From 6c410b219c92e01365caa96bcb6a9d0817d32a3e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 05:39:31 +0000 Subject: [PATCH 01/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 56ce25f..74d26d7 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.1.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed as ASL 2.0 @@ -181,6 +181,9 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 - bump to 4.1.3 From 9a8a8d7024bcb36efec266ef68e0369c4cee28c0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 17 Feb 2022 01:37:57 +0100 Subject: [PATCH 02/54] bump to 4.2.0-rc1 --- .gitignore | 1 + sources | 2 +- yara.spec | 18 +++++++++++------- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index a37e177..05edf24 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /yara-4.1.0.tar.gz /yara-4.1.1.tar.gz /yara-4.1.3.tar.gz +/yara-4.2.0-rc1.tar.gz diff --git a/sources b/sources index 769384d..5f1c34b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yara-4.1.3.tar.gz) = 1bfa1787c62dfd9a87fa8db5e8c2fa68f082ae66b16b5373bdcc6bc66b32016fcaffd4baa7e59a7c1f6d3426c972eca9cc22f70d475067d7557b1014a4ab65fc +SHA512 (yara-4.2.0-rc1.tar.gz) = 03bd09d7c020078946101854e68b7f9ca17c04f7a68624e9e15dc476fe209cc11b010108a0e7aea9746f05aabdbb8d6a6a2ffc54516eb9cb86f170c4259934df SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be diff --git a/yara.spec b/yara.spec index 74d26d7..be69986 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,7 @@ Name: yara -Version: 4.1.3 -Release: 2%{?dist} +Version: 4.2.0 +%global upversion 4.2.0-rc1 +Release: 0.rc1.1%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed as ASL 2.0 @@ -14,8 +15,8 @@ URL: http://VirusTotal.github.io/yara/ %global gituser VirusTotal %global gitname yara -# Commit of version 4.1.1 -%global commit 8206dc6f728fe50e21af92cb40e454b68ef6af05 +# Commit of version 4.2.0-rc1 +%global commit 45a2883daad5b40a516b7fa1245beb2a45d586a6 %global shortcommit %(c=%{commit}; echo ${c:0:7}) # additional module for yara @@ -29,7 +30,7 @@ URL: http://VirusTotal.github.io/yara/ # Build from git commit baseline #Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz # Build from git release version -Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.tar.gz#/%{name}-%{upversion}.tar.gz # http://github.com/Koodous/androguard-yara/ Source1: https://github.com/%{androguard_gituser}/%{androguard_gitname}/archive/%{androguard_commit}/%{androguard_gitname}-%{androguard_gitdate}-%{androguard_shortcommit}.tar.gz @@ -106,11 +107,11 @@ developing applications that use %{name}. %prep # autosetup -n %%{gitname}-%%{commit} -p 1 -S git -%autosetup -p 1 -S git +%autosetup -n %{gitname}-%{upversion} -p 1 -S git # Add the Androguard module # %%setup -qn %%{gitname}-%%{commit} -a 1 -D -T -%setup -q -a 1 -D -T +%setup -n %{gitname}-%{upversion} -q -a 1 -D -T pushd %{androguard_gitname}-%{androguard_commit} mkdir -p ../libyara/modules/androguard @@ -181,6 +182,9 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %changelog +* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 +- bump to 4.2.0-rc1 + * Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From ec0a9b468fb423dd05b6e238f3f14ea3a073684e Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 14 Mar 2022 10:34:49 +0100 Subject: [PATCH 03/54] bump to 4.2.0 --- .gitignore | 1 + sources | 2 +- yara.spec | 12 +++++++----- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 05edf24..c6df2c1 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ /yara-4.1.1.tar.gz /yara-4.1.3.tar.gz /yara-4.2.0-rc1.tar.gz +/yara-4.2.0.tar.gz diff --git a/sources b/sources index 5f1c34b..8e2ab13 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yara-4.2.0-rc1.tar.gz) = 03bd09d7c020078946101854e68b7f9ca17c04f7a68624e9e15dc476fe209cc11b010108a0e7aea9746f05aabdbb8d6a6a2ffc54516eb9cb86f170c4259934df +SHA512 (yara-4.2.0.tar.gz) = 24ca707015c77d87126bcaac0991997f6b09403024765d615a06db47191a3f0177e1c1eb4a917ec8412876b61d28f4a708f36999ddd9214c3967968c71ae3b7c SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be diff --git a/yara.spec b/yara.spec index be69986..434d50e 100644 --- a/yara.spec +++ b/yara.spec @@ -1,7 +1,6 @@ Name: yara Version: 4.2.0 -%global upversion 4.2.0-rc1 -Release: 0.rc1.1%{?dist} +Release: 1%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed as ASL 2.0 @@ -30,7 +29,7 @@ URL: http://VirusTotal.github.io/yara/ # Build from git commit baseline #Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz # Build from git release version -Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.tar.gz#/%{name}-%{upversion}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz # http://github.com/Koodous/androguard-yara/ Source1: https://github.com/%{androguard_gituser}/%{androguard_gitname}/archive/%{androguard_commit}/%{androguard_gitname}-%{androguard_gitdate}-%{androguard_shortcommit}.tar.gz @@ -107,11 +106,11 @@ developing applications that use %{name}. %prep # autosetup -n %%{gitname}-%%{commit} -p 1 -S git -%autosetup -n %{gitname}-%{upversion} -p 1 -S git +%autosetup -n %{gitname}-%{version} -p 1 -S git # Add the Androguard module # %%setup -qn %%{gitname}-%%{commit} -a 1 -D -T -%setup -n %{gitname}-%{upversion} -q -a 1 -D -T +%setup -n %{gitname}-%{version} -q -a 1 -D -T pushd %{androguard_gitname}-%{androguard_commit} mkdir -p ../libyara/modules/androguard @@ -182,6 +181,9 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %changelog +* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 +- bump to 4.2.0 + * Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 - bump to 4.2.0-rc1 From 0bd9dc340647bf4d7d8ca60a4cce5cd36dd729dc Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 28 May 2022 16:24:23 +0200 Subject: [PATCH 04/54] Merge in proposals of Mikel Olasagasti Uranga https://src.fedoraproject.org/fork/mikelo2/rpms/yara/c/96f6b94345feed3101a706e6274ef1fbb71795dd --- .gitignore | 1 + sources | 2 +- yara-pull627.patch | 12323 ------------------------------------------- 3 files changed, 2 insertions(+), 12324 deletions(-) delete mode 100644 yara-pull627.patch diff --git a/.gitignore b/.gitignore index c6df2c1..0f7ab56 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ /yara-4.1.3.tar.gz /yara-4.2.0-rc1.tar.gz /yara-4.2.0.tar.gz +/yara-4.2.1.tar.gz diff --git a/sources b/sources index 8e2ab13..7a4e041 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yara-4.2.0.tar.gz) = 24ca707015c77d87126bcaac0991997f6b09403024765d615a06db47191a3f0177e1c1eb4a917ec8412876b61d28f4a708f36999ddd9214c3967968c71ae3b7c +SHA512 (yara-4.2.1.tar.gz) = 036a35d713647b23998135da0d27c13a8876aa44e18e3c9dc99fa425273d7c4a953cbdc78f413f29e8bf818d84b340d0719e241d2a83b7165a16d97e952c45b0 SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be diff --git a/yara-pull627.patch b/yara-pull627.patch deleted file mode 100644 index 0799e1f..0000000 --- a/yara-pull627.patch +++ /dev/null @@ -1,12323 +0,0 @@ -From a07b8943aff6d1daa2af404ba086d7c45fcd76c7 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Sun, 26 Mar 2017 15:27:30 +0200 -Subject: [PATCH 01/36] Reorganize pe / pe_utils - -cherry-picked from - -- 7f1596d5b802567a0b81d95ddd0f6b3ebb234d6a: "Add support for CLI - parsing" -- 94249fc2e2436e66c680446df4bac021929f3a45, "Other minor fixes in - pe_utils.c" -- 04578d76555284d9cc8d0d902f408593e311fb7a, "Add pe_utils.c to Visual - Studio 2015 project" -- 798d37a45822bc3c86dee67899b980c7a2870755, "Fix conditionals" ---- - libyara/Makefile.am | 3 + - libyara/include/yara/pe.h | 61 ++++++++- - libyara/include/yara/pe_utils.h | 30 +++++ - libyara/modules/pe.c | 239 +-------------------------------- - libyara/modules/pe_utils.c | 219 +++++++++++++++++++++++++++++- - windows/vs2015/libyara/libyara.vcxproj | 1 + - 6 files changed, 303 insertions(+), 250 deletions(-) - create mode 100644 libyara/include/yara/pe_utils.h - -diff --git a/libyara/Makefile.am b/libyara/Makefile.am -index be389a2..20dbe4a 100644 ---- a/libyara/Makefile.am -+++ b/libyara/Makefile.am -@@ -16,6 +16,9 @@ if HASH_MODULE - MODULES += modules/hash.c - endif - -+# This isn't really a module, but needs to be compiled with them. -+MODULES += modules/pe_utils.c -+ - # - # Add your modules here: - # -diff --git a/libyara/include/yara/pe.h b/libyara/include/yara/pe.h -index 9afa314..d03e91a 100644 ---- a/libyara/include/yara/pe.h -+++ b/libyara/include/yara/pe.h -@@ -27,6 +27,11 @@ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -+#ifndef YR_PE_H -+#define YR_PE_H -+ -+#include -+ - #pragma pack(push, 1) - - #if defined(_WIN32) || defined(__CYGWIN__) -@@ -285,6 +290,11 @@ typedef struct _IMAGE_OPTIONAL_HEADER64 { - #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b - #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b - -+#define OptionalHeader(pe,field) \ -+ (IS_64BITS_PE(pe) ? \ -+ pe->header64->OptionalHeader.field : \ -+ pe->header->OptionalHeader.field) -+ - - typedef struct _IMAGE_NT_HEADERS32 { - DWORD Signature; -@@ -302,6 +312,50 @@ typedef struct _IMAGE_NT_HEADERS64 { - } IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64; - - -+// -+// Imports are stored in a linked list. Each node (IMPORTED_DLL) contains the -+// name of the DLL and a pointer to another linked list of IMPORTED_FUNCTION -+// structures containing the names of imported functions. -+// -+ -+typedef struct _IMPORTED_DLL -+{ -+ char *name; -+ -+ struct _IMPORTED_FUNCTION *functions; -+ struct _IMPORTED_DLL *next; -+ -+} IMPORTED_DLL, *PIMPORTED_DLL; -+ -+ -+typedef struct _IMPORTED_FUNCTION -+{ -+ char *name; -+ uint8_t has_ordinal; -+ uint16_t ordinal; -+ -+ struct _IMPORTED_FUNCTION *next; -+ -+} IMPORTED_FUNCTION, *PIMPORTED_FUNCTION; -+ -+ -+typedef struct _PE -+{ -+ uint8_t* data; -+ size_t data_size; -+ -+ union { -+ PIMAGE_NT_HEADERS32 header; -+ PIMAGE_NT_HEADERS64 header64; -+ }; -+ -+ YR_OBJECT* object; -+ IMPORTED_DLL* imported_dlls; -+ uint32_t resources; -+ -+} PE; -+ -+ - // IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is - // the same either way. - -@@ -481,10 +535,5 @@ typedef struct _RICH_SIGNATURE { - #define RICH_DANS 0x536e6144 // "DanS" - #define RICH_RICH 0x68636952 // "Rich" - --typedef struct _RICH_DATA { -- size_t len; -- BYTE* raw_data; -- BYTE* clear_data; --} RICH_DATA, *PRICH_DATA; -- - #pragma pack(pop) -+#endif -diff --git a/libyara/include/yara/pe_utils.h b/libyara/include/yara/pe_utils.h -new file mode 100644 -index 0000000..945d843 ---- /dev/null -+++ b/libyara/include/yara/pe_utils.h -@@ -0,0 +1,30 @@ -+#ifndef YR_PE_UTILS_H -+#define YR_PE_UTILS_H -+ -+#include -+ -+#define MAX_PE_SECTIONS 96 -+ -+#define IS_64BITS_PE(pe) \ -+ (pe->header64->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) -+ -+#define fits_in_pe(pe, pointer, size) \ -+ ((size_t) size <= pe->data_size && \ -+ (uint8_t*) (pointer) >= pe->data && \ -+ (uint8_t*) (pointer) <= pe->data + pe->data_size - size) -+ -+#define struct_fits_in_pe(pe, pointer, struct_type) \ -+ fits_in_pe(pe, pointer, sizeof(struct_type)) -+ -+PIMAGE_NT_HEADERS32 pe_get_header(uint8_t* data, size_t data_size); -+PIMAGE_DATA_DIRECTORY pe_get_directory_entry(PE* pe, int entry); -+PIMAGE_DATA_DIRECTORY pe_get_directory_entry(PE* pe, int entry); -+int64_t pe_rva_to_offset(PE* pe, uint64_t rva); -+char *ord_lookup(char *dll, uint16_t ord); -+ -+#if HAVE_LIBCRYPTO -+#include -+time_t ASN1_get_time_t(ASN1_TIME* time); -+#endif -+ -+#endif -diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c -index 1af5562..8c4cb12 100644 ---- a/libyara/modules/pe.c -+++ b/libyara/modules/pe.c -@@ -52,7 +52,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #include - #include - --#include "pe_utils.c" -+#include - - #define MODULE_NAME pe - -@@ -88,7 +88,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #define RESOURCE_ITERATOR_ABORTED 1 - - --#define MAX_PE_SECTIONS 96 - #define MAX_PE_IMPORTS 16384 - #define MAX_PE_EXPORTS 65535 - -@@ -101,24 +100,10 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - ((entry)->OffsetToData & 0x7FFFFFFF) - - --#define IS_64BITS_PE(pe) \ -- (pe->header64->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) -- -- - #define available_space(pe, pointer) \ - (pe->data + pe->data_size - (uint8_t*)(pointer)) - - --#define fits_in_pe(pe, pointer, size) \ -- ((size_t) size <= pe->data_size && \ -- (uint8_t*) (pointer) >= pe->data && \ -- (uint8_t*) (pointer) <= pe->data + pe->data_size - size) -- -- --#define struct_fits_in_pe(pe, pointer, struct_type) \ -- fits_in_pe(pe, pointer, sizeof(struct_type)) -- -- - typedef int (*RESOURCE_CALLBACK_FUNC) ( \ - PIMAGE_RESOURCE_DATA_ENTRY rsrc_data, \ - int rsrc_type, \ -@@ -130,50 +115,6 @@ typedef int (*RESOURCE_CALLBACK_FUNC) ( \ - void* cb_data); - - --// --// Imports are stored in a linked list. Each node (IMPORTED_DLL) contains the --// name of the DLL and a pointer to another linked list of IMPORTED_FUNCTION --// structures containing the names of imported functions. --// -- --typedef struct _IMPORTED_DLL --{ -- char *name; -- -- struct _IMPORTED_FUNCTION *functions; -- struct _IMPORTED_DLL *next; -- --} IMPORTED_DLL, *PIMPORTED_DLL; -- -- --typedef struct _IMPORTED_FUNCTION --{ -- char *name; -- uint8_t has_ordinal; -- uint16_t ordinal; -- -- struct _IMPORTED_FUNCTION *next; -- --} IMPORTED_FUNCTION, *PIMPORTED_FUNCTION; -- -- --typedef struct _PE --{ -- uint8_t* data; -- size_t data_size; -- -- union { -- PIMAGE_NT_HEADERS32 header; -- PIMAGE_NT_HEADERS64 header64; -- }; -- -- YR_OBJECT* object; -- IMPORTED_DLL* imported_dlls; -- uint32_t resources; -- --} PE; -- -- - int wide_string_fits_in_pe( - PE* pe, - char* data) -@@ -193,71 +134,6 @@ int wide_string_fits_in_pe( - } - - --PIMAGE_NT_HEADERS32 pe_get_header( -- uint8_t* data, -- size_t data_size) --{ -- PIMAGE_DOS_HEADER mz_header; -- PIMAGE_NT_HEADERS32 pe_header; -- -- size_t headers_size = 0; -- -- if (data_size < sizeof(IMAGE_DOS_HEADER)) -- return NULL; -- -- mz_header = (PIMAGE_DOS_HEADER) data; -- -- if (mz_header->e_magic != IMAGE_DOS_SIGNATURE) -- return NULL; -- -- if (mz_header->e_lfanew < 0) -- return NULL; -- -- headers_size = mz_header->e_lfanew + \ -- sizeof(pe_header->Signature) + \ -- sizeof(IMAGE_FILE_HEADER); -- -- if (data_size < headers_size) -- return NULL; -- -- pe_header = (PIMAGE_NT_HEADERS32) (data + mz_header->e_lfanew); -- -- headers_size += pe_header->FileHeader.SizeOfOptionalHeader; -- -- if (pe_header->Signature == IMAGE_NT_SIGNATURE && -- (pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_UNKNOWN || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AM33 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARMNT || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM64 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_EBC || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_I386 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_M32R || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPS16 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPSFPU || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPSFPU16 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_POWERPC || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_POWERPCFP || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_R4000 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH3 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH3DSP || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH4 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH5 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_THUMB || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_WCEMIPSV2) && -- data_size > headers_size) -- { -- return pe_header; -- } -- else -- { -- return NULL; -- } --} -- -- - // Parse the rich signature. - // http://www.ntcore.com/files/richsign.htm - -@@ -372,119 +248,6 @@ void pe_parse_rich_signature( - } - - --PIMAGE_DATA_DIRECTORY pe_get_directory_entry( -- PE* pe, -- int entry) --{ -- PIMAGE_DATA_DIRECTORY result; -- -- if (IS_64BITS_PE(pe)) -- result = &pe->header64->OptionalHeader.DataDirectory[entry]; -- else -- result = &pe->header->OptionalHeader.DataDirectory[entry]; -- -- return result; --} -- -- --#define OptionalHeader(pe,field) \ -- (IS_64BITS_PE(pe) ? \ -- pe->header64->OptionalHeader.field : \ -- pe->header->OptionalHeader.field) -- -- --int64_t pe_rva_to_offset( -- PE* pe, -- uint64_t rva) --{ -- PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pe->header); -- -- DWORD lowest_section_rva = 0xffffffff; -- DWORD section_rva = 0; -- DWORD section_offset = 0; -- DWORD section_raw_size = 0; -- -- int64_t result; -- -- int i = 0; -- -- int alignment = 0; -- int rest = 0; -- -- while(i < yr_min(pe->header->FileHeader.NumberOfSections, MAX_PE_SECTIONS)) -- { -- if (struct_fits_in_pe(pe, section, IMAGE_SECTION_HEADER)) -- { -- if (lowest_section_rva > section->VirtualAddress) -- { -- lowest_section_rva = section->VirtualAddress; -- } -- -- if (rva >= section->VirtualAddress && -- section_rva <= section->VirtualAddress) -- { -- // Round section_offset -- // -- // Rounding everything less than 0x200 to 0 as discussed in -- // https://code.google.com/archive/p/corkami/wikis/PE.wiki#PointerToRawData -- // does not work for PE32_FILE from the test suite and for -- // some tinype samples where File Alignment = 4 -- // (http://www.phreedom.org/research/tinype/). -- // -- // If FileAlignment is >= 0x200, it is apparently ignored (see -- // Ero Carreras's pefile.py, PE.adjust_FileAlignment). -- -- alignment = yr_min(OptionalHeader(pe, FileAlignment), 0x200); -- -- section_rva = section->VirtualAddress; -- section_offset = section->PointerToRawData; -- section_raw_size = section->SizeOfRawData; -- -- if (alignment) -- { -- rest = section_offset % alignment; -- -- if (rest) -- section_offset -= rest; -- } -- } -- -- section++; -- i++; -- } -- else -- { -- return -1; -- } -- } -- -- // Everything before the first section seems to get mapped straight -- // relative to ImageBase. -- -- if (rva < lowest_section_rva) -- { -- section_rva = 0; -- section_offset = 0; -- section_raw_size = (DWORD) pe->data_size; -- } -- -- // Many sections, have a raw (on disk) size smaller than their in-memory size. -- // Check for rva's that map to this sparse space, and therefore have no valid -- // associated file offset. -- -- if ((rva - section_rva) >= section_raw_size) -- return -1; -- -- result = section_offset + (rva - section_rva); -- -- // Check that the offset fits within the file. -- if (result >= pe->data_size) -- return -1; -- -- return result; --} -- -- - // Return a pointer to the resource directory string or NULL. - // The callback function will parse this and call set_sized_string(). - // The pointer is guranteed to have enough space to contain the entire string. -diff --git a/libyara/modules/pe_utils.c b/libyara/modules/pe_utils.c -index 81a7ae4..ed69b80 100644 ---- a/libyara/modules/pe_utils.c -+++ b/libyara/modules/pe_utils.c -@@ -1,16 +1,223 @@ -+/* -+Copyright (c) 2014-2015. The YARA Authors. All Rights Reserved. - -+Redistribution and use in source and binary forms, with or without modification, -+are permitted provided that the following conditions are met: -+ -+1. Redistributions of source code must retain the above copyright notice, this -+list of conditions and the following disclaimer. -+ -+2. Redistributions in binary form must reproduce the above copyright notice, -+this list of conditions and the following disclaimer in the documentation and/or -+other materials provided with the distribution. -+ -+3. Neither the name of the copyright holder nor the names of its contributors -+may be used to endorse or promote products derived from this software without -+specific prior written permission. -+ -+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -+*/ - - #include - -+#if defined(_WIN32) -+#define timegm _mkgmtime -+#endif -+ -+#include -+ -+#include -+#include - #include - #include -+#include -+#include - --#if defined(WIN32) --#include --#define strncasecmp _strnicmp --#define timegm _mkgmtime -+#if HAVE_LIBCRYPTO -+#include - #endif - -+PIMAGE_NT_HEADERS32 pe_get_header( -+ uint8_t* data, -+ size_t data_size) -+{ -+ PIMAGE_DOS_HEADER mz_header; -+ PIMAGE_NT_HEADERS32 pe_header; -+ -+ size_t headers_size = 0; -+ -+ if (data_size < sizeof(IMAGE_DOS_HEADER)) -+ return NULL; -+ -+ mz_header = (PIMAGE_DOS_HEADER) data; -+ -+ if (mz_header->e_magic != IMAGE_DOS_SIGNATURE) -+ return NULL; -+ -+ if (mz_header->e_lfanew < 0) -+ return NULL; -+ -+ headers_size = mz_header->e_lfanew + \ -+ sizeof(pe_header->Signature) + \ -+ sizeof(IMAGE_FILE_HEADER); -+ -+ if (data_size < headers_size) -+ return NULL; -+ -+ pe_header = (PIMAGE_NT_HEADERS32) (data + mz_header->e_lfanew); -+ -+ headers_size += pe_header->FileHeader.SizeOfOptionalHeader; -+ -+ if (pe_header->Signature == IMAGE_NT_SIGNATURE && -+ (pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_UNKNOWN || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AM33 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARMNT || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM64 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_EBC || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_I386 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_M32R || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPS16 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPSFPU || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPSFPU16 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_POWERPC || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_POWERPCFP || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_R4000 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH3 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH3DSP || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH4 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH5 || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_THUMB || -+ pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_WCEMIPSV2) && -+ data_size > headers_size) -+ { -+ return pe_header; -+ } -+ else -+ { -+ return NULL; -+ } -+} -+ -+ -+PIMAGE_DATA_DIRECTORY pe_get_directory_entry( -+ PE* pe, -+ int entry) -+{ -+ PIMAGE_DATA_DIRECTORY result; -+ -+ if (IS_64BITS_PE(pe)) -+ result = &pe->header64->OptionalHeader.DataDirectory[entry]; -+ else -+ result = &pe->header->OptionalHeader.DataDirectory[entry]; -+ -+ return result; -+} -+ -+ -+int64_t pe_rva_to_offset( -+ PE* pe, -+ uint64_t rva) -+{ -+ PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pe->header); -+ -+ DWORD lowest_section_rva = 0xffffffff; -+ DWORD section_rva = 0; -+ DWORD section_offset = 0; -+ DWORD section_raw_size = 0; -+ -+ int64_t result; -+ -+ int i = 0; -+ -+ int alignment = 0; -+ int rest = 0; -+ -+ while(i < yr_min(pe->header->FileHeader.NumberOfSections, MAX_PE_SECTIONS)) -+ { -+ if (struct_fits_in_pe(pe, section, IMAGE_SECTION_HEADER)) -+ { -+ if (lowest_section_rva > section->VirtualAddress) -+ { -+ lowest_section_rva = section->VirtualAddress; -+ } -+ -+ if (rva >= section->VirtualAddress && -+ section_rva <= section->VirtualAddress) -+ { -+ // Round section_offset -+ // -+ // Rounding everything less than 0x200 to 0 as discussed in -+ // https://code.google.com/archive/p/corkami/wikis/PE.wiki#PointerToRawData -+ // does not work for PE32_FILE from the test suite and for -+ // some tinype samples where File Alignment = 4 -+ // (http://www.phreedom.org/research/tinype/). -+ // -+ // If FileAlignment is >= 0x200, it is apparently ignored (see -+ // Ero Carreras's pefile.py, PE.adjust_FileAlignment). -+ -+ alignment = yr_min(OptionalHeader(pe, FileAlignment), 0x200); -+ -+ section_rva = section->VirtualAddress; -+ section_offset = section->PointerToRawData; -+ section_raw_size = section->SizeOfRawData; -+ -+ if (alignment) -+ { -+ rest = section_offset % alignment; -+ -+ if (rest) -+ section_offset -= rest; -+ } -+ } -+ -+ section++; -+ i++; -+ } -+ else -+ { -+ return -1; -+ } -+ } -+ -+ // Everything before the first section seems to get mapped straight -+ // relative to ImageBase. -+ -+ if (rva < lowest_section_rva) -+ { -+ section_rva = 0; -+ section_offset = 0; -+ section_raw_size = (DWORD) pe->data_size; -+ } -+ -+ // Many sections, have a raw (on disk) size smaller than their in-memory size. -+ // Check for rva's that map to this sparse space, and therefore have no valid -+ // associated file offset. -+ -+ if ((rva - section_rva) >= section_raw_size) -+ return -1; -+ -+ result = section_offset + (rva - section_rva); -+ -+ // Check that the offset fits within the file. -+ if (result >= pe->data_size) -+ return -1; -+ -+ return result; -+} -+ -+ - #if !HAVE_TIMEGM && !defined(WIN32) - - #include -@@ -57,7 +264,7 @@ time_t timegm( - // Taken from http://stackoverflow.com/questions/10975542/asn1-time-conversion - // and cleaned up. Also uses timegm(3) instead of mktime(3). - --static time_t ASN1_get_time_t( -+time_t ASN1_get_time_t( - ASN1_TIME* time) - { - struct tm t; -@@ -105,7 +312,7 @@ static time_t ASN1_get_time_t( - // "ordN" and if that fails, return NULL. The caller is responsible for freeing - // the returned string. - --static char *ord_lookup( -+char *ord_lookup( - char *dll, - uint16_t ord) - { -diff --git a/windows/vs2015/libyara/libyara.vcxproj b/windows/vs2015/libyara/libyara.vcxproj -index c7e31f7..dc3c59f 100644 ---- a/windows/vs2015/libyara/libyara.vcxproj -+++ b/windows/vs2015/libyara/libyara.vcxproj -@@ -189,6 +189,7 @@ - - - -+ - - - - -From 89dbf689408399d34f160a916c9cc428dc7a66a2 Mon Sep 17 00:00:00 2001 -From: "Victor M. Alvarez" -Date: Tue, 9 Aug 2016 10:28:57 +0200 -Subject: [PATCH 02/36] Change modules macro names in VS 2010 project - -(cherry picked from commit 0216b3a7dfa9f9c0ecabbea2517964a3b2242a9f) ---- - windows/vs2010/libyara/libyara.vcxproj | 8 ++++---- - windows/vs2010/yara.sln | 22 +++++++++++----------- - 2 files changed, 15 insertions(+), 15 deletions(-) - -diff --git a/windows/vs2010/libyara/libyara.vcxproj b/windows/vs2010/libyara/libyara.vcxproj -index 10d1688..f61145a 100644 ---- a/windows/vs2010/libyara/libyara.vcxproj -+++ b/windows/vs2010/libyara/libyara.vcxproj -@@ -74,7 +74,7 @@ - - - -- _CRT_SECURE_NO_WARNINGS;CUCKOO;HASH;HAVE_LIBCRYPTO -+ _CRT_SECURE_NO_WARNINGS;CUCKOO_MODULE;HASH_MODULE;HAVE_LIBCRYPTO - ..\..\..;..\..\..\libyara;..\..\..\libyara\include;..\..\..\windows\include;%(AdditionalIncludeDirectories) - MultiThreadedDebugDLL - 4005;4273;4090; -@@ -98,7 +98,7 @@ - - - -- CUCKOO;HASH;HAVE_LIBCRYPTO -+ CUCKOO_MODULE;HASH_MODULE;HAVE_LIBCRYPTO - ..\..\..;..\..\..\libyara;..\..\..\libyara\include;..\..\..\windows\include;%(AdditionalIncludeDirectories) - 4005;4273;4090; - CompileAsCpp -@@ -120,7 +120,7 @@ - - - -- _CRT_SECURE_NO_WARNINGS;CUCKOO;HASH;HAVE_LIBCRYPTO -+ _CRT_SECURE_NO_WARNINGS;CUCKOO_MODULE;HASH_MODULE;HAVE_LIBCRYPTO - ..\..\..;..\..\..\libyara;..\..\..\libyara\include;..\..\..\windows\include;%(AdditionalIncludeDirectories) - MultiThreadedDLL - 4005;4273;4090;%(DisableSpecificWarnings) -@@ -140,7 +140,7 @@ - - - -- CUCKOO;HASH;HAVE_LIBCRYPTO -+ CUCKOO_MODULE;HASH_MODULE;HAVE_LIBCRYPTO - ..\..\..;..\..\..\libyara;..\..\..\libyara\include;..\..\..\windows\include;%(AdditionalIncludeDirectories) - 4005;4273;4090;%(DisableSpecificWarnings) - CompileAsCpp -diff --git a/windows/vs2010/yara.sln b/windows/vs2010/yara.sln -index 53a4058..054f60c 100644 ---- a/windows/vs2010/yara.sln -+++ b/windows/vs2010/yara.sln -@@ -1,16 +1,16 @@ -  - Microsoft Visual Studio Solution File, Format Version 11.00 - # Visual Studio 2010 --Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libyara", "libyara\libyara.vcxproj", "{B90417B6-5132-DA5C-DBA8-E8A830BE8172}" -+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libyara", "libyara\libyara.vcxproj", "{5E18111F-0F7D-08E0-195A-C60C1C0DD239}" - EndProject - Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "yara", "yara\yara.vcxproj", "{E203D7BB-29B9-4152-9208-BB410983CE8C}" - ProjectSection(ProjectDependencies) = postProject -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172} = {B90417B6-5132-DA5C-DBA8-E8A830BE8172} -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239} = {5E18111F-0F7D-08E0-195A-C60C1C0DD239} - EndProjectSection - EndProject - Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "yarac", "yarac\yarac.vcxproj", "{C2EE445F-2BA5-4E2D-A9E5-44ADE8CAF8E4}" - ProjectSection(ProjectDependencies) = postProject -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172} = {B90417B6-5132-DA5C-DBA8-E8A830BE8172} -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239} = {5E18111F-0F7D-08E0-195A-C60C1C0DD239} - EndProjectSection - EndProject - Global -@@ -21,14 +21,14 @@ Global - Release|x64 = Release|x64 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Debug|Win32.ActiveCfg = Debug|Win32 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Debug|Win32.Build.0 = Debug|Win32 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Debug|x64.ActiveCfg = Debug|x64 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Debug|x64.Build.0 = Debug|x64 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Release|Win32.ActiveCfg = Release|Win32 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Release|Win32.Build.0 = Release|Win32 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Release|x64.ActiveCfg = Release|x64 -- {B90417B6-5132-DA5C-DBA8-E8A830BE8172}.Release|x64.Build.0 = Release|x64 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Debug|Win32.ActiveCfg = Debug|Win32 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Debug|Win32.Build.0 = Debug|Win32 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Debug|x64.ActiveCfg = Debug|x64 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Debug|x64.Build.0 = Debug|x64 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Release|Win32.ActiveCfg = Release|Win32 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Release|Win32.Build.0 = Release|Win32 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Release|x64.ActiveCfg = Release|x64 -+ {5E18111F-0F7D-08E0-195A-C60C1C0DD239}.Release|x64.Build.0 = Release|x64 - {E203D7BB-29B9-4152-9208-BB410983CE8C}.Debug|Win32.ActiveCfg = Debug|Win32 - {E203D7BB-29B9-4152-9208-BB410983CE8C}.Debug|Win32.Build.0 = Debug|Win32 - {E203D7BB-29B9-4152-9208-BB410983CE8C}.Debug|x64.ActiveCfg = Debug|x64 - -From ef0f55912f40180a8ab35eeb576f6f087c9a90a3 Mon Sep 17 00:00:00 2001 -From: ejectck -Date: Wed, 10 Aug 2016 18:46:10 +0200 -Subject: [PATCH 03/36] Added missing apt-get command "install" (#500) - -(cherry picked from commit c9d0819fe2c1f330823c541f118de45f0aad3406) ---- - docs/gettingstarted.rst | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/docs/gettingstarted.rst b/docs/gettingstarted.rst -index 90f14a5..4a518da 100644 ---- a/docs/gettingstarted.rst -+++ b/docs/gettingstarted.rst -@@ -19,12 +19,12 @@ Download the source tarball and get prepared for compiling it:: - Make sure you have ``automake``, ``libtool``, ``make`` and ``gcc`` installed - in your system. Ubuntu and Debian users can use:: - -- sudo apt-get automake libtool make gcc -+ sudo apt-get install automake libtool make gcc - - If you plan to modify YARA's source code you may also need ``flex`` and - ``bison`` for generating lexers and parsers:: - -- sudo apt-get flex bison -+ sudo apt-get install flex bison - - Compile and install YARA in the standard way:: - - -From 06391f0853aeea3bf4582291bea540767a88678b Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Fri, 19 Aug 2016 17:25:14 +0200 -Subject: [PATCH 04/36] Fix issue #506 - -(cherry picked from commit f4b535fa2b8adb73a0494b8f96d16af0c920180d) ---- - libyara/lexer.c | 319 ++++++++++++++++++++++++++--------------------------- - libyara/lexer.l | 2 +- - tests/test-rules.c | 10 +- - 3 files changed, 168 insertions(+), 163 deletions(-) - -diff --git a/libyara/lexer.c b/libyara/lexer.c -index d0f3688..64c3fea 100644 ---- a/libyara/lexer.c -+++ b/libyara/lexer.c -@@ -243,7 +243,7 @@ struct yy_buffer_state - /* Number of characters read into yy_ch_buf, not including EOB - * characters. - */ -- yy_size_t yy_n_chars; -+ int yy_n_chars; - - /* Whether we "own" the buffer - i.e., we know we created it, - * and can realloc() it to grow it, and should free() it to -@@ -455,7 +455,7 @@ static yyconst YY_CHAR yy_ec[256] = - - static yyconst YY_CHAR yy_meta[56] = - { 0, -- 1, 2, 3, 1, 1, 4, 1, 1, 2, 5, -+ 1, 2, 3, 2, 1, 4, 1, 1, 2, 5, - 6, 7, 8, 8, 8, 8, 8, 8, 8, 1, - 9, 1, 1, 10, 10, 11, 12, 12, 13, 11, - 10, 10, 10, 10, 10, 10, 11, 11, 11, 11, -@@ -465,32 +465,32 @@ static yyconst YY_CHAR yy_meta[56] = - - static yyconst flex_uint16_t yy_base[266] = - { 0, -- 0, 0, 53, 54, 55, 58, 343, 342, 337, 330, -- 339, 640, 640, 640, 317, 640, 0, 327, 325, 52, -- 52, 58, 45, 312, 50, 0, 0, 48, 289, 289, -- 50, 290, 32, 61, 278, 32, 273, 269, 269, 59, -- 276, 275, 298, 0, 640, 640, 70, 0, 640, 61, -- 297, 0, 640, 640, 296, 286, 640, 0, 640, 296, -- 640, 640, 0, 109, 0, 280, 279, 0, 640, 640, -- 640, 640, 640, 0, 0, 263, 67, 269, 0, 259, -- 253, 259, 258, 252, 256, 252, 250, 58, 246, 239, -- 69, 0, 0, 246, 244, 238, 247, 231, 236, 243, -+ 0, 0, 53, 54, 55, 58, 347, 346, 341, 340, -+ 349, 640, 640, 640, 327, 640, 0, 337, 329, 52, -+ 52, 58, 45, 318, 50, 0, 0, 48, 295, 295, -+ 50, 296, 32, 61, 290, 32, 287, 283, 283, 59, -+ 282, 279, 305, 0, 640, 640, 70, 0, 640, 61, -+ 304, 0, 640, 640, 303, 289, 640, 0, 640, 299, -+ 640, 640, 0, 109, 0, 283, 282, 0, 640, 640, -+ 640, 640, 640, 0, 0, 266, 67, 272, 0, 262, -+ 256, 262, 261, 255, 259, 255, 253, 58, 249, 248, -+ 69, 0, 0, 255, 253, 241, 250, 236, 241, 248, - - 63, 96, 0, 640, 640, 640, 640, 640, 0, 0, -- 230, 640, 640, 640, 0, 640, 0, 116, 640, 0, -- 0, 0, 0, 228, 102, 219, 217, 227, 0, 221, -- 228, 213, 215, 123, 221, 222, 221, 0, 202, 215, -- 210, 207, 212, 199, 210, 640, 234, 148, 0, 204, -- 203, 210, 188, 204, 186, 181, 199, 184, 180, 207, -- 209, 191, 184, 0, 167, 181, 0, 168, 0, 0, -- 0, 199, 196, 202, 0, 101, 0, 640, 0, 160, -- 167, 158, 0, 162, 157, 159, 151, 163, 161, 160, -- 159, 146, 155, 256, 128, 152, 