c" break; case YYSYMBOL__STRING_IDENTIFIER_WITH_WILDCARD_: /* "string identifier with wildcard" */ #line 317 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1805 "grammar.c" +#line 1807 "grammar.c" break; case YYSYMBOL__TEXT_STRING_: /* "text string" */ #line 318 "grammar.y" { yr_free(((*yyvaluep).sized_string)); ((*yyvaluep).sized_string) = NULL; } -#line 1811 "grammar.c" +#line 1813 "grammar.c" break; case YYSYMBOL__HEX_STRING_: /* "hex string" */ #line 319 "grammar.y" { yr_free(((*yyvaluep).sized_string)); ((*yyvaluep).sized_string) = NULL; } -#line 1817 "grammar.c" +#line 1819 "grammar.c" break; case YYSYMBOL__REGEXP_: /* "regular expression" */ #line 320 "grammar.y" { yr_free(((*yyvaluep).sized_string)); ((*yyvaluep).sized_string) = NULL; } -#line 1823 "grammar.c" +#line 1825 "grammar.c" break; case YYSYMBOL_string_modifiers: /* string_modifiers */ @@ -1831,7 +1833,7 @@ yydestruct (const char *yymsg, ((*yyvaluep).modifier).alphabet = NULL; } } -#line 1835 "grammar.c" +#line 1837 "grammar.c" break; case YYSYMBOL_string_modifier: /* string_modifier */ @@ -1843,19 +1845,19 @@ yydestruct (const char *yymsg, ((*yyvaluep).modifier).alphabet = NULL; } } -#line 1847 "grammar.c" +#line 1849 "grammar.c" break; case YYSYMBOL_arguments: /* arguments */ #line 322 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1853 "grammar.c" +#line 1855 "grammar.c" break; case YYSYMBOL_arguments_list: /* arguments_list */ #line 323 "grammar.y" { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } -#line 1859 "grammar.c" +#line 1861 "grammar.c" break; default: @@ -2136,7 +2138,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { _yr_compiler_pop_file_name(compiler); } -#line 2140 "grammar.c" +#line 2142 "grammar.c" break; case 9: /* import: "" "text string" */ @@ -2148,7 +2150,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2152 "grammar.c" +#line 2154 "grammar.c" break; case 10: /* @1: %empty */ @@ -2157,7 +2159,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(yr_parser_reduce_rule_declaration_phase_1( yyscanner, (int32_t) (yyvsp[-2].integer), (yyvsp[0].c_string), &(yyval.rule))); } -#line 2161 "grammar.c" +#line 2163 "grammar.c" break; case 11: /* $@2: %empty */ @@ -2175,7 +2177,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); rule->strings = (YR_STRING*) yr_arena_ref_to_ptr( compiler->arena, &(yyvsp[0].string)); } -#line 2179 "grammar.c" +#line 2181 "grammar.c" break; case 12: /* rule: rule_modifiers "" "identifier" @1 tags '{' meta strings $@2 condition '}' */ @@ -2188,7 +2190,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2192 "grammar.c" +#line 2194 "grammar.c" break; case 13: /* meta: %empty */ @@ -2196,7 +2198,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { (yyval.meta) = YR_ARENA_NULL_REF; } -#line 2200 "grammar.c" +#line 2202 "grammar.c" break; case 14: /* meta: "" ':' meta_declarations */ @@ -2211,7 +2213,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.meta) = (yyvsp[0].meta); } -#line 2215 "grammar.c" +#line 2217 "grammar.c" break; case 15: /* strings: %empty */ @@ -2219,7 +2221,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { (yyval.string) = YR_ARENA_NULL_REF; } -#line 2223 "grammar.c" +#line 2225 "grammar.c" break; case 16: /* strings: "" ':' string_declarations */ @@ -2234,31 +2236,31 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.string) = (yyvsp[0].string); } -#line 2238 "grammar.c" +#line 2240 "grammar.c" break; case 18: /* rule_modifiers: %empty */ #line 461 "grammar.y" { (yyval.integer) = 0; } -#line 2244 "grammar.c" +#line 2246 "grammar.c" break; case 19: /* rule_modifiers: rule_modifiers rule_modifier */ #line 462 "grammar.y" { (yyval.integer) = (yyvsp[-1].integer) | (yyvsp[0].integer); } -#line 2250 "grammar.c" +#line 2252 "grammar.c" break; case 20: /* rule_modifier: "" */ #line 467 "grammar.y" { (yyval.integer) = RULE_FLAGS_PRIVATE; } -#line 2256 "grammar.c" +#line 2258 "grammar.c" break; case 21: /* rule_modifier: "" */ #line 468 "grammar.y" { (yyval.integer) = RULE_FLAGS_GLOBAL; } -#line 2262 "grammar.c" +#line 2264 "grammar.c" break; case 22: /* tags: %empty */ @@ -2266,7 +2268,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { (yyval.tag) = YR_ARENA_NULL_REF; } -#line 2270 "grammar.c" +#line 2272 "grammar.c" break; case 23: /* tags: ':' tag_list */ @@ -2282,7 +2284,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.tag) = (yyvsp[0].tag); } -#line 2286 "grammar.c" +#line 2288 "grammar.c" break; case 24: /* tag_list: "identifier" */ @@ -2295,7 +2297,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2299 "grammar.c" +#line 2301 "grammar.c" break; case 25: /* tag_list: tag_list "identifier" */ @@ -2336,19 +2338,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.tag) = (yyvsp[-1].tag); } -#line 2340 "grammar.c" +#line 2342 "grammar.c" break; case 26: /* meta_declarations: meta_declaration */ #line 544 "grammar.y" { (yyval.meta) = (yyvsp[0].meta); } -#line 2346 "grammar.c" +#line 2348 "grammar.c" break; case 27: /* meta_declarations: meta_declarations meta_declaration */ #line 545 "grammar.y" { (yyval.meta) = (yyvsp[-1].meta); } -#line 2352 "grammar.c" +#line 2354 "grammar.c" break; case 28: /* meta_declaration: "identifier" '=' "text string" */ @@ -2369,7 +2371,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2373 "grammar.c" +#line 2375 "grammar.c" break; case 29: /* meta_declaration: "identifier" '=' "integer number" */ @@ -2387,7 +2389,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2391 "grammar.c" +#line 2393 "grammar.c" break; case 30: /* meta_declaration: "identifier" '=' '-' "integer number" */ @@ -2405,7 +2407,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2409 "grammar.c" +#line 2411 "grammar.c" break; case 31: /* meta_declaration: "identifier" '=' "" */ @@ -2423,7 +2425,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2427 "grammar.c" +#line 2429 "grammar.c" break; case 32: /* meta_declaration: "identifier" '=' "" */ @@ -2441,19 +2443,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2445 "grammar.c" +#line 2447 "grammar.c" break; case 33: /* string_declarations: string_declaration */ #line 627 "grammar.y" { (yyval.string) = (yyvsp[0].string); } -#line 2451 "grammar.c" +#line 2453 "grammar.c" break; case 34: /* string_declarations: string_declarations string_declaration */ #line 628 "grammar.y" { (yyval.string) = (yyvsp[-1].string); } -#line 2457 "grammar.c" +#line 2459 "grammar.c" break; case 35: /* $@3: %empty */ @@ -2461,7 +2463,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { compiler->current_line = yyget_lineno(yyscanner); } -#line 2465 "grammar.c" +#line 2467 "grammar.c" break; case 36: /* string_declaration: "string identifier" '=' $@3 "text string" string_modifiers */ @@ -2477,7 +2479,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); compiler->current_line = 0; } -#line 2481 "grammar.c" +#line 2483 "grammar.c" break; case 37: /* $@4: %empty */ @@ -2485,7 +2487,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { compiler->current_line = yyget_lineno(yyscanner); } -#line 2489 "grammar.c" +#line 2491 "grammar.c" break; case 38: /* string_declaration: "string identifier" '=' $@4 "regular expression" regexp_modifiers */ @@ -2505,7 +2507,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); compiler->current_line = 0; } -#line 2509 "grammar.c" +#line 2511 "grammar.c" break; case 39: /* $@5: %empty */ @@ -2513,7 +2515,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); { compiler->current_line = yyget_lineno(yyscanner); } -#line 2517 "grammar.c" +#line 2519 "grammar.c" break; case 40: /* string_declaration: "string identifier" '=' $@5 "hex string" hex_modifiers */ @@ -2533,7 +2535,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); compiler->current_line = 0; } -#line 2537 "grammar.c" +#line 2539 "grammar.c" break; case 41: /* string_modifiers: %empty */ @@ -2544,7 +2546,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).xor_max = 0; (yyval.modifier).alphabet = NULL; } -#line 2548 "grammar.c" +#line 2550 "grammar.c" break; case 42: /* string_modifiers: string_modifiers string_modifier */ @@ -2604,37 +2606,37 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = (yyval.modifier).flags | (yyvsp[0].modifier).flags; } } -#line 2608 "grammar.c" +#line 2610 "grammar.c" break; case 43: /* string_modifier: "" */ #line 760 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_WIDE; } -#line 2614 "grammar.c" +#line 2616 "grammar.c" break; case 44: /* string_modifier: "" */ #line 761 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_ASCII; } -#line 2620 "grammar.c" +#line 2622 "grammar.c" break; case 45: /* string_modifier: "" */ #line 762 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_NO_CASE; } -#line 2626 "grammar.c" +#line 2628 "grammar.c" break; case 46: /* string_modifier: "" */ #line 763 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_FULL_WORD; } -#line 2632 "grammar.c" +#line 2634 "grammar.c" break; case 47: /* string_modifier: "" */ #line 764 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_PRIVATE; } -#line 2638 "grammar.c" +#line 2640 "grammar.c" break; case 48: /* string_modifier: "" */ @@ -2644,7 +2646,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).xor_min = 0; (yyval.modifier).xor_max = 255; } -#line 2648 "grammar.c" +#line 2650 "grammar.c" break; case 49: /* string_modifier: "" '(' "integer number" ')' */ @@ -2664,7 +2666,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).xor_min = (uint8_t) (yyvsp[-1].integer); (yyval.modifier).xor_max = (uint8_t) (yyvsp[-1].integer); } -#line 2668 "grammar.c" +#line 2670 "grammar.c" break; case 50: /* string_modifier: "" '(' "integer number" '-' "integer number" ')' */ @@ -2699,7 +2701,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).xor_min = (uint8_t) (yyvsp[-3].integer); (yyval.modifier).xor_max = (uint8_t) (yyvsp[-1].integer); } -#line 2703 "grammar.c" +#line 2705 "grammar.c" break; case 51: /* string_modifier: "" */ @@ -2708,7 +2710,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = STRING_FLAGS_BASE64; (yyval.modifier).alphabet = ss_new(DEFAULT_BASE64_ALPHABET); } -#line 2712 "grammar.c" +#line 2714 "grammar.c" break; case 52: /* string_modifier: "" '(' "text string" ')' */ @@ -2729,7 +2731,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = STRING_FLAGS_BASE64; (yyval.modifier).alphabet = (yyvsp[-1].sized_string); } -#line 2733 "grammar.c" +#line 2735 "grammar.c" break; case 53: /* string_modifier: "" */ @@ -2738,7 +2740,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = STRING_FLAGS_BASE64_WIDE; (yyval.modifier).alphabet = ss_new(DEFAULT_BASE64_ALPHABET); } -#line 2742 "grammar.c" +#line 2744 "grammar.c" break; case 54: /* string_modifier: "" '(' "text string" ')' */ @@ -2759,13 +2761,13 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = STRING_FLAGS_BASE64_WIDE; (yyval.modifier).alphabet = (yyvsp[-1].sized_string); } -#line 2763 "grammar.c" +#line 2765 "grammar.c" break; case 55: /* regexp_modifiers: %empty */ #line 870 "grammar.y" { (yyval.modifier).flags = 0; } -#line 2769 "grammar.c" +#line 2771 "grammar.c" break; case 56: /* regexp_modifiers: regexp_modifiers regexp_modifier */ @@ -2780,43 +2782,43 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = (yyvsp[-1].modifier).flags | (yyvsp[0].modifier).flags; } } -#line 2784 "grammar.c" +#line 2786 "grammar.c" break; case 57: /* regexp_modifier: "" */ #line 885 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_WIDE; } -#line 2790 "grammar.c" +#line 2792 "grammar.c" break; case 58: /* regexp_modifier: "" */ #line 886 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_ASCII; } -#line 2796 "grammar.c" +#line 2798 "grammar.c" break; case 59: /* regexp_modifier: "" */ #line 887 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_NO_CASE; } -#line 2802 "grammar.c" +#line 2804 "grammar.c" break; case 60: /* regexp_modifier: "" */ #line 888 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_FULL_WORD; } -#line 2808 "grammar.c" +#line 2810 "grammar.c" break; case 