[Forensics-changes] [yara] 169/415: Fix bug causing expressions "str matches /whatever/" evaluating to true when str is an empty string

Hilko Bengen bengen at moszumanska.debian.org
Thu Apr 3 05:43:01 UTC 2014


This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to branch debian
in repository yara.

commit beb13f3688eede08fafec561f8c9951c2cfcb306
Author: Victor M. Alvarez <plusvic at gmail.com>
Date:   Fri May 31 08:42:00 2013 +0000

    Fix bug causing expressions "str matches /whatever/" evaluating to true when str is an empty string
---
 libyara/exec.c       | 10 +++++++++-
 yara-python/tests.py | 13 ++++++++-----
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/libyara/exec.c b/libyara/exec.c
index c78cb36..b0fff36 100644
--- a/libyara/exec.c
+++ b/libyara/exec.c
@@ -547,6 +547,14 @@ int yr_execute_code(
         pop(r2);
         pop(r1);
 
+        count = strlen(UINT64_TO_PTR(char*, r1));
+
+        if (count == 0)
+        {
+          push(FALSE);
+          break;
+        }
+
         result = regex_compile(&re,
             UINT64_TO_PTR(char*, r2),
             FALSE,
@@ -561,7 +569,7 @@ int yr_execute_code(
         result = regex_exec(&re,
             FALSE,
             UINT64_TO_PTR(char*, r1),
-            strlen(UINT64_TO_PTR(char*, r1)));
+            count);
 
         push(result >= 0);
         break;
diff --git a/yara-python/tests.py b/yara-python/tests.py
index 495cf8e..0159859 100644
--- a/yara-python/tests.py
+++ b/yara-python/tests.py
@@ -275,19 +275,22 @@ class TestYara(unittest.TestCase):
     def testExternals(self):
 
         r = yara.compile(source='rule test { condition: ext_int == 15 }', externals={'ext_int': 15})
-        self.assertTrue(r.match(data=PE32_FILE))
+        self.assertTrue(r.match(data='dummy'))
 
         r = yara.compile(source='rule test { condition: ext_bool }', externals={'ext_bool': True})
-        self.assertTrue(r.match(data=PE32_FILE))
+        self.assertTrue(r.match(data='dummy'))
 
         r = yara.compile(source='rule test { condition: ext_bool }', externals={'ext_bool': False})
-        self.assertFalse(r.match(data=PE32_FILE))
+        self.assertFalse(r.match(data='dummy'))
 
         r = yara.compile(source='rule test { condition: ext_str contains "ssi" }', externals={'ext_str': 'mississippi'})
-        self.assertTrue(r.match(data=PE32_FILE))
+        self.assertTrue(r.match(data='dummy'))
+
+        r = yara.compile(source='rule test { condition: ext_str matches /foo/ }', externals={'ext_str': ''})
+        self.assertFalse(r.match(data='dummy'))
 
         r = yara.compile(source='rule test { condition: ext_str matches /ssi(s|p)/ }', externals={'ext_str': 'mississippi'})
-        self.assertTrue(r.match(data=PE32_FILE))
+        self.assertTrue(r.match(data='dummy'))
 
     def testCallback(self):
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git



More information about the forensics-changes mailing list