148, 146, 135, 142, -- -- 0, 0, 151, 0, 139, 0, 143, 131, 310, 0, -- 364, 164, 131, 0, 132, 128, 132, 135, 135, 166, -- 0, 0, 0, 134, 149, 135, 136, 142, 78, 0, -- 73, 0, 0, 108, 143, 0, 146, 0, 31, 640, -+ 233, 640, 640, 640, 0, 640, 0, 116, 640, 0, -+ 0, 0, 0, 239, 102, 232, 230, 232, 0, 224, -+ 231, 219, 221, 123, 223, 224, 223, 0, 204, 217, -+ 212, 209, 214, 201, 212, 640, 236, 148, 0, 206, -+ 205, 212, 190, 206, 194, 189, 201, 186, 182, 211, -+ 213, 193, 186, 0, 177, 191, 0, 171, 0, 0, -+ 0, 202, 198, 202, 0, 101, 0, 640, 0, 162, -+ 169, 163, 0, 163, 158, 160, 152, 164, 162, 161, -+ 160, 147, 156, 256, 128, 153, 149, 147, 136, 143, -+ -+ 0, 0, 152, 0, 140, 0, 150, 132, 310, 0, -+ 364, 165, 131, 0, 133, 129, 135, 136, 135, 157, -+ 0, 0, 0, 134, 148, 135, 136, 143, 78, 0, -+ 73, 0, 0, 108, 144, 0, 158, 0, 31, 640, - 0, 640, 419, 432, 445, 458, 464, 469, 477, 484, - 489, 494, 505, 515, 527, 540, 552, 565, 578, 584, - 587, 597, 610, 616, 626 -@@ -547,30 +547,30 @@ static yyconst flex_uint16_t yy_nxt[696] = - 109, 118, 118, 118, 118, 118, 118, 118, 118, 118, - 118, 118, 118, 118, 118, 151, 160, 194, 161, 195, - 227, 162, 228, 235, 194, 236, 195, 237, 152, 175, -- 101, 227, 173, 228, 211, 227, 175, 228, 173, 176, -- 175, 175, 175, 175, 175, 175, 175, 234, 233, 232, -- 231, 175, 175, 230, 229, 226, 223, 222, 175, 175, -- 175, 175, 175, 175, 221, 220, 219, 218, 217, 216, -- 215, 208, 207, 206, 205, 204, 203, 202, 201, 200, -- -- 199, 198, 177, 175, 101, 197, 196, 101, 173, 193, -- 175, 192, 191, 176, 175, 175, 175, 175, 175, 175, -- 175, 190, 189, 162, 162, 175, 175, 188, 187, 186, -- 185, 184, 175, 175, 175, 175, 175, 175, 183, 182, -- 181, 180, 179, 173, 171, 134, 170, 169, 168, 167, -- 166, 165, 164, 163, 159, 158, 177, 210, 211, 157, -- 156, 155, 154, 153, 210, 212, 150, 213, 210, 210, -- 210, 210, 210, 210, 210, 112, 145, 144, 143, 210, -- 210, 142, 141, 140, 139, 136, 210, 210, 210, 210, -- 210, 210, 135, 132, 131, 130, 129, 128, 127, 126, -- -- 125, 124, 121, 119, 119, 59, 242, 116, 114, 102, -- 214, 210, 211, 100, 99, 96, 95, 94, 210, 212, -- 91, 213, 210, 210, 210, 210, 210, 210, 210, 86, -- 81, 80, 71, 210, 210, 61, 59, 57, 242, 55, -- 210, 210, 210, 210, 210, 210, 55, 53, 53, 242, -- 242, 242, 242, 242, 242, 242, 242, 242, 242, 242, -- 242, 242, 242, 242, 214, 211, 211, 242, 242, 242, -+ 101, 175, 227, 173, 228, 211, 175, 173, 234, 176, -+ 175, 175, 175, 175, 175, 175, 175, 227, 233, 228, -+ 232, 175, 175, 231, 230, 229, 226, 223, 175, 175, -+ 175, 175, 175, 175, 222, 221, 220, 219, 218, 217, -+ 216, 215, 208, 207, 206, 205, 204, 203, 202, 201, -+ -+ 200, 199, 177, 175, 101, 175, 198, 197, 196, 101, -+ 175, 173, 193, 176, 175, 175, 175, 175, 175, 175, -+ 175, 192, 191, 190, 189, 175, 175, 162, 162, 188, -+ 187, 186, 175, 175, 175, 175, 175, 175, 185, 184, -+ 183, 182, 181, 180, 179, 173, 171, 134, 170, 169, -+ 168, 167, 166, 165, 164, 163, 177, 210, 211, 210, -+ 159, 158, 157, 156, 210, 212, 155, 213, 210, 210, -+ 210, 210, 210, 210, 210, 154, 153, 150, 112, 210, -+ 210, 145, 144, 143, 142, 141, 210, 210, 210, 210, -+ 210, 210, 140, 139, 136, 135, 132, 131, 130, 129, -+ -+ 128, 127, 126, 125, 124, 121, 119, 119, 59, 242, -+ 214, 210, 211, 210, 116, 114, 102, 100, 210, 212, -+ 99, 213, 210, 210, 210, 210, 210, 210, 210, 96, -+ 95, 94, 91, 210, 210, 86, 81, 80, 71, 61, -+ 210, 210, 210, 210, 210, 210, 59, 57, 242, 55, -+ 55, 53, 53, 242, 242, 242, 242, 242, 242, 242, -+ 242, 242, 242, 242, 214, 211, 211, 211, 242, 242, - 242, 242, 211, 173, 242, 224, 211, 211, 211, 211, - 211, 211, 211, 242, 242, 242, 242, 211, 211, 242, - 242, 242, 242, 242, 211, 211, 211, 211, 211, 211, -@@ -628,30 +628,30 @@ static yyconst flex_int16_t yy_chk[696] = - 47, 64, 64, 64, 64, 64, 64, 64, 118, 118, - 118, 118, 118, 118, 118, 125, 134, 195, 134, 195, - 213, 134, 213, 224, 226, 224, 226, 227, 125, 148, -- 148, 228, 235, 228, 235, 237, 148, 237, 225, 148, -- 148, 148, 148, 148, 148, 148, 148, 220, 219, 218, -- 217, 148, 148, 216, 215, 212, 208, 207, 148, 148, -- 148, 148, 148, 148, 205, 203, 200, 199, 198, 197, -- 196, 193, 192, 191, 190, 189, 188, 187, 186, 185, -- -- 184, 182, 148, 174, 174, 181, 180, 173, 172, 168, -- 174, 166, 165, 174, 174, 174, 174, 174, 174, 174, -- 174, 163, 162, 161, 160, 174, 174, 159, 158, 157, -- 156, 155, 174, 174, 174, 174, 174, 174, 154, 153, -- 152, 151, 150, 147, 145, 144, 143, 142, 141, 140, -- 139, 137, 136, 135, 133, 132, 174, 194, 194, 131, -- 130, 128, 127, 126, 194, 194, 124, 194, 194, 194, -- 194, 194, 194, 194, 194, 111, 100, 99, 98, 194, -- 194, 97, 96, 95, 94, 90, 194, 194, 194, 194, -- 194, 194, 89, 87, 86, 85, 84, 83, 82, 81, -- -- 80, 78, 76, 67, 66, 60, 56, 55, 51, 43, -- 194, 209, 209, 42, 41, 39, 38, 37, 209, 209, -- 35, 209, 209, 209, 209, 209, 209, 209, 209, 32, -- 30, 29, 24, 209, 209, 19, 18, 15, 11, 10, -- 209, 209, 209, 209, 209, 209, 9, 8, 7, 0, -- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -- 0, 0, 0, 0, 209, 211, 211, 0, 0, 0, -+ 148, 148, 228, 235, 228, 235, 148, 225, 220, 148, -+ 148, 148, 148, 148, 148, 148, 148, 237, 219, 237, -+ 218, 148, 148, 217, 216, 215, 212, 208, 148, 148, -+ 148, 148, 148, 148, 207, 205, 203, 200, 199, 198, -+ 197, 196, 193, 192, 191, 190, 189, 188, 187, 186, -+ -+ 185, 184, 148, 174, 174, 174, 182, 181, 180, 173, -+ 174, 172, 168, 174, 174, 174, 174, 174, 174, 174, -+ 174, 166, 165, 163, 162, 174, 174, 161, 160, 159, -+ 158, 157, 174, 174, 174, 174, 174, 174, 156, 155, -+ 154, 153, 152, 151, 150, 147, 145, 144, 143, 142, -+ 141, 140, 139, 137, 136, 135, 174, 194, 194, 194, -+ 133, 132, 131, 130, 194, 194, 128, 194, 194, 194, -+ 194, 194, 194, 194, 194, 127, 126, 124, 111, 194, -+ 194, 100, 99, 98, 97, 96, 194, 194, 194, 194, -+ 194, 194, 95, 94, 90, 89, 87, 86, 85, 84, -+ -+ 83, 82, 81, 80, 78, 76, 67, 66, 60, 56, -+ 194, 209, 209, 209, 55, 51, 43, 42, 209, 209, -+ 41, 209, 209, 209, 209, 209, 209, 209, 209, 39, -+ 38, 37, 35, 209, 209, 32, 30, 29, 24, 19, -+ 209, 209, 209, 209, 209, 209, 18, 15, 11, 10, -+ 9, 8, 7, 0, 0, 0, 0, 0, 0, 0, -+ 0, 0, 0, 0, 209, 211, 211, 211, 0, 0, - 0, 0, 211, 211, 0, 211, 211, 211, 211, 211, - 211, 211, 211, 0, 0, 0, 0, 211, 211, 0, - 0, 0, 0, 0, 211, 211, 211, 211, 211, 211, -@@ -736,7 +736,7 @@ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - /* Lexical analyzer for YARA */ --#line 20 "lexer.l" -+#line 33 "lexer.l" - - /* Disable warnings for unused functions in this file. - -@@ -754,11 +754,10 @@ with noyywrap then we can remove this pragma. - #include - #include - #include --#include - #include - #include - -- -+#include - #include - #include - #include -@@ -810,7 +809,7 @@ with noyywrap then we can remove this pragma. - - - --#line 801 "lexer.c" -+#line 813 "lexer.c" - - #define INITIAL 0 - #define str 1 -@@ -843,7 +842,7 @@ struct yyguts_t - size_t yy_buffer_stack_max; /**< capacity of stack. */ - YY_BUFFER_STATE * yy_buffer_stack; /**< Stack as an array. */ - char yy_hold_char; -- yy_size_t yy_n_chars; -+ int yy_n_chars; - yy_size_t yyleng_r; - char *yy_c_buf_p; - int yy_init; -@@ -1087,10 +1086,10 @@ YY_DECL - } - - { --#line 111 "lexer.l" -+#line 123 "lexer.l" - - --#line 1081 "lexer.c" -+#line 1093 "lexer.c" - - while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */ - { -@@ -1157,208 +1156,208 @@ YY_DECL - - case 1: - YY_RULE_SETUP --#line 113 "lexer.l" -+#line 125 "lexer.l" - { return _DOT_DOT_; } - YY_BREAK - case 2: - YY_RULE_SETUP --#line 114 "lexer.l" -+#line 126 "lexer.l" - { return _LT_; } - YY_BREAK - case 3: - YY_RULE_SETUP --#line 115 "lexer.l" -+#line 127 "lexer.l" - { return _GT_; } - YY_BREAK - case 4: - YY_RULE_SETUP --#line 116 "lexer.l" -+#line 128 "lexer.l" - { return _LE_; } - YY_BREAK - case 5: - YY_RULE_SETUP --#line 117 "lexer.l" -+#line 129 "lexer.l" - { return _GE_; } - YY_BREAK - case 6: - YY_RULE_SETUP --#line 118 "lexer.l" -+#line 130 "lexer.l" - { return _EQ_; } - YY_BREAK - case 7: - YY_RULE_SETUP --#line 119 "lexer.l" -+#line 131 "lexer.l" - { return _NEQ_; } - YY_BREAK - case 8: - YY_RULE_SETUP --#line 120 "lexer.l" -+#line 132 "lexer.l" - { return _SHIFT_LEFT_; } - YY_BREAK - case 9: - YY_RULE_SETUP --#line 121 "lexer.l" -+#line 133 "lexer.l" - { return _SHIFT_RIGHT_; } - YY_BREAK - case 10: - YY_RULE_SETUP --#line 122 "lexer.l" -+#line 134 "lexer.l" - { return _PRIVATE_; } - YY_BREAK - case 11: - YY_RULE_SETUP --#line 123 "lexer.l" -+#line 135 "lexer.l" - { return _GLOBAL_; } - YY_BREAK - case 12: - YY_RULE_SETUP --#line 124 "lexer.l" -+#line 136 "lexer.l" - { return _RULE_; } - YY_BREAK - case 13: - YY_RULE_SETUP --#line 125 "lexer.l" -+#line 137 "lexer.l" - { return _META_; } - YY_BREAK - case 14: - YY_RULE_SETUP --#line 126 "lexer.l" -+#line 138 "lexer.l" - { return _STRINGS_; } - YY_BREAK - case 15: - YY_RULE_SETUP --#line 127 "lexer.l" -+#line 139 "lexer.l" - { return _ASCII_; } - YY_BREAK - case 16: - YY_RULE_SETUP --#line 128 "lexer.l" -+#line 140 "lexer.l" - { return _WIDE_; } - YY_BREAK - case 17: - YY_RULE_SETUP --#line 129 "lexer.l" -+#line 141 "lexer.l" - { return _FULLWORD_; } - YY_BREAK - case 18: - YY_RULE_SETUP --#line 130 "lexer.l" -+#line 142 "lexer.l" - { return _NOCASE_; } - YY_BREAK - case 19: - YY_RULE_SETUP --#line 131 "lexer.l" -+#line 143 "lexer.l" - { return _CONDITION_; } - YY_BREAK - case 20: - YY_RULE_SETUP --#line 132 "lexer.l" -+#line 144 "lexer.l" - { return _TRUE_; } - YY_BREAK - case 21: - YY_RULE_SETUP --#line 133 "lexer.l" -+#line 145 "lexer.l" - { return _FALSE_; } - YY_BREAK - case 22: - YY_RULE_SETUP --#line 134 "lexer.l" -+#line 146 "lexer.l" - { return _NOT_; } - YY_BREAK - case 23: - YY_RULE_SETUP --#line 135 "lexer.l" -+#line 147 "lexer.l" - { return _AND_; } - YY_BREAK - case 24: - YY_RULE_SETUP --#line 136 "lexer.l" -+#line 148 "lexer.l" - { return _OR_; } - YY_BREAK - case 25: - YY_RULE_SETUP --#line 137 "lexer.l" -+#line 149 "lexer.l" - { return _AT_; } - YY_BREAK - case 26: - YY_RULE_SETUP --#line 138 "lexer.l" -+#line 150 "lexer.l" - { return _IN_; } - YY_BREAK - case 27: - YY_RULE_SETUP --#line 139 "lexer.l" -+#line 151 "lexer.l" - { return _OF_; } - YY_BREAK - case 28: - YY_RULE_SETUP --#line 140 "lexer.l" -+#line 152 "lexer.l" - { return _THEM_; } - YY_BREAK - case 29: - YY_RULE_SETUP --#line 141 "lexer.l" -+#line 153 "lexer.l" - { return _FOR_; } - YY_BREAK - case 30: - YY_RULE_SETUP --#line 142 "lexer.l" -+#line 154 "lexer.l" - { return _ALL_; } - YY_BREAK - case 31: - YY_RULE_SETUP --#line 143 "lexer.l" -+#line 155 "lexer.l" - { return _ANY_; } - YY_BREAK - case 32: - YY_RULE_SETUP --#line 144 "lexer.l" -+#line 156 "lexer.l" - { return _ENTRYPOINT_; } - YY_BREAK - case 33: - YY_RULE_SETUP --#line 145 "lexer.l" -+#line 157 "lexer.l" - { return _FILESIZE_; } - YY_BREAK - case 34: - YY_RULE_SETUP --#line 146 "lexer.l" -+#line 158 "lexer.l" - { return _MATCHES_; } - YY_BREAK - case 35: - YY_RULE_SETUP --#line 147 "lexer.l" -+#line 159 "lexer.l" - { return _CONTAINS_; } - YY_BREAK - case 36: - YY_RULE_SETUP --#line 148 "lexer.l" -+#line 160 "lexer.l" - { return _IMPORT_; } - YY_BREAK - case 37: - YY_RULE_SETUP --#line 151 "lexer.l" -+#line 163 "lexer.l" - { BEGIN(comment); } - YY_BREAK - case 38: - YY_RULE_SETUP --#line 152 "lexer.l" -+#line 164 "lexer.l" - { BEGIN(INITIAL); } - YY_BREAK - case 39: - /* rule 39 can match eol */ - YY_RULE_SETUP --#line 153 "lexer.l" -+#line 165 "lexer.l" - { /* skip comments */ } - YY_BREAK - case 40: - YY_RULE_SETUP --#line 156 "lexer.l" -+#line 168 "lexer.l" - { /* skip single-line comments */ } - YY_BREAK - case 41: - YY_RULE_SETUP --#line 159 "lexer.l" -+#line 171 "lexer.l" - { - yyextra->lex_buf_ptr = yyextra->lex_buf; - yyextra->lex_buf_len = 0; -@@ -1368,12 +1367,12 @@ YY_RULE_SETUP - case 42: - /* rule 42 can match eol */ - YY_RULE_SETUP --#line 166 "lexer.l" -+#line 178 "lexer.l" - { YYTEXT_TO_BUFFER; } - YY_BREAK - case 43: - YY_RULE_SETUP --#line 169 "lexer.l" -+#line 181 "lexer.l" - { - - char buffer[1024]; -@@ -1489,7 +1488,7 @@ case YY_STATE_EOF(str): - case YY_STATE_EOF(regexp): - case YY_STATE_EOF(include): - case YY_STATE_EOF(comment): --#line 281 "lexer.l" -+#line 293 "lexer.l" - { - - YR_COMPILER* compiler = yara_yyget_extra(yyscanner); -@@ -1511,7 +1510,7 @@ case YY_STATE_EOF(comment): - YY_BREAK - case 44: - YY_RULE_SETUP --#line 301 "lexer.l" -+#line 313 "lexer.l" - { - - yylval->c_string = yr_strdup(yytext); -@@ -1527,7 +1526,7 @@ YY_RULE_SETUP - YY_BREAK - case 45: - YY_RULE_SETUP --#line 315 "lexer.l" -+#line 327 "lexer.l" - { - - yylval->c_string = yr_strdup(yytext); -@@ -1543,7 +1542,7 @@ YY_RULE_SETUP - YY_BREAK - case 46: - YY_RULE_SETUP --#line 329 "lexer.l" -+#line 341 "lexer.l" - { - - yylval->c_string = yr_strdup(yytext); -@@ -1560,7 +1559,7 @@ YY_RULE_SETUP - YY_BREAK - case 47: - YY_RULE_SETUP --#line 344 "lexer.l" -+#line 356 "lexer.l" - { - - yylval->c_string = yr_strdup(yytext); -@@ -1577,7 +1576,7 @@ YY_RULE_SETUP - YY_BREAK - case 48: - YY_RULE_SETUP --#line 359 "lexer.l" -+#line 371 "lexer.l" - { - - yylval->c_string = yr_strdup(yytext); -@@ -1594,7 +1593,7 @@ YY_RULE_SETUP - YY_BREAK - case 49: - YY_RULE_SETUP --#line 374 "lexer.l" -+#line 386 "lexer.l" - { - - char* text = yytext; -@@ -1635,7 +1634,7 @@ YY_RULE_SETUP - YY_BREAK - case 50: - YY_RULE_SETUP --#line 413 "lexer.l" -+#line 425 "lexer.l" - { - - if (strlen(yytext) > 128) -@@ -1656,7 +1655,7 @@ YY_RULE_SETUP - YY_BREAK - case 51: - YY_RULE_SETUP --#line 432 "lexer.l" -+#line 444 "lexer.l" - { - - #ifdef _MSC_VER -@@ -1678,7 +1677,7 @@ YY_RULE_SETUP - YY_BREAK - case 52: - YY_RULE_SETUP --#line 451 "lexer.l" -+#line 463 "lexer.l" - { - yylval->double_ = atof(yytext); - return _DOUBLE_; -@@ -1686,7 +1685,7 @@ YY_RULE_SETUP - YY_BREAK - case 53: - YY_RULE_SETUP --#line 456 "lexer.l" -+#line 468 "lexer.l" - { - - yylval->integer = xtoi(yytext + 2); -@@ -1695,7 +1694,7 @@ YY_RULE_SETUP - YY_BREAK - case 54: - YY_RULE_SETUP --#line 463 "lexer.l" -+#line 475 "lexer.l" - { /* saw closing quote - all done */ - - ALLOC_SIZED_STRING(s, yyextra->lex_buf_len); -@@ -1711,7 +1710,7 @@ YY_RULE_SETUP - YY_BREAK - case 55: - YY_RULE_SETUP --#line 477 "lexer.l" -+#line 489 "lexer.l" - { - - LEX_CHECK_SPACE_OK("\t", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1721,7 +1720,7 @@ YY_RULE_SETUP - YY_BREAK - case 56: - YY_RULE_SETUP --#line 485 "lexer.l" -+#line 497 "lexer.l" - { - - LEX_CHECK_SPACE_OK("\n", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1731,7 +1730,7 @@ YY_RULE_SETUP - YY_BREAK - case 57: - YY_RULE_SETUP --#line 493 "lexer.l" -+#line 505 "lexer.l" - { - - LEX_CHECK_SPACE_OK("\"", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1741,7 +1740,7 @@ YY_RULE_SETUP - YY_BREAK - case 58: - YY_RULE_SETUP --#line 501 "lexer.l" -+#line 513 "lexer.l" - { - - LEX_CHECK_SPACE_OK("\\", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1751,7 +1750,7 @@ YY_RULE_SETUP - YY_BREAK - case 59: - YY_RULE_SETUP --#line 509 "lexer.l" -+#line 521 "lexer.l" - { - - int result; -@@ -1764,13 +1763,13 @@ YY_RULE_SETUP - YY_BREAK - case 60: - YY_RULE_SETUP --#line 520 "lexer.l" -+#line 532 "lexer.l" - { YYTEXT_TO_BUFFER; } - YY_BREAK - case 61: - /* rule 61 can match eol */ - YY_RULE_SETUP --#line 523 "lexer.l" -+#line 535 "lexer.l" - { - - yyerror(yyscanner, compiler, "unterminated string"); -@@ -1780,7 +1779,7 @@ YY_RULE_SETUP - case 62: - /* rule 62 can match eol */ - YY_RULE_SETUP --#line 529 "lexer.l" -+#line 541 "lexer.l" - { - - yyerror(yyscanner, compiler, "illegal escape sequence"); -@@ -1788,7 +1787,7 @@ YY_RULE_SETUP - YY_BREAK - case 63: - YY_RULE_SETUP --#line 535 "lexer.l" -+#line 547 "lexer.l" - { - - if (yyextra->lex_buf_len > 0) -@@ -1816,7 +1815,7 @@ YY_RULE_SETUP - YY_BREAK - case 64: - YY_RULE_SETUP --#line 561 "lexer.l" -+#line 573 "lexer.l" - { - - LEX_CHECK_SPACE_OK("/", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1826,7 +1825,7 @@ YY_RULE_SETUP - YY_BREAK - case 65: - YY_RULE_SETUP --#line 569 "lexer.l" -+#line 581 "lexer.l" - { - - LEX_CHECK_SPACE_OK("\\.", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1837,13 +1836,13 @@ YY_RULE_SETUP - YY_BREAK - case 66: - YY_RULE_SETUP --#line 578 "lexer.l" -+#line 590 "lexer.l" - { YYTEXT_TO_BUFFER; } - YY_BREAK - case 67: - /* rule 67 can match eol */ - YY_RULE_SETUP --#line 581 "lexer.l" -+#line 593 "lexer.l" - { - - yyerror(yyscanner, compiler, "unterminated regular expression"); -@@ -1852,7 +1851,7 @@ YY_RULE_SETUP - YY_BREAK - case 68: - YY_RULE_SETUP --#line 588 "lexer.l" -+#line 600 "lexer.l" - { - - yyextra->lex_buf_ptr = yyextra->lex_buf; -@@ -1862,7 +1861,7 @@ YY_RULE_SETUP - YY_BREAK - case 69: - YY_RULE_SETUP --#line 596 "lexer.l" -+#line 608 "lexer.l" - { - - yyextra->lex_buf_ptr = yyextra->lex_buf; -@@ -1873,7 +1872,7 @@ YY_RULE_SETUP - case 70: - /* rule 70 can match eol */ - YY_RULE_SETUP --#line 604 "lexer.l" -+#line 616 "lexer.l" - { - // Match hex-digits with whitespace or comments. The latter are stripped - // out by hex_lexer.l -@@ -1889,12 +1888,12 @@ YY_RULE_SETUP - case 71: - /* rule 71 can match eol */ - YY_RULE_SETUP --#line 617 "lexer.l" -+#line 629 "lexer.l" - /* skip whitespace */ - YY_BREAK - case 72: - YY_RULE_SETUP --#line 619 "lexer.l" -+#line 631 "lexer.l" - { - - if (yytext[0] >= 32 && yytext[0] < 127) -@@ -1910,10 +1909,10 @@ YY_RULE_SETUP - YY_BREAK - case 73: - YY_RULE_SETUP --#line 632 "lexer.l" -+#line 644 "lexer.l" - ECHO; - YY_BREAK --#line 1904 "lexer.c" -+#line 1916 "lexer.c" - - case YY_END_OF_BUFFER: - { -@@ -2169,9 +2168,9 @@ static int yy_get_next_buffer (yyscan_t yyscanner) - else - ret_val = EOB_ACT_CONTINUE_SCAN; - -- if ((yy_size_t) (yyg->yy_n_chars + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { -+ if ((int) (yyg->yy_n_chars + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { - /* Extend the array by 50%, plus the number we really need. */ -- yy_size_t new_size = yyg->yy_n_chars + number_to_move + (yyg->yy_n_chars >> 1); -+ int new_size = yyg->yy_n_chars + number_to_move + (yyg->yy_n_chars >> 1); - YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yara_yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ,yyscanner ); - if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) - YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); -@@ -2571,7 +2570,7 @@ static void yara_yyensure_buffer_stack (yyscan_t yyscanner) - * scanner will even need a stack. We use 2 instead of 1 to avoid an - * immediate realloc on the next call. - */ -- num_to_alloc = 1; // After all that talk, this was set to 1 anyways... -+ num_to_alloc = 1; /* After all that talk, this was set to 1 anyways... */ - yyg->yy_buffer_stack = (struct yy_buffer_state**)yara_yyalloc - (num_to_alloc * sizeof(struct yy_buffer_state*) - , yyscanner); -@@ -3062,7 +3061,7 @@ void yara_yyfree (void * ptr , yyscan_t yyscanner) - - #define YYTABLES_NAME "yytables" - --#line 632 "lexer.l" -+#line 644 "lexer.l" - - - -diff --git a/libyara/lexer.l b/libyara/lexer.l -index 640304a..b22af75 100644 ---- a/libyara/lexer.l -+++ b/libyara/lexer.l -@@ -613,7 +613,7 @@ u?int(8|16|32)(be)? { - } - - --\{(({hexdigit}|[ \-|\?\[\]\(\)\n\t]|\/\*[^*]*\*\/)+|\/\/.*)+\} { -+\{(({hexdigit}|[ \-|\?\[\]\(\)\n\r\t]|\/\*[^*]*\*\/)+|\/\/.*)+\} { - // Match hex-digits with whitespace or comments. The latter are stripped - // out by hex_lexer.l - -diff --git a/tests/test-rules.c b/tests/test-rules.c -index 8aa3058..a305f06 100644 ---- a/tests/test-rules.c -+++ b/tests/test-rules.c -@@ -463,7 +463,7 @@ static void test_hex_strings() - - assert_true_rule( - "rule test { \ -- strings: $a = { 31 32 [-] // Inline comment\n\ -+ strings: $a = { 31 32 [-] // Inline comment\n\r \ - 38 39 } \ - condition: $a }", - "1234567890"); -@@ -476,13 +476,19 @@ static void test_hex_strings() - - assert_true_rule( - "rule test { \ -- strings: $a = { 31 32 /* Inline multi-line\n\ -+ strings: $a = { 31 32 /* Inline multi-line\n\r \ - comment */ [-] 38 39 } \ - condition: $a }", - "1234567890"); - - assert_true_rule( - "rule test { \ -+ strings: $a = {\n 31 32 [-] 38 39 \n\r} \ -+ condition: $a }", -+ "1234567890"); -+ -+ assert_true_rule( -+ "rule test { \ - strings: $a = { 31 32 [-] 33 34 [-] 38 39 } \ - condition: $a }", - "1234567890"); - -From 755b51fac03638c689bc6652e97fdc7f12ee9d2a Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Fri, 19 Aug 2016 18:10:45 +0200 -Subject: [PATCH 05/36] Fix issue #507 - -(cherry picked from commit 64930a6ea2678e7ce2d1374c984a661eb0d388fa) ---- - libyara/parser.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/libyara/parser.c b/libyara/parser.c -index 1123869..0ced96e 100644 ---- a/libyara/parser.c -+++ b/libyara/parser.c -@@ -970,6 +970,14 @@ int yr_parser_reduce_import( - - char* name; - -+ if (module_name->length == 0) -+ { -+ compiler->last_result = ERROR_UNKNOWN_MODULE; -+ yr_compiler_set_error_extra_info(compiler, ""); -+ -+ return ERROR_UNKNOWN_MODULE; -+ } -+ - module_structure = (YR_OBJECT*) yr_hash_table_lookup( - compiler->objects_table, - module_name->c_string, - -From 64711f99a6666f0cdcefd382560f84ad0e6b9014 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Thu, 25 Aug 2016 21:47:54 +0200 -Subject: [PATCH 06/36] Check error codes returned by json_unpack - -This avoid segfaults with JSON files not conforming the expected format. - -(cherry picked from commit be8ed5ff51013fc8e9a5d9b80f2ee5e884e95c49) ---- - libyara/modules/cuckoo.c | 26 ++++++++++++++------------ - 1 file changed, 14 insertions(+), 12 deletions(-) - -diff --git a/libyara/modules/cuckoo.c b/libyara/modules/cuckoo.c -index 53d30f4..2351889 100644 ---- a/libyara/modules/cuckoo.c -+++ b/libyara/modules/cuckoo.c -@@ -57,12 +57,13 @@ define_function(network_dns_lookup) - - json_array_foreach(dns_json, index, value) - { -- json_unpack(value, "{s:s, s:s}", "ip", &ip, "hostname", &hostname); -- -- if (yr_re_match(regexp_argument(1), hostname) > 0) -+ if (json_unpack(value, "{s:s, s:s}", "ip", &ip, "hostname", &hostname) == 0) - { -- result = 1; -- break; -+ if (yr_re_match(regexp_argument(1), hostname) > 0) -+ { -+ result = 1; -+ break; -+ } - } - } - -@@ -91,14 +92,15 @@ uint64_t http_request( - - json_array_foreach(http_json, index, value) - { -- json_unpack(value, "{s:s, s:s}", "uri", &uri, "method", &method); -- -- if (((methods & METHOD_GET && strcasecmp(method, "get") == 0) || -- (methods & METHOD_POST && strcasecmp(method, "post") == 0)) && -- yr_re_match(uri_regexp, uri) > 0) -+ if (json_unpack(value, "{s:s, s:s}", "uri", &uri, "method", &method) == 0) - { -- result = 1; -- break; -+ if (((methods & METHOD_GET && strcasecmp(method, "get") == 0) || -+ (methods & METHOD_POST && strcasecmp(method, "post") == 0)) && -+ yr_re_match(uri_regexp, uri) > 0) -+ { -+ result = 1; -+ break; -+ } - } - } - - -From d7420a1eec1cef1f6ee0182b49ff5b37423b226f Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Fri, 26 Aug 2016 10:43:54 +0200 -Subject: [PATCH 07/36] Better error reporting for regexps exceeding - RE_MAX_SPLIT_ID - -(cherry picked from commit 5122eb96201b07cd9643bbbc51c625112b3f455e) ---- - libyara/compiler.c | 5 +++++ - libyara/include/yara/error.h | 1 + - libyara/re.c | 2 +- - 3 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/libyara/compiler.c b/libyara/compiler.c -index dd4c251..4c0fdeb 100644 ---- a/libyara/compiler.c -+++ b/libyara/compiler.c -@@ -959,6 +959,11 @@ YR_API char* yr_compiler_get_error_message( - buffer_size, - "regular expression is too large"); - break; -+ case ERROR_REGULAR_EXPRESSION_TOO_COMPLEX: -+ snprintf( -+ buffer, -+ buffer_size, -+ "regular expression is too complex"); - - } - -diff --git a/libyara/include/yara/error.h b/libyara/include/yara/error.h -index 75d56ed..a5476b0 100644 ---- a/libyara/include/yara/error.h -+++ b/libyara/include/yara/error.h -@@ -87,6 +87,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #define ERROR_TOO_MANY_RE_FIBERS 46 - #define ERROR_COULD_NOT_READ_PROCESS_MEMORY 47 - #define ERROR_INVALID_EXTERNAL_VARIABLE_TYPE 48 -+#define ERROR_REGULAR_EXPRESSION_TOO_COMPLEX 49 - - - #define FAIL_ON_ERROR(x) { \ -diff --git a/libyara/re.c b/libyara/re.c -index a33d989..a0cf4f9 100644 ---- a/libyara/re.c -+++ b/libyara/re.c -@@ -650,7 +650,7 @@ int _yr_emit_split( - assert(opcode == RE_OPCODE_SPLIT_A || opcode == RE_OPCODE_SPLIT_B); - - if (emit_context->next_split_id == RE_MAX_SPLIT_ID) -- return ERROR_INTERNAL_FATAL_ERROR; -+ return ERROR_REGULAR_EXPRESSION_TOO_COMPLEX; - - FAIL_ON_ERROR(yr_arena_write_data( - emit_context->arena, - -From 94faf4c6b398503f9c1d06ba2403e3bbc3cb3609 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Wed, 14 Sep 2016 16:35:59 +0200 -Subject: [PATCH 08/36] Fix issue #517 - -Double free caused by regexps starting with a null character. - -(cherry picked from commit 658aec6227a61b848f66b004ebd16fadcf24b5e7) ---- - libyara/lexer.c | 28 +++++++++++++++------------- - libyara/lexer.l | 2 ++ - 2 files changed, 17 insertions(+), 13 deletions(-) - -diff --git a/libyara/lexer.c b/libyara/lexer.c -index 64c3fea..03f0465 100644 ---- a/libyara/lexer.c -+++ b/libyara/lexer.c -@@ -1783,11 +1783,12 @@ YY_RULE_SETUP - { - - yyerror(yyscanner, compiler, "illegal escape sequence"); -+ yyterminate(); - } - YY_BREAK - case 63: - YY_RULE_SETUP --#line 547 "lexer.l" -+#line 548 "lexer.l" - { - - if (yyextra->lex_buf_len > 0) -@@ -1807,6 +1808,7 @@ YY_RULE_SETUP - else - { - yyerror(yyscanner, compiler, "empty regular expression"); -+ yyterminate(); - } - - BEGIN(INITIAL); -@@ -1815,7 +1817,7 @@ YY_RULE_SETUP - YY_BREAK - case 64: - YY_RULE_SETUP --#line 573 "lexer.l" -+#line 575 "lexer.l" - { - - LEX_CHECK_SPACE_OK("/", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1825,7 +1827,7 @@ YY_RULE_SETUP - YY_BREAK - case 65: - YY_RULE_SETUP --#line 581 "lexer.l" -+#line 583 "lexer.l" - { - - LEX_CHECK_SPACE_OK("\\.", yyextra->lex_buf_len, LEX_BUF_SIZE); -@@ -1836,13 +1838,13 @@ YY_RULE_SETUP - YY_BREAK - case 66: - YY_RULE_SETUP --#line 590 "lexer.l" -+#line 592 "lexer.l" - { YYTEXT_TO_BUFFER; } - YY_BREAK - case 67: - /* rule 67 can match eol */ - YY_RULE_SETUP --#line 593 "lexer.l" -+#line 595 "lexer.l" - { - - yyerror(yyscanner, compiler, "unterminated regular expression"); -@@ -1851,7 +1853,7 @@ YY_RULE_SETUP - YY_BREAK - case 68: - YY_RULE_SETUP --#line 600 "lexer.l" -+#line 602 "lexer.l" - { - - yyextra->lex_buf_ptr = yyextra->lex_buf; -@@ -1861,7 +1863,7 @@ YY_RULE_SETUP - YY_BREAK - case 69: - YY_RULE_SETUP --#line 608 "lexer.l" -+#line 610 "lexer.l" - { - - yyextra->lex_buf_ptr = yyextra->lex_buf; -@@ -1872,7 +1874,7 @@ YY_RULE_SETUP - case 70: - /* rule 70 can match eol */ - YY_RULE_SETUP --#line 616 "lexer.l" -+#line 618 "lexer.l" - { - // Match hex-digits with whitespace or comments. The latter are stripped - // out by hex_lexer.l -@@ -1888,12 +1890,12 @@ YY_RULE_SETUP - case 71: - /* rule 71 can match eol */ - YY_RULE_SETUP --#line 629 "lexer.l" -+#line 631 "lexer.l" - /* skip whitespace */ - YY_BREAK - case 72: - YY_RULE_SETUP --#line 631 "lexer.l" -+#line 633 "lexer.l" - { - - if (yytext[0] >= 32 && yytext[0] < 127) -@@ -1909,10 +1911,10 @@ YY_RULE_SETUP - YY_BREAK - case 73: - YY_RULE_SETUP --#line 644 "lexer.l" -+#line 646 "lexer.l" - ECHO; - YY_BREAK --#line 1916 "lexer.c" -+#line 1918 "lexer.c" - - case YY_END_OF_BUFFER: - { -@@ -3061,7 +3063,7 @@ void yara_yyfree (void * ptr , yyscan_t yyscanner) - - #define YYTABLES_NAME "yytables" - --#line 644 "lexer.l" -+#line 646 "lexer.l" - - - -diff --git a/libyara/lexer.l b/libyara/lexer.l -index b22af75..a184606 100644 ---- a/libyara/lexer.l -+++ b/libyara/lexer.l -@@ -541,6 +541,7 @@ u?int(8|16|32)(be)? { - \\(.|\n) { - - yyerror(yyscanner, compiler, "illegal escape sequence"); -+ yyterminate(); - } - - -@@ -563,6 +564,7 @@ u?int(8|16|32)(be)? { - else - { - yyerror(yyscanner, compiler, "empty regular expression"); -+ yyterminate(); - } - - BEGIN(INITIAL); - -From 95e2ff2ccf2dba1df88030ed363dc4acdaa404d1 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Wed, 21 Sep 2016 09:53:51 +0200 -Subject: [PATCH 09/36] Fix issue #524 - -(cherry picked from commit f99a26ce5e0dd4be7206a9e490293403aeecf111) ---- - libyara/include/yara/pe.h | 51 +------------------------ - libyara/include/yara/pe_utils.h | 82 ++++++++++++++++++++++++++++++++++++++--- - 2 files changed, 78 insertions(+), 55 deletions(-) - -diff --git a/libyara/include/yara/pe.h b/libyara/include/yara/pe.h -index d03e91a..001da4d 100644 ---- a/libyara/include/yara/pe.h -+++ b/libyara/include/yara/pe.h -@@ -290,11 +290,6 @@ typedef struct _IMAGE_OPTIONAL_HEADER64 { - #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b - #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b - --#define OptionalHeader(pe,field) \ -- (IS_64BITS_PE(pe) ? \ -- pe->header64->OptionalHeader.field : \ -- pe->header->OptionalHeader.field) -- - - typedef struct _IMAGE_NT_HEADERS32 { - DWORD Signature; -@@ -311,51 +306,6 @@ typedef struct _IMAGE_NT_HEADERS64 { - - } IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64; - -- --// --// Imports are stored in a linked list. Each node (IMPORTED_DLL) contains the --// name of the DLL and a pointer to another linked list of IMPORTED_FUNCTION --// structures containing the names of imported functions. --// -- --typedef struct _IMPORTED_DLL --{ -- char *name; -- -- struct _IMPORTED_FUNCTION *functions; -- struct _IMPORTED_DLL *next; -- --} IMPORTED_DLL, *PIMPORTED_DLL; -- -- --typedef struct _IMPORTED_FUNCTION --{ -- char *name; -- uint8_t has_ordinal; -- uint16_t ordinal; -- -- struct _IMPORTED_FUNCTION *next; -- --} IMPORTED_FUNCTION, *PIMPORTED_FUNCTION; -- -- --typedef struct _PE --{ -- uint8_t* data; -- size_t data_size; -- -- union { -- PIMAGE_NT_HEADERS32 header; -- PIMAGE_NT_HEADERS64 header64; -- }; -- -- YR_OBJECT* object; -- IMPORTED_DLL* imported_dlls; -- uint32_t resources; -- --} PE; -- -- - // IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is - // the same either way. - -@@ -535,5 +485,6 @@ typedef struct _RICH_SIGNATURE { - #define RICH_DANS 0x536e6144 // "DanS" - #define RICH_RICH 0x68636952 // "Rich" - -+ - #pragma pack(pop) - #endif -diff --git a/libyara/include/yara/pe_utils.h b/libyara/include/yara/pe_utils.h -index 945d843..88e5a61 100644 ---- a/libyara/include/yara/pe_utils.h -+++ b/libyara/include/yara/pe_utils.h -@@ -5,9 +5,61 @@ - - #define MAX_PE_SECTIONS 96 - -+ - #define IS_64BITS_PE(pe) \ - (pe->header64->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) - -+ -+#define OptionalHeader(pe,field) \ -+ (IS_64BITS_PE(pe) ? \ -+ pe->header64->OptionalHeader.field : \ -+ pe->header->OptionalHeader.field) -+ -+ -+// -+// Imports are stored in a linked list. Each node (IMPORTED_DLL) contains the -+// name of the DLL and a pointer to another linked list of IMPORTED_FUNCTION -+// structures containing the names of imported functions. -+// -+ -+typedef struct _IMPORTED_DLL -+{ -+ char *name; -+ -+ struct _IMPORTED_FUNCTION *functions; -+ struct _IMPORTED_DLL *next; -+ -+} IMPORTED_DLL, *PIMPORTED_DLL; -+ -+ -+typedef struct _IMPORTED_FUNCTION -+{ -+ char *name; -+ uint8_t has_ordinal; -+ uint16_t ordinal; -+ -+ struct _IMPORTED_FUNCTION *next; -+ -+} IMPORTED_FUNCTION, *PIMPORTED_FUNCTION; -+ -+ -+typedef struct _PE -+{ -+ uint8_t* data; -+ size_t data_size; -+ -+ union { -+ PIMAGE_NT_HEADERS32 header; -+ PIMAGE_NT_HEADERS64 header64; -+ }; -+ -+ YR_OBJECT* object; -+ IMPORTED_DLL* imported_dlls; -+ uint32_t resources; -+ -+} PE; -+ -+ - #define fits_in_pe(pe, pointer, size) \ - ((size_t) size <= pe->data_size && \ - (uint8_t*) (pointer) >= pe->data && \ -@@ -16,11 +68,31 @@ - #define struct_fits_in_pe(pe, pointer, struct_type) \ - fits_in_pe(pe, pointer, sizeof(struct_type)) - --PIMAGE_NT_HEADERS32 pe_get_header(uint8_t* data, size_t data_size); --PIMAGE_DATA_DIRECTORY pe_get_directory_entry(PE* pe, int entry); --PIMAGE_DATA_DIRECTORY pe_get_directory_entry(PE* pe, int entry); --int64_t pe_rva_to_offset(PE* pe, uint64_t rva); --char *ord_lookup(char *dll, uint16_t ord); -+ -+PIMAGE_NT_HEADERS32 pe_get_header( -+ uint8_t* data, -+ size_t data_size); -+ -+ -+PIMAGE_DATA_DIRECTORY pe_get_directory_entry( -+ PE* pe, -+ int entry); -+ -+ -+PIMAGE_DATA_DIRECTORY pe_get_directory_entry( -+ PE* pe, -+ int entry); -+ -+ -+int64_t pe_rva_to_offset( -+ PE* pe, -+ uint64_t rva); -+ -+ -+char *ord_lookup( -+ char *dll, -+ uint16_t ord); -+ - - #if HAVE_LIBCRYPTO - #include - -From 86c141654fc4d35e5b76edf5a66e2c72e0ce0307 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Fri, 23 Sep 2016 11:47:38 +0200 -Subject: [PATCH 10/36] Fix warning caused by uninitalized array - -(cherry-picked from commit 542eff653586ab62088f612845edcd9005719ad2) ---- - libyara/re_lexer.c | 76 +++++++++++++++++++++++++++--------------------------- - libyara/re_lexer.l | 2 +- - 2 files changed, 39 insertions(+), 39 deletions(-) - -diff --git a/libyara/re_lexer.c b/libyara/re_lexer.c -index 7707178..6d784e6 100644 ---- a/libyara/re_lexer.c -+++ b/libyara/re_lexer.c -@@ -533,7 +533,7 @@ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - /* Lexical analyzer for regular expressions */ --#line 20 "re_lexer.l" -+#line 33 "re_lexer.l" - - /* Disable warnings for unused functions in this file. - -@@ -582,7 +582,7 @@ int read_escaped_char( - - #define YY_NO_UNISTD_H 1 - --#line 573 "re_lexer.c" -+#line 586 "re_lexer.c" - - #define INITIAL 0 - #define char_class 1 -@@ -856,10 +856,10 @@ YY_DECL - } - - { --#line 86 "re_lexer.l" -+#line 99 "re_lexer.l" - - --#line 850 "re_lexer.c" -+#line 863 "re_lexer.c" - - while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */ - { -@@ -926,7 +926,7 @@ YY_DECL - - case 1: - YY_RULE_SETUP --#line 88 "re_lexer.l" -+#line 101 "re_lexer.l" - { - - // Examples: {3,8} {0,5} {,5} {7,} -@@ -962,7 +962,7 @@ YY_RULE_SETUP - YY_BREAK - case 2: - YY_RULE_SETUP --#line 122 "re_lexer.l" -+#line 135 "re_lexer.l" - { - - // Example: {10} -@@ -982,7 +982,7 @@ YY_RULE_SETUP - YY_BREAK - case 3: - YY_RULE_SETUP --#line 140 "re_lexer.l" -+#line 153 "re_lexer.l" - { - - // Start of a negated character class. Example: [^abcd] -@@ -994,7 +994,7 @@ YY_RULE_SETUP - YY_BREAK - case 4: - YY_RULE_SETUP --#line 149 "re_lexer.l" -+#line 162 "re_lexer.l" - { - - // Start of character negated class containing a ]. -@@ -1009,7 +1009,7 @@ YY_RULE_SETUP - YY_BREAK - case 5: - YY_RULE_SETUP --#line 162 "re_lexer.l" -+#line 175 "re_lexer.l" - { - - // Start of character class containing a ]. -@@ -1024,7 +1024,7 @@ YY_RULE_SETUP - YY_BREAK - case 6: - YY_RULE_SETUP --#line 175 "re_lexer.l" -+#line 188 "re_lexer.l" - { - - // Start of character class. Example: [abcd] -@@ -1037,7 +1037,7 @@ YY_RULE_SETUP - case 7: - /* rule 7 can match eol */ - YY_RULE_SETUP --#line 185 "re_lexer.l" -+#line 198 "re_lexer.l" - { - - // Any non-special character is passed as a CHAR token to the scanner. -@@ -1048,63 +1048,63 @@ YY_RULE_SETUP - YY_BREAK - case 8: - YY_RULE_SETUP --#line 194 "re_lexer.l" -+#line 207 "re_lexer.l" - { - return _WORD_CHAR_; - } - YY_BREAK - case 9: - YY_RULE_SETUP --#line 199 "re_lexer.l" -+#line 212 "re_lexer.l" - { - return _NON_WORD_CHAR_; - } - YY_BREAK - case 10: - YY_RULE_SETUP --#line 204 "re_lexer.l" -+#line 217 "re_lexer.l" - { - return _SPACE_; - } - YY_BREAK - case 11: - YY_RULE_SETUP --#line 209 "re_lexer.l" -+#line 222 "re_lexer.l" - { - return _NON_SPACE_; - } - YY_BREAK - case 12: - YY_RULE_SETUP --#line 214 "re_lexer.l" -+#line 227 "re_lexer.l" - { - return _DIGIT_; - } - YY_BREAK - case 13: - YY_RULE_SETUP --#line 219 "re_lexer.l" -+#line 232 "re_lexer.l" - { - return _NON_DIGIT_; - } - YY_BREAK - case 14: - YY_RULE_SETUP --#line 224 "re_lexer.l" -+#line 237 "re_lexer.l" - { - return _WORD_BOUNDARY_; - } - YY_BREAK - case 15: - YY_RULE_SETUP --#line 228 "re_lexer.l" -+#line 241 "re_lexer.l" - { - return _NON_WORD_BOUNDARY_; - } - YY_BREAK - case 16: - YY_RULE_SETUP --#line 233 "re_lexer.l" -+#line 246 "re_lexer.l" - { - - yyerror(yyscanner, lex_env, "backreferences are not allowed"); -@@ -1113,7 +1113,7 @@ YY_RULE_SETUP - YY_BREAK - case 17: - YY_RULE_SETUP --#line 240 "re_lexer.l" -+#line 253 "re_lexer.l" - { - - uint8_t c; -@@ -1132,7 +1132,7 @@ YY_RULE_SETUP - YY_BREAK - case 18: - YY_RULE_SETUP --#line 257 "re_lexer.l" -+#line 270 "re_lexer.l" - { - - // End of character class. -@@ -1155,7 +1155,7 @@ YY_RULE_SETUP - case 19: - /* rule 19 can match eol */ - YY_RULE_SETUP --#line 278 "re_lexer.l" -+#line 291 "re_lexer.l" - { - - // A range inside a character class. -@@ -1199,7 +1199,7 @@ YY_RULE_SETUP - YY_BREAK - case 20: - YY_RULE_SETUP --#line 320 "re_lexer.l" -+#line 333 "re_lexer.l" - { - - int i; -@@ -1210,7 +1210,7 @@ YY_RULE_SETUP - YY_BREAK - case 21: - YY_RULE_SETUP --#line 329 "re_lexer.l" -+#line 342 "re_lexer.l" - { - - int i; -@@ -1221,7 +1221,7 @@ YY_RULE_SETUP - YY_BREAK - case 22: - YY_RULE_SETUP --#line 338 "re_lexer.l" -+#line 351 "re_lexer.l" - { - - LEX_ENV->class_vector[' ' / 8] |= 1 << ' ' % 8; -@@ -1230,7 +1230,7 @@ YY_RULE_SETUP - YY_BREAK - case 23: - YY_RULE_SETUP --#line 345 "re_lexer.l" -+#line 358 "re_lexer.l" - { - - int i; -@@ -1248,7 +1248,7 @@ YY_RULE_SETUP - YY_BREAK - case 24: - YY_RULE_SETUP --#line 361 "re_lexer.l" -+#line 374 "re_lexer.l" - { - - char c; -@@ -1259,7 +1259,7 @@ YY_RULE_SETUP - YY_BREAK - case 25: - YY_RULE_SETUP --#line 370 "re_lexer.l" -+#line 383 "re_lexer.l" - { - - int i; -@@ -1281,7 +1281,7 @@ YY_RULE_SETUP - YY_BREAK - case 26: - YY_RULE_SETUP --#line 390 "re_lexer.l" -+#line 403 "re_lexer.l" - { - - uint8_t c; -@@ -1299,7 +1299,7 @@ YY_RULE_SETUP - YY_BREAK - case 27: - YY_RULE_SETUP --#line 406 "re_lexer.l" -+#line 419 "re_lexer.l" - { - - if (yytext[0] >= 32 && yytext[0] < 127) -@@ -1317,7 +1317,7 @@ YY_RULE_SETUP - } - YY_BREAK - case YY_STATE_EOF(char_class): --#line 423 "re_lexer.l" -+#line 436 "re_lexer.l" - { - - // End of regexp reached while scanning a character class. -@@ -1328,7 +1328,7 @@ case YY_STATE_EOF(char_class): - YY_BREAK - case 28: - YY_RULE_SETUP --#line 432 "re_lexer.l" -+#line 445 "re_lexer.l" - { - - if (yytext[0] >= 32 && yytext[0] < 127) -@@ -1343,7 +1343,7 @@ YY_RULE_SETUP - } - YY_BREAK - case YY_STATE_EOF(INITIAL): --#line 446 "re_lexer.l" -+#line 459 "re_lexer.l" - { - - yyterminate(); -@@ -1351,10 +1351,10 @@ case YY_STATE_EOF(INITIAL): - YY_BREAK - case 29: - YY_RULE_SETUP --#line 451 "re_lexer.l" -+#line 464 "re_lexer.l" - ECHO; - YY_BREAK --#line 1345 "re_lexer.c" -+#line 1358 "re_lexer.c" - - case YY_END_OF_BUFFER: - { -@@ -2503,7 +2503,7 @@ void re_yyfree (void * ptr , yyscan_t yyscanner) - - #define YYTABLES_NAME "yytables" - --#line 451 "re_lexer.l" -+#line 464 "re_lexer.l" - - - -@@ -2563,7 +2563,7 @@ int read_escaped_char( - yyscan_t yyscanner, - uint8_t* escaped_char) - { -- char text[4]; -+ char text[4] = {0, 0, 0, 0}; - - text[0] = '\\'; - text[1] = RE_YY_INPUT(yyscanner); -diff --git a/libyara/re_lexer.l b/libyara/re_lexer.l -index f1108e5..b3744a3 100644 ---- a/libyara/re_lexer.l -+++ b/libyara/re_lexer.l -@@ -519,7 +519,7 @@ int read_escaped_char( - yyscan_t yyscanner, - uint8_t* escaped_char) - { -- char text[4]; -+ char text[4] = {0, 0, 0, 0}; - - text[0] = '\\'; - text[1] = RE_YY_INPUT(yyscanner); - -From aca4e81f18cc3d05cca882531ecc8f90f0f1949b Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Fri, 23 Sep 2016 11:50:47 +0200 -Subject: [PATCH 11/36] Fix issue with mingw not recognising %llx and %lld - printf formats - -(cherry-picked from commit 197477632635e99ff3a1234eaebc4be101dde168) ---- - yara.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/yara.c b/yara.c -index a8503b7..7a7981f 100644 ---- a/yara.c -+++ b/yara.c -@@ -38,8 +38,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - #include - --#define PRIx64 "llx" --#define PRId64 "lld" -+#define PRIx64 "I64x" -+#define PRId64 "I64d" - - #endif - - -From a250447234b3d9ffce382c08a5c77106a77e8883 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Thu, 13 Oct 2016 22:48:38 +0200 -Subject: [PATCH 12/36] Big endian fixes (#535) - -* Use union instead of PTR_TO_INT64 when emitting bytecode - -On big-endian architectures, this fixes pointer dereference problems - -* Fix interpretation of SIZED_STRING in module function argument list - -* Add macros for mapping BE/LE encoded integers to host byte order - -Chaange int16, uint32be etc. and legacy entrypoint operations to use -those macros -- this fixes YARA's behavior on big-endian architectures. - -* Change tests related to PE files - -The pe module is not suitable for big-endian architectures yet. - -* Rebuild lexer, parser - -(cherry picked from commit a9a1105d923912a27546e5a8940ec1ddc19cd1be) ---- - configure.ac | 2 + - libyara/exec.c | 31 ++- - libyara/exefiles.c | 83 ++++---- - libyara/grammar.c | 409 ++++++++++++++++++++-------------------- - libyara/grammar.h | 2 +- - libyara/grammar.y | 29 ++- - libyara/include/yara/compiler.h | 2 +- - libyara/include/yara/modules.h | 2 +- - libyara/include/yara/parser.h | 4 +- - libyara/include/yara/pe.h | 3 +- - libyara/include/yara/utils.h | 30 ++- - libyara/parser.c | 20 +- - tests/test-pe.c | 7 + - tests/test-rules.c | 5 +- - 14 files changed, 327 insertions(+), 302 deletions(-) - -diff --git a/configure.ac b/configure.ac -index e9e27ee..6d821c8 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -32,6 +32,8 @@ case $host_os in - darwin*) CFLAGS="$CFLAGS -I/opt/local/include" ;; - esac - -+AC_C_BIGENDIAN -+ - ACX_PTHREAD( - [LIBS="$PTHREAD_LIBS $LIBS" - CFLAGS="$CFLAGS $PTHREAD_CFLAGS" -diff --git a/libyara/exec.c b/libyara/exec.c -index b0a79b6..3facabd 100644 ---- a/libyara/exec.c -+++ b/libyara/exec.c -@@ -88,27 +88,18 @@ typedef union _STACK_ITEM { - - - #define little_endian_uint8_t(x) (x) --#define little_endian_uint16_t(x) (x) --#define little_endian_uint32_t(x) (x) - #define little_endian_int8_t(x) (x) --#define little_endian_int16_t(x) (x) --#define little_endian_int32_t(x) (x) -- --#define big_endian_uint8_t(x) (x) -- --#define big_endian_uint16_t(x) \ -- (((((uint16_t)(x) & 0xFF)) << 8) | \ -- ((((uint16_t)(x) & 0xFF00)) >> 8)) -- --#define big_endian_uint32_t(x) \ -- (((((uint32_t)(x) & 0xFF)) << 24) | \ -- ((((uint32_t)(x) & 0xFF00)) << 8) | \ -- ((((uint32_t)(x) & 0xFF0000)) >> 8) | \ -- ((((uint32_t)(x) & 0xFF000000)) >> 24)) -- --#define big_endian_int8_t(x) big_endian_uint8_t(x) --#define big_endian_int16_t(x) big_endian_uint16_t(x) --#define big_endian_int32_t(x) big_endian_uint32_t(x) -+#define little_endian_uint16_t(x) yr_le16toh(x) -+#define little_endian_int16_t(x) yr_le16toh(x) -+#define little_endian_uint32_t(x) yr_le32toh(x) -+#define little_endian_int32_t(x) yr_le32toh(x) -+ -+#define big_endian_uint8_t(x) (x) -+#define big_endian_int8_t(x) (x) -+#define big_endian_uint16_t(x) yr_be16toh(x) -+#define big_endian_int16_t(x) yr_be16toh(x) -+#define big_endian_uint32_t(x) yr_be32toh(x) -+#define big_endian_int32_t(x) yr_be32toh(x) - - - #define function_read(type, endianess) \ -diff --git a/libyara/exefiles.c b/libyara/exefiles.c -index f8d455a..599e397 100644 ---- a/libyara/exefiles.c -+++ b/libyara/exefiles.c -@@ -32,6 +32,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #include - #include - #include -+#include - - #ifndef NULL - #define NULL 0 -@@ -56,26 +57,26 @@ PIMAGE_NT_HEADERS32 yr_get_pe_header( - - mz_header = (PIMAGE_DOS_HEADER) buffer; - -- if (mz_header->e_magic != IMAGE_DOS_SIGNATURE) -+ if (yr_le16toh(mz_header->e_magic) != IMAGE_DOS_SIGNATURE) - return NULL; - -- if (mz_header->e_lfanew < 0) -+ if ((int32_t)yr_le32toh(mz_header->e_lfanew) < 0) - return NULL; - -- headers_size = mz_header->e_lfanew + \ -+ headers_size = yr_le32toh(mz_header->e_lfanew) + \ - sizeof(pe_header->Signature) + \ - sizeof(IMAGE_FILE_HEADER); - - if (buffer_length < headers_size) - return NULL; - -- pe_header = (PIMAGE_NT_HEADERS32) (buffer + mz_header->e_lfanew); -+ pe_header = (PIMAGE_NT_HEADERS32) (buffer + yr_le32toh(mz_header->e_lfanew)); - -- headers_size += pe_header->FileHeader.SizeOfOptionalHeader; -+ headers_size += yr_le16toh(pe_header->FileHeader.SizeOfOptionalHeader); - -- if (pe_header->Signature == IMAGE_NT_SIGNATURE && -- (pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_I386 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) && -+ if (yr_le32toh(pe_header->Signature) == IMAGE_NT_SIGNATURE && -+ (yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_I386 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_AMD64) && - buffer_length > headers_size) - { - return pe_header; -@@ -101,16 +102,16 @@ uint64_t yr_pe_rva_to_offset( - section_rva = 0; - section_offset = 0; - -- while(i < MIN(pe_header->FileHeader.NumberOfSections, 60)) -+ while(i < MIN(yr_le16toh(pe_header->FileHeader.NumberOfSections), 60)) - { - if ((uint8_t*) section - \ - (uint8_t*) pe_header + sizeof(IMAGE_SECTION_HEADER) < buffer_length) - { - if (rva >= section->VirtualAddress && -- section_rva <= section->VirtualAddress) -+ section_rva <= yr_le32toh(section->VirtualAddress)) - { -- section_rva = section->VirtualAddress; -- section_offset = section->PointerToRawData; -+ section_rva = yr_le32toh(section->VirtualAddress); -+ section_offset = yr_le32toh(section->PointerToRawData); - } - - section++; -@@ -137,7 +138,7 @@ int yr_get_elf_type( - - elf_ident = (elf_ident_t*) buffer; - -- if (elf_ident->magic == ELF_MAGIC) -+ if (yr_le32toh(elf_ident->magic) == ELF_MAGIC) - { - return elf_ident->_class; - } -@@ -161,38 +162,38 @@ uint64_t yr_elf_rva_to_offset_32( - - // check to prevent integer wraps - -- if (ULONG_MAX - elf_header->sh_entry_count < -- sizeof(elf32_section_header_t) * elf_header->sh_entry_count) -+ if (ULONG_MAX - yr_le16toh(elf_header->sh_entry_count) < -+ sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) - return 0; - - // check that 'sh_offset' doesn't wrap when added to the - // size of entries. - -- if (ULONG_MAX - elf_header->sh_offset < -- sizeof(elf32_section_header_t) * elf_header->sh_entry_count) -+ if (ULONG_MAX - yr_le32toh(elf_header->sh_offset) < -+ sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) - return 0; - -- if (elf_header->sh_offset + \ -+ if (yr_le32toh(elf_header->sh_offset) + \ - sizeof(elf32_section_header_t) * \ -- elf_header->sh_entry_count > buffer_length) -+ yr_le16toh(elf_header->sh_entry_count) > buffer_length) - return 0; - - section = (elf32_section_header_t*) \ -- ((unsigned char*) elf_header + elf_header->sh_offset); -+ ((unsigned char*) elf_header + yr_le32toh(elf_header->sh_offset)); - -- for (i = 0; i < elf_header->sh_entry_count; i++) -+ for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) - { -- if (section->type != ELF_SHT_NULL && -- section->type != ELF_SHT_NOBITS && -- rva >= section->addr && -- rva < section->addr + section->size) -+ if (yr_le32toh(section->type) != ELF_SHT_NULL && -+ yr_le32toh(section->type) != ELF_SHT_NOBITS && -+ rva >= yr_le32toh(section->addr) && -+ rva < yr_le32toh(section->addr) + yr_le32toh(section->size)) - { - // prevent integer wrapping with the return value - -- if (ULONG_MAX - section->offset < (rva - section->addr)) -+ if (ULONG_MAX - yr_le32toh(section->offset) < (rva - yr_le32toh(section->addr))) - return 0; - else -- return section->offset + (rva - section->addr); -+ return yr_le32toh(section->offset) + (rva - yr_le32toh(section->addr)); - } - - section++; -@@ -216,26 +217,26 @@ uint64_t yr_elf_rva_to_offset_64( - - // check that 'sh_offset' doesn't wrap when added to the - // size of entries. -- if(ULONG_MAX - elf_header->sh_offset < -- sizeof(elf64_section_header_t) * elf_header->sh_entry_count) -+ if(ULONG_MAX - yr_le64toh(elf_header->sh_offset) < -+ sizeof(elf64_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) - return 0; - -- if (elf_header->sh_offset + \ -+ if (yr_le64toh(elf_header->sh_offset) + \ - sizeof(elf64_section_header_t) * \ -- elf_header->sh_entry_count > buffer_length) -+ yr_le16toh(elf_header->sh_entry_count) > buffer_length) - return 0; - - section = (elf64_section_header_t*) \ -- ((uint8_t*) elf_header + elf_header->sh_offset); -+ ((uint8_t*) elf_header + yr_le64toh(elf_header->sh_offset)); - -- for (i = 0; i < elf_header->sh_entry_count; i++) -+ for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) - { -- if (section->type != ELF_SHT_NULL && -- section->type != ELF_SHT_NOBITS && -- rva >= section->addr && -- rva < section->addr + section->size) -+ if (yr_le32toh(section->type) != ELF_SHT_NULL && -+ yr_le32toh(section->type) != ELF_SHT_NOBITS && -+ rva >= yr_le64toh(section->addr) && -+ rva < yr_le64toh(section->addr) + yr_le64toh(section->size)) - { -- return section->offset + (rva - section->addr); -+ return yr_le64toh(section->offset) + (rva - yr_le64toh(section->addr)); - } - - section++; -@@ -259,7 +260,7 @@ uint64_t yr_get_entry_point_offset( - { - return yr_pe_rva_to_offset( - pe_header, -- pe_header->OptionalHeader.AddressOfEntryPoint, -+ yr_le32toh(pe_header->OptionalHeader.AddressOfEntryPoint), - buffer_length - ((uint8_t*) pe_header - buffer)); - } - -@@ -269,14 +270,14 @@ uint64_t yr_get_entry_point_offset( - elf_header32 = (elf32_header_t*) buffer; - return yr_elf_rva_to_offset_32( - elf_header32, -- elf_header32->entry, -+ yr_le32toh(elf_header32->entry), - buffer_length); - - case ELF_CLASS_64: - elf_header64 = (elf64_header_t*) buffer; - return yr_elf_rva_to_offset_64( - elf_header64, -- elf_header64->entry, -+ yr_le64toh(elf_header64->entry), - buffer_length); - } - -diff --git a/libyara/grammar.c b/libyara/grammar.c -index 0f803df..0ce27b2 100644 ---- a/libyara/grammar.c -+++ b/libyara/grammar.c -@@ -68,18 +68,18 @@ - - - /* Copy the first part of user declarations. */ --#line 17 "grammar.y" /* yacc.c:339 */ -+#line 30 "grammar.y" /* yacc.c:339 */ - - - - #include - #include --#include - #include - #include - #include - - -+#include - #include - #include - #include -@@ -277,7 +277,7 @@ extern int yara_yydebug; - - union YYSTYPE - { --#line 191 "grammar.y" /* yacc.c:355 */ -+#line 204 "grammar.y" /* yacc.c:355 */ - - EXPRESSION expression; - SIZED_STRING* sized_string; -@@ -606,19 +606,19 @@ static const yytype_uint8 yytranslate[] = - /* YYRLINE[YYN] -- Source line where rule number YYN was defined. */ - static const yytype_uint16 yyrline[] = - { -- 0, 205, 205, 207, 208, 209, 210, 211, 216, 229, -- 238, 228, 261, 264, 292, 295, 322, 327, 328, 333, -- 334, 340, 343, 361, 374, 411, 412, 417, 433, 446, -- 459, 472, 489, 490, 496, 495, 511, 510, 526, 540, -- 541, 546, 547, 548, 549, 554, 639, 685, 743, 788, -- 789, 793, 818, 854, 900, 922, 931, 940, 955, 967, -- 981, 994, 1006, 1036, 1005, 1152, 1151, 1231, 1237, 1244, -- 1243, 1306, 1305, 1366, 1375, 1384, 1393, 1402, 1411, 1420, -- 1424, 1432, 1433, 1438, 1460, 1472, 1488, 1487, 1493, 1504, -- 1505, 1510, 1517, 1528, 1529, 1533, 1541, 1545, 1555, 1569, -- 1585, 1595, 1604, 1629, 1641, 1653, 1669, 1681, 1697, 1742, -- 1761, 1779, 1797, 1815, 1841, 1859, 1869, 1879, 1889, 1899, -- 1909, 1919 -+ 0, 218, 218, 220, 221, 222, 223, 224, 229, 242, -+ 251, 241, 274, 277, 305, 308, 335, 340, 341, 346, -+ 347, 353, 356, 374, 387, 424, 425, 430, 446, 459, -+ 472, 485, 502, 503, 509, 508, 524, 523, 539, 553, -+ 554, 559, 560, 561, 562, 567, 652, 698, 756, 801, -+ 802, 806, 831, 867, 913, 935, 944, 953, 968, 980, -+ 994, 1007, 1019, 1049, 1018, 1163, 1162, 1241, 1247, 1254, -+ 1253, 1316, 1315, 1376, 1385, 1394, 1403, 1412, 1421, 1430, -+ 1434, 1442, 1443, 1448, 1470, 1482, 1498, 1497, 1503, 1514, -+ 1515, 1520, 1527, 1538, 1539, 1543, 1551, 1555, 1565, 1579, -+ 1595, 1605, 1614, 1639, 1651, 1663, 1679, 1691, 1707, 1752, -+ 1771, 1789, 1807, 1825, 1851, 1869, 1879, 1889, 1899, 1909, -+ 1919, 1929 - }; - #endif - -@@ -1333,55 +1333,55 @@ yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep, void *yyscanner, Y - switch (yytype) - { - case 10: /* _IDENTIFIER_ */ --#line 181 "grammar.y" /* yacc.c:1257 */ -+#line 194 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).c_string)); } - #line 1339 "grammar.c" /* yacc.c:1257 */ - break; - - case 11: /* _STRING_IDENTIFIER_ */ --#line 185 "grammar.y" /* yacc.c:1257 */ -+#line 198 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).c_string)); } - #line 1345 "grammar.c" /* yacc.c:1257 */ - break; - - case 12: /* _STRING_COUNT_ */ --#line 182 "grammar.y" /* yacc.c:1257 */ -+#line 195 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).c_string)); } - #line 1351 "grammar.c" /* yacc.c:1257 */ - break; - - case 13: /* _STRING_OFFSET_ */ --#line 183 "grammar.y" /* yacc.c:1257 */ -+#line 196 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).c_string)); } - #line 1357 "grammar.c" /* yacc.c:1257 */ - break; - - case 14: /* _STRING_LENGTH_ */ --#line 184 "grammar.y" /* yacc.c:1257 */ -+#line 197 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).c_string)); } - #line 1363 "grammar.c" /* yacc.c:1257 */ - break; - - case 15: /* _STRING_IDENTIFIER_WITH_WILDCARD_ */ --#line 186 "grammar.y" /* yacc.c:1257 */ -+#line 199 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).c_string)); } - #line 1369 "grammar.c" /* yacc.c:1257 */ - break; - - case 19: /* _TEXT_STRING_ */ --#line 187 "grammar.y" /* yacc.c:1257 */ -+#line 200 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).sized_string)); } - #line 1375 "grammar.c" /* yacc.c:1257 */ - break; - - case 20: /* _HEX_STRING_ */ --#line 188 "grammar.y" /* yacc.c:1257 */ -+#line 201 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).sized_string)); } - #line 1381 "grammar.c" /* yacc.c:1257 */ - break; - - case 21: /* _REGEXP_ */ --#line 189 "grammar.y" /* yacc.c:1257 */ -+#line 202 "grammar.y" /* yacc.c:1257 */ - { yr_free(((*yyvaluep).sized_string)); } - #line 1387 "grammar.c" /* yacc.c:1257 */ - break; -@@ -1649,7 +1649,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - switch (yyn) - { - case 8: --#line 217 "grammar.y" /* yacc.c:1646 */ -+#line 230 "grammar.y" /* yacc.c:1646 */ - { - int result = yr_parser_reduce_import(yyscanner, (yyvsp[0].sized_string)); - -@@ -1661,7 +1661,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 9: --#line 229 "grammar.y" /* yacc.c:1646 */ -+#line 242 "grammar.y" /* yacc.c:1646 */ - { - YR_RULE* rule = yr_parser_reduce_rule_declaration_phase_1( - yyscanner, (int32_t) (yyvsp[-2].integer), (yyvsp[0].c_string)); -@@ -1674,7 +1674,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 10: --#line 238 "grammar.y" /* yacc.c:1646 */ -+#line 251 "grammar.y" /* yacc.c:1646 */ - { - YR_RULE* rule = (yyvsp[-4].rule); // rule created in phase 1 - -@@ -1686,7 +1686,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 11: --#line 246 "grammar.y" /* yacc.c:1646 */ -+#line 259 "grammar.y" /* yacc.c:1646 */ - { - YR_RULE* rule = (yyvsp[-7].rule); // rule created in phase 1 - -@@ -1701,7 +1701,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 12: --#line 261 "grammar.y" /* yacc.c:1646 */ -+#line 274 "grammar.y" /* yacc.c:1646 */ - { - (yyval.meta) = NULL; - } -@@ -1709,7 +1709,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 13: --#line 265 "grammar.y" /* yacc.c:1646 */ -+#line 278 "grammar.y" /* yacc.c:1646 */ - { - // Each rule have a list of meta-data info, consisting in a - // sequence of YR_META structures. The last YR_META structure does -@@ -1736,7 +1736,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 14: --#line 292 "grammar.y" /* yacc.c:1646 */ -+#line 305 "grammar.y" /* yacc.c:1646 */ - { - (yyval.string) = NULL; - } -@@ -1744,7 +1744,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 15: --#line 296 "grammar.y" /* yacc.c:1646 */ -+#line 309 "grammar.y" /* yacc.c:1646 */ - { - // Each rule have a list of strings, consisting in a sequence - // of YR_STRING structures. The last YR_STRING structure does not -@@ -1771,31 +1771,31 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 17: --#line 327 "grammar.y" /* yacc.c:1646 */ -+#line 340 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = 0; } - #line 1777 "grammar.c" /* yacc.c:1646 */ - break; - - case 18: --#line 328 "grammar.y" /* yacc.c:1646 */ -+#line 341 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = (yyvsp[-1].integer) | (yyvsp[0].integer); } - #line 1783 "grammar.c" /* yacc.c:1646 */ - break; - - case 19: --#line 333 "grammar.y" /* yacc.c:1646 */ -+#line 346 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = RULE_GFLAGS_PRIVATE; } - #line 1789 "grammar.c" /* yacc.c:1646 */ - break; - - case 20: --#line 334 "grammar.y" /* yacc.c:1646 */ -+#line 347 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = RULE_GFLAGS_GLOBAL; } - #line 1795 "grammar.c" /* yacc.c:1646 */ - break; - - case 21: --#line 340 "grammar.y" /* yacc.c:1646 */ -+#line 353 "grammar.y" /* yacc.c:1646 */ - { - (yyval.c_string) = NULL; - } -@@ -1803,7 +1803,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 22: --#line 344 "grammar.y" /* yacc.c:1646 */ -+#line 357 "grammar.y" /* yacc.c:1646 */ - { - // Tags list is represented in the arena as a sequence - // of null-terminated strings, the sequence ends with an -@@ -1821,7 +1821,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 23: --#line 362 "grammar.y" /* yacc.c:1646 */ -+#line 375 "grammar.y" /* yacc.c:1646 */ - { - char* identifier; - -@@ -1838,7 +1838,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 24: --#line 375 "grammar.y" /* yacc.c:1646 */ -+#line 388 "grammar.y" /* yacc.c:1646 */ - { - char* tag_name = (yyvsp[-1].c_string); - size_t tag_length = tag_name != NULL ? strlen(tag_name) : 0; -@@ -1874,19 +1874,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 25: --#line 411 "grammar.y" /* yacc.c:1646 */ -+#line 424 "grammar.y" /* yacc.c:1646 */ - { (yyval.meta) = (yyvsp[0].meta); } - #line 1880 "grammar.c" /* yacc.c:1646 */ - break; - - case 26: --#line 412 "grammar.y" /* yacc.c:1646 */ -+#line 425 "grammar.y" /* yacc.c:1646 */ - { (yyval.meta) = (yyvsp[-1].meta); } - #line 1886 "grammar.c" /* yacc.c:1646 */ - break; - - case 27: --#line 418 "grammar.y" /* yacc.c:1646 */ -+#line 431 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string = (yyvsp[0].sized_string); - -@@ -1906,7 +1906,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 28: --#line 434 "grammar.y" /* yacc.c:1646 */ -+#line 447 "grammar.y" /* yacc.c:1646 */ - { - (yyval.meta) = yr_parser_reduce_meta_declaration( - yyscanner, -@@ -1923,7 +1923,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 29: --#line 447 "grammar.y" /* yacc.c:1646 */ -+#line 460 "grammar.y" /* yacc.c:1646 */ - { - (yyval.meta) = yr_parser_reduce_meta_declaration( - yyscanner, -@@ -1940,7 +1940,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 30: --#line 460 "grammar.y" /* yacc.c:1646 */ -+#line 473 "grammar.y" /* yacc.c:1646 */ - { - (yyval.meta) = yr_parser_reduce_meta_declaration( - yyscanner, -@@ -1957,7 +1957,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 31: --#line 473 "grammar.y" /* yacc.c:1646 */ -+#line 486 "grammar.y" /* yacc.c:1646 */ - { - (yyval.meta) = yr_parser_reduce_meta_declaration( - yyscanner, -@@ -1974,19 +1974,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 32: --#line 489 "grammar.y" /* yacc.c:1646 */ -+#line 502 "grammar.y" /* yacc.c:1646 */ - { (yyval.string) = (yyvsp[0].string); } - #line 1980 "grammar.c" /* yacc.c:1646 */ - break; - - case 33: --#line 490 "grammar.y" /* yacc.c:1646 */ -+#line 503 "grammar.y" /* yacc.c:1646 */ - { (yyval.string) = (yyvsp[-1].string); } - #line 1986 "grammar.c" /* yacc.c:1646 */ - break; - - case 34: --#line 496 "grammar.y" /* yacc.c:1646 */ -+#line 509 "grammar.y" /* yacc.c:1646 */ - { - compiler->error_line = yyget_lineno(yyscanner); - } -@@ -1994,7 +1994,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 35: --#line 500 "grammar.y" /* yacc.c:1646 */ -+#line 513 "grammar.y" /* yacc.c:1646 */ - { - (yyval.string) = yr_parser_reduce_string_declaration( - yyscanner, (int32_t) (yyvsp[0].integer), (yyvsp[-4].c_string), (yyvsp[-1].sized_string)); -@@ -2009,7 +2009,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 36: --#line 511 "grammar.y" /* yacc.c:1646 */ -+#line 524 "grammar.y" /* yacc.c:1646 */ - { - compiler->error_line = yyget_lineno(yyscanner); - } -@@ -2017,7 +2017,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 37: --#line 515 "grammar.y" /* yacc.c:1646 */ -+#line 528 "grammar.y" /* yacc.c:1646 */ - { - (yyval.string) = yr_parser_reduce_string_declaration( - yyscanner, (int32_t) (yyvsp[0].integer) | STRING_GFLAGS_REGEXP, (yyvsp[-4].c_string), (yyvsp[-1].sized_string)); -@@ -2033,7 +2033,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 38: --#line 527 "grammar.y" /* yacc.c:1646 */ -+#line 540 "grammar.y" /* yacc.c:1646 */ - { - (yyval.string) = yr_parser_reduce_string_declaration( - yyscanner, STRING_GFLAGS_HEXADECIMAL, (yyvsp[-2].c_string), (yyvsp[0].sized_string)); -@@ -2047,43 +2047,43 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 39: --#line 540 "grammar.y" /* yacc.c:1646 */ -+#line 553 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = 0; } - #line 2053 "grammar.c" /* yacc.c:1646 */ - break; - - case 40: --#line 541 "grammar.y" /* yacc.c:1646 */ -+#line 554 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = (yyvsp[-1].integer) | (yyvsp[0].integer); } - #line 2059 "grammar.c" /* yacc.c:1646 */ - break; - - case 41: --#line 546 "grammar.y" /* yacc.c:1646 */ -+#line 559 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = STRING_GFLAGS_WIDE; } - #line 2065 "grammar.c" /* yacc.c:1646 */ - break; - - case 42: --#line 547 "grammar.y" /* yacc.c:1646 */ -+#line 560 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = STRING_GFLAGS_ASCII; } - #line 2071 "grammar.c" /* yacc.c:1646 */ - break; - - case 43: --#line 548 "grammar.y" /* yacc.c:1646 */ -+#line 561 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = STRING_GFLAGS_NO_CASE; } - #line 2077 "grammar.c" /* yacc.c:1646 */ - break; - - case 44: --#line 549 "grammar.y" /* yacc.c:1646 */ -+#line 562 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = STRING_GFLAGS_FULL_WORD; } - #line 2083 "grammar.c" /* yacc.c:1646 */ - break; - - case 45: --#line 555 "grammar.y" /* yacc.c:1646 */ -+#line 568 "grammar.y" /* yacc.c:1646 */ - { - int var_index = yr_parser_lookup_loop_variable(yyscanner, (yyvsp[0].c_string)); - -@@ -2128,7 +2128,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_OBJ_LOAD, -- PTR_TO_INT64(id), -+ id, - NULL, - NULL); - -@@ -2148,7 +2148,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH_RULE, -- PTR_TO_INT64(rule), -+ rule, - NULL, - NULL); - -@@ -2172,7 +2172,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 46: --#line 640 "grammar.y" /* yacc.c:1646 */ -+#line 653 "grammar.y" /* yacc.c:1646 */ - { - YR_OBJECT* field = NULL; - -@@ -2192,7 +2192,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_OBJ_FIELD, -- PTR_TO_INT64(ident), -+ ident, - NULL, - NULL); - -@@ -2222,7 +2222,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 47: --#line 686 "grammar.y" /* yacc.c:1646 */ -+#line 699 "grammar.y" /* yacc.c:1646 */ - { - YR_OBJECT_ARRAY* array; - YR_OBJECT_DICTIONARY* dict; -@@ -2283,7 +2283,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 48: --#line 744 "grammar.y" /* yacc.c:1646 */ -+#line 757 "grammar.y" /* yacc.c:1646 */ - { - YR_OBJECT_FUNCTION* function; - char* args_fmt; -@@ -2302,7 +2302,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_CALL, -- PTR_TO_INT64(args_fmt), -+ args_fmt, - NULL, - NULL); - -@@ -2328,19 +2328,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 49: --#line 788 "grammar.y" /* yacc.c:1646 */ -+#line 801 "grammar.y" /* yacc.c:1646 */ - { (yyval.c_string) = yr_strdup(""); } - #line 2334 "grammar.c" /* yacc.c:1646 */ - break; - - case 50: --#line 789 "grammar.y" /* yacc.c:1646 */ -+#line 802 "grammar.y" /* yacc.c:1646 */ - { (yyval.c_string) = (yyvsp[0].c_string); } - #line 2340 "grammar.c" /* yacc.c:1646 */ - break; - - case 51: --#line 794 "grammar.y" /* yacc.c:1646 */ -+#line 807 "grammar.y" /* yacc.c:1646 */ - { - (yyval.c_string) = (char*) yr_malloc(MAX_FUNCTION_ARGS + 1); - -@@ -2369,7 +2369,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 52: --#line 819 "grammar.y" /* yacc.c:1646 */ -+#line 832 "grammar.y" /* yacc.c:1646 */ - { - if (strlen((yyvsp[-2].c_string)) == MAX_FUNCTION_ARGS) - { -@@ -2405,7 +2405,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 53: --#line 855 "grammar.y" /* yacc.c:1646 */ -+#line 868 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string = (yyvsp[0].sized_string); - RE* re; -@@ -2437,7 +2437,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH, -- PTR_TO_INT64(re->root_node->forward_code), -+ re->root_node->forward_code, - NULL, - NULL); - -@@ -2451,7 +2451,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 54: --#line 901 "grammar.y" /* yacc.c:1646 */ -+#line 914 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type == EXPRESSION_TYPE_STRING) - { -@@ -2474,7 +2474,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 55: --#line 923 "grammar.y" /* yacc.c:1646 */ -+#line 936 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -2487,7 +2487,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 56: --#line 932 "grammar.y" /* yacc.c:1646 */ -+#line 945 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 0, NULL, NULL); -@@ -2500,7 +2500,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 57: --#line 941 "grammar.y" /* yacc.c:1646 */ -+#line 954 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "matches"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_REGEXP, "matches"); -@@ -2519,7 +2519,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 58: --#line 956 "grammar.y" /* yacc.c:1646 */ -+#line 969 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "contains"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "contains"); -@@ -2535,7 +2535,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 59: --#line 968 "grammar.y" /* yacc.c:1646 */ -+#line 981 "grammar.y" /* yacc.c:1646 */ - { - int result = yr_parser_reduce_string_identifier( - yyscanner, -@@ -2553,7 +2553,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 60: --#line 982 "grammar.y" /* yacc.c:1646 */ -+#line 995 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "at"); - -@@ -2570,7 +2570,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 61: --#line 995 "grammar.y" /* yacc.c:1646 */ -+#line 1008 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-2].c_string), OP_FOUND_IN, UNDEFINED); -@@ -2585,7 +2585,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 62: --#line 1006 "grammar.y" /* yacc.c:1646 */ -+#line 1019 "grammar.y" /* yacc.c:1646 */ - { - int var_index; - -@@ -2619,7 +2619,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 63: --#line 1036 "grammar.y" /* yacc.c:1646 */ -+#line 1049 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2658,7 +2658,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - break; - - case 64: --#line 1071 "grammar.y" /* yacc.c:1646 */ -+#line 1084 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2684,8 +2684,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_JNUNDEF, -- PTR_TO_INT64( -- compiler->loop_address[compiler->loop_depth]), -+ compiler->loop_address[compiler->loop_depth], - NULL, - NULL); - } -@@ -2708,8 +2707,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_JLE, -- PTR_TO_INT64( -- compiler->loop_address[compiler->loop_depth]), -+ compiler->loop_address[compiler->loop_depth], - NULL, - NULL); - -@@ -2739,11 +2737,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2743 "grammar.c" /* yacc.c:1646 */ -+#line 2741 "grammar.c" /* yacc.c:1646 */ - break; - - case 65: --#line 1152 "grammar.y" /* yacc.c:1646 */ -+#line 1163 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2773,11 +2771,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = NULL; - compiler->loop_depth++; - } --#line 2777 "grammar.c" /* yacc.c:1646 */ -+#line 2775 "grammar.c" /* yacc.c:1646 */ - break; - - case 66: --#line 1182 "grammar.y" /* yacc.c:1646 */ -+#line 1193 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2802,8 +2800,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_JNUNDEF, -- PTR_TO_INT64( -- compiler->loop_address[compiler->loop_depth]), -+ compiler->loop_address[compiler->loop_depth], - NULL, - NULL); - -@@ -2827,34 +2824,34 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - - } --#line 2831 "grammar.c" /* yacc.c:1646 */ -+#line 2828 "grammar.c" /* yacc.c:1646 */ - break; - - case 67: --#line 1232 "grammar.y" /* yacc.c:1646 */ -+#line 1242 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_OF, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2841 "grammar.c" /* yacc.c:1646 */ -+#line 2838 "grammar.c" /* yacc.c:1646 */ - break; - - case 68: --#line 1238 "grammar.y" /* yacc.c:1646 */ -+#line 1248 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_NOT, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2851 "grammar.c" /* yacc.c:1646 */ -+#line 2848 "grammar.c" /* yacc.c:1646 */ - break; - - case 69: --#line 1244 "grammar.y" /* yacc.c:1646 */ -+#line 1254 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; -- int64_t* jmp_destination_addr; -+ void* jmp_destination_addr; - - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, -@@ -2877,11 +2874,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2881 "grammar.c" /* yacc.c:1646 */ -+#line 2878 "grammar.c" /* yacc.c:1646 */ - break; - - case 70: --#line 1270 "grammar.y" /* yacc.c:1646 */ -+#line 1280 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* and_addr; -@@ -2910,21 +2907,21 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - // page, so we can compute the address for the opcode following the AND - // by simply adding one to its address. - -- *(fixup->address) = PTR_TO_INT64(and_addr + 1); -+ *(void**)(fixup->address) = (void*)(and_addr + 1); - - compiler->fixup_stack_head = fixup->next; - yr_free(fixup); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2921 "grammar.c" /* yacc.c:1646 */ -+#line 2918 "grammar.c" /* yacc.c:1646 */ - break; - - case 71: --#line 1306 "grammar.y" /* yacc.c:1646 */ -+#line 1316 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; -- int64_t* jmp_destination_addr; -+ void* jmp_destination_addr; - - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, -@@ -2946,11 +2943,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2950 "grammar.c" /* yacc.c:1646 */ -+#line 2947 "grammar.c" /* yacc.c:1646 */ - break; - - case 72: --#line 1331 "grammar.y" /* yacc.c:1646 */ -+#line 1341 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* or_addr; -@@ -2979,18 +2976,18 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - // page, so we can compute the address for the opcode following the OR - // by simply adding one to its address. - -- *(fixup->address) = PTR_TO_INT64(or_addr + 1); -+ *(void**)(fixup->address) = (void*)(or_addr + 1); - - compiler->fixup_stack_head = fixup->next; - yr_free(fixup); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2990 "grammar.c" /* yacc.c:1646 */ -+#line 2987 "grammar.c" /* yacc.c:1646 */ - break; - - case 73: --#line 1367 "grammar.y" /* yacc.c:1646 */ -+#line 1377 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -2999,11 +2996,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3003 "grammar.c" /* yacc.c:1646 */ -+#line 3000 "grammar.c" /* yacc.c:1646 */ - break; - - case 74: --#line 1376 "grammar.y" /* yacc.c:1646 */ -+#line 1386 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3012,11 +3009,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3016 "grammar.c" /* yacc.c:1646 */ -+#line 3013 "grammar.c" /* yacc.c:1646 */ - break; - - case 75: --#line 1385 "grammar.y" /* yacc.c:1646 */ -+#line 1395 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3025,11 +3022,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3029 "grammar.c" /* yacc.c:1646 */ -+#line 3026 "grammar.c" /* yacc.c:1646 */ - break; - - case 76: --#line 1394 "grammar.y" /* yacc.c:1646 */ -+#line 1404 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3038,11 +3035,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3042 "grammar.c" /* yacc.c:1646 */ -+#line 3039 "grammar.c" /* yacc.c:1646 */ - break; - - case 77: --#line 1403 "grammar.y" /* yacc.c:1646 */ -+#line 1413 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "==", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3051,11 +3048,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3055 "grammar.c" /* yacc.c:1646 */ -+#line 3052 "grammar.c" /* yacc.c:1646 */ - break; - - case 78: --#line 1412 "grammar.y" /* yacc.c:1646 */ -+#line 1422 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "!=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3064,39 +3061,39 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3068 "grammar.c" /* yacc.c:1646 */ -+#line 3065 "grammar.c" /* yacc.c:1646 */ - break; - - case 79: --#line 1421 "grammar.y" /* yacc.c:1646 */ -+#line 1431 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3076 "grammar.c" /* yacc.c:1646 */ -+#line 3073 "grammar.c" /* yacc.c:1646 */ - break; - - case 80: --#line 1425 "grammar.y" /* yacc.c:1646 */ -+#line 1435 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3084 "grammar.c" /* yacc.c:1646 */ -+#line 3081 "grammar.c" /* yacc.c:1646 */ - break; - - case 81: --#line 1432 "grammar.y" /* yacc.c:1646 */ -+#line 1442 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_ENUMERATION; } --#line 3090 "grammar.c" /* yacc.c:1646 */ -+#line 3087 "grammar.c" /* yacc.c:1646 */ - break; - - case 82: --#line 1433 "grammar.y" /* yacc.c:1646 */ -+#line 1443 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_RANGE; } --#line 3096 "grammar.c" /* yacc.c:1646 */ -+#line 3093 "grammar.c" /* yacc.c:1646 */ - break; - - case 83: --#line 1439 "grammar.y" /* yacc.c:1646 */ -+#line 1449 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[-3].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3114,11 +3111,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3118 "grammar.c" /* yacc.c:1646 */ -+#line 3115 "grammar.c" /* yacc.c:1646 */ - break; - - case 84: --#line 1461 "grammar.y" /* yacc.c:1646 */ -+#line 1471 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3130,11 +3127,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3134 "grammar.c" /* yacc.c:1646 */ -+#line 3131 "grammar.c" /* yacc.c:1646 */ - break; - - case 85: --#line 1473 "grammar.y" /* yacc.c:1646 */ -+#line 1483 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3145,77 +3142,77 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3149 "grammar.c" /* yacc.c:1646 */ -+#line 3146 "grammar.c" /* yacc.c:1646 */ - break; - - case 86: --#line 1488 "grammar.y" /* yacc.c:1646 */ -+#line 1498 "grammar.y" /* yacc.c:1646 */ - { - // Push end-of-list marker - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3158 "grammar.c" /* yacc.c:1646 */ -+#line 3155 "grammar.c" /* yacc.c:1646 */ - break; - - case 88: --#line 1494 "grammar.y" /* yacc.c:1646 */ -+#line 1504 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - yr_parser_emit_pushes_for_strings(yyscanner, "$*"); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3169 "grammar.c" /* yacc.c:1646 */ -+#line 3166 "grammar.c" /* yacc.c:1646 */ - break; - - case 91: --#line 1511 "grammar.y" /* yacc.c:1646 */ -+#line 1521 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3180 "grammar.c" /* yacc.c:1646 */ -+#line 3177 "grammar.c" /* yacc.c:1646 */ - break; - - case 92: --#line 1518 "grammar.y" /* yacc.c:1646 */ -+#line 1528 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3191 "grammar.c" /* yacc.c:1646 */ -+#line 3188 "grammar.c" /* yacc.c:1646 */ - break; - - case 94: --#line 1530 "grammar.y" /* yacc.c:1646 */ -+#line 1540 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3199 "grammar.c" /* yacc.c:1646 */ -+#line 3196 "grammar.c" /* yacc.c:1646 */ - break; - - case 95: --#line 1534 "grammar.y" /* yacc.c:1646 */ -+#line 1544 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, 1, NULL, NULL); - } --#line 3207 "grammar.c" /* yacc.c:1646 */ -+#line 3204 "grammar.c" /* yacc.c:1646 */ - break; - - case 96: --#line 1542 "grammar.y" /* yacc.c:1646 */ -+#line 1552 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3215 "grammar.c" /* yacc.c:1646 */ -+#line 3212 "grammar.c" /* yacc.c:1646 */ - break; - - case 97: --#line 1546 "grammar.y" /* yacc.c:1646 */ -+#line 1556 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit( - yyscanner, OP_FILESIZE, NULL); -@@ -3225,11 +3222,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3229 "grammar.c" /* yacc.c:1646 */ -+#line 3226 "grammar.c" /* yacc.c:1646 */ - break; - - case 98: --#line 1556 "grammar.y" /* yacc.c:1646 */ -+#line 1566 "grammar.y" /* yacc.c:1646 */ - { - yywarning(yyscanner, - "Using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " -@@ -3243,11 +3240,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3247 "grammar.c" /* yacc.c:1646 */ -+#line 3244 "grammar.c" /* yacc.c:1646 */ - break; - - case 99: --#line 1570 "grammar.y" /* yacc.c:1646 */ -+#line 1580 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-1].expression), EXPRESSION_TYPE_INTEGER, "intXXXX or uintXXXX"); - -@@ -3263,11 +3260,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3267 "grammar.c" /* yacc.c:1646 */ -+#line 3264 "grammar.c" /* yacc.c:1646 */ - break; - - case 100: --#line 1586 "grammar.y" /* yacc.c:1646 */ -+#line 1596 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, (yyvsp[0].integer), NULL, NULL); -@@ -3277,11 +3274,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = (yyvsp[0].integer); - } --#line 3281 "grammar.c" /* yacc.c:1646 */ -+#line 3278 "grammar.c" /* yacc.c:1646 */ - break; - - case 101: --#line 1596 "grammar.y" /* yacc.c:1646 */ -+#line 1606 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg_double( - yyscanner, OP_PUSH, (yyvsp[0].double_), NULL, NULL); -@@ -3290,11 +3287,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } --#line 3294 "grammar.c" /* yacc.c:1646 */ -+#line 3291 "grammar.c" /* yacc.c:1646 */ - break; - - case 102: --#line 1605 "grammar.y" /* yacc.c:1646 */ -+#line 1615 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string; - -@@ -3310,7 +3307,7 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH, -- PTR_TO_INT64(sized_string), -+ sized_string, - NULL, - NULL); - -@@ -3319,11 +3316,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_STRING; - (yyval.expression).value.sized_string = sized_string; - } --#line 3323 "grammar.c" /* yacc.c:1646 */ -+#line 3320 "grammar.c" /* yacc.c:1646 */ - break; - - case 103: --#line 1630 "grammar.y" /* yacc.c:1646 */ -+#line 1640 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[0].c_string), OP_COUNT, UNDEFINED); -@@ -3335,11 +3332,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3339 "grammar.c" /* yacc.c:1646 */ -+#line 3336 "grammar.c" /* yacc.c:1646 */ - break; - - case 104: --#line 1642 "grammar.y" /* yacc.c:1646 */ -+#line 1652 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_OFFSET, UNDEFINED); -@@ -3351,11 +3348,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3355 "grammar.c" /* yacc.c:1646 */ -+#line 3352 "grammar.c" /* yacc.c:1646 */ - break; - - case 105: --#line 1654 "grammar.y" /* yacc.c:1646 */ -+#line 1664 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3371,11 +3368,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3375 "grammar.c" /* yacc.c:1646 */ -+#line 3372 "grammar.c" /* yacc.c:1646 */ - break; - - case 106: --#line 1670 "grammar.y" /* yacc.c:1646 */ -+#line 1680 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_LENGTH, UNDEFINED); -@@ -3387,11 +3384,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3391 "grammar.c" /* yacc.c:1646 */ -+#line 3388 "grammar.c" /* yacc.c:1646 */ - break; - - case 107: --#line 1682 "grammar.y" /* yacc.c:1646 */ -+#line 1692 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3407,11 +3404,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3411 "grammar.c" /* yacc.c:1646 */ -+#line 3408 "grammar.c" /* yacc.c:1646 */ - break; - - case 108: --#line 1698 "grammar.y" /* yacc.c:1646 */ -+#line 1708 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) // loop identifier - { -@@ -3456,11 +3453,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3460 "grammar.c" /* yacc.c:1646 */ -+#line 3457 "grammar.c" /* yacc.c:1646 */ - break; - - case 109: --#line 1743 "grammar.y" /* yacc.c:1646 */ -+#line 1753 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT, "-"); - -@@ -3479,11 +3476,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3483 "grammar.c" /* yacc.c:1646 */ -+#line 3480 "grammar.c" /* yacc.c:1646 */ - break; - - case 110: --#line 1762 "grammar.y" /* yacc.c:1646 */ -+#line 1772 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "+", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3501,11 +3498,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3505 "grammar.c" /* yacc.c:1646 */ -+#line 3502 "grammar.c" /* yacc.c:1646 */ - break; - - case 111: --#line 1780 "grammar.y" /* yacc.c:1646 */ -+#line 1790 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "-", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3523,11 +3520,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3527 "grammar.c" /* yacc.c:1646 */ -+#line 3524 "grammar.c" /* yacc.c:1646 */ - break; - - case 112: --#line 1798 "grammar.y" /* yacc.c:1646 */ -+#line 1808 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "*", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3545,11 +3542,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3549 "grammar.c" /* yacc.c:1646 */ -+#line 3546 "grammar.c" /* yacc.c:1646 */ - break; - - case 113: --#line 1816 "grammar.y" /* yacc.c:1646 */ -+#line 1826 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "\\", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3575,11 +3572,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3579 "grammar.c" /* yacc.c:1646 */ -+#line 3576 "grammar.c" /* yacc.c:1646 */ - break; - - case 114: --#line 1842 "grammar.y" /* yacc.c:1646 */ -+#line 1852 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "%"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "%"); -@@ -3597,11 +3594,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } - } --#line 3601 "grammar.c" /* yacc.c:1646 */ -+#line 3598 "grammar.c" /* yacc.c:1646 */ - break; - - case 115: --#line 1860 "grammar.y" /* yacc.c:1646 */ -+#line 1870 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3611,11 +3608,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(^, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3615 "grammar.c" /* yacc.c:1646 */ -+#line 3612 "grammar.c" /* yacc.c:1646 */ - break; - - case 116: --#line 1870 "grammar.y" /* yacc.c:1646 */ -+#line 1880 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3625,11 +3622,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(&, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3629 "grammar.c" /* yacc.c:1646 */ -+#line 3626 "grammar.c" /* yacc.c:1646 */ - break; - - case 117: --#line 1880 "grammar.y" /* yacc.c:1646 */ -+#line 1890 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "|"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "|"); -@@ -3639,11 +3636,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(|, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3643 "grammar.c" /* yacc.c:1646 */ -+#line 3640 "grammar.c" /* yacc.c:1646 */ - break; - - case 118: --#line 1890 "grammar.y" /* yacc.c:1646 */ -+#line 1900 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "~"); - -@@ -3653,11 +3650,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == UNDEFINED) ? - UNDEFINED : ~((yyvsp[0].expression).value.integer); - } --#line 3657 "grammar.c" /* yacc.c:1646 */ -+#line 3654 "grammar.c" /* yacc.c:1646 */ - break; - - case 119: --#line 1900 "grammar.y" /* yacc.c:1646 */ -+#line 1910 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "<<"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "<<"); -@@ -3667,11 +3664,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(<<, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3671 "grammar.c" /* yacc.c:1646 */ -+#line 3668 "grammar.c" /* yacc.c:1646 */ - break; - - case 120: --#line 1910 "grammar.y" /* yacc.c:1646 */ -+#line 1920 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, ">>"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, ">>"); -@@ -3681,19 +3678,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(>>, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3685 "grammar.c" /* yacc.c:1646 */ -+#line 3682 "grammar.c" /* yacc.c:1646 */ - break; - - case 121: --#line 1920 "grammar.y" /* yacc.c:1646 */ -+#line 1930 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3693 "grammar.c" /* yacc.c:1646 */ -+#line 3690 "grammar.c" /* yacc.c:1646 */ - break; - - --#line 3697 "grammar.c" /* yacc.c:1646 */ -+#line 3694 "grammar.c" /* yacc.c:1646 */ - default: break; - } - /* User semantic actions sometimes alter yychar, and that requires -@@ -3921,5 +3918,5 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - #endif - return yyresult; - } --#line 1925 "grammar.y" /* yacc.c:1906 */ -+#line 1935 "grammar.y" /* yacc.c:1906 */ - -diff --git a/libyara/grammar.h b/libyara/grammar.h -index 06b3cbd..0e35f37 100644 ---- a/libyara/grammar.h -+++ b/libyara/grammar.h -@@ -152,7 +152,7 @@ extern int yara_yydebug; - - union YYSTYPE - { --#line 191 "grammar.y" /* yacc.c:1909 */ -+#line 204 "grammar.y" /* yacc.c:1909 */ - - EXPRESSION expression; - SIZED_STRING* sized_string; -diff --git a/libyara/grammar.y b/libyara/grammar.y -index 0090d73..56bae40 100644 ---- a/libyara/grammar.y -+++ b/libyara/grammar.y -@@ -609,7 +609,7 @@ identifier - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_OBJ_LOAD, -- PTR_TO_INT64(id), -+ id, - NULL, - NULL); - -@@ -629,7 +629,7 @@ identifier - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH_RULE, -- PTR_TO_INT64(rule), -+ rule, - NULL, - NULL); - -@@ -669,7 +669,7 @@ identifier - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_OBJ_FIELD, -- PTR_TO_INT64(ident), -+ ident, - NULL, - NULL); - -@@ -772,7 +772,7 @@ identifier - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_CALL, -- PTR_TO_INT64(args_fmt), -+ args_fmt, - NULL, - NULL); - -@@ -896,7 +896,7 @@ regexp - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH, -- PTR_TO_INT64(re->root_node->forward_code), -+ re->root_node->forward_code, - NULL, - NULL); - -@@ -1106,8 +1106,7 @@ expression - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_JNUNDEF, -- PTR_TO_INT64( -- compiler->loop_address[compiler->loop_depth]), -+ compiler->loop_address[compiler->loop_depth], - NULL, - NULL); - } -@@ -1130,8 +1129,7 @@ expression - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_JLE, -- PTR_TO_INT64( -- compiler->loop_address[compiler->loop_depth]), -+ compiler->loop_address[compiler->loop_depth], - NULL, - NULL); - -@@ -1216,8 +1214,7 @@ expression - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_JNUNDEF, -- PTR_TO_INT64( -- compiler->loop_address[compiler->loop_depth]), -+ compiler->loop_address[compiler->loop_depth], - NULL, - NULL); - -@@ -1256,7 +1253,7 @@ expression - | boolean_expression _AND_ - { - YR_FIXUP* fixup; -- int64_t* jmp_destination_addr; -+ void* jmp_destination_addr; - - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, -@@ -1308,7 +1305,7 @@ expression - // page, so we can compute the address for the opcode following the AND - // by simply adding one to its address. - -- *(fixup->address) = PTR_TO_INT64(and_addr + 1); -+ *(void**)(fixup->address) = (void*)(and_addr + 1); - - compiler->fixup_stack_head = fixup->next; - yr_free(fixup); -@@ -1318,7 +1315,7 @@ expression - | boolean_expression _OR_ - { - YR_FIXUP* fixup; -- int64_t* jmp_destination_addr; -+ void* jmp_destination_addr; - - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, -@@ -1369,7 +1366,7 @@ expression - // page, so we can compute the address for the opcode following the OR - // by simply adding one to its address. - -- *(fixup->address) = PTR_TO_INT64(or_addr + 1); -+ *(void**)(fixup->address) = (void*)(or_addr + 1); - - compiler->fixup_stack_head = fixup->next; - yr_free(fixup); -@@ -1630,7 +1627,7 @@ primary_expression - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH, -- PTR_TO_INT64(sized_string), -+ sized_string, - NULL, - NULL); - -diff --git a/libyara/include/yara/compiler.h b/libyara/include/yara/compiler.h -index f111373..440b777 100644 ---- a/libyara/include/yara/compiler.h -+++ b/libyara/include/yara/compiler.h -@@ -53,7 +53,7 @@ typedef void (*YR_COMPILER_CALLBACK_FUNC)( - - typedef struct _YR_FIXUP - { -- int64_t* address; -+ void* address; - struct _YR_FIXUP* next; - - } YR_FIXUP; -diff --git a/libyara/include/yara/modules.h b/libyara/include/yara/modules.h -index 3b5b058..38e1bcd 100644 ---- a/libyara/include/yara/modules.h -+++ b/libyara/include/yara/modules.h -@@ -272,7 +272,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - - #define sized_string_argument(n) \ -- ((SIZED_STRING*)(size_t)((int64_t*) __args)[n-1]) -+ (*(SIZED_STRING**) &(((int64_t*) __args)[n-1])) - - #define string_argument(n) \ - (sized_string_argument(n)->c_string) -diff --git a/libyara/include/yara/parser.h b/libyara/include/yara/parser.h -index 8fff40e..77c26b6 100644 ---- a/libyara/include/yara/parser.h -+++ b/libyara/include/yara/parser.h -@@ -59,9 +59,9 @@ int yr_parser_emit_with_arg_double( - int yr_parser_emit_with_arg_reloc( - yyscan_t yyscanner, - uint8_t instruction, -- int64_t argument, -+ void* argument, - uint8_t** instruction_address, -- int64_t** argument_address); -+ void** argument_address); - - - int yr_parser_check_types( -diff --git a/libyara/include/yara/pe.h b/libyara/include/yara/pe.h -index 001da4d..0291cb0 100644 ---- a/libyara/include/yara/pe.h -+++ b/libyara/include/yara/pe.h -@@ -31,6 +31,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #define YR_PE_H - - #include -+#include - - #pragma pack(push, 1) - -@@ -312,7 +313,7 @@ typedef struct _IMAGE_NT_HEADERS64 { - #define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \ - ((BYTE*)ntheader + \ - FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) + \ -- ((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader \ -+ yr_le16toh(((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader) \ - )) - - // Subsystem Values -diff --git a/libyara/include/yara/utils.h b/libyara/include/yara/utils.h -index 104d9ee..da0fb88 100644 ---- a/libyara/include/yara/utils.h -+++ b/libyara/include/yara/utils.h -@@ -31,6 +31,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #ifndef YR_UTILS_H - #define YR_UTILS_H - -+#include -+ - #ifndef TRUE - #define TRUE 1 - #endif -@@ -68,7 +70,33 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #define yr_min(x, y) ((x < y) ? (x) : (y)) - #define yr_max(x, y) ((x > y) ? (x) : (y)) - --#define PTR_TO_INT64(x) ((int64_t) (size_t) x) -+#if defined(__GNUC__) -+#define yr_bswap16(x) __builtin_bswap16(x) -+#define yr_bswap32(x) __builtin_bswap32(x) -+#define yr_bswap64(x) __builtin_bswap64(x) -+#elif defined(_MSC_VER) -+#define yr_bswap16(x) _byteswap_ushort(x) -+#define yr_bswap32(x) _byteswap_ulong(x) -+#define yr_bswap64(x) _byteswap_uint64(x) -+#else -+#error Unknown compiler: Add yr_bswap* definitions -+#endif -+ -+#if defined(WORDS_BIGENDIAN) -+#define yr_le16toh(x) yr_bswap16(x) -+#define yr_le32toh(x) yr_bswap32(x) -+#define yr_le64toh(x) yr_bswap64(x) -+#define yr_be16toh(x) (x) -+#define yr_be32toh(x) (x) -+#define yr_be64toh(x) (x) -+#else -+#define yr_le16toh(x) (x) -+#define yr_le32toh(x) (x) -+#define yr_le64toh(x) (x) -+#define yr_be16toh(x) yr_bswap16(x) -+#define yr_be32toh(x) yr_bswap32(x) -+#define yr_be64toh(x) yr_bswap64(x) -+#endif - - - #ifdef NDEBUG -diff --git a/libyara/parser.c b/libyara/parser.c -index 0ced96e..9c99e17 100644 ---- a/libyara/parser.c -+++ b/libyara/parser.c -@@ -111,11 +111,13 @@ int yr_parser_emit_with_arg( - int yr_parser_emit_with_arg_reloc( - yyscan_t yyscanner, - uint8_t instruction, -- int64_t argument, -+ void* argument, - uint8_t** instruction_address, -- int64_t** argument_address) -+ void** argument_address) - { - int64_t* ptr = NULL; -+ DECLARE_REFERENCE(void*, argument) a; -+ a.argument = argument; - - int result = yr_arena_write_data( - yyget_extra(yyscanner)->code_arena, -@@ -126,7 +128,7 @@ int yr_parser_emit_with_arg_reloc( - if (result == ERROR_SUCCESS) - result = yr_arena_write_data( - yyget_extra(yyscanner)->code_arena, -- &argument, -+ &a, - sizeof(int64_t), - (void**) &ptr); - -@@ -138,7 +140,7 @@ int yr_parser_emit_with_arg_reloc( - EOL); - - if (argument_address != NULL) -- *argument_address = ptr; -+ *argument_address = (void*)ptr; - - return result; - } -@@ -180,7 +182,7 @@ int yr_parser_emit_pushes_for_strings( - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH, -- PTR_TO_INT64(string), -+ string, - NULL, - NULL); - -@@ -747,7 +749,7 @@ YR_RULE* yr_parser_reduce_rule_declaration_phase_1( - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_INIT_RULE, -- PTR_TO_INT64(rule), -+ rule, - NULL, - NULL); - -@@ -798,7 +800,7 @@ int yr_parser_reduce_rule_declaration_phase_2( - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_MATCH_RULE, -- PTR_TO_INT64(rule), -+ rule, - NULL, - NULL); - -@@ -875,7 +877,7 @@ int yr_parser_reduce_string_identifier( - yr_parser_emit_with_arg_reloc( - yyscanner, - OP_PUSH, -- PTR_TO_INT64(string), -+ string, - NULL, - NULL); - -@@ -1021,7 +1023,7 @@ int yr_parser_reduce_import( - compiler->last_result = yr_parser_emit_with_arg_reloc( - yyscanner, - OP_IMPORT, -- PTR_TO_INT64(name), -+ name, - NULL, - NULL); - -diff --git a/tests/test-pe.c b/tests/test-pe.c -index c2c6270..93cb06e 100644 ---- a/tests/test-pe.c -+++ b/tests/test-pe.c -@@ -1,8 +1,11 @@ - #include -+#include -+#include - #include "util.h" - - int main(int argc, char** argv) - { -+#if (defined(HAVE_ENDIAN_H) && BYTE_ORDER == LITTLE_ENDIAN) || defined(_MSC) - yr_initialize(); - - assert_true_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }", -@@ -15,5 +18,9 @@ int main(int argc, char** argv) - "tests/data/tiny-idata-5200"); - - yr_finalize(); -+#else -+ puts("Not testing pe module on big-endian architectures ... yet"); -+ exit(77); -+#endif - return 0; - } -diff --git a/tests/test-rules.c b/tests/test-rules.c -index a305f06..19a0902 100644 ---- a/tests/test-rules.c -+++ b/tests/test-rules.c -@@ -613,10 +613,9 @@ static void test_at() - static void test_in() - { - assert_true_rule_blob( -- "import \"pe\" \ -- rule test { \ -+ "rule test { \ - strings: $a = { 6a 2a 58 c3 } \ -- condition: $a in (pe.entry_point .. pe.entry_point + 1) }", -+ condition: $a in (entrypoint .. entrypoint + 1) }", - PE32_FILE); - } - - -From 00b7e34c42407051dfcb4f6e48c35820416123dd Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Sun, 16 Oct 2016 13:01:31 +0200 -Subject: [PATCH 13/36] Fix pe, elf module for big-endian architectures - (related to #493) (#538) - -* Fix pe module for big-endian architectures - -* No longer skip pe test on big-endian architectures - -(The ifdef was wrong anyhow.) - -* Add tests for elf module - -* Fix elf module for big-endian architectures - -(cherry picked from commit d272b9c742e15d6767f20a7f1c01579b468cceee) ---- - Makefile.am | 4 +- - libyara/include/yara/pe_utils.h | 2 +- - libyara/modules/elf.c | 135 ++++++++++++++++------------- - libyara/modules/pe.c | 187 +++++++++++++++++++++------------------- - libyara/modules/pe_utils.c | 78 ++++++++--------- - tests/test-elf.c | 29 +++++++ - tests/test-pe.c | 5 -- - 7 files changed, 244 insertions(+), 196 deletions(-) - create mode 100644 tests/test-elf.c - -diff --git a/Makefile.am b/Makefile.am -index 4d4f7fa..8c1652a 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -15,12 +15,14 @@ yarac_SOURCES = args.c args.h yarac.c - yarac_LDADD = libyara/.libs/libyara.a - - TESTS = $(check_PROGRAMS) --check_PROGRAMS = test-alignment test-rules test-pe -+check_PROGRAMS = test-alignment test-rules test-pe test-elf - test_alignment_SOURCES = tests/test-alignment.c - test_rules_SOURCES = tests/test-rules.c tests/util.c - test_rules_LDADD = libyara/.libs/libyara.a - test_pe_SOURCES = tests/test-pe.c tests/util.c - test_pe_LDADD = libyara/.libs/libyara.a -+test_elf_SOURCES = tests/test-elf.c tests/util.c -+test_elf_LDADD = libyara/.libs/libyara.a - - # man pages - man1_MANS = yara.man yarac.man -diff --git a/libyara/include/yara/pe_utils.h b/libyara/include/yara/pe_utils.h -index 88e5a61..86571c5 100644 ---- a/libyara/include/yara/pe_utils.h -+++ b/libyara/include/yara/pe_utils.h -@@ -7,7 +7,7 @@ - - - #define IS_64BITS_PE(pe) \ -- (pe->header64->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) -+ (yr_le16toh(pe->header64->OptionalHeader.Magic) == IMAGE_NT_OPTIONAL_HDR64_MAGIC) - - - #define OptionalHeader(pe,field) \ -diff --git a/libyara/modules/elf.c b/libyara/modules/elf.c -index ed4ccd1..08c3ce4 100644 ---- a/libyara/modules/elf.c -+++ b/libyara/modules/elf.c -@@ -48,7 +48,7 @@ int get_elf_type( - - elf_ident = (elf_ident_t*) buffer; - -- if (elf_ident->magic == ELF_MAGIC) -+ if (yr_le32toh(elf_ident->magic) == ELF_MAGIC) - { - return elf_ident->_class; - } -@@ -58,11 +58,11 @@ int get_elf_type( - } - } - --#define SIZE_OF_SECTION_TABLE_32 \ -- (sizeof(elf32_section_header_t) * elf_header->sh_entry_count) -+#define SIZE_OF_SECTION_TABLE_32(h) \ -+ (sizeof(elf32_section_header_t) * yr_le16toh(h->sh_entry_count)) - --#define SIZE_OF_SECTION_TABLE_64 \ -- (sizeof(elf64_section_header_t) * elf_header->sh_entry_count) -+#define SIZE_OF_SECTION_TABLE_64(h) \ -+ (sizeof(elf64_section_header_t) * yr_le16toh(h->sh_entry_count)) - - - #define ELF_RVA_TO_OFFSET(bits) \ -@@ -77,30 +77,34 @@ uint64_t elf_rva_to_offset_##bits( \ - \ - /* check that sh_offset doesn't wrap when added to SIZE_OF_SECTION_TABLE */ \ - \ -- if(ULONG_MAX - elf_header->sh_offset < SIZE_OF_SECTION_TABLE_##bits) \ -+ if(ULONG_MAX - yr_le##bits##toh(elf_header->sh_offset) < \ -+ SIZE_OF_SECTION_TABLE_##bits(elf_header)) \ - { \ - return UNDEFINED; \ - } \ - \ -- if (elf_header->sh_offset == 0 || \ -- elf_header->sh_offset > elf_size || \ -- elf_header->sh_offset + SIZE_OF_SECTION_TABLE_##bits > elf_size || \ -- elf_header->sh_entry_count == 0) \ -+ if (yr_le##bits##toh(elf_header->sh_offset) == 0 || \ -+ yr_le##bits##toh(elf_header->sh_offset) > elf_size || \ -+ yr_le##bits##toh(elf_header->sh_offset) + \ -+ SIZE_OF_SECTION_TABLE_##bits(elf_header) > elf_size || \ -+ yr_le16toh(elf_header->sh_entry_count) == 0) \ - { \ - return UNDEFINED; \ - } \ - \ - section = (elf##bits##_section_header_t*) \ -- ((uint8_t*) elf_header + elf_header->sh_offset); \ -+ ((uint8_t*) elf_header + yr_le##bits##toh(elf_header->sh_offset)); \ - \ -- for (i = 0; i < elf_header->sh_entry_count; i++) \ -+ for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) \ - { \ -- if (section->type != ELF_SHT_NULL && \ -- section->type != ELF_SHT_NOBITS && \ -- rva >= section->addr && \ -- rva < section->addr + section->size) \ -+ if (yr_le32toh(section->type) != ELF_SHT_NULL && \ -+ yr_le32toh(section->type) != ELF_SHT_NOBITS && \ -+ rva >= yr_le##bits##toh(section->addr) && \ -+ rva < yr_le##bits##toh(section->addr) + \ -+ yr_le##bits##toh(section->size)) \ - { \ -- return section->offset + (rva - section->addr); \ -+ return yr_le##bits##toh(section->offset) + \ -+ (rva - yr_le##bits##toh(section->addr)); \ - } \ - \ - section++; \ -@@ -122,83 +126,96 @@ void parse_elf_header_##bits( \ - elf##bits##_section_header_t* section; \ - elf##bits##_program_header_t* segment; \ - \ -- set_integer(elf->type, elf_obj, "type"); \ -- set_integer(elf->machine, elf_obj, "machine"); \ -- set_integer(elf->sh_offset, elf_obj, "sh_offset"); \ -- set_integer(elf->sh_entry_size, elf_obj, "sh_entry_size"); \ -- set_integer(elf->sh_entry_count, elf_obj, "number_of_sections"); \ -- set_integer(elf->ph_offset, elf_obj, "ph_offset"); \ -- set_integer(elf->ph_entry_size, elf_obj, "ph_entry_size"); \ -- set_integer(elf->ph_entry_count, elf_obj, "number_of_segments"); \ -+ set_integer(yr_le16toh(elf->type), elf_obj, "type"); \ -+ set_integer(yr_le16toh(elf->machine), elf_obj, "machine"); \ -+ set_integer(yr_le##bits##toh(elf->sh_offset), elf_obj, "sh_offset"); \ -+ set_integer(yr_le16toh(elf->sh_entry_size), elf_obj, "sh_entry_size"); \ -+ set_integer(yr_le16toh(elf->sh_entry_count), elf_obj, "number_of_sections"); \ -+ set_integer(yr_le##bits##toh(elf->ph_offset), elf_obj, "ph_offset"); \ -+ set_integer(yr_le16toh(elf->ph_entry_size), elf_obj, "ph_entry_size"); \ -+ set_integer(yr_le16toh(elf->ph_entry_count), elf_obj, "number_of_segments"); \ - \ -- if (elf->entry != 0) \ -+ if (yr_le##bits##toh(elf->entry) != 0) \ - { \ - set_integer( \ - flags & SCAN_FLAGS_PROCESS_MEMORY ? \ -- base_address + elf->entry : \ -- elf_rva_to_offset_##bits(elf, elf->entry, elf_size), \ -+ base_address + yr_le##bits##toh(elf->entry) : \ -+ elf_rva_to_offset_##bits(elf, yr_le##bits##toh(elf->entry), elf_size), \ - elf_obj, "entry_point"); \ - } \ - \ -- if (elf->sh_entry_count < ELF_SHN_LORESERVE && \ -- elf->sh_str_table_index < elf->sh_entry_count && \ -- elf->sh_offset < elf_size && \ -- elf->sh_offset + elf->sh_entry_count * \ -+ if (yr_le16toh(elf->sh_entry_count) < ELF_SHN_LORESERVE && \ -+ yr_le16toh(elf->sh_str_table_index) < yr_le16toh(elf->sh_entry_count) && \ -+ yr_le##bits##toh(elf->sh_offset) < elf_size && \ -+ yr_le##bits##toh(elf->sh_offset) + yr_le16toh(elf->sh_entry_count) * \ - sizeof(elf##bits##_section_header_t) <= elf_size) \ - { \ - char* str_table = NULL; \ - \ - section = (elf##bits##_section_header_t*) \ -- ((uint8_t*) elf + elf->sh_offset); \ -+ ((uint8_t*) elf + yr_le##bits##toh(elf->sh_offset)); \ - \ -- if (section[elf->sh_str_table_index].offset < elf_size) \ -- str_table = (char*) elf + section[elf->sh_str_table_index].offset; \ -+ if (section[yr_le16toh(elf->sh_str_table_index)].offset < elf_size) \ -+ str_table = (char*) elf + \ -+ yr_le##bits##toh(section[yr_le16toh(elf->sh_str_table_index)].offset); \ - \ -- for (i = 0; i < elf->sh_entry_count; i++) \ -+ for (i = 0; i < yr_le16toh(elf->sh_entry_count); i++) \ - { \ -- set_integer(section->type, elf_obj, "sections[%i].type", i); \ -- set_integer(section->flags, elf_obj, "sections[%i].flags", i); \ -- set_integer(section->size, elf_obj, "sections[%i].size", i); \ -- set_integer(section->offset, elf_obj, "sections[%i].offset", i); \ -+ set_integer(yr_le32toh(section->type), elf_obj, \ -+ "sections[%i].type", i); \ -+ set_integer(yr_le32toh(section->flags), elf_obj, \ -+ "sections[%i].flags", i); \ -+ set_integer(yr_le##bits##toh(section->size), elf_obj, \ -+ "sections[%i].size", i); \ -+ set_integer(yr_le##bits##toh(section->offset), elf_obj, \ -+ "sections[%i].offset", i); \ - \ -- if (section->name < elf_size && \ -+ if (yr_le##bits##toh(section->name) < elf_size && \ - str_table > (char*) elf && \ -- str_table + section->name < (char*) elf + elf_size) \ -+ str_table + yr_le##bits##toh(section->name) < \ -+ (char*) elf + elf_size) \ - { \ -- set_string(str_table + section->name, elf_obj, "sections[%i].name", i);\ -+ set_string(str_table + yr_le##bits##toh(section->name), elf_obj, \ -+ "sections[%i].name", i); \ - } \ - \ - section++; \ - } \ - } \ - \ -- if (elf->ph_entry_count > 0 && \ -- elf->ph_entry_count < ELF_PN_XNUM && \ -- elf->ph_offset < elf_size && \ -- elf->ph_offset + elf->ph_entry_count * \ -+ if (yr_le16toh(elf->ph_entry_count) > 0 && \ -+ yr_le16toh(elf->ph_entry_count) < ELF_PN_XNUM && \ -+ yr_le##bits##toh(elf->ph_offset) < elf_size && \ -+ yr_le##bits##toh(elf->ph_offset) + yr_le16toh(elf->ph_entry_count) * \ - sizeof(elf##bits##_program_header_t) <= elf_size) \ - { \ - segment = (elf##bits##_program_header_t*) \ -- ((uint8_t*) elf + elf->ph_offset); \ -+ ((uint8_t*) elf + yr_le##bits##toh(elf->ph_offset)); \ - \ -- for (i = 0; i < elf->ph_entry_count; i++) \ -+ for (i = 0; i < yr_le16toh(elf->ph_entry_count); i++) \ - { \ - set_integer( \ -- segment->type, elf_obj, "segments[%i].type", i); \ -+ yr_le32toh(segment->type), elf_obj, "segments[%i].type", i); \ - set_integer( \ -- segment->flags, elf_obj, "segments[%i].flags", i); \ -+ yr_le32toh(segment->flags), elf_obj, "segments[%i].flags", i); \ - set_integer( \ -- segment->offset, elf_obj, "segments[%i].offset", i); \ -+ yr_le##bits##toh(segment->offset), elf_obj, \ -+ "segments[%i].offset", i); \ - set_integer( \ -- segment->virt_addr, elf_obj, "segments[%i].virtual_address", i); \ -+ yr_le##bits##toh(segment->virt_addr), elf_obj, \ -+ "segments[%i].virtual_address", i); \ - set_integer( \ -- segment->phys_addr, elf_obj, "segments[%i].physical_address", i); \ -+ yr_le##bits##toh(segment->phys_addr), elf_obj, \ -+ "segments[%i].physical_address", i); \ - set_integer( \ -- segment->file_size, elf_obj, "segments[%i].file_size", i); \ -+ yr_le##bits##toh(segment->file_size), elf_obj, \ -+ "segments[%i].file_size", i); \ - set_integer( \ -- segment->mem_size, elf_obj, "segments[%i].memory_size", i); \ -+ yr_le##bits##toh(segment->mem_size), elf_obj, \ -+ "segments[%i].memory_size", i); \ - set_integer( \ -- segment->alignment, elf_obj, "segments[%i].alignment", i); \ -+ yr_le##bits##toh(segment->alignment), elf_obj, \ -+ "segments[%i].alignment", i); \ - \ - segment++; \ - } \ -@@ -398,7 +415,7 @@ int module_load( - elf_header32 = (elf32_header_t*) block_data; - - if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || -- elf_header32->type == ELF_ET_EXEC) -+ yr_le16toh(elf_header32->type) == ELF_ET_EXEC) - { - parse_elf_header_32( - elf_header32, -@@ -418,7 +435,7 @@ int module_load( - elf_header64 = (elf64_header_t*) block_data; - - if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || -- elf_header64->type == ELF_ET_EXEC) -+ yr_le16toh(elf_header64->type) == ELF_ET_EXEC) - { - parse_elf_header_64( - elf_header64, -diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c -index 8c4cb12..7c32daf 100644 ---- a/libyara/modules/pe.c -+++ b/libyara/modules/pe.c -@@ -156,13 +156,13 @@ void pe_parse_rich_signature( - - mz_header = (PIMAGE_DOS_HEADER) pe->data; - -- if (mz_header->e_magic != IMAGE_DOS_SIGNATURE) -+ if (yr_le16toh(mz_header->e_magic) != IMAGE_DOS_SIGNATURE) - return; - -- if (mz_header->e_lfanew < 0) -+ if (yr_le32toh(mz_header->e_lfanew) < 0) - return; - -- headers_size = mz_header->e_lfanew + \ -+ headers_size = yr_le32toh(mz_header->e_lfanew) + \ - sizeof(pe_header->Signature) + \ - sizeof(IMAGE_FILE_HEADER); - -@@ -177,9 +177,9 @@ void pe_parse_rich_signature( - - rich_signature = (PRICH_SIGNATURE) (pe->data + 0x80); - -- if (rich_signature->key1 != rich_signature->key2 || -- rich_signature->key2 != rich_signature->key3 || -- (rich_signature->dans ^ rich_signature->key1) != RICH_DANS) -+ if (yr_le32toh(rich_signature->key1) != yr_le32toh(rich_signature->key2) || -+ yr_le32toh(rich_signature->key2) != yr_le32toh(rich_signature->key3) || -+ (yr_le32toh(rich_signature->dans) ^ yr_le32toh(rich_signature->key1)) != RICH_DANS) - { - return; - } -@@ -188,7 +188,7 @@ void pe_parse_rich_signature( - rich_ptr <= (DWORD*) (pe->data + headers_size); - rich_ptr++) - { -- if (*rich_ptr == RICH_RICH) -+ if (yr_le32toh(*rich_ptr) == RICH_RICH) - { - // Multiple by 4 because we are counting in DWORDs. - rich_len = (rich_ptr - (DWORD*) rich_signature) * 4; -@@ -261,11 +261,11 @@ uint8_t* parse_resource_name( - // If high bit is set it is an offset relative to rsrc_data, which contains - // a resource directory string. - -- if (entry->Name & 0x80000000) -+ if (yr_le32toh(entry->Name) & 0x80000000) - { - DWORD length; - -- uint8_t* rsrc_str_ptr = rsrc_data + (entry->Name & 0x7FFFFFFF); -+ uint8_t* rsrc_str_ptr = rsrc_data + (yr_le32toh(entry->Name) & 0x7FFFFFFF); - - // A resource directory string is 2 bytes for a string and then a variable - // length Unicode string. Make sure we at least have two bytes. -@@ -307,15 +307,15 @@ int _pe_iterate_resources( - - // A few sanity checks to avoid corrupt files - -- if (resource_dir->Characteristics != 0 || -- resource_dir->NumberOfNamedEntries > 32768 || -- resource_dir->NumberOfIdEntries > 32768) -+ if (yr_le32toh(resource_dir->Characteristics) != 0 || -+ yr_le16toh(resource_dir->NumberOfNamedEntries) > 32768 || -+ yr_le16toh(resource_dir->NumberOfIdEntries) > 32768) - { - return result; - } - -- total_entries = resource_dir->NumberOfNamedEntries + -- resource_dir->NumberOfIdEntries; -+ total_entries = yr_le16toh(resource_dir->NumberOfNamedEntries) + -+ yr_le16toh(resource_dir->NumberOfIdEntries); - - // The first directory entry is just after the resource directory, - // by incrementing resource_dir we skip sizeof(resource_dir) bytes -@@ -333,15 +333,15 @@ int _pe_iterate_resources( - switch(rsrc_tree_level) - { - case 0: -- *type = entry->Name; -+ *type = yr_le32toh(entry->Name); - type_string = parse_resource_name(pe, rsrc_data, entry); - break; - case 1: -- *id = entry->Name; -+ *id = yr_le32toh(entry->Name); - name_string = parse_resource_name(pe, rsrc_data, entry); - break; - case 2: -- *language = entry->Name; -+ *language = yr_le32toh(entry->Name); - lang_string = parse_resource_name(pe, rsrc_data, entry); - break; - } -@@ -425,11 +425,11 @@ int pe_iterate_resources( - PIMAGE_DATA_DIRECTORY directory = pe_get_directory_entry( - pe, IMAGE_DIRECTORY_ENTRY_RESOURCE); - -- if (directory->VirtualAddress != 0) -+ if (yr_le32toh(directory->VirtualAddress) != 0) - { - PIMAGE_RESOURCE_DIRECTORY rsrc_dir; - -- offset = pe_rva_to_offset(pe, directory->VirtualAddress); -+ offset = pe_rva_to_offset(pe, yr_le32toh(directory->VirtualAddress)); - - if (offset < 0) - return 0; -@@ -438,14 +438,14 @@ int pe_iterate_resources( - - if (struct_fits_in_pe(pe, rsrc_dir, IMAGE_RESOURCE_DIRECTORY)) - { -- set_integer(rsrc_dir->TimeDateStamp, -+ set_integer(yr_le32toh(rsrc_dir->TimeDateStamp), - pe->object, - "resource_timestamp"); - -- set_integer(rsrc_dir->MajorVersion, -+ set_integer(yr_le16toh(rsrc_dir->MajorVersion), - pe->object, - "resource_version.major"); -- set_integer(rsrc_dir->MinorVersion, -+ set_integer(yr_le16toh(rsrc_dir->MinorVersion), - pe->object, - "resource_version.minor"); - -@@ -483,7 +483,7 @@ void pe_parse_version_info( - { - PVERSION_INFO version_info; - -- int64_t version_info_offset = pe_rva_to_offset(pe, rsrc_data->OffsetToData); -+ int64_t version_info_offset = pe_rva_to_offset(pe, yr_le32toh(rsrc_data->OffsetToData)); - - if (version_info_offset < 0) - return; -@@ -504,16 +504,16 @@ void pe_parse_version_info( - - while(fits_in_pe(pe, version_info->Key, sizeof("VarFileInfo") * 2) && - strcmp_w(version_info->Key, "VarFileInfo") == 0 && -- version_info->Length != 0) -+ yr_le16toh(version_info->Length) != 0) - { - version_info = ADD_OFFSET( - version_info, -- version_info->Length); -+ yr_le16toh(version_info->Length)); - } - - while(fits_in_pe(pe, version_info->Key, sizeof("StringFileInfo") * 2) && - strcmp_w(version_info->Key, "StringFileInfo") == 0 && -- version_info->Length != 0) -+ yr_le16toh(version_info->Length) != 0) - { - PVERSION_INFO string_table = ADD_OFFSET( - version_info, -@@ -521,11 +521,11 @@ void pe_parse_version_info( - - version_info = ADD_OFFSET( - version_info, -- version_info->Length); -+ yr_le16toh(version_info->Length)); - - while (struct_fits_in_pe(pe, string_table, VERSION_INFO) && - wide_string_fits_in_pe(pe, string_table->Key) && -- string_table->Length != 0 && -+ yr_le16toh(string_table->Length) != 0 && - string_table < version_info) - { - PVERSION_INFO string = ADD_OFFSET( -@@ -534,11 +534,11 @@ void pe_parse_version_info( - - string_table = ADD_OFFSET( - string_table, -- string_table->Length); -+ yr_le16toh(string_table->Length)); - - while (struct_fits_in_pe(pe, string, VERSION_INFO) && - wide_string_fits_in_pe(pe, string->Key) && -- string->Length != 0 && -+ yr_le16toh(string->Length) != 0 && - string < string_table) - { - if (string->ValueLength > 0) -@@ -577,9 +577,9 @@ int pe_collect_resources( - { - DWORD length; - -- int64_t offset = pe_rva_to_offset(pe, rsrc_data->OffsetToData); -+ int64_t offset = pe_rva_to_offset(pe, yr_le32toh(rsrc_data->OffsetToData)); - -- if (offset < 0 || !fits_in_pe(pe, pe->data + offset, rsrc_data->Size)) -+ if (offset < 0 || !fits_in_pe(pe, pe->data + offset, yr_le32toh(rsrc_data->Size))) - return RESOURCE_CALLBACK_CONTINUE; - - set_integer( -@@ -589,7 +589,7 @@ int pe_collect_resources( - pe->resources); - - set_integer( -- rsrc_data->Size, -+ yr_le32toh(rsrc_data->Size), - pe->object, - "resources[%i].length", - pe->resources); -@@ -669,13 +669,13 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor( - int num_functions = 0; - - int64_t offset = pe_rva_to_offset( -- pe, import_descriptor->OriginalFirstThunk); -+ pe, yr_le32toh(import_descriptor->OriginalFirstThunk)); - - // I've seen binaries where OriginalFirstThunk is zero. In this case - // use FirstThunk. - - if (offset <= 0) -- offset = pe_rva_to_offset(pe, import_descriptor->FirstThunk); -+ offset = pe_rva_to_offset(pe, yr_le32toh(import_descriptor->FirstThunk)); - - if (offset < 0) - return NULL; -@@ -685,16 +685,16 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor( - PIMAGE_THUNK_DATA64 thunks64 = (PIMAGE_THUNK_DATA64)(pe->data + offset); - - while (struct_fits_in_pe(pe, thunks64, IMAGE_THUNK_DATA64) && -- thunks64->u1.Ordinal != 0 && num_functions < MAX_PE_IMPORTS) -+ yr_le64toh(thunks64->u1.Ordinal) != 0 && num_functions < MAX_PE_IMPORTS) - { - char* name = NULL; - uint16_t ordinal = 0; - uint8_t has_ordinal = 0; - -- if (!(thunks64->u1.Ordinal & IMAGE_ORDINAL_FLAG64)) -+ if (!(yr_le64toh(thunks64->u1.Ordinal) & IMAGE_ORDINAL_FLAG64)) - { - // If imported by name -- offset = pe_rva_to_offset(pe, thunks64->u1.Function); -+ offset = pe_rva_to_offset(pe, yr_le64toh(thunks64->u1.Function)); - - if (offset >= 0) - { -@@ -712,9 +712,9 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor( - else - { - // If imported by ordinal. Lookup the ordinal. -- name = ord_lookup(dll_name, thunks64->u1.Ordinal & 0xFFFF); -+ name = ord_lookup(dll_name, yr_le64toh(thunks64->u1.Ordinal) & 0xFFFF); - // Also store the ordinal. -- ordinal = thunks64->u1.Ordinal & 0xFFFF; -+ ordinal = yr_le64toh(thunks64->u1.Ordinal) & 0xFFFF; - has_ordinal = 1; - } - -@@ -752,16 +752,16 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor( - PIMAGE_THUNK_DATA32 thunks32 = (PIMAGE_THUNK_DATA32)(pe->data + offset); - - while (struct_fits_in_pe(pe, thunks32, IMAGE_THUNK_DATA32) && -- thunks32->u1.Ordinal != 0 && num_functions < MAX_PE_IMPORTS) -+ yr_le32toh(thunks32->u1.Ordinal) != 0 && num_functions < MAX_PE_IMPORTS) - { - char* name = NULL; - uint16_t ordinal = 0; - uint8_t has_ordinal = 0; - -- if (!(thunks32->u1.Ordinal & IMAGE_ORDINAL_FLAG32)) -+ if (!(yr_le32toh(thunks32->u1.Ordinal) & IMAGE_ORDINAL_FLAG32)) - { - // If imported by name -- offset = pe_rva_to_offset(pe, thunks32->u1.Function); -+ offset = pe_rva_to_offset(pe, yr_le32toh(thunks32->u1.Function)); - - if (offset >= 0) - { -@@ -779,9 +779,9 @@ IMPORTED_FUNCTION* pe_parse_import_descriptor( - else - { - // If imported by ordinal. Lookup the ordinal. -- name = ord_lookup(dll_name, thunks32->u1.Ordinal & 0xFFFF); -+ name = ord_lookup(dll_name, yr_le32toh(thunks32->u1.Ordinal) & 0xFFFF); - // Also store the ordinal. -- ordinal = thunks32->u1.Ordinal & 0xFFFF; -+ ordinal = yr_le32toh(thunks32->u1.Ordinal) & 0xFFFF; - has_ordinal = 1; - } - -@@ -865,10 +865,10 @@ IMPORTED_DLL* pe_parse_imports( - PIMAGE_DATA_DIRECTORY directory = pe_get_directory_entry( - pe, IMAGE_DIRECTORY_ENTRY_IMPORT); - -- if (directory->VirtualAddress == 0) -+ if (yr_le32toh(directory->VirtualAddress) == 0) - return NULL; - -- offset = pe_rva_to_offset(pe, directory->VirtualAddress); -+ offset = pe_rva_to_offset(pe, yr_le32toh(directory->VirtualAddress)); - - if (offset < 0) - return NULL; -@@ -877,9 +877,9 @@ IMPORTED_DLL* pe_parse_imports( - (pe->data + offset); - - while (struct_fits_in_pe(pe, imports, IMAGE_IMPORT_DESCRIPTOR) && -- imports->Name != 0 && num_imports < MAX_PE_IMPORTS) -+ yr_le32toh(imports->Name) != 0 && num_imports < MAX_PE_IMPORTS) - { -- int64_t offset = pe_rva_to_offset(pe, imports->Name); -+ int64_t offset = pe_rva_to_offset(pe, yr_le32toh(imports->Name)); - - if (offset >= 0) - { -@@ -943,19 +943,19 @@ void pe_parse_certificates( - set_integer(0, pe->object, "number_of_signatures"); - - // directory->VirtualAddress is a file offset. Don't call pe_rva_to_offset(). -- if (directory->VirtualAddress == 0 || -- directory->VirtualAddress > pe->data_size || -- directory->Size > pe->data_size || -- directory->VirtualAddress + directory->Size > pe->data_size) -+ if (yr_le32toh(directory->VirtualAddress) == 0 || -+ yr_le32toh(directory->VirtualAddress) > pe->data_size || -+ yr_le32toh(directory->Size) > pe->data_size || -+ yr_le32toh(directory->VirtualAddress) + yr_le32toh(directory->Size) > pe->data_size) - { - return; - } - - // Store the end of directory, making comparisons easier. -- eod = pe->data + directory->VirtualAddress + directory->Size; -+ eod = pe->data + yr_le32toh(directory->VirtualAddress) + directory->Size; - - win_cert = (PWIN_CERTIFICATE) \ -- (pe->data + directory->VirtualAddress); -+ (pe->data + yr_le32toh(directory->VirtualAddress)); - - // - // Walk the directory, pulling out certificates. -@@ -969,10 +969,10 @@ void pe_parse_certificates( - // - - while (struct_fits_in_pe(pe, win_cert, WIN_CERTIFICATE) && -- win_cert->Length > sizeof(WIN_CERTIFICATE) && -- fits_in_pe(pe, win_cert, win_cert->Length) && -+ yr_le32toh(win_cert->Length) > sizeof(WIN_CERTIFICATE) && -+ fits_in_pe(pe, win_cert, yr_le32toh(win_cert->Length)) && - (uint8_t*) win_cert + sizeof(WIN_CERTIFICATE) < eod && -- (uint8_t*) win_cert + win_cert->Length <= eod) -+ (uint8_t*) win_cert + yr_le32toh(win_cert->Length) <= eod) - { - BIO* cert_bio; - PKCS7* pkcs7; -@@ -980,9 +980,9 @@ void pe_parse_certificates( - - // Some sanity checks - -- if (win_cert->Length == 0 || -- (win_cert->Revision != WIN_CERT_REVISION_1_0 && -- win_cert->Revision != WIN_CERT_REVISION_2_0)) -+ if (yr_le32toh(win_cert->Length) == 0 || -+ (yr_le16toh(win_cert->Revision) != WIN_CERT_REVISION_1_0 && -+ yr_le16toh(win_cert->Revision) != WIN_CERT_REVISION_2_0)) - { - break; - } -@@ -990,16 +990,16 @@ void pe_parse_certificates( - // Don't support legacy revision for now. - // Make sure type is PKCS#7 too. - -- if (win_cert->Revision != WIN_CERT_REVISION_2_0 || -- win_cert->CertificateType != WIN_CERT_TYPE_PKCS_SIGNED_DATA) -+ if (yr_le16toh(win_cert->Revision) != WIN_CERT_REVISION_2_0 || -+ yr_le16toh(win_cert->CertificateType) != WIN_CERT_TYPE_PKCS_SIGNED_DATA) - { -- uintptr_t end = (uintptr_t) ((uint8_t *) win_cert) + win_cert->Length; -+ uintptr_t end = (uintptr_t) ((uint8_t *) win_cert) + yr_le32toh(win_cert->Length); - win_cert = (PWIN_CERTIFICATE) (end + (end % 8)); - - continue; - } - -- cert_bio = BIO_new_mem_buf(win_cert->Certificate, win_cert->Length); -+ cert_bio = BIO_new_mem_buf(win_cert->Certificate, yr_le32toh(win_cert->Length)); - - if (!cert_bio) - break; -@@ -1161,29 +1161,31 @@ void pe_parse_header( - int i, scount; - - set_integer( -- pe->header->FileHeader.Machine, -+ yr_le16toh(pe->header->FileHeader.Machine), - pe->object, "machine"); - - set_integer( -- pe->header->FileHeader.NumberOfSections, -+ yr_le16toh(pe->header->FileHeader.NumberOfSections), - pe->object, "number_of_sections"); - - set_integer( -- pe->header->FileHeader.TimeDateStamp, -+ yr_le32toh(pe->header->FileHeader.TimeDateStamp), - pe->object, "timestamp"); - - set_integer( -- pe->header->FileHeader.Characteristics, -+ yr_le16toh(pe->header->FileHeader.Characteristics), - pe->object, "characteristics"); - - set_integer( - flags & SCAN_FLAGS_PROCESS_MEMORY ? -- base_address + OptionalHeader(pe, AddressOfEntryPoint) : -- pe_rva_to_offset(pe, OptionalHeader(pe, AddressOfEntryPoint)), -+ base_address + yr_le32toh(OptionalHeader(pe, AddressOfEntryPoint)) : -+ pe_rva_to_offset(pe, yr_le32toh(OptionalHeader(pe, AddressOfEntryPoint))), - pe->object, "entry_point"); - - set_integer( -- OptionalHeader(pe, ImageBase), -+ IS_64BITS_PE(pe) ? -+ yr_le64toh(OptionalHeader(pe, ImageBase)) : -+ yr_le32toh(OptionalHeader(pe, ImageBase)), - pe->object, "image_base"); - - set_integer( -@@ -1195,31 +1197,31 @@ void pe_parse_header( - pe->object, "linker_version.minor"); - - set_integer( -- OptionalHeader(pe, MajorOperatingSystemVersion), -+ yr_le16toh(OptionalHeader(pe, MajorOperatingSystemVersion)), - pe->object, "os_version.major"); - - set_integer( -- OptionalHeader(pe, MinorOperatingSystemVersion), -+ yr_le16toh(OptionalHeader(pe, MinorOperatingSystemVersion)), - pe->object, "os_version.minor"); - - set_integer( -- OptionalHeader(pe, MajorImageVersion), -+ yr_le16toh(OptionalHeader(pe, MajorImageVersion)), - pe->object, "image_version.major"); - - set_integer( -- OptionalHeader(pe, MinorImageVersion), -+ yr_le16toh(OptionalHeader(pe, MinorImageVersion)), - pe->object, "image_version.minor"); - - set_integer( -- OptionalHeader(pe, MajorSubsystemVersion), -+ yr_le16toh(OptionalHeader(pe, MajorSubsystemVersion)), - pe->object, "subsystem_version.major"); - - set_integer( -- OptionalHeader(pe, MinorSubsystemVersion), -+ yr_le16toh(OptionalHeader(pe, MinorSubsystemVersion)), - pe->object, "subsystem_version.minor"); - - set_integer( -- OptionalHeader(pe, Subsystem), -+ yr_le16toh(OptionalHeader(pe, Subsystem)), - pe->object, "subsystem"); - - pe_iterate_resources( -@@ -1231,7 +1233,7 @@ void pe_parse_header( - - section = IMAGE_FIRST_SECTION(pe->header); - -- scount = yr_min(pe->header->FileHeader.NumberOfSections, MAX_PE_SECTIONS); -+ scount = yr_min(yr_le16toh(pe->header->FileHeader.NumberOfSections), MAX_PE_SECTIONS); - - for (i = 0; i < scount; i++) - { -@@ -1246,20 +1248,23 @@ void pe_parse_header( - pe->object, "sections[%i].name", i); - - set_integer( -- section->Characteristics, -+ yr_le32toh(section->Characteristics), - pe->object, "sections[%i].characteristics", i); - -- set_integer(section->SizeOfRawData, -+ set_integer( -+ yr_le32toh(section->SizeOfRawData), - pe->object, "sections[%i].raw_data_size", i); - -- set_integer(section->PointerToRawData, -+ set_integer( -+ yr_le32toh(section->PointerToRawData), - pe->object, "sections[%i].raw_data_offset", i); - -- set_integer(section->VirtualAddress, -+ set_integer( -+ yr_le32toh(section->VirtualAddress), - pe->object, "sections[%i].virtual_address", i); - - set_integer( -- section->Misc.VirtualSize, -+ yr_le32toh(section->Misc.VirtualSize), - pe->object, "sections[%i].virtual_size", i); - - section++; -@@ -1377,7 +1382,7 @@ define_function(exports) - - // If the PE doesn't export any functions, return FALSE - -- if (directory->VirtualAddress == 0) -+ if (yr_le32toh(directory->VirtualAddress) == 0) - return_integer(0); - - offset = pe_rva_to_offset(pe, directory->VirtualAddress); -@@ -1391,18 +1396,18 @@ define_function(exports) - if (!struct_fits_in_pe(pe, exports, IMAGE_EXPORT_DIRECTORY)) - return_integer(0); - -- offset = pe_rva_to_offset(pe, exports->AddressOfNames); -+ offset = pe_rva_to_offset(pe, yr_le32toh(exports->AddressOfNames)); - - if (offset < 0) - return_integer(0); - -- if (exports->NumberOfNames > MAX_PE_EXPORTS || -- exports->NumberOfNames * sizeof(DWORD) > pe->data_size - offset) -+ if (yr_le32toh(exports->NumberOfNames) > MAX_PE_EXPORTS || -+ yr_le32toh(exports->NumberOfNames) * sizeof(DWORD) > pe->data_size - offset) - return_integer(0); - - names = (DWORD*)(pe->data + offset); - -- for (i = 0; i < exports->NumberOfNames; i++) -+ for (i = 0; i < yr_le32toh(exports->NumberOfNames); i++) - { - char* name; - offset = pe_rva_to_offset(pe, names[i]); -@@ -2299,7 +2304,7 @@ int module_load( - // Ignore DLLs while scanning a process - - if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || -- !(pe_header->FileHeader.Characteristics & IMAGE_FILE_DLL)) -+ !(yr_le16toh(pe_header->FileHeader.Characteristics) & IMAGE_FILE_DLL)) - { - pe = (PE*) yr_malloc(sizeof(PE)); - -diff --git a/libyara/modules/pe_utils.c b/libyara/modules/pe_utils.c -index ed69b80..9b80286 100644 ---- a/libyara/modules/pe_utils.c -+++ b/libyara/modules/pe_utils.c -@@ -60,46 +60,46 @@ PIMAGE_NT_HEADERS32 pe_get_header( - - mz_header = (PIMAGE_DOS_HEADER) data; - -- if (mz_header->e_magic != IMAGE_DOS_SIGNATURE) -+ if (yr_le16toh(mz_header->e_magic) != IMAGE_DOS_SIGNATURE) - return NULL; - -- if (mz_header->e_lfanew < 0) -+ if (yr_le32toh(mz_header->e_lfanew) < 0) - return NULL; - -- headers_size = mz_header->e_lfanew + \ -+ headers_size = yr_le32toh(mz_header->e_lfanew) + \ - sizeof(pe_header->Signature) + \ - sizeof(IMAGE_FILE_HEADER); - - if (data_size < headers_size) - return NULL; - -- pe_header = (PIMAGE_NT_HEADERS32) (data + mz_header->e_lfanew); -- -- headers_size += pe_header->FileHeader.SizeOfOptionalHeader; -- -- if (pe_header->Signature == IMAGE_NT_SIGNATURE && -- (pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_UNKNOWN || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AM33 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARMNT || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM64 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_EBC || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_I386 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_M32R || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPS16 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPSFPU || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_MIPSFPU16 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_POWERPC || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_POWERPCFP || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_R4000 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH3 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH3DSP || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH4 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_SH5 || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_THUMB || -- pe_header->FileHeader.Machine == IMAGE_FILE_MACHINE_WCEMIPSV2) && -+ pe_header = (PIMAGE_NT_HEADERS32) (data + yr_le32toh(mz_header->e_lfanew)); -+ -+ headers_size += yr_le16toh(pe_header->FileHeader.SizeOfOptionalHeader); -+ -+ if (yr_le32toh(pe_header->Signature) == IMAGE_NT_SIGNATURE && -+ (yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_UNKNOWN || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_AM33 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_AMD64 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_ARM || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_ARMNT || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_ARM64 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_EBC || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_I386 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_IA64 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_M32R || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_MIPS16 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_MIPSFPU || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_MIPSFPU16 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_POWERPC || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_POWERPCFP || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_R4000 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_SH3 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_SH3DSP || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_SH4 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_SH5 || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_THUMB || -+ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_WCEMIPSV2) && - data_size > headers_size) - { - return pe_header; -@@ -144,17 +144,17 @@ int64_t pe_rva_to_offset( - int alignment = 0; - int rest = 0; - -- while(i < yr_min(pe->header->FileHeader.NumberOfSections, MAX_PE_SECTIONS)) -+ while(i < yr_min(yr_le16toh(pe->header->FileHeader.NumberOfSections), MAX_PE_SECTIONS)) - { - if (struct_fits_in_pe(pe, section, IMAGE_SECTION_HEADER)) - { -- if (lowest_section_rva > section->VirtualAddress) -+ if (lowest_section_rva > yr_le32toh(section->VirtualAddress)) - { -- lowest_section_rva = section->VirtualAddress; -+ lowest_section_rva = yr_le32toh(section->VirtualAddress); - } - -- if (rva >= section->VirtualAddress && -- section_rva <= section->VirtualAddress) -+ if (rva >= yr_le32toh(section->VirtualAddress) && -+ section_rva <= yr_le32toh(section->VirtualAddress)) - { - // Round section_offset - // -@@ -167,11 +167,11 @@ int64_t pe_rva_to_offset( - // If FileAlignment is >= 0x200, it is apparently ignored (see - // Ero Carreras's pefile.py, PE.adjust_FileAlignment). - -- alignment = yr_min(OptionalHeader(pe, FileAlignment), 0x200); -+ alignment = yr_min(yr_le32toh(OptionalHeader(pe, FileAlignment)), 0x200); - -- section_rva = section->VirtualAddress; -- section_offset = section->PointerToRawData; -- section_raw_size = section->SizeOfRawData; -+ section_rva = yr_le32toh(section->VirtualAddress); -+ section_offset = yr_le32toh(section->PointerToRawData); -+ section_raw_size = yr_le32toh(section->SizeOfRawData); - - if (alignment) - { -diff --git a/tests/test-elf.c b/tests/test-elf.c -new file mode 100644 -index 0000000..8d13b47 ---- /dev/null -+++ b/tests/test-elf.c -@@ -0,0 +1,29 @@ -+#include -+#include "util.h" -+#include "blob.h" -+ -+int main(int argc, char** argv) -+{ -+ yr_initialize(); -+ -+ assert_true_rule_blob("import \"elf\" rule test { condition: elf.type }", ELF32_FILE); -+ assert_true_rule_blob("import \"elf\" rule test { condition: elf.type }", ELF64_FILE); -+ -+ assert_true_rule_blob("import \"elf\" rule test { condition: elf.machine == elf.EM_386 }", ELF32_FILE) -+ assert_true_rule_blob("import \"elf\" rule test { condition: elf.machine == elf.EM_X86_64 }", ELF64_FILE) -+ -+ assert_true_rule_blob( -+ "import \"elf\" rule test { \ -+ strings: $a = { b8 01 00 00 00 bb 2a } \ -+ condition: $a at elf.entry_point }", -+ ELF32_FILE); -+ -+ assert_true_rule_blob( -+ "import \"elf\" rule test { \ -+ strings: $a = { b8 01 00 00 00 bb 2a } \ -+ condition: $a at elf.entry_point }", -+ ELF64_FILE); -+ -+ yr_finalize(); -+ return 0; -+} -diff --git a/tests/test-pe.c b/tests/test-pe.c -index 93cb06e..881939e 100644 ---- a/tests/test-pe.c -+++ b/tests/test-pe.c -@@ -5,7 +5,6 @@ - - int main(int argc, char** argv) - { --#if (defined(HAVE_ENDIAN_H) && BYTE_ORDER == LITTLE_ENDIAN) || defined(_MSC) - yr_initialize(); - - assert_true_rule_file("import \"pe\" rule test { condition: pe.imports(\"KERNEL32.dll\", \"DeleteCriticalSection\") }", -@@ -18,9 +17,5 @@ int main(int argc, char** argv) - "tests/data/tiny-idata-5200"); - - yr_finalize(); --#else -- puts("Not testing pe module on big-endian architectures ... yet"); -- exit(77); --#endif - return 0; - } - -From 1cca7072d684d86fdba4a8a1f3eca63ba584befe Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Mon, 24 Oct 2016 11:14:44 +0200 -Subject: [PATCH 14/36] Move yr_*toh() macros to their own header file (#542) - -See #541 -(cherry picked from commit d3b77eb1e9ee4731ea11c39fceb262cf4f2b006f) ---- - libyara/exec.c | 1 + - libyara/exefiles.c | 1 + - libyara/include/yara/endian.h | 63 +++++++++++++++++++++++++++++++++++++++++++ - libyara/include/yara/pe.h | 2 +- - libyara/include/yara/utils.h | 29 -------------------- - libyara/modules/elf.c | 1 + - libyara/modules/pe.c | 1 + - libyara/modules/pe_utils.c | 1 + - 8 files changed, 69 insertions(+), 30 deletions(-) - create mode 100644 libyara/include/yara/endian.h - -diff --git a/libyara/exec.c b/libyara/exec.c -index 3facabd..1a347c0 100644 ---- a/libyara/exec.c -+++ b/libyara/exec.c -@@ -34,6 +34,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #include - #include - -+#include - #include - #include - #include -diff --git a/libyara/exefiles.c b/libyara/exefiles.c -index 599e397..05d1de7 100644 ---- a/libyara/exefiles.c -+++ b/libyara/exefiles.c -@@ -29,6 +29,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - #include - -+#include - #include - #include - #include -diff --git a/libyara/include/yara/endian.h b/libyara/include/yara/endian.h -new file mode 100644 -index 0000000..06d8c14 ---- /dev/null -+++ b/libyara/include/yara/endian.h -@@ -0,0 +1,63 @@ -+/* -+Copyright (c) 2016. The YARA Authors. All Rights Reserved. -+ -+Redistribution and use in source and binary forms, with or without modification, -+are permitted provided that the following conditions are met: -+ -+1. Redistributions of source code must retain the above copyright notice, this -+list of conditions and the following disclaimer. -+ -+2. Redistributions in binary form must reproduce the above copyright notice, -+this list of conditions and the following disclaimer in the documentation and/or -+other materials provided with the distribution. -+ -+3. Neither the name of the copyright holder nor the names of its contributors -+may be used to endorse or promote products derived from this software without -+specific prior written permission. -+ -+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -+*/ -+ -+#ifndef YR_ENDIAN_H -+#define YR_ENDIAN_H -+ -+#include -+ -+#if defined(__GNUC__) -+#define yr_bswap16(x) __builtin_bswap16(x) -+#define yr_bswap32(x) __builtin_bswap32(x) -+#define yr_bswap64(x) __builtin_bswap64(x) -+#elif defined(_MSC_VER) -+#define yr_bswap16(x) _byteswap_ushort(x) -+#define yr_bswap32(x) _byteswap_ulong(x) -+#define yr_bswap64(x) _byteswap_uint64(x) -+#else -+#error Unknown compiler: Add yr_bswap* definitions -+#endif -+ -+#if defined(WORDS_BIGENDIAN) -+#define yr_le16toh(x) yr_bswap16(x) -+#define yr_le32toh(x) yr_bswap32(x) -+#define yr_le64toh(x) yr_bswap64(x) -+#define yr_be16toh(x) (x) -+#define yr_be32toh(x) (x) -+#define yr_be64toh(x) (x) -+#else -+#define yr_le16toh(x) (x) -+#define yr_le32toh(x) (x) -+#define yr_le64toh(x) (x) -+#define yr_be16toh(x) yr_bswap16(x) -+#define yr_be32toh(x) yr_bswap32(x) -+#define yr_be64toh(x) yr_bswap64(x) -+#endif -+ -+#endif -diff --git a/libyara/include/yara/pe.h b/libyara/include/yara/pe.h -index 0291cb0..c189146 100644 ---- a/libyara/include/yara/pe.h -+++ b/libyara/include/yara/pe.h -@@ -30,8 +30,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #ifndef YR_PE_H - #define YR_PE_H - -+#include - #include --#include - - #pragma pack(push, 1) - -diff --git a/libyara/include/yara/utils.h b/libyara/include/yara/utils.h -index da0fb88..58f1347 100644 ---- a/libyara/include/yara/utils.h -+++ b/libyara/include/yara/utils.h -@@ -70,35 +70,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #define yr_min(x, y) ((x < y) ? (x) : (y)) - #define yr_max(x, y) ((x > y) ? (x) : (y)) - --#if defined(__GNUC__) --#define yr_bswap16(x) __builtin_bswap16(x) --#define yr_bswap32(x) __builtin_bswap32(x) --#define yr_bswap64(x) __builtin_bswap64(x) --#elif defined(_MSC_VER) --#define yr_bswap16(x) _byteswap_ushort(x) --#define yr_bswap32(x) _byteswap_ulong(x) --#define yr_bswap64(x) _byteswap_uint64(x) --#else --#error Unknown compiler: Add yr_bswap* definitions --#endif -- --#if defined(WORDS_BIGENDIAN) --#define yr_le16toh(x) yr_bswap16(x) --#define yr_le32toh(x) yr_bswap32(x) --#define yr_le64toh(x) yr_bswap64(x) --#define yr_be16toh(x) (x) --#define yr_be32toh(x) (x) --#define yr_be64toh(x) (x) --#else --#define yr_le16toh(x) (x) --#define yr_le32toh(x) (x) --#define yr_le64toh(x) (x) --#define yr_be16toh(x) yr_bswap16(x) --#define yr_be32toh(x) yr_bswap32(x) --#define yr_be64toh(x) yr_bswap64(x) --#endif -- -- - #ifdef NDEBUG - - #define assertf(expr, msg, ...) ((void)0) -diff --git a/libyara/modules/elf.c b/libyara/modules/elf.c -index 08c3ce4..e934084 100644 ---- a/libyara/modules/elf.c -+++ b/libyara/modules/elf.c -@@ -30,6 +30,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #include - - #include -+#include - #include - #include - -diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c -index 7c32daf..f78a9d5 100644 ---- a/libyara/modules/pe.c -+++ b/libyara/modules/pe.c -@@ -47,6 +47,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #endif - #endif - -+#include - #include - #include - #include -diff --git a/libyara/modules/pe_utils.c b/libyara/modules/pe_utils.c -index 9b80286..dddbba3 100644 ---- a/libyara/modules/pe_utils.c -+++ b/libyara/modules/pe_utils.c -@@ -35,6 +35,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - #include - -+#include - #include - #include - #include - -From 0dafb5078bee2c880e3db5ad372c39ceb8a3a9af Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Mon, 24 Oct 2016 11:47:00 +0200 -Subject: [PATCH 15/36] Use a union instead of a int64_t for arguments to - module functions. This makes the code clearer, reduce typecasting and solve - warnings. - -(cherry-picked from commit fc36b064096233b959b958d7cd51a2edb2f563e7) ---- - libyara/exec.c | 31 ++++++++----------------------- - libyara/include/yara/modules.h | 10 +++++----- - libyara/include/yara/types.h | 15 +++++++++++++-- - 3 files changed, 26 insertions(+), 30 deletions(-) - -diff --git a/libyara/exec.c b/libyara/exec.c -index 1a347c0..5266b9a 100644 ---- a/libyara/exec.c -+++ b/libyara/exec.c -@@ -50,17 +50,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - #define MEM_SIZE MAX_LOOP_NESTING * LOOP_LOCAL_VARS - --typedef union _STACK_ITEM { -- -- int64_t i; -- double d; -- void* p; -- YR_OBJECT* o; -- YR_STRING* s; -- SIZED_STRING* ss; -- --} STACK_ITEM; -- - - #define push(x) \ - if (sp < stack_size) \ -@@ -172,14 +161,14 @@ int yr_execute_code( - time_t start_time) - { - int64_t mem[MEM_SIZE]; -- int64_t args[MAX_FUNCTION_ARGS]; - int32_t sp = 0; - uint8_t* ip = rules->code_start; - -- STACK_ITEM *stack; -- STACK_ITEM r1; -- STACK_ITEM r2; -- STACK_ITEM r3; -+ YR_VALUE args[MAX_FUNCTION_ARGS]; -+ YR_VALUE *stack; -+ YR_VALUE r1; -+ YR_VALUE r2; -+ YR_VALUE r3; - - #ifdef PROFILING_ENABLED - YR_RULE* current_rule = NULL; -@@ -207,7 +196,7 @@ int yr_execute_code( - - yr_get_configuration(YR_CONFIG_STACK_SIZE, (void*) &stack_size); - -- stack = (STACK_ITEM*) yr_malloc(stack_size * sizeof(STACK_ITEM)); -+ stack = (YR_VALUE*) yr_malloc(stack_size * sizeof(YR_VALUE)); - - if (stack == NULL) - return ERROR_INSUFICIENT_MEMORY; -@@ -553,7 +542,7 @@ int yr_execute_code( - if (is_undef(r1)) // count the number of undefined args - count++; - -- args[i - 1] = r1.i; -+ args[i - 1] = r1; - i--; - } - -@@ -580,11 +569,7 @@ int yr_execute_code( - - if (strcmp(function->prototypes[i].arguments_fmt, args_fmt) == 0) - { -- result = function->prototypes[i].code( -- (void*) args, -- context, -- function); -- -+ result = function->prototypes[i].code(args, context, function); - break; - } - } -diff --git a/libyara/include/yara/modules.h b/libyara/include/yara/modules.h -index 38e1bcd..9e9a6e3 100644 ---- a/libyara/include/yara/modules.h -+++ b/libyara/include/yara/modules.h -@@ -266,25 +266,25 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - #define define_function(func) \ - int func ( \ -- void* __args, \ -+ YR_VALUE* __args, \ - YR_SCAN_CONTEXT* __context, \ - YR_OBJECT_FUNCTION* __function_obj) - - - #define sized_string_argument(n) \ -- (*(SIZED_STRING**) &(((int64_t*) __args)[n-1])) -+ (__args[n-1].ss) - - #define string_argument(n) \ - (sized_string_argument(n)->c_string) - - #define integer_argument(n) \ -- (((int64_t*) __args)[n-1]) -+ (__args[n-1].i) - - #define float_argument(n) \ -- (((double*) __args)[n-1]) -+ (__args[n-1].d) - - #define regexp_argument(n) \ -- ((RE_CODE)((int64_t*) __args)[n-1]) -+ ((RE_CODE)(__args[n-1].p)) - - - #define module() yr_object_get_root((YR_OBJECT*) __function_obj) -diff --git a/libyara/include/yara/types.h b/libyara/include/yara/types.h -index bdacaa9..0fea79b 100644 ---- a/libyara/include/yara/types.h -+++ b/libyara/include/yara/types.h -@@ -382,7 +382,6 @@ typedef struct _YR_RULES { - } YR_RULES; - - -- - struct _YR_MEMORY_BLOCK; - struct _YR_MEMORY_BLOCK_ITERATOR; - -@@ -516,11 +515,23 @@ typedef struct _YR_OBJECT_DICTIONARY - } YR_OBJECT_DICTIONARY; - - -+typedef union _YR_VALUE { -+ -+ int64_t i; -+ double d; -+ void* p; -+ YR_OBJECT* o; -+ YR_STRING* s; -+ SIZED_STRING* ss; -+ -+} YR_VALUE; -+ -+ - struct _YR_OBJECT_FUNCTION; - - - typedef int (*YR_MODULE_FUNC)( -- void* args, -+ YR_VALUE* args, - YR_SCAN_CONTEXT* context, - struct _YR_OBJECT_FUNCTION* function_obj); - - -From 00bcc7c6865be713bed6d2e58cb6308e055ce3cd Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Mon, 31 Oct 2016 09:40:38 +0100 -Subject: [PATCH 16/36] Don't unmask signals when setting up exception handler - (Unix) (#546) - -* YR_TRYCATCH: Remove duplicate initialization of oldmask - -* Add test for handling exceptions - -With - - #define YR_TRYCATCH(_try_clause_, _catch_clause_) {_try_clause_} - -this will cause a bus error on Linux -- as it should. - -* tests: Add assert_*_rule_blob_size, make count_matches usable from test code - -* test-exception: Block and send SIGUSR1 before 2nd yr_rules_scan_mem call - -This seems to reproduce something similar to the symptom described in - -$ ./test-exception -Scanning for "aaaa"... -err = 4, matches = 0 -Sending blocked SIGUSR1 to ourselves... -Scanning for {00 00 00 00}... -User defined signal 1 - -* exception (UNIX): Remove unneeded pthread_sigmask() calls - -sigsetjmp() already saves the signal mask for us. - -Also, setting the signal mask using the (empty) act.sa_mask was wrong -and led to the behavior described in #544. - -We still want delivery of all signals to be blocked during execution of -the signal handler. - -* Document test-exception - -cherry-picked from: - -- 8b2b6b8f82b8a8a8830bae122474b39ac2814fc6 -- 0b3d9a93276d3364b2a3561995d27e8b4a137134, "Minor re-styling" ---- - Makefile.am | 4 +- - libyara/exception.h | 7 +-- - tests/test-exception.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++ - tests/util.c | 2 +- - tests/util.h | 20 ++++++-- - 5 files changed, 147 insertions(+), 12 deletions(-) - create mode 100644 tests/test-exception.c - -diff --git a/Makefile.am b/Makefile.am -index 8c1652a..8f5ab59 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -15,7 +15,7 @@ yarac_SOURCES = args.c args.h yarac.c - yarac_LDADD = libyara/.libs/libyara.a - - TESTS = $(check_PROGRAMS) --check_PROGRAMS = test-alignment test-rules test-pe test-elf -+check_PROGRAMS = test-alignment test-rules test-pe test-elf test-exception - test_alignment_SOURCES = tests/test-alignment.c - test_rules_SOURCES = tests/test-rules.c tests/util.c - test_rules_LDADD = libyara/.libs/libyara.a -@@ -23,6 +23,8 @@ test_pe_SOURCES = tests/test-pe.c tests/util.c - test_pe_LDADD = libyara/.libs/libyara.a - test_elf_SOURCES = tests/test-elf.c tests/util.c - test_elf_LDADD = libyara/.libs/libyara.a -+test_exception_SOURCES = tests/test-exception.c tests/util.c -+test_exception_LDADD = libyara/.libs/libyara.a - - # man pages - man1_MANS = yara.man yarac.man -diff --git a/libyara/exception.h b/libyara/exception.h -index 436d006..c70ae63 100644 ---- a/libyara/exception.h -+++ b/libyara/exception.h -@@ -99,13 +99,9 @@ typedef struct sigaction sa; - { \ - struct sigaction oldact; \ - struct sigaction act; \ -- sigset_t oldmask; \ - act.sa_handler = exception_handler; \ - act.sa_flags = 0; /* SA_ONSTACK? */ \ -- sigemptyset(&oldmask); \ -- sigemptyset(&act.sa_mask); \ -- sigemptyset(&oldmask); \ -- pthread_sigmask(SIG_SETMASK, &act.sa_mask, &oldmask); \ -+ sigfillset(&act.sa_mask); \ - sigaction(SIGBUS, &act, &oldact); \ - int tidx = yr_get_tidx(); \ - assert(tidx != -1); \ -@@ -117,7 +113,6 @@ typedef struct sigaction sa; - { _catch_clause_ } \ - exc_jmp_buf[tidx] = NULL; \ - sigaction(SIGBUS, &oldact, NULL); \ -- pthread_sigmask(SIG_SETMASK, &oldmask, NULL); \ - } while (0) - - #endif -diff --git a/tests/test-exception.c b/tests/test-exception.c -new file mode 100644 -index 0000000..8ebea58 ---- /dev/null -+++ b/tests/test-exception.c -@@ -0,0 +1,126 @@ -+/* -+Copyright (c) 2016. The YARA Authors. All Rights Reserved. -+ -+Redistribution and use in source and binary forms, with or without modification, -+are permitted provided that the following conditions are met: -+ -+1. Redistributions of source code must retain the above copyright notice, this -+list of conditions and the following disclaimer. -+ -+2. Redistributions in binary form must reproduce the above copyright notice, -+this list of conditions and the following disclaimer in the documentation and/or -+other materials provided with the distribution. -+ -+3. Neither the name of the copyright holder nor the names of its contributors -+may be used to endorse or promote products derived from this software without -+specific prior written permission. -+ -+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -+*/ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include "util.h" -+ -+int main(int argc, char **argv) -+{ -+ char* filename = strdup("yara-testblob.XXXXXX"); -+ int fd = mkstemp(filename); -+ char wbuf[4096]; -+ int i; -+ -+ if (fd <= 0) -+ { -+ perror("Create temp file"); -+ return 77; -+ } -+ -+ unlink(filename); -+ -+ memset(wbuf, 'a', sizeof(wbuf)); -+ -+ for (i = 0; i <= 3; i++) -+ write(fd, wbuf, sizeof(wbuf)); -+ -+ uint8_t* mapped_region = mmap( -+ NULL, 4 * sizeof(wbuf), PROT_READ, MAP_SHARED, fd, 0); -+ -+ ftruncate(fd, 2 * sizeof(wbuf)); -+ -+ /* -+ mapped_region is now only partially backed by the open file -+ referred to by fd. Accessing the memory beyond -+ -+ mapped_region + 2 * sizeof(wbuf) -+ -+ causes SIGBUS to be raised. -+ */ -+ -+ yr_initialize(); -+ -+ YR_RULES* rules_a = compile_rule( -+ "rule test { strings: $a = \"aaaa\" condition: all of them }"); -+ -+ YR_RULES* rules_0 = compile_rule( -+ "rule test { strings: $a = { 00 00 00 00 } condition: all of them }"); -+ -+ puts("Scanning for \"aaaa\"..."); -+ -+ int matches = 0; -+ -+ /* -+ If YR_TRYCATCH is redefined like this -+ -+ #define YR_TRYCATCH(_try_clause_,_catch_clause_) {_try_clause_} -+ -+ yr_rules_scan_mem() will terminate the process. -+ */ -+ -+ int rc = yr_rules_scan_mem( -+ rules_a, mapped_region, 4 * sizeof(wbuf), 0, count_matches, &matches, 0); -+ -+ printf("err = %d, matches = %d\n", rc, matches); -+ -+ if (rc == ERROR_SUCCESS || matches != 0) -+ return 1; -+ -+ puts("Sending blocked SIGUSR1 to ourselves..."); -+ -+ sigset_t set; -+ sigemptyset(&set); -+ sigaddset(&set, SIGUSR1); -+ sigprocmask(SIG_BLOCK, &set, NULL); -+ kill(getpid(), SIGUSR1); -+ -+ puts("Scanning for {00 00 00 00}..."); -+ matches = 0; -+ -+ /* -+ This tests that SIGUSR1 is not delivered when setting up SIGBUS -+ signal handling -- or during SIGBUS signal handling -+ */ -+ -+ rc = yr_rules_scan_mem( -+ rules_0, mapped_region, 4 * sizeof(wbuf), 0, count_matches, &matches, 0); -+ -+ printf("err = %d, matches = %d\n", rc, matches); -+ -+ if (rc == ERROR_SUCCESS || matches != 0) -+ return 1; -+ -+ return 0; -+} -diff --git a/tests/util.c b/tests/util.c -index 5597c98..59105dd 100644 ---- a/tests/util.c -+++ b/tests/util.c -@@ -82,7 +82,7 @@ YR_RULES* compile_rule( - } - - --static int count_matches( -+int count_matches( - int message, - void* message_data, - void* user_data) -diff --git a/tests/util.h b/tests/util.h -index 89b245b..835115f 100644 ---- a/tests/util.h -+++ b/tests/util.h -@@ -36,6 +36,12 @@ YR_RULES* compile_rule( - char* string); - - -+int count_matches( -+ int message, -+ void* message_data, -+ void* user_data); -+ -+ - int matches_blob( - char* rule, - uint8_t* blob, -@@ -66,15 +72,18 @@ int read_file( - } \ - } while (0); - --#define assert_true_rule_blob(rule, blob) \ -+#define assert_true_rule_blob_size(rule, blob, size) \ - do { \ -- if (!matches_blob(rule, (uint8_t*) (blob), sizeof(blob))) { \ -+ if (!matches_blob(rule, (uint8_t*) (blob), size)) { \ - fprintf(stderr, "%s:%d: rule does not match (but should)\n", \ - __FILE__, __LINE__ ); \ - exit(EXIT_FAILURE); \ - } \ - } while (0); - -+#define assert_true_rule_blob(rule, blob) \ -+ assert_true_rule_blob_size(rule, blob, sizeof(blob)) -+ - #define assert_true_rule_file(rule, filename) \ - do { \ - char* buf; \ -@@ -102,15 +111,18 @@ int read_file( - } \ - } while (0); - --#define assert_false_rule_blob(rule, blob) \ -+#define assert_false_rule_blob_size(rule, blob, size) \ - do { \ -- if (matches_blob(rule, (uint8_t*) (blob), sizeof(blob))) { \ -+ if (matches_blob(rule, (uint8_t*) (blob), size)) { \ - fprintf(stderr, "%s:%d: rule matches (but shouldn't)\n", \ - __FILE__, __LINE__ ); \ - exit(EXIT_FAILURE); \ - } \ - } while (0); - -+#define assert_false_rule_blob(rule, blob) \ -+ assert_false_rule_blob_size(rule, blob, sizeof(blob)) -+ - #define assert_false_rule_file(rule, filename) \ - do { \ - char* buf; \ - -From 7a71fc986f00abd29a7c332d01c45ee101ffda25 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Mon, 31 Oct 2016 22:31:27 +0100 -Subject: [PATCH 17/36] tests: Use larger file to demonstrate SIGBUS (#549) - -Apparently, PowerPC uses larger pages so the original size did not lead -to a signal. -(cherry picked from commit ddd5e975f2c36323e408e0eeedd56db59e0148a0) ---- - tests/test-exception.c | 18 ++++++++++-------- - 1 file changed, 10 insertions(+), 8 deletions(-) - -diff --git a/tests/test-exception.c b/tests/test-exception.c -index 8ebea58..29232b2 100644 ---- a/tests/test-exception.c -+++ b/tests/test-exception.c -@@ -36,11 +36,13 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #include - #include "util.h" - -+#define COUNT 128 -+char wbuf[1024]; -+ - int main(int argc, char **argv) - { - char* filename = strdup("yara-testblob.XXXXXX"); - int fd = mkstemp(filename); -- char wbuf[4096]; - int i; - - if (fd <= 0) -@@ -53,21 +55,21 @@ int main(int argc, char **argv) - - memset(wbuf, 'a', sizeof(wbuf)); - -- for (i = 0; i <= 3; i++) -+ for (i = 0; i < COUNT; i++) - write(fd, wbuf, sizeof(wbuf)); - - uint8_t* mapped_region = mmap( -- NULL, 4 * sizeof(wbuf), PROT_READ, MAP_SHARED, fd, 0); -+ NULL, COUNT * sizeof(wbuf), PROT_READ, MAP_SHARED, fd, 0); - -- ftruncate(fd, 2 * sizeof(wbuf)); -+ ftruncate(fd, COUNT * sizeof(wbuf) / 2); - - /* - mapped_region is now only partially backed by the open file - referred to by fd. Accessing the memory beyond - -- mapped_region + 2 * sizeof(wbuf) -+ mapped_region + COUNT * sizeof(wbuf) / 2 - -- causes SIGBUS to be raised. -+ should cause a signal (usually SIGBUS) to be raised. - */ - - yr_initialize(); -@@ -91,7 +93,7 @@ int main(int argc, char **argv) - */ - - int rc = yr_rules_scan_mem( -- rules_a, mapped_region, 4 * sizeof(wbuf), 0, count_matches, &matches, 0); -+ rules_a, mapped_region, COUNT * sizeof(wbuf), 0, count_matches, &matches, 0); - - printf("err = %d, matches = %d\n", rc, matches); - -@@ -115,7 +117,7 @@ int main(int argc, char **argv) - */ - - rc = yr_rules_scan_mem( -- rules_0, mapped_region, 4 * sizeof(wbuf), 0, count_matches, &matches, 0); -+ rules_0, mapped_region, COUNT * sizeof(wbuf), 0, count_matches, &matches, 0); - - printf("err = %d, matches = %d\n", rc, matches); - - -From 5032e9030a64ccf5bdbcda9ead7581bbd8c47229 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Wed, 2 Nov 2016 09:23:15 +0100 -Subject: [PATCH 18/36] Exception handler (Unix): Install a handler for SIGSEGV - (#552) - -test-exception now passes on FreeBSD11/amd64, OpenBSD6/amd64. - -Closes #551 -(cherry picked from commit 35f01653ab162d4302faebcfa36b349b4141344a) ---- - libyara/exception.h | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/libyara/exception.h b/libyara/exception.h -index c70ae63..a9698b3 100644 ---- a/libyara/exception.h -+++ b/libyara/exception.h -@@ -81,7 +81,7 @@ static LONG CALLBACK exception_handler( - sigjmp_buf *exc_jmp_buf[MAX_THREADS]; - - static void exception_handler(int sig) { -- if (sig == SIGBUS) -+ if (sig == SIGBUS || sig == SIGSEGV) - { - int tidx = yr_get_tidx(); - -@@ -97,12 +97,14 @@ typedef struct sigaction sa; - #define YR_TRYCATCH(_try_clause_, _catch_clause_) \ - do \ - { \ -- struct sigaction oldact; \ -+ struct sigaction old_sigbus_act; \ -+ struct sigaction old_sigsegv_act; \ - struct sigaction act; \ - act.sa_handler = exception_handler; \ - act.sa_flags = 0; /* SA_ONSTACK? */ \ - sigfillset(&act.sa_mask); \ -- sigaction(SIGBUS, &act, &oldact); \ -+ sigaction(SIGBUS, &act, &old_sigbus_act); \ -+ sigaction(SIGSEGV, &act, &old_sigsegv_act); \ - int tidx = yr_get_tidx(); \ - assert(tidx != -1); \ - sigjmp_buf jb; \ -@@ -112,7 +114,8 @@ typedef struct sigaction sa; - else \ - { _catch_clause_ } \ - exc_jmp_buf[tidx] = NULL; \ -- sigaction(SIGBUS, &oldact, NULL); \ -+ sigaction(SIGBUS, &old_sigbus_act, NULL); \ -+ sigaction(SIGSEGV, &old_sigsegv_act, NULL); \ - } while (0) - - #endif - -From 6ba610d91aebdc94de95802507bff71456ca2532 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Wed, 2 Nov 2016 22:43:58 +0100 -Subject: [PATCH 19/36] Add scan flag for disabling exceptions - -(cherry picked from commit c72536a223a3e039c147273c7cc0d43f40b77660) ---- - libyara/exception.h | 74 +++++++++++++++++++++++++++------------------ - libyara/include/yara/scan.h | 1 + - libyara/rules.c | 12 ++++++-- - 3 files changed, 54 insertions(+), 33 deletions(-) - -diff --git a/libyara/exception.h b/libyara/exception.h -index a9698b3..edead24 100644 ---- a/libyara/exception.h -+++ b/libyara/exception.h -@@ -57,20 +57,27 @@ static LONG CALLBACK exception_handler( - return EXCEPTION_CONTINUE_SEARCH; - } - --#define YR_TRYCATCH(_try_clause_, _catch_clause_) \ -+#define YR_TRYCATCH(_do_,_try_clause_, _catch_clause_) \ - do \ - { \ -- jmp_buf jb; \ -- HANDLE exh = AddVectoredExceptionHandler(1, exception_handler); \ -- int tidx = yr_get_tidx(); \ -- assert(tidx != -1); \ -- exc_jmp_buf[tidx] = &jb; \ -- if (setjmp(jb) == 0) \ -- { _try_clause_ } \ -+ if (_do_) \ -+ { \ -+ jmp_buf jb; \ -+ HANDLE exh = AddVectoredExceptionHandler(1, exception_handler); \ -+ int tidx = yr_get_tidx(); \ -+ assert(tidx != -1); \ -+ exc_jmp_buf[tidx] = &jb; \ -+ if (setjmp(jb) == 0) \ -+ { _try_clause_ } \ -+ else \ -+ { _catch_clause_ } \ -+ exc_jmp_buf[tidx] = NULL; \ -+ RemoveVectoredExceptionHandler(exh); \ -+ } \ - else \ -- { _catch_clause_ } \ -- exc_jmp_buf[tidx] = NULL; \ -- RemoveVectoredExceptionHandler(exh); \ -+ { \ -+ _try_clause_ \ -+ } \ - } while(0) - - #else -@@ -94,28 +101,35 @@ static void exception_handler(int sig) { - - typedef struct sigaction sa; - --#define YR_TRYCATCH(_try_clause_, _catch_clause_) \ -+#define YR_TRYCATCH(_do_,_try_clause_, _catch_clause_) \ - do \ - { \ -- struct sigaction old_sigbus_act; \ -- struct sigaction old_sigsegv_act; \ -- struct sigaction act; \ -- act.sa_handler = exception_handler; \ -- act.sa_flags = 0; /* SA_ONSTACK? */ \ -- sigfillset(&act.sa_mask); \ -- sigaction(SIGBUS, &act, &old_sigbus_act); \ -- sigaction(SIGSEGV, &act, &old_sigsegv_act); \ -- int tidx = yr_get_tidx(); \ -- assert(tidx != -1); \ -- sigjmp_buf jb; \ -- exc_jmp_buf[tidx] = &jb; \ -- if (sigsetjmp(jb, 1) == 0) \ -- { _try_clause_ } \ -+ if (_do_) \ -+ { \ -+ struct sigaction old_sigbus_act; \ -+ struct sigaction old_sigsegv_act; \ -+ struct sigaction act; \ -+ act.sa_handler = exception_handler; \ -+ act.sa_flags = 0; /* SA_ONSTACK? */ \ -+ sigfillset(&act.sa_mask); \ -+ sigaction(SIGBUS, &act, &old_sigbus_act); \ -+ sigaction(SIGSEGV, &act, &old_sigsegv_act); \ -+ int tidx = yr_get_tidx(); \ -+ assert(tidx != -1); \ -+ sigjmp_buf jb; \ -+ exc_jmp_buf[tidx] = &jb; \ -+ if (sigsetjmp(jb, 1) == 0) \ -+ { _try_clause_ } \ -+ else \ -+ { _catch_clause_ } \ -+ exc_jmp_buf[tidx] = NULL; \ -+ sigaction(SIGBUS, &old_sigbus_act, NULL); \ -+ sigaction(SIGSEGV, &old_sigsegv_act, NULL); \ -+ } \ - else \ -- { _catch_clause_ } \ -- exc_jmp_buf[tidx] = NULL; \ -- sigaction(SIGBUS, &old_sigbus_act, NULL); \ -- sigaction(SIGSEGV, &old_sigsegv_act, NULL); \ -+ { \ -+ _try_clause_ \ -+ } \ - } while (0) - - #endif -diff --git a/libyara/include/yara/scan.h b/libyara/include/yara/scan.h -index 8ea0cb8..8ef6575 100644 ---- a/libyara/include/yara/scan.h -+++ b/libyara/include/yara/scan.h -@@ -35,6 +35,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - // Bitmasks for flags. - #define SCAN_FLAGS_FAST_MODE 1 - #define SCAN_FLAGS_PROCESS_MEMORY 2 -+#define SCAN_FLAGS_NO_TRYCATCH 4 - - - int yr_scan_verify_match( -diff --git a/libyara/rules.c b/libyara/rules.c -index 490c472..336ba7c 100644 ---- a/libyara/rules.c -+++ b/libyara/rules.c -@@ -436,7 +436,9 @@ YR_API int yr_rules_scan_mem_blocks( - - if (context.entry_point == UNDEFINED) - { -- YR_TRYCATCH({ -+ YR_TRYCATCH( -+ !(flags & SCAN_FLAGS_NO_TRYCATCH), -+ { - if (flags & SCAN_FLAGS_PROCESS_MEMORY) - context.entry_point = yr_get_entry_point_address( - data, -@@ -449,7 +451,9 @@ YR_API int yr_rules_scan_mem_blocks( - },{}); - } - -- YR_TRYCATCH({ -+ YR_TRYCATCH( -+ !(flags & SCAN_FLAGS_NO_TRYCATCH), -+ { - result = _yr_rules_scan_mem_block( - rules, - data, -@@ -467,7 +471,9 @@ YR_API int yr_rules_scan_mem_blocks( - block = iterator->next(iterator); - } - -- YR_TRYCATCH({ -+ YR_TRYCATCH( -+ !(flags & SCAN_FLAGS_NO_TRYCATCH), -+ { - result = yr_execute_code( - rules, - &context, - -From e7eab9a77c858ad7440810b571a3e5d0b19ca208 Mon Sep 17 00:00:00 2001 -From: Rastislav Masaryk -Date: Fri, 11 Nov 2016 10:15:57 +0100 -Subject: [PATCH 20/36] Windows mutex replaced with CriticalSection - -(cherry picked from commit 245edc994b2c8c0a9753a0f690e186d2fb513dd0) ---- - threading.c | 13 +++++-------- - threading.h | 2 +- - 2 files changed, 6 insertions(+), 9 deletions(-) - -diff --git a/threading.c b/threading.c -index 5257884..5a65c2e 100644 ---- a/threading.c -+++ b/threading.c -@@ -40,11 +40,8 @@ int mutex_init( - MUTEX* mutex) - { - #if defined(_WIN32) || defined(__CYGWIN__) -- *mutex = CreateMutex(NULL, FALSE, NULL); -- if (*mutex == NULL) -- return GetLastError(); -- else -- return 0; -+ InitializeCriticalSection(mutex); -+ return GetLastError(); - #else - return pthread_mutex_init(mutex, NULL); - #endif -@@ -54,7 +51,7 @@ void mutex_destroy( - MUTEX* mutex) - { - #if defined(_WIN32) || defined(__CYGWIN__) -- CloseHandle(*mutex); -+ DeleteCriticalSection(mutex); - #else - pthread_mutex_destroy(mutex); - #endif -@@ -65,7 +62,7 @@ void mutex_lock( - MUTEX* mutex) - { - #if defined(_WIN32) || defined(__CYGWIN__) -- WaitForSingleObject(*mutex, INFINITE); -+ EnterCriticalSection(mutex); - #else - pthread_mutex_lock(mutex); - #endif -@@ -76,7 +73,7 @@ void mutex_unlock( - MUTEX* mutex) - { - #if defined(_WIN32) || defined(__CYGWIN__) -- ReleaseMutex(*mutex); -+ LeaveCriticalSection(mutex); - #else - pthread_mutex_unlock(mutex); - #endif -diff --git a/threading.h b/threading.h -index d6bf46a..43a68b6 100644 ---- a/threading.h -+++ b/threading.h -@@ -42,7 +42,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #if defined(_WIN32) || defined(__CYGWIN__) - - typedef HANDLE SEMAPHORE; --typedef HANDLE MUTEX; -+typedef CRITICAL_SECTION MUTEX; - typedef HANDLE THREAD; - - typedef LPTHREAD_START_ROUTINE THREAD_START_ROUTINE; - -From 405a2cc32b7c3ef73c5678133bccaad327c49733 Mon Sep 17 00:00:00 2001 -From: Rastislav Masaryk -Date: Mon, 14 Nov 2016 07:59:55 +0100 -Subject: [PATCH 21/36] CritSection in try block and return value fixed - -(cherry picked from commit 7e168cd2a344b206da799d1fd8344ac0dcdd4807) ---- - threading.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/threading.c b/threading.c -index 5a65c2e..5479c20 100644 ---- a/threading.c -+++ b/threading.c -@@ -40,8 +40,13 @@ int mutex_init( - MUTEX* mutex) - { - #if defined(_WIN32) || defined(__CYGWIN__) -- InitializeCriticalSection(mutex); -- return GetLastError(); -+ __try { -+ InitializeCriticalSection(mutex); -+ return 0; -+ } -+ __except (STATUS_NO_MEMORY) { -+ return STATUS_NO_MEMORY; -+ } - #else - return pthread_mutex_init(mutex, NULL); - #endif - -From ac1057c8f8310cdaa6eeed92aa013cd9ae8f20ff Mon Sep 17 00:00:00 2001 -From: Rastislav Masaryk -Date: Mon, 14 Nov 2016 08:57:59 +0100 -Subject: [PATCH 22/36] removed __try block around CritSection - -(cherry picked from commit e0c19f2bceee50787e9044d010b5ad59f11da93e) ---- - threading.c | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/threading.c b/threading.c -index 5479c20..07c0b88 100644 ---- a/threading.c -+++ b/threading.c -@@ -40,13 +40,8 @@ int mutex_init( - MUTEX* mutex) - { - #if defined(_WIN32) || defined(__CYGWIN__) -- __try { - InitializeCriticalSection(mutex); - return 0; -- } -- __except (STATUS_NO_MEMORY) { -- return STATUS_NO_MEMORY; -- } - #else - return pthread_mutex_init(mutex, NULL); - #endif - -From 8e364afcf9e328c016c109ee2e417412e634f2e0 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Wed, 4 Jan 2017 16:18:03 +0100 -Subject: [PATCH 23/36] Fix issue #576 - -(cherry picked from commit eb491e03851a11bc811173f5e13c89cefa7257ac) ---- - libyara/lexer.c | 27 +++++++++++++++++---------- - libyara/lexer.l | 7 +++++++ - 2 files changed, 24 insertions(+), 10 deletions(-) - -diff --git a/libyara/lexer.c b/libyara/lexer.c -index 03f0465..b20e0c4 100644 ---- a/libyara/lexer.c -+++ b/libyara/lexer.c -@@ -1831,6 +1831,13 @@ YY_RULE_SETUP - { - - LEX_CHECK_SPACE_OK("\\.", yyextra->lex_buf_len, LEX_BUF_SIZE); -+ -+ if (yytext[1] == 0) -+ { -+ yyerror(yyscanner, compiler, "malformed regular expression"); -+ yyterminate(); -+ } -+ - *yyextra->lex_buf_ptr++ = yytext[0]; - *yyextra->lex_buf_ptr++ = yytext[1]; - yyextra->lex_buf_len += 2; -@@ -1838,13 +1845,13 @@ YY_RULE_SETUP - YY_BREAK - case 66: - YY_RULE_SETUP --#line 592 "lexer.l" -+#line 599 "lexer.l" - { YYTEXT_TO_BUFFER; } - YY_BREAK - case 67: - /* rule 67 can match eol */ - YY_RULE_SETUP --#line 595 "lexer.l" -+#line 602 "lexer.l" - { - - yyerror(yyscanner, compiler, "unterminated regular expression"); -@@ -1853,7 +1860,7 @@ YY_RULE_SETUP - YY_BREAK - case 68: - YY_RULE_SETUP --#line 602 "lexer.l" -+#line 609 "lexer.l" - { - - yyextra->lex_buf_ptr = yyextra->lex_buf; -@@ -1863,7 +1870,7 @@ YY_RULE_SETUP - YY_BREAK - case 69: - YY_RULE_SETUP --#line 610 "lexer.l" -+#line 617 "lexer.l" - { - - yyextra->lex_buf_ptr = yyextra->lex_buf; -@@ -1874,7 +1881,7 @@ YY_RULE_SETUP - case 70: - /* rule 70 can match eol */ - YY_RULE_SETUP --#line 618 "lexer.l" -+#line 625 "lexer.l" - { - // Match hex-digits with whitespace or comments. The latter are stripped - // out by hex_lexer.l -@@ -1890,12 +1897,12 @@ YY_RULE_SETUP - case 71: - /* rule 71 can match eol */ - YY_RULE_SETUP --#line 631 "lexer.l" -+#line 638 "lexer.l" - /* skip whitespace */ - YY_BREAK - case 72: - YY_RULE_SETUP --#line 633 "lexer.l" -+#line 640 "lexer.l" - { - - if (yytext[0] >= 32 && yytext[0] < 127) -@@ -1911,10 +1918,10 @@ YY_RULE_SETUP - YY_BREAK - case 73: - YY_RULE_SETUP --#line 646 "lexer.l" -+#line 653 "lexer.l" - ECHO; - YY_BREAK --#line 1918 "lexer.c" -+#line 1925 "lexer.c" - - case YY_END_OF_BUFFER: - { -@@ -3063,7 +3070,7 @@ void yara_yyfree (void * ptr , yyscan_t yyscanner) - - #define YYTABLES_NAME "yytables" - --#line 646 "lexer.l" -+#line 653 "lexer.l" - - - -diff --git a/libyara/lexer.l b/libyara/lexer.l -index a184606..e1bd98b 100644 ---- a/libyara/lexer.l -+++ b/libyara/lexer.l -@@ -583,6 +583,13 @@ u?int(8|16|32)(be)? { - \\. { - - LEX_CHECK_SPACE_OK("\\.", yyextra->lex_buf_len, LEX_BUF_SIZE); -+ -+ if (yytext[1] == 0) -+ { -+ yyerror(yyscanner, compiler, "malformed regular expression"); -+ yyterminate(); -+ } -+ - *yyextra->lex_buf_ptr++ = yytext[0]; - *yyextra->lex_buf_ptr++ = yytext[1]; - yyextra->lex_buf_len += 2; - -From 3fc60e8b46cb0a0bbab433fd4c72c1ae2658f475 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Wed, 4 Jan 2017 17:09:35 +0100 -Subject: [PATCH 24/36] Fix issue #575 - -(cherry picked from commit 890c3f850293176c0e996a602ffa88b315f4e98f) ---- - libyara/grammar.c | 645 +++++++++++++++++++++++++++--------------------------- - libyara/grammar.y | 5 + - 2 files changed, 332 insertions(+), 318 deletions(-) - -diff --git a/libyara/grammar.c b/libyara/grammar.c -index 0ce27b2..eb28701 100644 ---- a/libyara/grammar.c -+++ b/libyara/grammar.c -@@ -546,16 +546,16 @@ union yyalloc - /* YYFINAL -- State number of the termination state. */ - #define YYFINAL 2 - /* YYLAST -- Last index in YYTABLE. */ --#define YYLAST 408 -+#define YYLAST 406 - - /* YYNTOKENS -- Number of terminals. */ - #define YYNTOKENS 72 - /* YYNNTS -- Number of nonterminals. */ - #define YYNNTS 41 - /* YYNRULES -- Number of rules. */ --#define YYNRULES 121 -+#define YYNRULES 122 - /* YYNSTATES -- Number of states. */ --#define YYNSTATES 209 -+#define YYNSTATES 210 - - /* YYTRANSLATE[YYX] -- Symbol number corresponding to YYX as returned - by yylex, with out-of-bounds checking. */ -@@ -612,13 +612,13 @@ static const yytype_uint16 yyrline[] = - 472, 485, 502, 503, 509, 508, 524, 523, 539, 553, - 554, 559, 560, 561, 562, 567, 652, 698, 756, 801, - 802, 806, 831, 867, 913, 935, 944, 953, 968, 980, -- 994, 1007, 1019, 1049, 1018, 1163, 1162, 1241, 1247, 1254, -- 1253, 1316, 1315, 1376, 1385, 1394, 1403, 1412, 1421, 1430, -- 1434, 1442, 1443, 1448, 1470, 1482, 1498, 1497, 1503, 1514, -- 1515, 1520, 1527, 1538, 1539, 1543, 1551, 1555, 1565, 1579, -- 1595, 1605, 1614, 1639, 1651, 1663, 1679, 1691, 1707, 1752, -- 1771, 1789, 1807, 1825, 1851, 1869, 1879, 1889, 1899, 1909, -- 1919, 1929 -+ 994, 1007, 1018, 1024, 1054, 1023, 1168, 1167, 1246, 1252, -+ 1259, 1258, 1321, 1320, 1381, 1390, 1399, 1408, 1417, 1426, -+ 1435, 1439, 1447, 1448, 1453, 1475, 1487, 1503, 1502, 1508, -+ 1519, 1520, 1525, 1532, 1543, 1544, 1548, 1556, 1560, 1570, -+ 1584, 1600, 1610, 1619, 1644, 1656, 1668, 1684, 1696, 1712, -+ 1757, 1776, 1794, 1812, 1830, 1856, 1874, 1884, 1894, 1904, -+ 1914, 1924, 1934 - }; - #endif - -@@ -672,7 +672,7 @@ static const yytype_uint16 yytoknum[] = - #define yypact_value_is_default(Yystate) \ - (!!