61: /* regexp_modifier: "" */ #line 889 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_PRIVATE; } -#line 2814 "grammar.c" +#line 2816 "grammar.c" break; case 62: /* hex_modifiers: %empty */ #line 893 "grammar.y" { (yyval.modifier).flags = 0; } -#line 2820 "grammar.c" +#line 2822 "grammar.c" break; case 63: /* hex_modifiers: hex_modifiers hex_modifier */ @@ -2831,13 +2833,13 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.modifier).flags = (yyvsp[-1].modifier).flags | (yyvsp[0].modifier).flags; } } -#line 2835 "grammar.c" +#line 2837 "grammar.c" break; case 64: /* hex_modifier: "" */ #line 908 "grammar.y" { (yyval.modifier).flags = STRING_FLAGS_PRIVATE; } -#line 2841 "grammar.c" +#line 2843 "grammar.c" break; case 65: /* identifier: "identifier" */ @@ -2936,7 +2938,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2940 "grammar.c" +#line 2942 "grammar.c" break; case 66: /* identifier: identifier '.' "identifier" */ @@ -2988,7 +2990,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 2992 "grammar.c" +#line 2994 "grammar.c" break; case 67: /* identifier: identifier '[' primary_expression ']' */ @@ -3052,7 +3054,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 3056 "grammar.c" +#line 3058 "grammar.c" break; case 68: /* identifier: identifier '(' arguments ')' */ @@ -3097,19 +3099,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 3101 "grammar.c" +#line 3103 "grammar.c" break; case 69: /* arguments: %empty */ #line 1161 "grammar.y" { (yyval.c_string) = yr_strdup(""); } -#line 3107 "grammar.c" +#line 3109 "grammar.c" break; case 70: /* arguments: arguments_list */ #line 1162 "grammar.y" { (yyval.c_string) = (yyvsp[0].c_string); } -#line 3113 "grammar.c" +#line 3115 "grammar.c" break; case 71: /* arguments_list: expression */ @@ -3148,7 +3150,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); assert(compiler->last_error != ERROR_SUCCESS); } } -#line 3152 "grammar.c" +#line 3154 "grammar.c" break; case 72: /* arguments_list: arguments_list ',' expression */ @@ -3201,7 +3203,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.c_string) = (yyvsp[-2].c_string); } -#line 3205 "grammar.c" +#line 3207 "grammar.c" break; case 73: /* regexp: "regular expression" */ @@ -3243,7 +3245,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_REGEXP; } -#line 3247 "grammar.c" +#line 3249 "grammar.c" break; case 74: /* boolean_expression: expression */ @@ -3267,7 +3269,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3271 "grammar.c" +#line 3273 "grammar.c" break; case 75: /* expression: "" */ @@ -3277,7 +3279,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3281 "grammar.c" +#line 3283 "grammar.c" break; case 76: /* expression: "" */ @@ -3287,7 +3289,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3291 "grammar.c" +#line 3293 "grammar.c" break; case 77: /* expression: primary_expression "" regexp */ @@ -3303,7 +3305,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3307 "grammar.c" +#line 3309 "grammar.c" break; case 78: /* expression: primary_expression "" primary_expression */ @@ -3317,7 +3319,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3321 "grammar.c" +#line 3323 "grammar.c" break; case 79: /* expression: primary_expression "" primary_expression */ @@ -3331,7 +3333,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3335 "grammar.c" +#line 3337 "grammar.c" break; case 80: /* expression: primary_expression "" primary_expression */ @@ -3345,7 +3347,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3349 "grammar.c" +#line 3351 "grammar.c" break; case 81: /* expression: primary_expression "" primary_expression */ @@ -3359,7 +3361,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3363 "grammar.c" +#line 3365 "grammar.c" break; case 82: /* expression: primary_expression "" primary_expression */ @@ -3373,7 +3375,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3377 "grammar.c" +#line 3379 "grammar.c" break; case 83: /* expression: primary_expression "" primary_expression */ @@ -3387,7 +3389,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3391 "grammar.c" +#line 3393 "grammar.c" break; case 84: /* expression: primary_expression "" primary_expression */ @@ -3401,7 +3403,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3405 "grammar.c" +#line 3407 "grammar.c" break; case 85: /* expression: "string identifier" */ @@ -3419,7 +3421,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3423 "grammar.c" +#line 3425 "grammar.c" break; case 86: /* expression: "string identifier" "" primary_expression */ @@ -3438,7 +3440,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3442 "grammar.c" +#line 3444 "grammar.c" break; case 87: /* expression: "string identifier" "" range */ @@ -3453,7 +3455,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3457 "grammar.c" +#line 3459 "grammar.c" break; case 88: /* expression: "" for_expression error */ @@ -3474,7 +3476,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); compiler->loop_index = -1; YYERROR; } -#line 3478 "grammar.c" +#line 3480 "grammar.c" break; case 89: /* $@6: %empty */ @@ -3516,7 +3518,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(yr_parser_emit_with_arg( yyscanner, OP_POP_M, var_frame + 2, NULL, NULL)); } -#line 3520 "grammar.c" +#line 3522 "grammar.c" break; case 90: /* $@7: %empty */ @@ -3569,7 +3571,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); loop_ctx->start_ref = loop_start_ref; } -#line 3573 "grammar.c" +#line 3575 "grammar.c" break; case 91: /* expression: "" for_expression $@6 for_iteration ':' $@7 '(' boolean_expression ')' */ @@ -3653,7 +3655,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3657 "grammar.c" +#line 3659 "grammar.c" break; case 92: /* expression: for_expression "" string_set */ @@ -3668,7 +3670,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3672 "grammar.c" +#line 3674 "grammar.c" break; case 93: /* expression: for_expression "" rule_set */ @@ -3683,7 +3685,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3687 "grammar.c" +#line 3689 "grammar.c" break; case 94: /* expression: primary_expression '%' "" string_set */ @@ -3706,7 +3708,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); yr_parser_emit_with_arg(yyscanner, OP_OF_PERCENT, OF_STRING_SET, NULL, NULL); } -#line 3710 "grammar.c" +#line 3712 "grammar.c" break; case 95: /* expression: primary_expression '%' "" rule_set */ @@ -3729,7 +3731,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); yr_parser_emit_with_arg(yyscanner, OP_OF_PERCENT, OF_RULE_SET, NULL, NULL); } -#line 3733 "grammar.c" +#line 3735 "grammar.c" break; case 96: /* expression: for_expression "" string_set "" range */ @@ -3745,30 +3747,54 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3749 "grammar.c" +#line 3751 "grammar.c" break; - case 97: /* expression: "" boolean_expression */ + case 97: /* expression: for_expression "" string_set "" primary_expression */ #line 1767 "grammar.y" + { + if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) + { + yr_compiler_set_error_extra_info(compiler, + "at expression must be an integer"); + + fail_with_error(ERROR_INVALID_VALUE); + } + + if ((yyvsp[-4].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-4].expression).value.integer > (yyvsp[-2].integer)) + { + yywarning(yyscanner, + "expression always false - requesting %" PRId64 " of %" PRId64 ".", (yyvsp[-4].expression).value.integer, (yyvsp[-2].integer)); + } + + yr_parser_emit(yyscanner, OP_OF_FOUND_AT, NULL); + + (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; + } +#line 3775 "grammar.c" + break; + + case 98: /* expression: "" boolean_expression */ +#line 1787 "grammar.y" { yr_parser_emit(yyscanner, OP_NOT, NULL); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3759 "grammar.c" +#line 3785 "grammar.c" break; - case 98: /* expression: "" boolean_expression */ -#line 1773 "grammar.y" + case 99: /* expression: "" boolean_expression */ +#line 1793 "grammar.y" { yr_parser_emit(yyscanner, OP_DEFINED, NULL); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3768 "grammar.c" +#line 3794 "grammar.c" break; - case 99: /* $@8: %empty */ -#line 1778 "grammar.y" + case 100: /* $@8: %empty */ +#line 1798 "grammar.y" { YR_FIXUP* fixup; YR_ARENA_REF jmp_offset_ref; @@ -3790,11 +3816,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fixup->next = compiler->fixup_stack_head; compiler->fixup_stack_head = fixup; } -#line 3794 "grammar.c" +#line 3820 "grammar.c" break; - case 100: /* expression: boolean_expression "" $@8 boolean_expression */ -#line 1800 "grammar.y" + case 101: /* expression: boolean_expression "" $@8 boolean_expression */ +#line 1820 "grammar.y" { YR_FIXUP* fixup; @@ -3817,11 +3843,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3821 "grammar.c" +#line 3847 "grammar.c" break; - case 101: /* $@9: %empty */ -#line 1823 "grammar.y" + case 102: /* $@9: %empty */ +#line 1843 "grammar.y" { YR_FIXUP* fixup; YR_ARENA_REF jmp_offset_ref; @@ -3842,11 +3868,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fixup->next = compiler->fixup_stack_head; compiler->fixup_stack_head = fixup; } -#line 3846 "grammar.c" +#line 3872 "grammar.c" break; - case 102: /* expression: boolean_expression "" $@9 boolean_expression */ -#line 1844 "grammar.y" + case 103: /* expression: boolean_expression "" $@9 boolean_expression */ +#line 1864 "grammar.y" { YR_FIXUP* fixup; @@ -3869,99 +3895,99 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3873 "grammar.c" +#line 3899 "grammar.c" break; - case 103: /* expression: primary_expression "<" primary_expression */ -#line 1867 "grammar.y" + case 104: /* expression: primary_expression "<" primary_expression */ +#line 1887 "grammar.y" { fail_if_error(yr_parser_reduce_operation( yyscanner, "<", (yyvsp[-2].expression), (yyvsp[0].expression))); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3884 "grammar.c" +#line 3910 "grammar.c" break; - case 104: /* expression: primary_expression ">" primary_expression */ -#line 1874 "grammar.y" + case 105: /* expression: primary_expression ">" primary_expression */ +#line 1894 "grammar.y" { fail_if_error(yr_parser_reduce_operation( yyscanner, ">", (yyvsp[-2].expression), (yyvsp[0].expression))); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3895 "grammar.c" +#line 3921 "grammar.c" break; - case 105: /* expression: primary_expression "<=" primary_expression */ -#line 1881 "grammar.y" + case 106: /* expression: primary_expression "<=" primary_expression */ +#line 1901 "grammar.y" { fail_if_error(yr_parser_reduce_operation( yyscanner, "<=", (yyvsp[-2].expression), (yyvsp[0].expression))); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3906 "grammar.c" +#line 3932 "grammar.c" break; - case 106: /* expression: primary_expression ">=" primary_expression */ -#line 1888 "grammar.y" + case 107: /* expression: primary_expression ">=" primary_expression */ +#line 1908 "grammar.y" { fail_if_error(yr_parser_reduce_operation( yyscanner, ">=", (yyvsp[-2].expression), (yyvsp[0].expression))); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3917 "grammar.c" +#line 3943 "grammar.c" break; - case 107: /* expression: primary_expression "==" primary_expression */ -#line 1895 "grammar.y" + case 108: /* expression: primary_expression "==" primary_expression */ +#line 1915 "grammar.y" { fail_if_error(yr_parser_reduce_operation( yyscanner, "==", (yyvsp[-2].expression), (yyvsp[0].expression))); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3928 "grammar.c" +#line 3954 "grammar.c" break; - case 108: /* expression: primary_expression "!=" primary_expression */ -#line 1902 "grammar.y" + case 109: /* expression: primary_expression "!=" primary_expression */ +#line 1922 "grammar.y" { fail_if_error(yr_parser_reduce_operation( yyscanner, "!