fmt/899 and fmt/900 contain byte sequences we can't convert

[mistydemeo]

Dev Effort

TBCD

Description

fmt/899 (Windows Portable Executable 32-bit) and fmt/900 (Windows Portable Executable 64-bit) contain regexes that trip the __INCOMPATIBLE_SIG__ case in prepare.convert_to_regex. Their byte sequences look like this:

<!-- fmt/899 -->
<ByteSequenceValue>4D5A{126-128500}50450000{20}0B01{66}[0000:1000]</ByteSequenceValue>

<!-- fmt/900 -->
<ByteSequenceValue>4D5A{126-128500}50450000{20}0B02{66}[0000:1000]</ByteSequenceValue>

Specifically, the [0000:1000] sequence trips up convert_to_regex here, where it assumes that the digits following the open square bracket are at most one byte. There's a similar assumption with the portion after the colon.

[jrwdunham]

I have recently run into this issue also. The ultimate problem here seems to be lack of clarity over what exactly is the specification of the regular expression language used to write these ByteSequenceValues.

[ablwr]

hmmmm, anyone know where I can grab some test files?

[ross-spencer]

• Skeleton test suite

[ablwr]

Thanks! I gave up when I got an error previously, but you've convinced me to go back and wrangle it up with ye olde Python2.

[carlwilson]

Hackathon 2023 Review: Selected for initial task list. @sromkey one of the maintainer team might want to take this one?

[Dhwaniartefact]

@carlwilson : I am investigating this issue.