=", (yyvsp[-2].expression), (yyvsp[0].expression))); (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; } -#line 3939 "grammar.c" +#line 3965 "grammar.c" break; - case 109: /* expression: primary_expression */ -#line 1909 "grammar.y" + case 110: /* expression: primary_expression */ +#line 1929 "grammar.y" { (yyval.expression) = (yyvsp[0].expression); } -#line 3947 "grammar.c" +#line 3973 "grammar.c" break; - case 110: /* expression: '(' expression ')' */ -#line 1913 "grammar.y" + case 111: /* expression: '(' expression ')' */ +#line 1933 "grammar.y" { (yyval.expression) = (yyvsp[-1].expression); } -#line 3955 "grammar.c" +#line 3981 "grammar.c" break; - case 111: /* for_iteration: for_variables "" iterator */ -#line 1920 "grammar.y" + case 112: /* for_iteration: for_variables "" iterator */ +#line 1940 "grammar.y" { (yyval.integer) = FOR_ITERATION_ITERATOR; } -#line 3961 "grammar.c" +#line 3987 "grammar.c" break; - case 112: /* for_iteration: "" string_iterator */ -#line 1922 "grammar.y" + case 113: /* for_iteration: "" string_iterator */ +#line 1942 "grammar.y" { int var_frame; int result = ERROR_SUCCESS; @@ -3982,11 +4008,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = FOR_ITERATION_STRING_SET; } -#line 3986 "grammar.c" +#line 4012 "grammar.c" break; - case 113: /* for_variables: "identifier" */ -#line 1947 "grammar.y" + case 114: /* for_variables: "identifier" */ +#line 1967 "grammar.y" { int result = ERROR_SUCCESS; @@ -4006,11 +4032,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); assert(loop_ctx->vars_count <= YR_MAX_LOOP_VARS); } -#line 4010 "grammar.c" +#line 4036 "grammar.c" break; - case 114: /* for_variables: for_variables ',' "identifier" */ -#line 1967 "grammar.y" + case 115: /* for_variables: for_variables ',' "identifier" */ +#line 1987 "grammar.y" { int result = ERROR_SUCCESS; @@ -4035,11 +4061,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); loop_ctx->vars[loop_ctx->vars_count++].identifier.ptr = (yyvsp[0].c_string); } -#line 4039 "grammar.c" +#line 4065 "grammar.c" break; - case 115: /* iterator: identifier */ -#line 1995 "grammar.y" + case 116: /* iterator: identifier */ +#line 2015 "grammar.y" { YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[compiler->loop_index]; @@ -4113,11 +4139,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4117 "grammar.c" +#line 4143 "grammar.c" break; - case 116: /* iterator: integer_set */ -#line 2069 "grammar.y" + case 117: /* iterator: integer_set */ +#line 2089 "grammar.y" { int result = ERROR_SUCCESS; @@ -4141,11 +4167,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4145 "grammar.c" +#line 4171 "grammar.c" break; - case 117: /* integer_set: '(' integer_enumeration ')' */ -#line 2097 "grammar.y" + case 118: /* integer_set: '(' integer_enumeration ')' */ +#line 2117 "grammar.y" { // $2 contains the number of integers in the enumeration fail_if_error(yr_parser_emit_push_const(yyscanner, (yyvsp[-1].integer))); @@ -4153,20 +4179,20 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(yr_parser_emit( yyscanner, OP_ITER_START_INT_ENUM, NULL)); } -#line 4157 "grammar.c" +#line 4183 "grammar.c" break; - case 118: /* integer_set: range */ -#line 2105 "grammar.y" + case 119: /* integer_set: range */ +#line 2125 "grammar.y" { fail_if_error(yr_parser_emit( yyscanner, OP_ITER_START_INT_RANGE, NULL)); } -#line 4166 "grammar.c" +#line 4192 "grammar.c" break; - case 119: /* range: '(' primary_expression ".." primary_expression ')' */ -#line 2114 "grammar.y" + case 120: /* range: '(' primary_expression ".." primary_expression ')' */ +#line 2134 "grammar.y" { int result = ERROR_SUCCESS; @@ -4205,11 +4231,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4209 "grammar.c" +#line 4235 "grammar.c" break; - case 120: /* integer_enumeration: primary_expression */ -#line 2157 "grammar.y" + case 121: /* integer_enumeration: primary_expression */ +#line 2177 "grammar.y" { int result = ERROR_SUCCESS; @@ -4224,11 +4250,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = 1; } -#line 4228 "grammar.c" +#line 4254 "grammar.c" break; - case 121: /* integer_enumeration: integer_enumeration ',' primary_expression */ -#line 2172 "grammar.y" + case 122: /* integer_enumeration: integer_enumeration ',' primary_expression */ +#line 2192 "grammar.y" { int result = ERROR_SUCCESS; @@ -4243,38 +4269,38 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = (yyvsp[-2].integer) + 1; } -#line 4247 "grammar.c" +#line 4273 "grammar.c" break; - case 122: /* string_iterator: string_set */ -#line 2191 "grammar.y" + case 123: /* string_iterator: string_set */ +#line 2211 "grammar.y" { fail_if_error(yr_parser_emit_push_const(yyscanner, (yyvsp[0].integer))); fail_if_error(yr_parser_emit(yyscanner, OP_ITER_START_STRING_SET, NULL)); } -#line 4257 "grammar.c" +#line 4283 "grammar.c" break; - case 123: /* $@10: %empty */ -#line 2200 "grammar.y" + case 124: /* $@10: %empty */ +#line 2220 "grammar.y" { // Push end-of-list marker yr_parser_emit_push_const(yyscanner, YR_UNDEFINED); } -#line 4266 "grammar.c" +#line 4292 "grammar.c" break; - case 124: /* string_set: '(' $@10 string_enumeration ')' */ -#line 2205 "grammar.y" + case 125: /* string_set: '(' $@10 string_enumeration ')' */ +#line 2225 "grammar.y" { (yyval.integer) = (yyvsp[-1].integer); } -#line 4274 "grammar.c" +#line 4300 "grammar.c" break; - case 125: /* string_set: "" */ -#line 2209 "grammar.y" + case 126: /* string_set: "" */ +#line 2229 "grammar.y" { fail_if_error(yr_parser_emit_push_const(yyscanner, YR_UNDEFINED)); @@ -4284,23 +4310,23 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = count; } -#line 4288 "grammar.c" +#line 4314 "grammar.c" break; - case 126: /* string_enumeration: string_enumeration_item */ -#line 2222 "grammar.y" + case 127: /* string_enumeration: string_enumeration_item */ +#line 2242 "grammar.y" { (yyval.integer) = (yyvsp[0].integer); } -#line 4294 "grammar.c" +#line 4320 "grammar.c" break; - case 127: /* string_enumeration: string_enumeration ',' string_enumeration_item */ -#line 2223 "grammar.y" + case 128: /* string_enumeration: string_enumeration ',' string_enumeration_item */ +#line 2243 "grammar.y" { (yyval.integer) = (yyvsp[-2].integer) + (yyvsp[0].integer); } -#line 4300 "grammar.c" +#line 4326 "grammar.c" break; - case 128: /* string_enumeration_item: "string identifier" */ -#line 2229 "grammar.y" + case 129: /* string_enumeration_item: "string identifier" */ +#line 2249 "grammar.y" { int count = 0; int result = yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string), &count); @@ -4310,11 +4336,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = count; } -#line 4314 "grammar.c" +#line 4340 "grammar.c" break; - case 129: /* string_enumeration_item: "string identifier with wildcard" */ -#line 2239 "grammar.y" + case 130: /* string_enumeration_item: "string identifier with wildcard" */ +#line 2259 "grammar.y" { int count = 0; int result = yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string), &count); @@ -4324,40 +4350,40 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = count; } -#line 4328 "grammar.c" +#line 4354 "grammar.c" break; - case 130: /* $@11: %empty */ -#line 2253 "grammar.y" + case 131: /* $@11: %empty */ +#line 2273 "grammar.y" { // Push end-of-list marker yr_parser_emit_push_const(yyscanner, YR_UNDEFINED); } -#line 4337 "grammar.c" +#line 4363 "grammar.c" break; - case 131: /* rule_set: '(' $@11 rule_enumeration ')' */ -#line 2258 "grammar.y" + case 132: /* rule_set: '(' $@11 rule_enumeration ')' */ +#line 2278 "grammar.y" { (yyval.integer) = (yyvsp[-1].integer); } -#line 4345 "grammar.c" +#line 4371 "grammar.c" break; - case 132: /* rule_enumeration: rule_enumeration_item */ -#line 2265 "grammar.y" + case 133: /* rule_enumeration: rule_enumeration_item */ +#line 2285 "grammar.y" { (yyval.integer) = (yyvsp[0].integer); } -#line 4351 "grammar.c" +#line 4377 "grammar.c" break; - case 133: /* rule_enumeration: rule_enumeration ',' rule_enumeration_item */ -#line 2266 "grammar.y" + case 134: /* rule_enumeration: rule_enumeration ',' rule_enumeration_item */ +#line 2286 "grammar.y" { (yyval.integer) = (yyvsp[-2].integer) + (yyvsp[0].integer); } -#line 4357 "grammar.c" +#line 4383 "grammar.c" break; - case 134: /* rule_enumeration_item: "identifier" */ -#line 2272 "grammar.y" + case 135: /* rule_enumeration_item: "identifier" */ +#line 2292 "grammar.y" { int result = ERROR_SUCCESS; @@ -4390,11 +4416,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = 1; } -#line 4394 "grammar.c" +#line 4420 "grammar.c" break; - case 135: /* rule_enumeration_item: "identifier" '*' */ -#line 2305 "grammar.y" + case 136: /* rule_enumeration_item: "identifier" '*' */ +#line 2325 "grammar.y" { int count = 0; YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( @@ -4415,11 +4441,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.integer) = count; } -#line 4419 "grammar.c" +#line 4445 "grammar.c" break; - case 136: /* for_expression: primary_expression */ -#line 2330 "grammar.y" + case 137: /* for_expression: primary_expression */ +#line 2350 "grammar.y" { if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER && !IS_UNDEFINED((yyvsp[0].expression).value.integer)) { @@ -4467,57 +4493,57 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).value.integer = (yyvsp[0].expression).value.integer; } -#line 4471 "grammar.c" +#line 4497 "grammar.c" break; - case 137: /* for_expression: for_quantifier */ -#line 2378 "grammar.y" + case 138: /* for_expression: for_quantifier */ +#line 2398 "grammar.y" { (yyval.expression).value.integer = (yyvsp[0].expression).value.integer; } -#line 4479 "grammar.c" +#line 4505 "grammar.c" break; - case 138: /* for_quantifier: "" */ -#line 2385 "grammar.y" + case 139: /* for_quantifier: "" */ +#line 2405 "grammar.y" { yr_parser_emit_push_const(yyscanner, YR_UNDEFINED); (yyval.expression).type = EXPRESSION_TYPE_QUANTIFIER; (yyval.expression).value.integer = FOR_EXPRESSION_ALL; } -#line 4489 "grammar.c" +#line 4515 "grammar.c" break; - case 139: /* for_quantifier: "" */ -#line 2391 "grammar.y" + case 140: /* for_quantifier: "" */ +#line 2411 "grammar.y" { yr_parser_emit_push_const(yyscanner, 1); (yyval.expression).type = EXPRESSION_TYPE_QUANTIFIER; (yyval.expression).value.integer = FOR_EXPRESSION_ANY; } -#line 4499 "grammar.c" +#line 4525 "grammar.c" break; - case 140: /* for_quantifier: "" */ -#line 2397 "grammar.y" + case 141: /* for_quantifier: "" */ +#line 2417 "grammar.y" { yr_parser_emit_push_const(yyscanner, 0); (yyval.expression).type = EXPRESSION_TYPE_QUANTIFIER; (yyval.expression).value.integer = FOR_EXPRESSION_NONE; } -#line 4509 "grammar.c" +#line 4535 "grammar.c" break; - case 141: /* primary_expression: '(' primary_expression ')' */ -#line 2407 "grammar.y" + case 142: /* primary_expression: '(' primary_expression ')' */ +#line 2427 "grammar.y" { (yyval.expression) = (yyvsp[-1].expression); } -#line 4517 "grammar.c" +#line 4543 "grammar.c" break; - case 142: /* primary_expression: "" */ -#line 2411 "grammar.y" + case 143: /* primary_expression: "" */ +#line 2431 "grammar.y" { fail_if_error(yr_parser_emit( yyscanner, OP_FILESIZE, NULL)); @@ -4525,11 +4551,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4529 "grammar.c" +#line 4555 "grammar.c" break; - case 143: /* primary_expression: "" */ -#line 2419 "grammar.y" + case 144: /* primary_expression: "" */ +#line 2439 "grammar.y" { yywarning(yyscanner, "using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " @@ -4541,11 +4567,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4545 "grammar.c" +#line 4571 "grammar.c" break; - case 144: /* primary_expression: "integer function" '(' primary_expression ')' */ -#line 2431 "grammar.y" + case 145: /* primary_expression: "integer function" '(' primary_expression ')' */ +#line 2451 "grammar.y" { check_type((yyvsp[-1].expression), EXPRESSION_TYPE_INTEGER, "intXXXX or uintXXXX"); @@ -4559,33 +4585,33 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4563 "grammar.c" +#line 4589 "grammar.c" break; - case 145: /* primary_expression: "integer number" */ -#line 2445 "grammar.y" + case 146: /* primary_expression: "integer number" */ +#line 2465 "grammar.y" { fail_if_error(yr_parser_emit_push_const(yyscanner, (yyvsp[0].integer))); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = (yyvsp[0].integer); } -#line 4574 "grammar.c" +#line 4600 "grammar.c" break; - case 146: /* primary_expression: "floating point number" */ -#line 2452 "grammar.y" + case 147: /* primary_expression: "floating point number" */ +#line 2472 "grammar.y" { fail_if_error(yr_parser_emit_with_arg_double( yyscanner, OP_PUSH, (yyvsp[0].double_), NULL, NULL)); (yyval.expression).type = EXPRESSION_TYPE_FLOAT; } -#line 4585 "grammar.c" +#line 4611 "grammar.c" break; - case 147: /* primary_expression: "text string" */ -#line 2459 "grammar.y" + case 148: /* primary_expression: "text string" */ +#line 2479 "grammar.y" { YR_ARENA_REF ref; @@ -4610,11 +4636,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_STRING; (yyval.expression).value.sized_string_ref = ref; } -#line 4614 "grammar.c" +#line 4640 "grammar.c" break; - case 148: /* primary_expression: "string count" "" range */ -#line 2484 "grammar.y" + case 149: /* primary_expression: "string count" "" range */ +#line 2504 "grammar.y" { int result = yr_parser_reduce_string_identifier( yyscanner, (yyvsp[-2].c_string), OP_COUNT_IN, YR_UNDEFINED); @@ -4626,11 +4652,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4630 "grammar.c" +#line 4656 "grammar.c" break; - case 149: /* primary_expression: "string count" */ -#line 2496 "grammar.y" + case 150: /* primary_expression: "string count" */ +#line 2516 "grammar.y" { int result = yr_parser_reduce_string_identifier( yyscanner, (yyvsp[0].c_string), OP_COUNT, YR_UNDEFINED); @@ -4642,11 +4668,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4646 "grammar.c" +#line 4672 "grammar.c" break; - case 150: /* primary_expression: "string offset" '[' primary_expression ']' */ -#line 2508 "grammar.y" + case 151: /* primary_expression: "string offset" '[' primary_expression ']' */ +#line 2528 "grammar.y" { int result = yr_parser_reduce_string_identifier( yyscanner, (yyvsp[-3].c_string), OP_OFFSET, YR_UNDEFINED); @@ -4658,11 +4684,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4662 "grammar.c" +#line 4688 "grammar.c" break; - case 151: /* primary_expression: "string offset" */ -#line 2520 "grammar.y" + case 152: /* primary_expression: "string offset" */ +#line 2540 "grammar.y" { int result = yr_parser_emit_push_const(yyscanner, 1); @@ -4677,11 +4703,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4681 "grammar.c" +#line 4707 "grammar.c" break; - case 152: /* primary_expression: "string length" '[' primary_expression ']' */ -#line 2535 "grammar.y" + case 153: /* primary_expression: "string length" '[' primary_expression ']' */ +#line 2555 "grammar.y" { int result = yr_parser_reduce_string_identifier( yyscanner, (yyvsp[-3].c_string), OP_LENGTH, YR_UNDEFINED); @@ -4693,11 +4719,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4697 "grammar.c" +#line 4723 "grammar.c" break; - case 153: /* primary_expression: "string length" */ -#line 2547 "grammar.y" + case 154: /* primary_expression: "string length" */ +#line 2567 "grammar.y" { int result = yr_parser_emit_push_const(yyscanner, 1); @@ -4712,11 +4738,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = YR_UNDEFINED; } -#line 4716 "grammar.c" +#line 4742 "grammar.c" break; - case 154: /* primary_expression: identifier */ -#line 2562 "grammar.y" + case 155: /* primary_expression: identifier */ +#line 2582 "grammar.y" { int result = ERROR_SUCCESS; @@ -4759,11 +4785,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4763 "grammar.c" +#line 4789 "grammar.c" break; - case 155: /* primary_expression: '-' primary_expression */ -#line 2605 "grammar.y" + case 156: /* primary_expression: '-' primary_expression */ +#line 2625 "grammar.y" { int result = ERROR_SUCCESS; @@ -4784,11 +4810,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4788 "grammar.c" +#line 4814 "grammar.c" break; - case 156: /* primary_expression: primary_expression '+' primary_expression */ -#line 2626 "grammar.y" + case 157: /* primary_expression: primary_expression '+' primary_expression */ +#line 2646 "grammar.y" { int result = yr_parser_reduce_operation( yyscanner, "+", (yyvsp[-2].expression), (yyvsp[0].expression)); @@ -4823,11 +4849,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4827 "grammar.c" +#line 4853 "grammar.c" break; - case 157: /* primary_expression: primary_expression '-' primary_expression */ -#line 2661 "grammar.y" + case 158: /* primary_expression: primary_expression '-' primary_expression */ +#line 2681 "grammar.y" { int result = yr_parser_reduce_operation( yyscanner, "-", (yyvsp[-2].expression), (yyvsp[0].expression)); @@ -4862,11 +4888,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4866 "grammar.c" +#line 4892 "grammar.c" break; - case 158: /* primary_expression: primary_expression '*' primary_expression */ -#line 2696 "grammar.y" + case 159: /* primary_expression: primary_expression '*' primary_expression */ +#line 2716 "grammar.y" { int result = yr_parser_reduce_operation( yyscanner, "*", (yyvsp[-2].expression), (yyvsp[0].expression)); @@ -4900,11 +4926,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4904 "grammar.c" +#line 4930 "grammar.c" break; - case 159: /* primary_expression: primary_expression '\\' primary_expression */ -#line 2730 "grammar.y" + case 160: /* primary_expression: primary_expression '\\' primary_expression */ +#line 2750 "grammar.y" { int result = yr_parser_reduce_operation( yyscanner, "\\", (yyvsp[-2].expression), (yyvsp[0].expression)); @@ -4929,11 +4955,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 4933 "grammar.c" +#line 4959 "grammar.c" break; - case 160: /* primary_expression: primary_expression '%' primary_expression */ -#line 2755 "grammar.y" + case 161: /* primary_expression: primary_expression '%' primary_expression */ +#line 2775 "grammar.y" { check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "%"); check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "%"); @@ -4950,11 +4976,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(ERROR_DIVISION_BY_ZERO); } } -#line 4954 "grammar.c" +#line 4980 "grammar.c" break; - case 161: /* primary_expression: primary_expression '^' primary_expression */ -#line 2772 "grammar.y" + case 162: /* primary_expression: primary_expression '^' primary_expression */ +#line 2792 "grammar.y" { check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); @@ -4964,11 +4990,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = OPERATION(^, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); } -#line 4968 "grammar.c" +#line 4994 "grammar.c" break; - case 162: /* primary_expression: primary_expression '&' primary_expression */ -#line 2782 "grammar.y" + case 163: /* primary_expression: primary_expression '&' primary_expression */ +#line 2802 "grammar.y" { check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); @@ -4978,11 +5004,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = OPERATION(&, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); } -#line 4982 "grammar.c" +#line 5008 "grammar.c" break; - case 163: /* primary_expression: primary_expression '|' primary_expression */ -#line 2792 "grammar.y" + case 164: /* primary_expression: primary_expression '|' primary_expression */ +#line 2812 "grammar.y" { check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "|"); check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "|"); @@ -4992,11 +5018,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).type = EXPRESSION_TYPE_INTEGER; (yyval.expression).value.integer = OPERATION(|, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); } -#line 4996 "grammar.c" +#line 5022 "grammar.c" break; - case 164: /* primary_expression: '~' primary_expression */ -#line 2802 "grammar.y" + case 165: /* primary_expression: '~' primary_expression */ +#line 2822 "grammar.y" { check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "~"); @@ -5006,11 +5032,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == YR_UNDEFINED) ? YR_UNDEFINED : ~((yyvsp[0].expression).value.integer); } -#line 5010 "grammar.c" +#line 5036 "grammar.c" break; - case 165: /* primary_expression: primary_expression "<<" primary_expression */ -#line 2812 "grammar.y" + case 166: /* primary_expression: primary_expression "<<" primary_expression */ +#line 2832 "grammar.y" { int result; @@ -5030,11 +5056,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 5034 "grammar.c" +#line 5060 "grammar.c" break; - case 166: /* primary_expression: primary_expression ">>" primary_expression */ -#line 2832 "grammar.y" + case 167: /* primary_expression: primary_expression ">>" primary_expression */ +#line 2852 "grammar.y" { int result; @@ -5054,19 +5080,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); fail_if_error(result); } -#line 5058 "grammar.c" +#line 5084 "grammar.c" break; - case 167: /* primary_expression: regexp */ -#line 2852 "grammar.y" + case 168: /* primary_expression: regexp */ +#line 2872 "grammar.y" { (yyval.expression) = (yyvsp[0].expression); } -#line 5066 "grammar.c" +#line 5092 "grammar.c" break; -#line 5070 "grammar.c" +#line 5096 "grammar.c" default: break; } @@ -5290,5 +5316,5 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); return yyresult; } -#line 2857 "grammar.y" +#line 2877 "grammar.y" diff --git a/libyara/grammar.y b/libyara/grammar.y index 56b9ff01cc..7de9344e5f 100644 --- a/libyara/grammar.y +++ b/libyara/grammar.y @@ -1761,6 +1761,26 @@ expression yr_parser_emit(yyscanner, OP_OF_FOUND_IN, NULL); + $$.type = EXPRESSION_TYPE_BOOLEAN; + } + | for_expression _OF_ string_set _AT_ primary_expression + { + if ($5.type != EXPRESSION_TYPE_INTEGER) + { + yr_compiler_set_error_extra_info(compiler, + "at expression must be an integer"); + + fail_with_error(ERROR_INVALID_VALUE); + } + + if ($1.type == EXPRESSION_TYPE_INTEGER && $1.value.integer > $3) + { + yywarning(yyscanner, + "expression always false - requesting %" PRId64 " of %" PRId64 ".", $1.value.integer, $3); + } + + yr_parser_emit(yyscanner, OP_OF_FOUND_AT, NULL); + $$.type = EXPRESSION_TYPE_BOOLEAN; } | _NOT_ boolean_expression diff --git a/libyara/include/yara/exec.h b/libyara/include/yara/exec.h index f913ec1291..e875ac7abb 100644 --- a/libyara/include/yara/exec.h +++ b/libyara/include/yara/exec.h @@ -123,6 +123,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #define OP_OF_FOUND_IN 75 #define OP_COUNT_IN 76 #define OP_DEFINED 77 +#define OP_OF_FOUND_AT 78 #define _OP_EQ 0 #define _OP_NEQ 1 diff --git a/tests/test-rules.c b/tests/test-rules.c index c3ceb627d6..acc1bd92d8 100644 --- a/tests/test-rules.c +++ b/tests/test-rules.c @@ -607,6 +607,22 @@ static void test_warnings() 2 of (a*) \ }"); + assert_warning("rule test { \ + strings: \ + $a = \"AXSERS\" \ + condition: \ + 2 of ($a*) at 0\ + }"); + + assert_error( + "rule test { \ + strings: \ + $a = \"AXSERS\" \ + condition: \ + 1 of them at \"x\"\ + }", + ERROR_INVALID_VALUE); + YR_DEBUG_FPRINTF(1, stderr, "} // %s()\n", __FUNCTION__); } @@ -1642,6 +1658,12 @@ static void test_at() { YR_DEBUG_FPRINTF(1, stderr, "+ %s() {\n", __FUNCTION__); + assert_true_rule( + "rule test { \ + strings: $a = \"miss\" \ + condition: any of them at 0}", + "mississippi"); + assert_true_rule( "rule test { \ strings: $a = \"ssi\" \ From 3f99600c124aa7ea6de92bfae35cc6c913ceaa52 Mon Sep 17 00:00:00 2001 From: Wesley Shields Date: Fri, 23 Sep 2022 16:48:16 -0400 Subject: [PATCH 2/2] Add short blurb to docs about new string set at offset. --- docs/writingrules.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/writingrules.rst b/docs/writingrules.rst index efe986f015..8c5e1d990b 100644 --- a/docs/writingrules.rst +++ b/docs/writingrules.rst @@ -1221,6 +1221,13 @@ integer range, like this: all of ($a*) in (filesize-500..filesize) any of ($a*, $b*) in (1000..2000) +Starting with YARA 4.3.0 it is possible to express a set of strings at a +specific offset, like this: + +.. code-block:: yara + + any of ($a*) at 0 + Applying the same condition to many strings -------------------------------------------