((Yystate) == (-73))) - --#define YYTABLE_NINF -94 -+#define YYTABLE_NINF -95 - - #define yytable_value_is_error(Yytable_value) \ - 0 -@@ -681,27 +681,27 @@ static const yytype_uint16 yytoknum[] = - STATE-NUM. */ - static const yytype_int16 yypact[] = - { -- -73, 79, -73, -32, -4, -73, -73, 94, -73, -73, -- -73, -73, 13, -73, -73, -73, -73, -8, 72, 6, -- -73, 78, 111, -73, 61, 122, 123, 82, -73, 90, -- 123, -73, 147, 150, 16, -73, 96, 147, -73, 101, -- 97, -73, -73, -73, -73, 151, 53, -73, 48, -73, -- -73, -73, 149, 145, -73, -9, -73, 103, 107, -73, -- -73, 106, -73, -73, -73, -73, -73, -73, 110, -73, -- -73, 135, 48, 135, 48, -33, -73, 64, -73, 144, -- 306, -73, -73, 135, 108, 135, 135, 135, 135, -7, -- 322, -73, -73, -73, 64, 117, 163, 168, 135, 48, -- -73, -73, -6, 167, 135, 135, 135, 135, 135, 135, -- 135, 135, 135, 135, 135, 135, 135, 135, 135, 135, -- 135, 86, 86, 322, 135, -73, 243, 261, 183, 203, -- 159, -6, -73, -73, -73, 279, 121, 125, 95, 48, -- 48, -73, -73, -73, -73, 322, 337, 351, -43, 322, -- 322, 322, 322, 322, 322, 40, 40, 58, 58, -73, -- -73, -73, -73, -73, -73, -73, -73, 129, -73, -73, -- -73, -73, 128, -73, -73, 48, 152, -73, 15, 135, -- 131, -73, 95, -73, -73, 71, -73, 223, 135, 133, -- -73, 132, -73, 15, -73, 73, 129, -73, 48, -73, -- -73, 135, 134, 31, 322, 48, -73, 49, -73 -+ -73, 90, -73, -32, -10, -73, -73, 93, -73, -73, -+ -73, -73, 1, -73, -73, -73, -73, -49, 7, -36, -+ -73, 20, 26, -73, -28, 92, 46, 4, -73, 40, -+ 46, -73, 100, 119, 16, -73, 72, 100, -73, 77, -+ 83, -73, -73, -73, -73, 134, 59, -73, 48, -73, -+ -73, -73, 133, 136, -73, -18, -73, 88, 95, -73, -+ -73, 91, -73, -73, -73, -73, -73, -73, 102, -73, -+ -73, 126, 48, 126, 48, -44, -73, 85, -73, 127, -+ 297, -73, -73, 126, 110, 126, 126, 126, 126, 2, -+ 313, -73, -73, -73, 85, 111, 154, 172, 126, 48, -+ -73, -73, -6, 162, 126, 126, 126, 126, 126, 126, -+ 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, -+ 126, 60, 60, 313, 126, -73, 234, 252, 174, 194, -+ -73, 153, -6, -73, -73, -73, 270, 117, 120, 108, -+ 48, 48, -73, -73, -73, -73, 313, 328, 342, 349, -+ 313, 313, 313, 313, 313, 313, 113, 113, 53, 53, -+ -73, -73, -73, -73, -73, -73, -73, -73, 121, -73, -+ -73, -73, -73, 124, -73, -73, 48, 151, -73, -1, -+ 126, 125, -73, 108, -73, -73, 18, -73, 214, 126, -+ 129, -73, 143, -73, -1, -73, 63, 121, -73, 48, -+ -73, -73, 126, 144, 31, 313, 48, -73, 33, -73 - }; - - /* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM. -@@ -714,31 +714,31 @@ static const yytype_uint8 yydefact[] = - 23, 22, 12, 24, 0, 14, 0, 0, 10, 0, - 13, 25, 0, 0, 0, 26, 0, 15, 32, 0, - 0, 28, 27, 30, 31, 0, 34, 33, 0, 11, -- 29, 38, 0, 0, 45, 59, 103, 105, 107, 100, -- 101, 0, 102, 53, 97, 98, 94, 95, 0, 55, -- 56, 0, 0, 0, 0, 108, 121, 16, 54, 0, -- 79, 39, 39, 0, 0, 0, 0, 0, 0, 0, -- 93, 109, 68, 118, 0, 54, 79, 0, 0, 49, -- 71, 69, 0, 0, 0, 0, 0, 0, 0, 0, -+ 29, 38, 0, 0, 45, 59, 104, 106, 108, 101, -+ 102, 0, 103, 53, 98, 99, 95, 96, 0, 55, -+ 56, 0, 0, 0, 0, 109, 122, 16, 54, 0, -+ 80, 39, 39, 0, 0, 0, 0, 0, 0, 0, -+ 94, 110, 69, 119, 0, 54, 80, 0, 0, 49, -+ 72, 70, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 35, 37, 60, 0, 61, 0, 0, 0, 0, -- 0, 0, 80, 96, 46, 0, 0, 50, 51, 0, -- 0, 88, 86, 67, 57, 58, 117, 115, 116, 77, -- 78, 73, 75, 74, 76, 119, 120, 110, 111, 112, -- 113, 114, 42, 41, 43, 44, 40, 0, 104, 106, -- 99, 62, 0, 47, 48, 0, 72, 70, 0, 0, -- 0, 65, 52, 91, 92, 0, 89, 0, 0, 0, -- 82, 0, 87, 0, 83, 0, 84, 63, 0, 90, -- 81, 0, 0, 0, 85, 0, 66, 0, 64 -+ 62, 0, 0, 81, 97, 46, 0, 0, 50, 51, -+ 0, 0, 89, 87, 68, 57, 58, 118, 116, 117, -+ 78, 79, 74, 76, 75, 77, 120, 121, 111, 112, -+ 113, 114, 115, 42, 41, 43, 44, 40, 0, 105, -+ 107, 100, 63, 0, 47, 48, 0, 73, 71, 0, -+ 0, 0, 66, 52, 92, 93, 0, 90, 0, 0, -+ 0, 83, 0, 88, 0, 84, 0, 85, 64, 0, -+ 91, 82, 0, 0, 0, 86, 0, 67, 0, 65 - }; - - /* YYPGOTO[NTERM-NUM]. */ - static const yytype_int16 yypgoto[] = - { -- -73, -73, 199, 218, -73, -73, -73, -73, -73, -73, -- -73, -73, -73, -73, 192, -73, 186, -73, -73, 142, -- -73, -73, -73, -73, 126, -48, -72, -73, -73, -73, -- -73, -73, -73, 50, -73, 100, -73, -73, 35, 164, -+ -73, -73, 211, 212, -73, -73, -73, -73, -73, -73, -+ -73, -73, -73, -73, 189, -73, 183, -73, -73, 139, -+ -73, -73, -73, -73, 130, -48, -72, -73, -73, -73, -+ -73, -73, -73, 41, -73, 103, -73, -73, 29, 164, - -67 - }; - -@@ -747,8 +747,8 @@ static const yytype_int16 yydefgoto[] = - { - -1, 1, 5, 6, 17, 33, 25, 28, 40, 7, - 15, 19, 21, 30, 31, 37, 38, 52, 53, 121, -- 166, 75, 136, 137, 76, 94, 78, 180, 202, 191, -- 140, 139, 189, 125, 195, 143, 178, 185, 186, 79, -+ 167, 75, 137, 138, 76, 94, 78, 181, 203, 192, -+ 141, 140, 190, 125, 196, 144, 179, 186, 187, 79, - 80 - }; - -@@ -757,92 +757,92 @@ static const yytype_int16 yydefgoto[] = - number is the opposite. If YYTABLE_NINF, syntax error. */ - static const yytype_int16 yytable[] = - { -- 77, 90, 95, 130, 91, 4, 93, 96, 114, 115, -- 116, 117, 118, 119, 120, 11, 123, 83, 126, 127, -- 128, 129, 84, 16, 92, 131, 183, 138, 141, 8, -- 184, 135, 41, 97, 98, 42, 99, 145, 146, 147, -- 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, -- 158, 159, 160, 161, 43, 44, 18, 167, 54, 55, -- 56, 57, 58, 142, 59, 60, 61, 62, 22, 63, -- 45, 100, 101, 51, -36, 64, 65, 66, 67, 2, -- 3, 68, 20, -17, -17, -17, 69, 70, 23, 100, -- 101, 176, 177, 116, 117, 118, 119, 120, 12, 13, -- 14, 206, 71, 182, 100, 101, 72, 73, 162, 163, -- 164, 165, 187, 118, 119, 120, 4, 74, 24, 208, -- 54, 196, 56, 57, 58, 26, 59, 60, 61, 62, -- 27, 63, 179, 29, 204, -54, -54, 64, 65, 66, -- 67, 192, 193, 200, 201, 54, 32, 56, 57, 58, -- 203, 59, 60, 61, 62, 34, 63, 207, 36, 39, -- 49, 46, 64, 65, 71, 48, 82, 50, 81, 73, -- 85, 105, 106, 107, 86, 87, 102, 124, 134, 88, -- 114, 115, 116, 117, 118, 119, 120, 132, 63, 71, -- 171, 174, 181, 101, 73, -93, 175, 197, 103, 104, -- 188, 198, 9, 205, 88, 105, 106, 107, 108, 109, -- 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, -- 120, 10, 35, 47, 122, 105, 106, 107, 199, 144, -- 190, 172, 89, 133, 114, 115, 116, 117, 118, 119, -- 120, 0, 0, 0, 0, 105, 106, 107, 0, 0, -- 0, 0, 0, 170, 114, 115, 116, 117, 118, 119, -- 120, 0, 0, 0, 0, 105, 106, 107, 0, 0, -- 0, 0, 0, 133, 114, 115, 116, 117, 118, 119, -- 120, 0, 0, 0, 0, 105, 106, 107, 0, 0, -- 0, 0, 0, 194, 114, 115, 116, 117, 118, 119, -- 120, 0, 0, 105, 106, 107, 0, 0, 0, 0, -- 0, 168, 114, 115, 116, 117, 118, 119, 120, 0, -- 0, 105, 106, 107, 0, 0, 0, 0, 0, 169, -- 114, 115, 116, 117, 118, 119, 120, 0, -93, 0, -- 0, 103, 104, 0, 0, 0, 0, 173, 105, 106, -- 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, -- 117, 118, 119, 120, 105, 106, 107, 0, 0, 0, -+ 77, 90, 95, 130, 91, 4, 93, 96, 83, 11, -+ 184, 16, 131, 84, 185, 18, 123, 20, 126, 127, -+ 128, 129, 97, 98, 92, 99, 22, 139, 142, 8, -+ 23, 136, 41, 24, 132, 42, 26, 146, 147, 148, -+ 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, -+ 159, 160, 161, 162, 43, 44, 29, 168, 54, 55, -+ 56, 57, 58, 143, 59, 60, 61, 62, 32, 63, -+ 45, 100, 101, 100, 101, 64, 65, 66, 67, 51, -+ -36, 68, 163, 164, 165, 166, 69, 70, 193, 194, -+ 2, 3, 177, 178, -17, -17, -17, 12, 13, 14, -+ 27, 207, 71, 209, 183, 34, 72, 73, 118, 119, -+ 120, 36, 54, 188, 56, 57, 58, 74, 59, 60, -+ 61, 62, 197, 63, 180, 100, 101, 4, 39, 64, -+ 65, 66, 67, 201, 202, 205, 54, 46, 56, 57, -+ 58, 48, 59, 60, 61, 62, 49, 63, -54, -54, -+ 50, 204, 81, 64, 65, 85, 71, 82, 208, 102, -+ 87, 73, 86, 105, 106, 107, 116, 117, 118, 119, -+ 120, 88, 114, 115, 116, 117, 118, 119, 120, 124, -+ 71, 133, 135, 63, 172, 73, -94, 175, 182, 103, -+ 104, 176, 101, 198, 189, 88, 105, 106, 107, 108, -+ 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, -+ 119, 120, 199, 206, 9, 10, 105, 106, 107, 35, -+ 47, 122, 191, 200, 134, 114, 115, 116, 117, 118, -+ 119, 120, 89, 145, 0, 173, 105, 106, 107, 0, -+ 0, 0, 0, 0, 171, 114, 115, 116, 117, 118, -+ 119, 120, 0, 0, 0, 0, 105, 106, 107, 0, -+ 0, 0, 0, 0, 134, 114, 115, 116, 117, 118, -+ 119, 120, 0, 0, 0, 0, 105, 106, 107, 0, -+ 0, 0, 0, 0, 195, 114, 115, 116, 117, 118, -+ 119, 120, 0, 0, 105, 106, 107, 0, 0, 0, -+ 0, 0, 169, 114, 115, 116, 117, 118, 119, 120, -+ 0, 0, 105, 106, 107, 0, 0, 0, 0, 0, -+ 170, 114, 115, 116, 117, 118, 119, 120, 0, -94, -+ 0, 0, 103, 104, 0, 0, 0, 0, 174, 105, -+ 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, -+ 116, 117, 118, 119, 120, 105, 106, 107, 0, 0, -+ 0, 0, 0, 0, 114, 115, 116, 117, 118, 119, -+ 120, 106, 107, 0, 0, 0, 0, 0, 0, 114, -+ 115, 116, 117, 118, 119, 120, 107, 0, 0, 0, - 0, 0, 0, 114, 115, 116, 117, 118, 119, 120, -- 106, 107, 0, 0, 0, 0, 0, 0, 114, 115, -- 116, 117, 118, 119, 120, 107, 0, 0, 0, 0, -- 0, 0, 114, 115, 116, 117, 118, 119, 120 -+ 114, 115, 116, 117, 118, 119, 120 - }; - - static const yytype_int16 yycheck[] = - { -- 48, 68, 74, 10, 71, 37, 73, 74, 51, 52, -- 53, 54, 55, 56, 57, 19, 83, 26, 85, 86, -- 87, 88, 31, 10, 72, 32, 11, 99, 34, 61, -- 15, 98, 16, 66, 67, 19, 69, 104, 105, 106, -+ 48, 68, 74, 1, 71, 37, 73, 74, 26, 19, -+ 11, 10, 10, 31, 15, 64, 83, 10, 85, 86, -+ 87, 88, 66, 67, 72, 69, 62, 99, 34, 61, -+ 10, 98, 16, 7, 32, 19, 64, 104, 105, 106, - 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, -- 117, 118, 119, 120, 38, 39, 64, 124, 10, 11, -- 12, 13, 14, 69, 16, 17, 18, 19, 62, 21, -- 54, 40, 41, 20, 21, 27, 28, 29, 30, 0, -- 1, 33, 10, 4, 5, 6, 38, 39, 10, 40, -- 41, 139, 140, 53, 54, 55, 56, 57, 4, 5, -- 6, 70, 54, 175, 40, 41, 58, 59, 22, 23, -- 24, 25, 179, 55, 56, 57, 37, 69, 7, 70, -- 10, 188, 12, 13, 14, 64, 16, 17, 18, 19, -- 8, 21, 3, 10, 201, 40, 41, 27, 28, 29, -- 30, 70, 71, 70, 71, 10, 64, 12, 13, 14, -- 198, 16, 17, 18, 19, 65, 21, 205, 11, 9, -- 63, 65, 27, 28, 54, 64, 21, 16, 19, 59, -- 67, 42, 43, 44, 67, 69, 32, 69, 10, 69, -- 51, 52, 53, 54, 55, 56, 57, 70, 21, 54, -- 31, 70, 64, 41, 59, 32, 71, 64, 35, 36, -- 69, 69, 3, 69, 69, 42, 43, 44, 45, 46, -- 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, -- 57, 3, 30, 37, 82, 42, 43, 44, 193, 103, -- 180, 131, 68, 70, 51, 52, 53, 54, 55, 56, -- 57, -1, -1, -1, -1, 42, 43, 44, -1, -1, -- -1, -1, -1, 70, 51, 52, 53, 54, 55, 56, -- 57, -1, -1, -1, -1, 42, 43, 44, -1, -1, -- -1, -1, -1, 70, 51, 52, 53, 54, 55, 56, -- 57, -1, -1, -1, -1, 42, 43, 44, -1, -1, -- -1, -1, -1, 70, 51, 52, 53, 54, 55, 56, -- 57, -1, -1, 42, 43, 44, -1, -1, -1, -1, -- -1, 68, 51, 52, 53, 54, 55, 56, 57, -1, -- -1, 42, 43, 44, -1, -1, -1, -1, -1, 68, -- 51, 52, 53, 54, 55, 56, 57, -1, 32, -1, -- -1, 35, 36, -1, -1, -1, -1, 68, 42, 43, -- 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, -- 54, 55, 56, 57, 42, 43, 44, -1, -1, -1, -+ 117, 118, 119, 120, 38, 39, 10, 124, 10, 11, -+ 12, 13, 14, 69, 16, 17, 18, 19, 64, 21, -+ 54, 40, 41, 40, 41, 27, 28, 29, 30, 20, -+ 21, 33, 22, 23, 24, 25, 38, 39, 70, 71, -+ 0, 1, 140, 141, 4, 5, 6, 4, 5, 6, -+ 8, 70, 54, 70, 176, 65, 58, 59, 55, 56, -+ 57, 11, 10, 180, 12, 13, 14, 69, 16, 17, -+ 18, 19, 189, 21, 3, 40, 41, 37, 9, 27, -+ 28, 29, 30, 70, 71, 202, 10, 65, 12, 13, -+ 14, 64, 16, 17, 18, 19, 63, 21, 40, 41, -+ 16, 199, 19, 27, 28, 67, 54, 21, 206, 32, -+ 69, 59, 67, 42, 43, 44, 53, 54, 55, 56, -+ 57, 69, 51, 52, 53, 54, 55, 56, 57, 69, -+ 54, 70, 10, 21, 31, 59, 32, 70, 64, 35, -+ 36, 71, 41, 64, 69, 69, 42, 43, 44, 45, -+ 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, -+ 56, 57, 69, 69, 3, 3, 42, 43, 44, 30, -+ 37, 82, 181, 194, 70, 51, 52, 53, 54, 55, -+ 56, 57, 68, 103, -1, 132, 42, 43, 44, -1, -+ -1, -1, -1, -1, 70, 51, 52, 53, 54, 55, -+ 56, 57, -1, -1, -1, -1, 42, 43, 44, -1, -+ -1, -1, -1, -1, 70, 51, 52, 53, 54, 55, -+ 56, 57, -1, -1, -1, -1, 42, 43, 44, -1, -+ -1, -1, -1, -1, 70, 51, 52, 53, 54, 55, -+ 56, 57, -1, -1, 42, 43, 44, -1, -1, -1, -+ -1, -1, 68, 51, 52, 53, 54, 55, 56, 57, -+ -1, -1, 42, 43, 44, -1, -1, -1, -1, -1, -+ 68, 51, 52, 53, 54, 55, 56, 57, -1, 32, -+ -1, -1, 35, 36, -1, -1, -1, -1, 68, 42, -+ 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, -+ 53, 54, 55, 56, 57, 42, 43, 44, -1, -1, -+ -1, -1, -1, -1, 51, 52, 53, 54, 55, 56, -+ 57, 43, 44, -1, -1, -1, -1, -1, -1, 51, -+ 52, 53, 54, 55, 56, 57, 44, -1, -1, -1, - -1, -1, -1, 51, 52, 53, 54, 55, 56, 57, -- 43, 44, -1, -1, -1, -1, -1, -1, 51, 52, -- 53, 54, 55, 56, 57, 44, -1, -1, -1, -1, -- -1, -1, 51, 52, 53, 54, 55, 56, 57 -+ 51, 52, 53, 54, 55, 56, 57 - }; - - /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing -@@ -862,14 +862,14 @@ static const yytype_uint8 yystos[] = - 40, 41, 32, 35, 36, 42, 43, 44, 45, 46, - 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, - 57, 91, 91, 112, 69, 105, 112, 112, 112, 112, -- 10, 32, 70, 70, 10, 112, 94, 95, 98, 103, -- 102, 34, 69, 107, 96, 112, 112, 112, 112, 112, -+ 1, 10, 32, 70, 70, 10, 112, 94, 95, 98, -+ 103, 102, 34, 69, 107, 96, 112, 112, 112, 112, - 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, -- 112, 112, 22, 23, 24, 25, 92, 112, 68, 68, -- 70, 31, 107, 68, 70, 71, 97, 97, 108, 3, -- 99, 64, 98, 11, 15, 109, 110, 112, 69, 104, -- 105, 101, 70, 71, 70, 106, 112, 64, 69, 110, -- 70, 71, 100, 97, 112, 69, 70, 97, 70 -+ 112, 112, 112, 22, 23, 24, 25, 92, 112, 68, -+ 68, 70, 31, 107, 68, 70, 71, 97, 97, 108, -+ 3, 99, 64, 98, 11, 15, 109, 110, 112, 69, -+ 104, 105, 101, 70, 71, 70, 106, 112, 64, 69, -+ 110, 70, 71, 100, 97, 112, 69, 70, 97, 70 - }; - - /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */ -@@ -881,13 +881,13 @@ static const yytype_uint8 yyr1[] = - 86, 86, 87, 87, 89, 88, 90, 88, 88, 91, - 91, 92, 92, 92, 92, 93, 93, 93, 93, 94, - 94, 95, 95, 96, 97, 98, 98, 98, 98, 98, -- 98, 98, 99, 100, 98, 101, 98, 98, 98, 102, -- 98, 103, 98, 98, 98, 98, 98, 98, 98, 98, -- 98, 104, 104, 105, 106, 106, 108, 107, 107, 109, -- 109, 110, 110, 111, 111, 111, 112, 112, 112, 112, -+ 98, 98, 98, 99, 100, 98, 101, 98, 98, 98, -+ 102, 98, 103, 98, 98, 98, 98, 98, 98, 98, -+ 98, 98, 104, 104, 105, 106, 106, 108, 107, 107, -+ 109, 109, 110, 110, 111, 111, 111, 112, 112, 112, - 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, - 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, -- 112, 112 -+ 112, 112, 112 - }; - - /* YYR2[YYN] -- Number of symbols on the right hand side of rule YYN. */ -@@ -899,13 +899,13 @@ static const yytype_uint8 yyr2[] = - 3, 3, 1, 2, 0, 5, 0, 5, 3, 0, - 2, 1, 1, 1, 1, 1, 3, 4, 4, 0, - 1, 1, 3, 1, 1, 1, 1, 3, 3, 1, -- 3, 3, 0, 0, 11, 0, 9, 3, 2, 0, -- 4, 0, 4, 3, 3, 3, 3, 3, 3, 1, -- 3, 3, 1, 5, 1, 3, 0, 4, 1, 1, -- 3, 1, 1, 1, 1, 1, 3, 1, 1, 4, -- 1, 1, 1, 1, 4, 1, 4, 1, 1, 2, -- 3, 3, 3, 3, 3, 3, 3, 3, 2, 3, -- 3, 1 -+ 3, 3, 3, 0, 0, 11, 0, 9, 3, 2, -+ 0, 4, 0, 4, 3, 3, 3, 3, 3, 3, -+ 1, 3, 3, 1, 5, 1, 3, 0, 4, 1, -+ 1, 3, 1, 1, 1, 1, 1, 3, 1, 1, -+ 4, 1, 1, 1, 1, 4, 1, 4, 1, 1, -+ 2, 3, 3, 3, 3, 3, 3, 3, 3, 2, -+ 3, 3, 1 - }; - - -@@ -2587,6 +2587,15 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - case 62: - #line 1019 "grammar.y" /* yacc.c:1646 */ - { -+ compiler->loop_depth--; -+ compiler->loop_identifier[compiler->loop_depth] = NULL; -+ } -+#line 2594 "grammar.c" /* yacc.c:1646 */ -+ break; -+ -+ case 63: -+#line 1024 "grammar.y" /* yacc.c:1646 */ -+ { - int var_index; - - if (compiler->loop_depth == MAX_LOOP_NESTING) -@@ -2615,11 +2624,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 2619 "grammar.c" /* yacc.c:1646 */ -+#line 2628 "grammar.c" /* yacc.c:1646 */ - break; - -- case 63: --#line 1049 "grammar.y" /* yacc.c:1646 */ -+ case 64: -+#line 1054 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2654,11 +2663,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = (yyvsp[-4].c_string); - compiler->loop_depth++; - } --#line 2658 "grammar.c" /* yacc.c:1646 */ -+#line 2667 "grammar.c" /* yacc.c:1646 */ - break; - -- case 64: --#line 1084 "grammar.y" /* yacc.c:1646 */ -+ case 65: -+#line 1089 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2737,11 +2746,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2741 "grammar.c" /* yacc.c:1646 */ -+#line 2750 "grammar.c" /* yacc.c:1646 */ - break; - -- case 65: --#line 1163 "grammar.y" /* yacc.c:1646 */ -+ case 66: -+#line 1168 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2771,11 +2780,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = NULL; - compiler->loop_depth++; - } --#line 2775 "grammar.c" /* yacc.c:1646 */ -+#line 2784 "grammar.c" /* yacc.c:1646 */ - break; - -- case 66: --#line 1193 "grammar.y" /* yacc.c:1646 */ -+ case 67: -+#line 1198 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2824,31 +2833,31 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - - } --#line 2828 "grammar.c" /* yacc.c:1646 */ -+#line 2837 "grammar.c" /* yacc.c:1646 */ - break; - -- case 67: --#line 1242 "grammar.y" /* yacc.c:1646 */ -+ case 68: -+#line 1247 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_OF, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2838 "grammar.c" /* yacc.c:1646 */ -+#line 2847 "grammar.c" /* yacc.c:1646 */ - break; - -- case 68: --#line 1248 "grammar.y" /* yacc.c:1646 */ -+ case 69: -+#line 1253 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_NOT, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2848 "grammar.c" /* yacc.c:1646 */ -+#line 2857 "grammar.c" /* yacc.c:1646 */ - break; - -- case 69: --#line 1254 "grammar.y" /* yacc.c:1646 */ -+ case 70: -+#line 1259 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - void* jmp_destination_addr; -@@ -2874,11 +2883,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2878 "grammar.c" /* yacc.c:1646 */ -+#line 2887 "grammar.c" /* yacc.c:1646 */ - break; - -- case 70: --#line 1280 "grammar.y" /* yacc.c:1646 */ -+ case 71: -+#line 1285 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* and_addr; -@@ -2914,11 +2923,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2918 "grammar.c" /* yacc.c:1646 */ -+#line 2927 "grammar.c" /* yacc.c:1646 */ - break; - -- case 71: --#line 1316 "grammar.y" /* yacc.c:1646 */ -+ case 72: -+#line 1321 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - void* jmp_destination_addr; -@@ -2943,11 +2952,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2947 "grammar.c" /* yacc.c:1646 */ -+#line 2956 "grammar.c" /* yacc.c:1646 */ - break; - -- case 72: --#line 1341 "grammar.y" /* yacc.c:1646 */ -+ case 73: -+#line 1346 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* or_addr; -@@ -2983,11 +2992,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2987 "grammar.c" /* yacc.c:1646 */ -+#line 2996 "grammar.c" /* yacc.c:1646 */ - break; - -- case 73: --#line 1377 "grammar.y" /* yacc.c:1646 */ -+ case 74: -+#line 1382 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -2996,11 +3005,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3000 "grammar.c" /* yacc.c:1646 */ -+#line 3009 "grammar.c" /* yacc.c:1646 */ - break; - -- case 74: --#line 1386 "grammar.y" /* yacc.c:1646 */ -+ case 75: -+#line 1391 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3009,11 +3018,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3013 "grammar.c" /* yacc.c:1646 */ -+#line 3022 "grammar.c" /* yacc.c:1646 */ - break; - -- case 75: --#line 1395 "grammar.y" /* yacc.c:1646 */ -+ case 76: -+#line 1400 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3022,11 +3031,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3026 "grammar.c" /* yacc.c:1646 */ -+#line 3035 "grammar.c" /* yacc.c:1646 */ - break; - -- case 76: --#line 1404 "grammar.y" /* yacc.c:1646 */ -+ case 77: -+#line 1409 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3035,11 +3044,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3039 "grammar.c" /* yacc.c:1646 */ -+#line 3048 "grammar.c" /* yacc.c:1646 */ - break; - -- case 77: --#line 1413 "grammar.y" /* yacc.c:1646 */ -+ case 78: -+#line 1418 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "==", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3048,11 +3057,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3052 "grammar.c" /* yacc.c:1646 */ -+#line 3061 "grammar.c" /* yacc.c:1646 */ - break; - -- case 78: --#line 1422 "grammar.y" /* yacc.c:1646 */ -+ case 79: -+#line 1427 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "!=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3061,39 +3070,39 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3065 "grammar.c" /* yacc.c:1646 */ -+#line 3074 "grammar.c" /* yacc.c:1646 */ - break; - -- case 79: --#line 1431 "grammar.y" /* yacc.c:1646 */ -+ case 80: -+#line 1436 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3073 "grammar.c" /* yacc.c:1646 */ -+#line 3082 "grammar.c" /* yacc.c:1646 */ - break; - -- case 80: --#line 1435 "grammar.y" /* yacc.c:1646 */ -+ case 81: -+#line 1440 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3081 "grammar.c" /* yacc.c:1646 */ -+#line 3090 "grammar.c" /* yacc.c:1646 */ - break; - -- case 81: --#line 1442 "grammar.y" /* yacc.c:1646 */ -+ case 82: -+#line 1447 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_ENUMERATION; } --#line 3087 "grammar.c" /* yacc.c:1646 */ -+#line 3096 "grammar.c" /* yacc.c:1646 */ - break; - -- case 82: --#line 1443 "grammar.y" /* yacc.c:1646 */ -+ case 83: -+#line 1448 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_RANGE; } --#line 3093 "grammar.c" /* yacc.c:1646 */ -+#line 3102 "grammar.c" /* yacc.c:1646 */ - break; - -- case 83: --#line 1449 "grammar.y" /* yacc.c:1646 */ -+ case 84: -+#line 1454 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[-3].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3111,11 +3120,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3115 "grammar.c" /* yacc.c:1646 */ -+#line 3124 "grammar.c" /* yacc.c:1646 */ - break; - -- case 84: --#line 1471 "grammar.y" /* yacc.c:1646 */ -+ case 85: -+#line 1476 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3127,11 +3136,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3131 "grammar.c" /* yacc.c:1646 */ -+#line 3140 "grammar.c" /* yacc.c:1646 */ - break; - -- case 85: --#line 1483 "grammar.y" /* yacc.c:1646 */ -+ case 86: -+#line 1488 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3142,77 +3151,77 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3146 "grammar.c" /* yacc.c:1646 */ -+#line 3155 "grammar.c" /* yacc.c:1646 */ - break; - -- case 86: --#line 1498 "grammar.y" /* yacc.c:1646 */ -+ case 87: -+#line 1503 "grammar.y" /* yacc.c:1646 */ - { - // Push end-of-list marker - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3155 "grammar.c" /* yacc.c:1646 */ -+#line 3164 "grammar.c" /* yacc.c:1646 */ - break; - -- case 88: --#line 1504 "grammar.y" /* yacc.c:1646 */ -+ case 89: -+#line 1509 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - yr_parser_emit_pushes_for_strings(yyscanner, "$*"); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3166 "grammar.c" /* yacc.c:1646 */ -+#line 3175 "grammar.c" /* yacc.c:1646 */ - break; - -- case 91: --#line 1521 "grammar.y" /* yacc.c:1646 */ -+ case 92: -+#line 1526 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3177 "grammar.c" /* yacc.c:1646 */ -+#line 3186 "grammar.c" /* yacc.c:1646 */ - break; - -- case 92: --#line 1528 "grammar.y" /* yacc.c:1646 */ -+ case 93: -+#line 1533 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3188 "grammar.c" /* yacc.c:1646 */ -+#line 3197 "grammar.c" /* yacc.c:1646 */ - break; - -- case 94: --#line 1540 "grammar.y" /* yacc.c:1646 */ -+ case 95: -+#line 1545 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3196 "grammar.c" /* yacc.c:1646 */ -+#line 3205 "grammar.c" /* yacc.c:1646 */ - break; - -- case 95: --#line 1544 "grammar.y" /* yacc.c:1646 */ -+ case 96: -+#line 1549 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, 1, NULL, NULL); - } --#line 3204 "grammar.c" /* yacc.c:1646 */ -+#line 3213 "grammar.c" /* yacc.c:1646 */ - break; - -- case 96: --#line 1552 "grammar.y" /* yacc.c:1646 */ -+ case 97: -+#line 1557 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3212 "grammar.c" /* yacc.c:1646 */ -+#line 3221 "grammar.c" /* yacc.c:1646 */ - break; - -- case 97: --#line 1556 "grammar.y" /* yacc.c:1646 */ -+ case 98: -+#line 1561 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit( - yyscanner, OP_FILESIZE, NULL); -@@ -3222,11 +3231,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3226 "grammar.c" /* yacc.c:1646 */ -+#line 3235 "grammar.c" /* yacc.c:1646 */ - break; - -- case 98: --#line 1566 "grammar.y" /* yacc.c:1646 */ -+ case 99: -+#line 1571 "grammar.y" /* yacc.c:1646 */ - { - yywarning(yyscanner, - "Using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " -@@ -3240,11 +3249,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3244 "grammar.c" /* yacc.c:1646 */ -+#line 3253 "grammar.c" /* yacc.c:1646 */ - break; - -- case 99: --#line 1580 "grammar.y" /* yacc.c:1646 */ -+ case 100: -+#line 1585 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-1].expression), EXPRESSION_TYPE_INTEGER, "intXXXX or uintXXXX"); - -@@ -3260,11 +3269,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3264 "grammar.c" /* yacc.c:1646 */ -+#line 3273 "grammar.c" /* yacc.c:1646 */ - break; - -- case 100: --#line 1596 "grammar.y" /* yacc.c:1646 */ -+ case 101: -+#line 1601 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, (yyvsp[0].integer), NULL, NULL); -@@ -3274,11 +3283,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = (yyvsp[0].integer); - } --#line 3278 "grammar.c" /* yacc.c:1646 */ -+#line 3287 "grammar.c" /* yacc.c:1646 */ - break; - -- case 101: --#line 1606 "grammar.y" /* yacc.c:1646 */ -+ case 102: -+#line 1611 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg_double( - yyscanner, OP_PUSH, (yyvsp[0].double_), NULL, NULL); -@@ -3287,11 +3296,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } --#line 3291 "grammar.c" /* yacc.c:1646 */ -+#line 3300 "grammar.c" /* yacc.c:1646 */ - break; - -- case 102: --#line 1615 "grammar.y" /* yacc.c:1646 */ -+ case 103: -+#line 1620 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string; - -@@ -3316,11 +3325,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_STRING; - (yyval.expression).value.sized_string = sized_string; - } --#line 3320 "grammar.c" /* yacc.c:1646 */ -+#line 3329 "grammar.c" /* yacc.c:1646 */ - break; - -- case 103: --#line 1640 "grammar.y" /* yacc.c:1646 */ -+ case 104: -+#line 1645 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[0].c_string), OP_COUNT, UNDEFINED); -@@ -3332,11 +3341,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3336 "grammar.c" /* yacc.c:1646 */ -+#line 3345 "grammar.c" /* yacc.c:1646 */ - break; - -- case 104: --#line 1652 "grammar.y" /* yacc.c:1646 */ -+ case 105: -+#line 1657 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_OFFSET, UNDEFINED); -@@ -3348,11 +3357,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3352 "grammar.c" /* yacc.c:1646 */ -+#line 3361 "grammar.c" /* yacc.c:1646 */ - break; - -- case 105: --#line 1664 "grammar.y" /* yacc.c:1646 */ -+ case 106: -+#line 1669 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3368,11 +3377,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3372 "grammar.c" /* yacc.c:1646 */ -+#line 3381 "grammar.c" /* yacc.c:1646 */ - break; - -- case 106: --#line 1680 "grammar.y" /* yacc.c:1646 */ -+ case 107: -+#line 1685 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_LENGTH, UNDEFINED); -@@ -3384,11 +3393,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3388 "grammar.c" /* yacc.c:1646 */ -+#line 3397 "grammar.c" /* yacc.c:1646 */ - break; - -- case 107: --#line 1692 "grammar.y" /* yacc.c:1646 */ -+ case 108: -+#line 1697 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3404,11 +3413,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3408 "grammar.c" /* yacc.c:1646 */ -+#line 3417 "grammar.c" /* yacc.c:1646 */ - break; - -- case 108: --#line 1708 "grammar.y" /* yacc.c:1646 */ -+ case 109: -+#line 1713 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) // loop identifier - { -@@ -3453,11 +3462,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3457 "grammar.c" /* yacc.c:1646 */ -+#line 3466 "grammar.c" /* yacc.c:1646 */ - break; - -- case 109: --#line 1753 "grammar.y" /* yacc.c:1646 */ -+ case 110: -+#line 1758 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT, "-"); - -@@ -3476,11 +3485,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3480 "grammar.c" /* yacc.c:1646 */ -+#line 3489 "grammar.c" /* yacc.c:1646 */ - break; - -- case 110: --#line 1772 "grammar.y" /* yacc.c:1646 */ -+ case 111: -+#line 1777 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "+", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3498,11 +3507,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3502 "grammar.c" /* yacc.c:1646 */ -+#line 3511 "grammar.c" /* yacc.c:1646 */ - break; - -- case 111: --#line 1790 "grammar.y" /* yacc.c:1646 */ -+ case 112: -+#line 1795 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "-", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3520,11 +3529,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3524 "grammar.c" /* yacc.c:1646 */ -+#line 3533 "grammar.c" /* yacc.c:1646 */ - break; - -- case 112: --#line 1808 "grammar.y" /* yacc.c:1646 */ -+ case 113: -+#line 1813 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "*", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3542,11 +3551,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3546 "grammar.c" /* yacc.c:1646 */ -+#line 3555 "grammar.c" /* yacc.c:1646 */ - break; - -- case 113: --#line 1826 "grammar.y" /* yacc.c:1646 */ -+ case 114: -+#line 1831 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "\\", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3572,11 +3581,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3576 "grammar.c" /* yacc.c:1646 */ -+#line 3585 "grammar.c" /* yacc.c:1646 */ - break; - -- case 114: --#line 1852 "grammar.y" /* yacc.c:1646 */ -+ case 115: -+#line 1857 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "%"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "%"); -@@ -3594,11 +3603,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } - } --#line 3598 "grammar.c" /* yacc.c:1646 */ -+#line 3607 "grammar.c" /* yacc.c:1646 */ - break; - -- case 115: --#line 1870 "grammar.y" /* yacc.c:1646 */ -+ case 116: -+#line 1875 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3608,11 +3617,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(^, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3612 "grammar.c" /* yacc.c:1646 */ -+#line 3621 "grammar.c" /* yacc.c:1646 */ - break; - -- case 116: --#line 1880 "grammar.y" /* yacc.c:1646 */ -+ case 117: -+#line 1885 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3622,11 +3631,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(&, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3626 "grammar.c" /* yacc.c:1646 */ -+#line 3635 "grammar.c" /* yacc.c:1646 */ - break; - -- case 117: --#line 1890 "grammar.y" /* yacc.c:1646 */ -+ case 118: -+#line 1895 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "|"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "|"); -@@ -3636,11 +3645,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(|, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3640 "grammar.c" /* yacc.c:1646 */ -+#line 3649 "grammar.c" /* yacc.c:1646 */ - break; - -- case 118: --#line 1900 "grammar.y" /* yacc.c:1646 */ -+ case 119: -+#line 1905 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "~"); - -@@ -3650,11 +3659,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == UNDEFINED) ? - UNDEFINED : ~((yyvsp[0].expression).value.integer); - } --#line 3654 "grammar.c" /* yacc.c:1646 */ -+#line 3663 "grammar.c" /* yacc.c:1646 */ - break; - -- case 119: --#line 1910 "grammar.y" /* yacc.c:1646 */ -+ case 120: -+#line 1915 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "<<"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "<<"); -@@ -3664,11 +3673,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(<<, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3668 "grammar.c" /* yacc.c:1646 */ -+#line 3677 "grammar.c" /* yacc.c:1646 */ - break; - -- case 120: --#line 1920 "grammar.y" /* yacc.c:1646 */ -+ case 121: -+#line 1925 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, ">>"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, ">>"); -@@ -3678,19 +3687,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(>>, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3682 "grammar.c" /* yacc.c:1646 */ -+#line 3691 "grammar.c" /* yacc.c:1646 */ - break; - -- case 121: --#line 1930 "grammar.y" /* yacc.c:1646 */ -+ case 122: -+#line 1935 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3690 "grammar.c" /* yacc.c:1646 */ -+#line 3699 "grammar.c" /* yacc.c:1646 */ - break; - - --#line 3694 "grammar.c" /* yacc.c:1646 */ -+#line 3703 "grammar.c" /* yacc.c:1646 */ - default: break; - } - /* User semantic actions sometimes alter yychar, and that requires -@@ -3918,5 +3927,5 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - #endif - return yyresult; - } --#line 1935 "grammar.y" /* yacc.c:1906 */ -+#line 1940 "grammar.y" /* yacc.c:1906 */ - -diff --git a/libyara/grammar.y b/libyara/grammar.y -index 56bae40..be24307 100644 ---- a/libyara/grammar.y -+++ b/libyara/grammar.y -@@ -1015,6 +1015,11 @@ expression - - $$.type = EXPRESSION_TYPE_BOOLEAN; - } -+ | _FOR_ for_expression error -+ { -+ compiler->loop_depth--; -+ compiler->loop_identifier[compiler->loop_depth] = NULL; -+ } - | _FOR_ for_expression _IDENTIFIER_ _IN_ - { - int var_index; - -From 03dc5bdb2f3fa820fb6c757f502c323aacd88f35 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Mon, 9 Jan 2017 13:17:39 +0100 -Subject: [PATCH 25/36] Make sure that loop depth is greater than 0 before - decrementing it. - -(cherry picked from commit 7f02eca670f29c00a1d2c305e96febae6ce5d37b) ---- - libyara/grammar.c | 251 +++++++++++++++++++++++++++--------------------------- - libyara/grammar.y | 7 +- - 2 files changed, 132 insertions(+), 126 deletions(-) - -diff --git a/libyara/grammar.c b/libyara/grammar.c -index eb28701..9c79512 100644 ---- a/libyara/grammar.c -+++ b/libyara/grammar.c -@@ -612,13 +612,13 @@ static const yytype_uint16 yyrline[] = - 472, 485, 502, 503, 509, 508, 524, 523, 539, 553, - 554, 559, 560, 561, 562, 567, 652, 698, 756, 801, - 802, 806, 831, 867, 913, 935, 944, 953, 968, 980, -- 994, 1007, 1018, 1024, 1054, 1023, 1168, 1167, 1246, 1252, -- 1259, 1258, 1321, 1320, 1381, 1390, 1399, 1408, 1417, 1426, -- 1435, 1439, 1447, 1448, 1453, 1475, 1487, 1503, 1502, 1508, -- 1519, 1520, 1525, 1532, 1543, 1544, 1548, 1556, 1560, 1570, -- 1584, 1600, 1610, 1619, 1644, 1656, 1668, 1684, 1696, 1712, -- 1757, 1776, 1794, 1812, 1830, 1856, 1874, 1884, 1894, 1904, -- 1914, 1924, 1934 -+ 994, 1007, 1018, 1027, 1057, 1026, 1171, 1170, 1249, 1255, -+ 1262, 1261, 1324, 1323, 1384, 1393, 1402, 1411, 1420, 1429, -+ 1438, 1442, 1450, 1451, 1456, 1478, 1490, 1506, 1505, 1511, -+ 1522, 1523, 1528, 1535, 1546, 1547, 1551, 1559, 1563, 1573, -+ 1587, 1603, 1613, 1622, 1647, 1659, 1671, 1687, 1699, 1715, -+ 1760, 1779, 1797, 1815, 1833, 1859, 1877, 1887, 1897, 1907, -+ 1917, 1927, 1937 - }; - #endif - -@@ -2587,14 +2587,17 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - case 62: - #line 1019 "grammar.y" /* yacc.c:1646 */ - { -- compiler->loop_depth--; -- compiler->loop_identifier[compiler->loop_depth] = NULL; -+ if (compiler->loop_depth > 0) -+ { -+ compiler->loop_depth--; -+ compiler->loop_identifier[compiler->loop_depth] = NULL; -+ } - } --#line 2594 "grammar.c" /* yacc.c:1646 */ -+#line 2597 "grammar.c" /* yacc.c:1646 */ - break; - - case 63: --#line 1024 "grammar.y" /* yacc.c:1646 */ -+#line 1027 "grammar.y" /* yacc.c:1646 */ - { - int var_index; - -@@ -2624,11 +2627,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 2628 "grammar.c" /* yacc.c:1646 */ -+#line 2631 "grammar.c" /* yacc.c:1646 */ - break; - - case 64: --#line 1054 "grammar.y" /* yacc.c:1646 */ -+#line 1057 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2663,11 +2666,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = (yyvsp[-4].c_string); - compiler->loop_depth++; - } --#line 2667 "grammar.c" /* yacc.c:1646 */ -+#line 2670 "grammar.c" /* yacc.c:1646 */ - break; - - case 65: --#line 1089 "grammar.y" /* yacc.c:1646 */ -+#line 1092 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2746,11 +2749,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2750 "grammar.c" /* yacc.c:1646 */ -+#line 2753 "grammar.c" /* yacc.c:1646 */ - break; - - case 66: --#line 1168 "grammar.y" /* yacc.c:1646 */ -+#line 1171 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2780,11 +2783,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = NULL; - compiler->loop_depth++; - } --#line 2784 "grammar.c" /* yacc.c:1646 */ -+#line 2787 "grammar.c" /* yacc.c:1646 */ - break; - - case 67: --#line 1198 "grammar.y" /* yacc.c:1646 */ -+#line 1201 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2833,31 +2836,31 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - - } --#line 2837 "grammar.c" /* yacc.c:1646 */ -+#line 2840 "grammar.c" /* yacc.c:1646 */ - break; - - case 68: --#line 1247 "grammar.y" /* yacc.c:1646 */ -+#line 1250 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_OF, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2847 "grammar.c" /* yacc.c:1646 */ -+#line 2850 "grammar.c" /* yacc.c:1646 */ - break; - - case 69: --#line 1253 "grammar.y" /* yacc.c:1646 */ -+#line 1256 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_NOT, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2857 "grammar.c" /* yacc.c:1646 */ -+#line 2860 "grammar.c" /* yacc.c:1646 */ - break; - - case 70: --#line 1259 "grammar.y" /* yacc.c:1646 */ -+#line 1262 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - void* jmp_destination_addr; -@@ -2883,11 +2886,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2887 "grammar.c" /* yacc.c:1646 */ -+#line 2890 "grammar.c" /* yacc.c:1646 */ - break; - - case 71: --#line 1285 "grammar.y" /* yacc.c:1646 */ -+#line 1288 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* and_addr; -@@ -2923,11 +2926,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2927 "grammar.c" /* yacc.c:1646 */ -+#line 2930 "grammar.c" /* yacc.c:1646 */ - break; - - case 72: --#line 1321 "grammar.y" /* yacc.c:1646 */ -+#line 1324 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - void* jmp_destination_addr; -@@ -2952,11 +2955,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2956 "grammar.c" /* yacc.c:1646 */ -+#line 2959 "grammar.c" /* yacc.c:1646 */ - break; - - case 73: --#line 1346 "grammar.y" /* yacc.c:1646 */ -+#line 1349 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* or_addr; -@@ -2992,11 +2995,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2996 "grammar.c" /* yacc.c:1646 */ -+#line 2999 "grammar.c" /* yacc.c:1646 */ - break; - - case 74: --#line 1382 "grammar.y" /* yacc.c:1646 */ -+#line 1385 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3005,11 +3008,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3009 "grammar.c" /* yacc.c:1646 */ -+#line 3012 "grammar.c" /* yacc.c:1646 */ - break; - - case 75: --#line 1391 "grammar.y" /* yacc.c:1646 */ -+#line 1394 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3018,11 +3021,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3022 "grammar.c" /* yacc.c:1646 */ -+#line 3025 "grammar.c" /* yacc.c:1646 */ - break; - - case 76: --#line 1400 "grammar.y" /* yacc.c:1646 */ -+#line 1403 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3031,11 +3034,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3035 "grammar.c" /* yacc.c:1646 */ -+#line 3038 "grammar.c" /* yacc.c:1646 */ - break; - - case 77: --#line 1409 "grammar.y" /* yacc.c:1646 */ -+#line 1412 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3044,11 +3047,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3048 "grammar.c" /* yacc.c:1646 */ -+#line 3051 "grammar.c" /* yacc.c:1646 */ - break; - - case 78: --#line 1418 "grammar.y" /* yacc.c:1646 */ -+#line 1421 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "==", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3057,11 +3060,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3061 "grammar.c" /* yacc.c:1646 */ -+#line 3064 "grammar.c" /* yacc.c:1646 */ - break; - - case 79: --#line 1427 "grammar.y" /* yacc.c:1646 */ -+#line 1430 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "!=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3070,39 +3073,39 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3074 "grammar.c" /* yacc.c:1646 */ -+#line 3077 "grammar.c" /* yacc.c:1646 */ - break; - - case 80: --#line 1436 "grammar.y" /* yacc.c:1646 */ -+#line 1439 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3082 "grammar.c" /* yacc.c:1646 */ -+#line 3085 "grammar.c" /* yacc.c:1646 */ - break; - - case 81: --#line 1440 "grammar.y" /* yacc.c:1646 */ -+#line 1443 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3090 "grammar.c" /* yacc.c:1646 */ -+#line 3093 "grammar.c" /* yacc.c:1646 */ - break; - - case 82: --#line 1447 "grammar.y" /* yacc.c:1646 */ -+#line 1450 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_ENUMERATION; } --#line 3096 "grammar.c" /* yacc.c:1646 */ -+#line 3099 "grammar.c" /* yacc.c:1646 */ - break; - - case 83: --#line 1448 "grammar.y" /* yacc.c:1646 */ -+#line 1451 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_RANGE; } --#line 3102 "grammar.c" /* yacc.c:1646 */ -+#line 3105 "grammar.c" /* yacc.c:1646 */ - break; - - case 84: --#line 1454 "grammar.y" /* yacc.c:1646 */ -+#line 1457 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[-3].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3120,11 +3123,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3124 "grammar.c" /* yacc.c:1646 */ -+#line 3127 "grammar.c" /* yacc.c:1646 */ - break; - - case 85: --#line 1476 "grammar.y" /* yacc.c:1646 */ -+#line 1479 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3136,11 +3139,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3140 "grammar.c" /* yacc.c:1646 */ -+#line 3143 "grammar.c" /* yacc.c:1646 */ - break; - - case 86: --#line 1488 "grammar.y" /* yacc.c:1646 */ -+#line 1491 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3151,77 +3154,77 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3155 "grammar.c" /* yacc.c:1646 */ -+#line 3158 "grammar.c" /* yacc.c:1646 */ - break; - - case 87: --#line 1503 "grammar.y" /* yacc.c:1646 */ -+#line 1506 "grammar.y" /* yacc.c:1646 */ - { - // Push end-of-list marker - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3164 "grammar.c" /* yacc.c:1646 */ -+#line 3167 "grammar.c" /* yacc.c:1646 */ - break; - - case 89: --#line 1509 "grammar.y" /* yacc.c:1646 */ -+#line 1512 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - yr_parser_emit_pushes_for_strings(yyscanner, "$*"); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3175 "grammar.c" /* yacc.c:1646 */ -+#line 3178 "grammar.c" /* yacc.c:1646 */ - break; - - case 92: --#line 1526 "grammar.y" /* yacc.c:1646 */ -+#line 1529 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3186 "grammar.c" /* yacc.c:1646 */ -+#line 3189 "grammar.c" /* yacc.c:1646 */ - break; - - case 93: --#line 1533 "grammar.y" /* yacc.c:1646 */ -+#line 1536 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3197 "grammar.c" /* yacc.c:1646 */ -+#line 3200 "grammar.c" /* yacc.c:1646 */ - break; - - case 95: --#line 1545 "grammar.y" /* yacc.c:1646 */ -+#line 1548 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3205 "grammar.c" /* yacc.c:1646 */ -+#line 3208 "grammar.c" /* yacc.c:1646 */ - break; - - case 96: --#line 1549 "grammar.y" /* yacc.c:1646 */ -+#line 1552 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, 1, NULL, NULL); - } --#line 3213 "grammar.c" /* yacc.c:1646 */ -+#line 3216 "grammar.c" /* yacc.c:1646 */ - break; - - case 97: --#line 1557 "grammar.y" /* yacc.c:1646 */ -+#line 1560 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3221 "grammar.c" /* yacc.c:1646 */ -+#line 3224 "grammar.c" /* yacc.c:1646 */ - break; - - case 98: --#line 1561 "grammar.y" /* yacc.c:1646 */ -+#line 1564 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit( - yyscanner, OP_FILESIZE, NULL); -@@ -3231,11 +3234,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3235 "grammar.c" /* yacc.c:1646 */ -+#line 3238 "grammar.c" /* yacc.c:1646 */ - break; - - case 99: --#line 1571 "grammar.y" /* yacc.c:1646 */ -+#line 1574 "grammar.y" /* yacc.c:1646 */ - { - yywarning(yyscanner, - "Using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " -@@ -3249,11 +3252,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3253 "grammar.c" /* yacc.c:1646 */ -+#line 3256 "grammar.c" /* yacc.c:1646 */ - break; - - case 100: --#line 1585 "grammar.y" /* yacc.c:1646 */ -+#line 1588 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-1].expression), EXPRESSION_TYPE_INTEGER, "intXXXX or uintXXXX"); - -@@ -3269,11 +3272,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3273 "grammar.c" /* yacc.c:1646 */ -+#line 3276 "grammar.c" /* yacc.c:1646 */ - break; - - case 101: --#line 1601 "grammar.y" /* yacc.c:1646 */ -+#line 1604 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, (yyvsp[0].integer), NULL, NULL); -@@ -3283,11 +3286,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = (yyvsp[0].integer); - } --#line 3287 "grammar.c" /* yacc.c:1646 */ -+#line 3290 "grammar.c" /* yacc.c:1646 */ - break; - - case 102: --#line 1611 "grammar.y" /* yacc.c:1646 */ -+#line 1614 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg_double( - yyscanner, OP_PUSH, (yyvsp[0].double_), NULL, NULL); -@@ -3296,11 +3299,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } --#line 3300 "grammar.c" /* yacc.c:1646 */ -+#line 3303 "grammar.c" /* yacc.c:1646 */ - break; - - case 103: --#line 1620 "grammar.y" /* yacc.c:1646 */ -+#line 1623 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string; - -@@ -3325,11 +3328,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_STRING; - (yyval.expression).value.sized_string = sized_string; - } --#line 3329 "grammar.c" /* yacc.c:1646 */ -+#line 3332 "grammar.c" /* yacc.c:1646 */ - break; - - case 104: --#line 1645 "grammar.y" /* yacc.c:1646 */ -+#line 1648 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[0].c_string), OP_COUNT, UNDEFINED); -@@ -3341,11 +3344,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3345 "grammar.c" /* yacc.c:1646 */ -+#line 3348 "grammar.c" /* yacc.c:1646 */ - break; - - case 105: --#line 1657 "grammar.y" /* yacc.c:1646 */ -+#line 1660 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_OFFSET, UNDEFINED); -@@ -3357,11 +3360,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3361 "grammar.c" /* yacc.c:1646 */ -+#line 3364 "grammar.c" /* yacc.c:1646 */ - break; - - case 106: --#line 1669 "grammar.y" /* yacc.c:1646 */ -+#line 1672 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3377,11 +3380,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3381 "grammar.c" /* yacc.c:1646 */ -+#line 3384 "grammar.c" /* yacc.c:1646 */ - break; - - case 107: --#line 1685 "grammar.y" /* yacc.c:1646 */ -+#line 1688 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_LENGTH, UNDEFINED); -@@ -3393,11 +3396,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3397 "grammar.c" /* yacc.c:1646 */ -+#line 3400 "grammar.c" /* yacc.c:1646 */ - break; - - case 108: --#line 1697 "grammar.y" /* yacc.c:1646 */ -+#line 1700 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3413,11 +3416,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3417 "grammar.c" /* yacc.c:1646 */ -+#line 3420 "grammar.c" /* yacc.c:1646 */ - break; - - case 109: --#line 1713 "grammar.y" /* yacc.c:1646 */ -+#line 1716 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) // loop identifier - { -@@ -3462,11 +3465,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3466 "grammar.c" /* yacc.c:1646 */ -+#line 3469 "grammar.c" /* yacc.c:1646 */ - break; - - case 110: --#line 1758 "grammar.y" /* yacc.c:1646 */ -+#line 1761 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT, "-"); - -@@ -3485,11 +3488,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3489 "grammar.c" /* yacc.c:1646 */ -+#line 3492 "grammar.c" /* yacc.c:1646 */ - break; - - case 111: --#line 1777 "grammar.y" /* yacc.c:1646 */ -+#line 1780 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "+", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3507,11 +3510,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3511 "grammar.c" /* yacc.c:1646 */ -+#line 3514 "grammar.c" /* yacc.c:1646 */ - break; - - case 112: --#line 1795 "grammar.y" /* yacc.c:1646 */ -+#line 1798 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "-", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3529,11 +3532,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3533 "grammar.c" /* yacc.c:1646 */ -+#line 3536 "grammar.c" /* yacc.c:1646 */ - break; - - case 113: --#line 1813 "grammar.y" /* yacc.c:1646 */ -+#line 1816 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "*", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3551,11 +3554,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3555 "grammar.c" /* yacc.c:1646 */ -+#line 3558 "grammar.c" /* yacc.c:1646 */ - break; - - case 114: --#line 1831 "grammar.y" /* yacc.c:1646 */ -+#line 1834 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "\\", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3581,11 +3584,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3585 "grammar.c" /* yacc.c:1646 */ -+#line 3588 "grammar.c" /* yacc.c:1646 */ - break; - - case 115: --#line 1857 "grammar.y" /* yacc.c:1646 */ -+#line 1860 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "%"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "%"); -@@ -3603,11 +3606,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } - } --#line 3607 "grammar.c" /* yacc.c:1646 */ -+#line 3610 "grammar.c" /* yacc.c:1646 */ - break; - - case 116: --#line 1875 "grammar.y" /* yacc.c:1646 */ -+#line 1878 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3617,11 +3620,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(^, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3621 "grammar.c" /* yacc.c:1646 */ -+#line 3624 "grammar.c" /* yacc.c:1646 */ - break; - - case 117: --#line 1885 "grammar.y" /* yacc.c:1646 */ -+#line 1888 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3631,11 +3634,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(&, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3635 "grammar.c" /* yacc.c:1646 */ -+#line 3638 "grammar.c" /* yacc.c:1646 */ - break; - - case 118: --#line 1895 "grammar.y" /* yacc.c:1646 */ -+#line 1898 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "|"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "|"); -@@ -3645,11 +3648,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(|, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3649 "grammar.c" /* yacc.c:1646 */ -+#line 3652 "grammar.c" /* yacc.c:1646 */ - break; - - case 119: --#line 1905 "grammar.y" /* yacc.c:1646 */ -+#line 1908 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "~"); - -@@ -3659,11 +3662,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == UNDEFINED) ? - UNDEFINED : ~((yyvsp[0].expression).value.integer); - } --#line 3663 "grammar.c" /* yacc.c:1646 */ -+#line 3666 "grammar.c" /* yacc.c:1646 */ - break; - - case 120: --#line 1915 "grammar.y" /* yacc.c:1646 */ -+#line 1918 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "<<"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "<<"); -@@ -3673,11 +3676,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(<<, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3677 "grammar.c" /* yacc.c:1646 */ -+#line 3680 "grammar.c" /* yacc.c:1646 */ - break; - - case 121: --#line 1925 "grammar.y" /* yacc.c:1646 */ -+#line 1928 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, ">>"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, ">>"); -@@ -3687,19 +3690,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(>>, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3691 "grammar.c" /* yacc.c:1646 */ -+#line 3694 "grammar.c" /* yacc.c:1646 */ - break; - - case 122: --#line 1935 "grammar.y" /* yacc.c:1646 */ -+#line 1938 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3699 "grammar.c" /* yacc.c:1646 */ -+#line 3702 "grammar.c" /* yacc.c:1646 */ - break; - - --#line 3703 "grammar.c" /* yacc.c:1646 */ -+#line 3706 "grammar.c" /* yacc.c:1646 */ - default: break; - } - /* User semantic actions sometimes alter yychar, and that requires -@@ -3927,5 +3930,5 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - #endif - return yyresult; - } --#line 1940 "grammar.y" /* yacc.c:1906 */ -+#line 1943 "grammar.y" /* yacc.c:1906 */ - -diff --git a/libyara/grammar.y b/libyara/grammar.y -index be24307..addb55d 100644 ---- a/libyara/grammar.y -+++ b/libyara/grammar.y -@@ -1017,8 +1017,11 @@ expression - } - | _FOR_ for_expression error - { -- compiler->loop_depth--; -- compiler->loop_identifier[compiler->loop_depth] = NULL; -+ if (compiler->loop_depth > 0) -+ { -+ compiler->loop_depth--; -+ compiler->loop_identifier[compiler->loop_depth] = NULL; -+ } - } - | _FOR_ for_expression _IDENTIFIER_ _IN_ - { - -From b9ca16ab1c5c11461c3cdd929dacafe5d74a72f0 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Tue, 15 Nov 2016 00:17:56 +0100 -Subject: [PATCH 26/36] Add support for big-endian ELF files (#560) - -cherry picked from: - -- c9c0dfb61ed5b27bdad3433d1e8d095f2f0c5684 -- 79316a3b911b4ccfda0b3961d26523f0fd8ccfd5, "Minor re-styling" ---- - libyara/modules/elf.c | 211 +++++++++++++++++++++++++++++++------------------- - 1 file changed, 133 insertions(+), 78 deletions(-) - -diff --git a/libyara/modules/elf.c b/libyara/modules/elf.c -index e934084..dff586e 100644 ---- a/libyara/modules/elf.c -+++ b/libyara/modules/elf.c -@@ -37,8 +37,9 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - #define MODULE_NAME elf - -+#define CLASS_DATA(c,d) ((c << 8) | d) - --int get_elf_type( -+int get_elf_class_data( - uint8_t* buffer, - size_t buffer_length) - { -@@ -51,7 +52,7 @@ int get_elf_type( - - if (yr_le32toh(elf_ident->magic) == ELF_MAGIC) - { -- return elf_ident->_class; -+ return CLASS_DATA(elf_ident->_class, elf_ident->data); - } - else - { -@@ -59,15 +60,13 @@ int get_elf_type( - } - } - --#define SIZE_OF_SECTION_TABLE_32(h) \ -- (sizeof(elf32_section_header_t) * yr_le16toh(h->sh_entry_count)) -+#define ELF_SIZE_OF_SECTION_TABLE(bits,bo,h) \ -+ (sizeof(elf##bits##_section_header_t) * yr_##bo##16toh(h->sh_entry_count)) - --#define SIZE_OF_SECTION_TABLE_64(h) \ -- (sizeof(elf64_section_header_t) * yr_le16toh(h->sh_entry_count)) - - --#define ELF_RVA_TO_OFFSET(bits) \ --uint64_t elf_rva_to_offset_##bits( \ -+#define ELF_RVA_TO_OFFSET(bits,bo) \ -+uint64_t elf_rva_to_offset_##bits##_##bo( \ - elf##bits##_header_t* elf_header, \ - uint64_t rva, \ - size_t elf_size) \ -@@ -78,34 +77,34 @@ uint64_t elf_rva_to_offset_##bits( \ - \ - /* check that sh_offset doesn't wrap when added to SIZE_OF_SECTION_TABLE */ \ - \ -- if(ULONG_MAX - yr_le##bits##toh(elf_header->sh_offset) < \ -- SIZE_OF_SECTION_TABLE_##bits(elf_header)) \ -+ if(ULONG_MAX - yr_##bo##bits##toh(elf_header->sh_offset) < \ -+ ELF_SIZE_OF_SECTION_TABLE(bits,bo,elf_header)) \ - { \ - return UNDEFINED; \ - } \ - \ -- if (yr_le##bits##toh(elf_header->sh_offset) == 0 || \ -- yr_le##bits##toh(elf_header->sh_offset) > elf_size || \ -- yr_le##bits##toh(elf_header->sh_offset) + \ -- SIZE_OF_SECTION_TABLE_##bits(elf_header) > elf_size || \ -- yr_le16toh(elf_header->sh_entry_count) == 0) \ -+ if (yr_##bo##bits##toh(elf_header->sh_offset) == 0 || \ -+ yr_##bo##bits##toh(elf_header->sh_offset) > elf_size || \ -+ yr_##bo##bits##toh(elf_header->sh_offset) + \ -+ ELF_SIZE_OF_SECTION_TABLE(bits,bo,elf_header) > elf_size || \ -+ yr_##bo##16toh(elf_header->sh_entry_count) == 0) \ - { \ - return UNDEFINED; \ - } \ - \ - section = (elf##bits##_section_header_t*) \ -- ((uint8_t*) elf_header + yr_le##bits##toh(elf_header->sh_offset)); \ -+ ((uint8_t*) elf_header + yr_##bo##bits##toh(elf_header->sh_offset)); \ - \ -- for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) \ -+ for (i = 0; i < yr_##bo##16toh(elf_header->sh_entry_count); i++) \ - { \ -- if (yr_le32toh(section->type) != ELF_SHT_NULL && \ -- yr_le32toh(section->type) != ELF_SHT_NOBITS && \ -- rva >= yr_le##bits##toh(section->addr) && \ -- rva < yr_le##bits##toh(section->addr) + \ -- yr_le##bits##toh(section->size)) \ -+ if (yr_##bo##32toh(section->type) != ELF_SHT_NULL && \ -+ yr_##bo##32toh(section->type) != ELF_SHT_NOBITS && \ -+ rva >= yr_##bo##bits##toh(section->addr) && \ -+ rva < yr_##bo##bits##toh(section->addr) + \ -+ yr_##bo##bits##toh(section->size)) \ - { \ -- return yr_le##bits##toh(section->offset) + \ -- (rva - yr_le##bits##toh(section->addr)); \ -+ return yr_##bo##bits##toh(section->offset) + \ -+ (rva - yr_##bo##bits##toh(section->addr)); \ - } \ - \ - section++; \ -@@ -114,8 +113,8 @@ uint64_t elf_rva_to_offset_##bits( \ - return UNDEFINED; \ - } - --#define PARSE_ELF_HEADER(bits) \ --void parse_elf_header_##bits( \ -+#define PARSE_ELF_HEADER(bits,bo) \ -+void parse_elf_header_##bits##_##bo( \ - elf##bits##_header_t* elf, \ - size_t base_address, \ - size_t elf_size, \ -@@ -127,56 +126,67 @@ void parse_elf_header_##bits( \ - elf##bits##_section_header_t* section; \ - elf##bits##_program_header_t* segment; \ - \ -- set_integer(yr_le16toh(elf->type), elf_obj, "type"); \ -- set_integer(yr_le16toh(elf->machine), elf_obj, "machine"); \ -- set_integer(yr_le##bits##toh(elf->sh_offset), elf_obj, "sh_offset"); \ -- set_integer(yr_le16toh(elf->sh_entry_size), elf_obj, "sh_entry_size"); \ -- set_integer(yr_le16toh(elf->sh_entry_count), elf_obj, "number_of_sections"); \ -- set_integer(yr_le##bits##toh(elf->ph_offset), elf_obj, "ph_offset"); \ -- set_integer(yr_le16toh(elf->ph_entry_size), elf_obj, "ph_entry_size"); \ -- set_integer(yr_le16toh(elf->ph_entry_count), elf_obj, "number_of_segments"); \ -+ set_integer(yr_##bo##16toh(elf->type), elf_obj, "type"); \ -+ set_integer(yr_##bo##16toh(elf->machine), elf_obj, "machine"); \ -+ set_integer(yr_##bo##bits##toh(elf->sh_offset), elf_obj, \ -+ "sh_offset"); \ -+ set_integer(yr_##bo##16toh(elf->sh_entry_size), elf_obj, \ -+ "sh_entry_size"); \ -+ set_integer(yr_##bo##16toh(elf->sh_entry_count), elf_obj, \ -+ "number_of_sections"); \ -+ set_integer(yr_##bo##bits##toh(elf->ph_offset), elf_obj, \ -+ "ph_offset"); \ -+ set_integer(yr_##bo##16toh(elf->ph_entry_size), elf_obj, \ -+ "ph_entry_size"); \ -+ set_integer(yr_##bo##16toh(elf->ph_entry_count), elf_obj, \ -+ "number_of_segments"); \ - \ -- if (yr_le##bits##toh(elf->entry) != 0) \ -+ if (yr_##bo##bits##toh(elf->entry) != 0) \ - { \ - set_integer( \ - flags & SCAN_FLAGS_PROCESS_MEMORY ? \ -- base_address + yr_le##bits##toh(elf->entry) : \ -- elf_rva_to_offset_##bits(elf, yr_le##bits##toh(elf->entry), elf_size), \ -+ base_address + yr_##bo##bits##toh(elf->entry) : \ -+ elf_rva_to_offset_##bits##_##bo( \ -+ elf, yr_##bo##bits##toh(elf->entry), elf_size), \ - elf_obj, "entry_point"); \ - } \ - \ -- if (yr_le16toh(elf->sh_entry_count) < ELF_SHN_LORESERVE && \ -- yr_le16toh(elf->sh_str_table_index) < yr_le16toh(elf->sh_entry_count) && \ -- yr_le##bits##toh(elf->sh_offset) < elf_size && \ -- yr_le##bits##toh(elf->sh_offset) + yr_le16toh(elf->sh_entry_count) * \ -- sizeof(elf##bits##_section_header_t) <= elf_size) \ -+ if (yr_##bo##16toh(elf->sh_entry_count) < ELF_SHN_LORESERVE && \ -+ yr_##bo##16toh(elf->sh_str_table_index) < \ -+ yr_##bo##16toh(elf->sh_entry_count) && \ -+ yr_##bo##bits##toh(elf->sh_offset) < elf_size && \ -+ yr_##bo##bits##toh(elf->sh_offset) + \ -+ yr_##bo##16toh(elf->sh_entry_count) * \ -+ sizeof(elf##bits##_section_header_t) <= elf_size) \ - { \ - char* str_table = NULL; \ - \ - section = (elf##bits##_section_header_t*) \ -- ((uint8_t*) elf + yr_le##bits##toh(elf->sh_offset)); \ -+ ((uint8_t*) elf + yr_##bo##bits##toh(elf->sh_offset)); \ - \ -- if (section[yr_le16toh(elf->sh_str_table_index)].offset < elf_size) \ -- str_table = (char*) elf + \ -- yr_le##bits##toh(section[yr_le16toh(elf->sh_str_table_index)].offset); \ -+ if (section[yr_##bo##16toh(elf->sh_str_table_index)].offset < elf_size) \ -+ { \ -+ str_table = (char*) elf + yr_##bo##bits##toh( \ -+ section[yr_##bo##16toh(elf->sh_str_table_index)].offset); \ -+ } \ - \ -- for (i = 0; i < yr_le16toh(elf->sh_entry_count); i++) \ -+ for (i = 0; i < yr_##bo##16toh(elf->sh_entry_count); i++) \ - { \ -- set_integer(yr_le32toh(section->type), elf_obj, \ -+ set_integer(yr_##bo##32toh(section->type), elf_obj, \ - "sections[%i].type", i); \ -- set_integer(yr_le32toh(section->flags), elf_obj, \ -+ set_integer(yr_##bo##32toh(section->flags), elf_obj, \ - "sections[%i].flags", i); \ -- set_integer(yr_le##bits##toh(section->size), elf_obj, \ -+ set_integer(yr_##bo##bits##toh(section->size), elf_obj, \ - "sections[%i].size", i); \ -- set_integer(yr_le##bits##toh(section->offset), elf_obj, \ -+ set_integer(yr_##bo##bits##toh(section->offset), elf_obj, \ - "sections[%i].offset", i); \ - \ -- if (yr_le##bits##toh(section->name) < elf_size && \ -+ if (yr_##bo##bits##toh(section->name) < elf_size && \ - str_table > (char*) elf && \ -- str_table + yr_le##bits##toh(section->name) < \ -- (char*) elf + elf_size) \ -+ str_table + yr_##bo##bits##toh(section->name) < \ -+ (char*) elf + elf_size) \ - { \ -- set_string(str_table + yr_le##bits##toh(section->name), elf_obj, \ -+ set_string(str_table + yr_##bo##bits##toh(section->name), elf_obj, \ - "sections[%i].name", i); \ - } \ - \ -@@ -184,38 +194,39 @@ void parse_elf_header_##bits( \ - } \ - } \ - \ -- if (yr_le16toh(elf->ph_entry_count) > 0 && \ -- yr_le16toh(elf->ph_entry_count) < ELF_PN_XNUM && \ -- yr_le##bits##toh(elf->ph_offset) < elf_size && \ -- yr_le##bits##toh(elf->ph_offset) + yr_le16toh(elf->ph_entry_count) * \ -+ if (yr_##bo##16toh(elf->ph_entry_count) > 0 && \ -+ yr_##bo##16toh(elf->ph_entry_count) < ELF_PN_XNUM && \ -+ yr_##bo##bits##toh(elf->ph_offset) < elf_size && \ -+ yr_##bo##bits##toh(elf->ph_offset) + \ -+ yr_##bo##16toh(elf->ph_entry_count) * \ - sizeof(elf##bits##_program_header_t) <= elf_size) \ - { \ - segment = (elf##bits##_program_header_t*) \ -- ((uint8_t*) elf + yr_le##bits##toh(elf->ph_offset)); \ -+ ((uint8_t*) elf + yr_##bo##bits##toh(elf->ph_offset)); \ - \ -- for (i = 0; i < yr_le16toh(elf->ph_entry_count); i++) \ -+ for (i = 0; i < yr_##bo##16toh(elf->ph_entry_count); i++) \ - { \ - set_integer( \ -- yr_le32toh(segment->type), elf_obj, "segments[%i].type", i); \ -+ yr_##bo##32toh(segment->type), elf_obj, "segments[%i].type", i); \ - set_integer( \ -- yr_le32toh(segment->flags), elf_obj, "segments[%i].flags", i); \ -+ yr_##bo##32toh(segment->flags), elf_obj, "segments[%i].flags", i); \ - set_integer( \ -- yr_le##bits##toh(segment->offset), elf_obj, \ -+ yr_##bo##bits##toh(segment->offset), elf_obj, \ - "segments[%i].offset", i); \ - set_integer( \ -- yr_le##bits##toh(segment->virt_addr), elf_obj, \ -+ yr_##bo##bits##toh(segment->virt_addr), elf_obj, \ - "segments[%i].virtual_address", i); \ - set_integer( \ -- yr_le##bits##toh(segment->phys_addr), elf_obj, \ -+ yr_##bo##bits##toh(segment->phys_addr), elf_obj, \ - "segments[%i].physical_address", i); \ - set_integer( \ -- yr_le##bits##toh(segment->file_size), elf_obj, \ -+ yr_##bo##bits##toh(segment->file_size), elf_obj, \ - "segments[%i].file_size", i); \ - set_integer( \ -- yr_le##bits##toh(segment->mem_size), elf_obj, \ -+ yr_##bo##bits##toh(segment->mem_size), elf_obj, \ - "segments[%i].memory_size", i); \ - set_integer( \ -- yr_le##bits##toh(segment->alignment), elf_obj, \ -+ yr_##bo##bits##toh(segment->alignment), elf_obj, \ - "segments[%i].alignment", i); \ - \ - segment++; \ -@@ -224,12 +235,16 @@ void parse_elf_header_##bits( \ - } - - --ELF_RVA_TO_OFFSET(32); --ELF_RVA_TO_OFFSET(64); -+ELF_RVA_TO_OFFSET(32,le); -+ELF_RVA_TO_OFFSET(64,le); -+ELF_RVA_TO_OFFSET(32,be); -+ELF_RVA_TO_OFFSET(64,be); - - --PARSE_ELF_HEADER(32); --PARSE_ELF_HEADER(64); -+PARSE_ELF_HEADER(32,le); -+PARSE_ELF_HEADER(64,le); -+PARSE_ELF_HEADER(32,be); -+PARSE_ELF_HEADER(64,be); - - - begin_declarations; -@@ -407,9 +422,9 @@ int module_load( - if (block_data == NULL) - continue; - -- switch(get_elf_type(block_data, block->size)) -+ switch(get_elf_class_data(block_data, block->size)) - { -- case ELF_CLASS_32: -+ case CLASS_DATA(ELF_CLASS_32, ELF_DATA_2LSB): - - if (block->size > sizeof(elf32_header_t)) - { -@@ -418,7 +433,27 @@ int module_load( - if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || - yr_le16toh(elf_header32->type) == ELF_ET_EXEC) - { -- parse_elf_header_32( -+ parse_elf_header_32_le( -+ elf_header32, -+ block->base, -+ block->size, -+ context->flags, -+ module_object); -+ } -+ } -+ -+ break; -+ -+ case CLASS_DATA(ELF_CLASS_32, ELF_DATA_2MSB): -+ -+ if (block->size > sizeof(elf32_header_t)) -+ { -+ elf_header32 = (elf32_header_t*) block_data; -+ -+ if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || -+ yr_be16toh(elf_header32->type) == ELF_ET_EXEC) -+ { -+ parse_elf_header_32_be( - elf_header32, - block->base, - block->size, -@@ -429,7 +464,7 @@ int module_load( - - break; - -- case ELF_CLASS_64: -+ case CLASS_DATA(ELF_CLASS_64,ELF_DATA_2LSB): - - if (block->size > sizeof(elf64_header_t)) - { -@@ -438,7 +473,27 @@ int module_load( - if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || - yr_le16toh(elf_header64->type) == ELF_ET_EXEC) - { -- parse_elf_header_64( -+ parse_elf_header_64_le( -+ elf_header64, -+ block->base, -+ block->size, -+ context->flags, -+ module_object); -+ } -+ } -+ -+ break; -+ -+ case CLASS_DATA(ELF_CLASS_64,ELF_DATA_2MSB): -+ -+ if (block->size > sizeof(elf64_header_t)) -+ { -+ elf_header64 = (elf64_header_t*) block_data; -+ -+ if (!(context->flags & SCAN_FLAGS_PROCESS_MEMORY) || -+ yr_be16toh(elf_header64->type) == ELF_ET_EXEC) -+ { -+ parse_elf_header_64_be( - elf_header64, - block->base, - block->size, - -From c221d4bb820a6005a7b9da44499ce4829f7cf591 Mon Sep 17 00:00:00 2001 -From: Hilko Bengen -Date: Tue, 17 Jan 2017 17:07:02 +0100 -Subject: [PATCH 27/36] re_lexer: Make reading escape sequences more robust - (#586) - -* Add test for issue #503 - -* re_lexer: Make reading escape sequences more robust - -This commit fixes parsing incomplete escape sequences at the end of a -regular expression and parsing things like \xxy (invalid hex digits) -which before were silently turned into (char)255. - -Close #503 - -* Update re_lexer.c - -(cherry picked from commit 3119b232c9c453c98d8fa8b6ae4e37ba18117cd4) ---- - libyara/re_lexer.c | 22 +++++++++++----------- - libyara/re_lexer.l | 12 ++++++------ - tests/test-rules.c | 6 ++++++ - 3 files changed, 23 insertions(+), 17 deletions(-) - -diff --git a/libyara/re_lexer.c b/libyara/re_lexer.c -index 6d784e6..388a5c6 100644 ---- a/libyara/re_lexer.c -+++ b/libyara/re_lexer.c -@@ -243,7 +243,7 @@ struct yy_buffer_state - /* Number of characters read into yy_ch_buf, not including EOB - * characters. - */ -- yy_size_t yy_n_chars; -+ int yy_n_chars; - - /* Whether we "own" the buffer - i.e., we know we created it, - * and can realloc() it to grow it, and should free() it to -@@ -612,7 +612,7 @@ struct yyguts_t - size_t yy_buffer_stack_max; /**< capacity of stack. */ - YY_BUFFER_STATE * yy_buffer_stack; /**< Stack as an array. */ - char yy_hold_char; -- yy_size_t yy_n_chars; -+ int yy_n_chars; - yy_size_t yyleng_r; - char *yy_c_buf_p; - int yy_init; -@@ -1125,7 +1125,7 @@ YY_RULE_SETUP - } - else - { -- yyerror(yyscanner, lex_env, "unexpected end of buffer"); -+ yyerror(yyscanner, lex_env, "illegal escape sequence"); - yyterminate(); - } - } -@@ -1180,7 +1180,7 @@ YY_RULE_SETUP - { - if (!read_escaped_char(yyscanner, &end)) - { -- yyerror(yyscanner, lex_env, "unexpected end of buffer"); -+ yyerror(yyscanner, lex_env, "illegal escape sequence"); - yyterminate(); - } - } -@@ -1292,7 +1292,7 @@ YY_RULE_SETUP - } - else - { -- yyerror(yyscanner, lex_env, "unexpected end of buffer"); -+ yyerror(yyscanner, lex_env, "illegal escape sequence"); - yyterminate(); - } - } -@@ -1610,9 +1610,9 @@ static int yy_get_next_buffer (yyscan_t yyscanner) - else - ret_val = EOB_ACT_CONTINUE_SCAN; - -- if ((yy_size_t) (yyg->yy_n_chars + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { -+ if ((int) (yyg->yy_n_chars + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { - /* Extend the array by 50%, plus the number we really need. */ -- yy_size_t new_size = yyg->yy_n_chars + number_to_move + (yyg->yy_n_chars >> 1); -+ int new_size = yyg->yy_n_chars + number_to_move + (yyg->yy_n_chars >> 1); - YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) re_yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ,yyscanner ); - if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) - YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); -@@ -2012,7 +2012,7 @@ static void re_yyensure_buffer_stack (yyscan_t yyscanner) - * scanner will even need a stack. We use 2 instead of 1 to avoid an - * immediate realloc on the next call. - */ -- num_to_alloc = 1; // After all that talk, this was set to 1 anyways... -+ num_to_alloc = 1; /* After all that talk, this was set to 1 anyways... */ - yyg->yy_buffer_stack = (struct yy_buffer_state**)re_yyalloc - (num_to_alloc * sizeof(struct yy_buffer_state*) - , yyscanner); -@@ -2568,19 +2568,19 @@ int read_escaped_char( - text[0] = '\\'; - text[1] = RE_YY_INPUT(yyscanner); - -- if (text[1] == EOF) -+ if (text[1] == EOF || text[1] == 0) - return 0; - - if (text[1] == 'x') - { - text[2] = RE_YY_INPUT(yyscanner); - -- if (text[2] == EOF) -+ if (!isxdigit(text[2])) - return 0; - - text[3] = RE_YY_INPUT(yyscanner); - -- if (text[3] == EOF) -+ if (!isxdigit(text[3])) - return 0; - } - -diff --git a/libyara/re_lexer.l b/libyara/re_lexer.l -index b3744a3..ecb6ad4 100644 ---- a/libyara/re_lexer.l -+++ b/libyara/re_lexer.l -@@ -261,7 +261,7 @@ hex_digit [0-9a-fA-F] - } - else - { -- yyerror(yyscanner, lex_env, "unexpected end of buffer"); -+ yyerror(yyscanner, lex_env, "illegal escape sequence"); - yyterminate(); - } - } -@@ -312,7 +312,7 @@ hex_digit [0-9a-fA-F] - { - if (!read_escaped_char(yyscanner, &end)) - { -- yyerror(yyscanner, lex_env, "unexpected end of buffer"); -+ yyerror(yyscanner, lex_env, "illegal escape sequence"); - yyterminate(); - } - } -@@ -410,7 +410,7 @@ hex_digit [0-9a-fA-F] - } - else - { -- yyerror(yyscanner, lex_env, "unexpected end of buffer"); -+ yyerror(yyscanner, lex_env, "illegal escape sequence"); - yyterminate(); - } - } -@@ -524,19 +524,19 @@ int read_escaped_char( - text[0] = '\\'; - text[1] = RE_YY_INPUT(yyscanner); - -- if (text[1] == EOF) -+ if (text[1] == EOF || text[1] == 0) - return 0; - - if (text[1] == 'x') - { - text[2] = RE_YY_INPUT(yyscanner); - -- if (text[2] == EOF) -+ if (!isxdigit(text[2])) - return 0; - - text[3] = RE_YY_INPUT(yyscanner); - -- if (text[3] == EOF) -+ if (!isxdigit(text[3])) - return 0; - } - -diff --git a/tests/test-rules.c b/tests/test-rules.c -index 19a0902..d4e8f1c 100644 ---- a/tests/test-rules.c -+++ b/tests/test-rules.c -@@ -1013,6 +1013,12 @@ void test_re() - - // Test case for issue #324 - assert_true_regexp("whatever| x. x", " xy x", " xy x"); -+ -+ // test case for issue #503, \x without two following hex-digits -+ assert_regexp_syntax_error("\\x0"); -+ assert_regexp_syntax_error("\\x"); -+ -+ assert_regexp_syntax_error("\\xxy"); - } - - - -From c869ac16178d10ffdc3d3eeb1931dfb08262525b Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Mon, 23 Jan 2017 18:08:51 +0100 -Subject: [PATCH 28/36] Fix issue #597 - -(cherry picked from commit ab906da53ff2a68c6fd6d1fa73f2b7c7bf0bc636) ---- - libyara/grammar.c | 296 ++++++++++++++++++++++++++++-------------------------- - libyara/grammar.y | 6 ++ - 2 files changed, 157 insertions(+), 145 deletions(-) - -diff --git a/libyara/grammar.c b/libyara/grammar.c -index 9c79512..6d4ba05 100644 ---- a/libyara/grammar.c -+++ b/libyara/grammar.c -@@ -611,14 +611,14 @@ static const yytype_uint16 yyrline[] = - 347, 353, 356, 374, 387, 424, 425, 430, 446, 459, - 472, 485, 502, 503, 509, 508, 524, 523, 539, 553, - 554, 559, 560, 561, 562, 567, 652, 698, 756, 801, -- 802, 806, 831, 867, 913, 935, 944, 953, 968, 980, -- 994, 1007, 1018, 1027, 1057, 1026, 1171, 1170, 1249, 1255, -- 1262, 1261, 1324, 1323, 1384, 1393, 1402, 1411, 1420, 1429, -- 1438, 1442, 1450, 1451, 1456, 1478, 1490, 1506, 1505, 1511, -- 1522, 1523, 1528, 1535, 1546, 1547, 1551, 1559, 1563, 1573, -- 1587, 1603, 1613, 1622, 1647, 1659, 1671, 1687, 1699, 1715, -- 1760, 1779, 1797, 1815, 1833, 1859, 1877, 1887, 1897, 1907, -- 1917, 1927, 1937 -+ 802, 806, 833, 871, 917, 939, 948, 957, 972, 984, -+ 998, 1011, 1022, 1033, 1063, 1032, 1177, 1176, 1255, 1261, -+ 1268, 1267, 1330, 1329, 1390, 1399, 1408, 1417, 1426, 1435, -+ 1444, 1448, 1456, 1457, 1462, 1484, 1496, 1512, 1511, 1517, -+ 1528, 1529, 1534, 1541, 1552, 1553, 1557, 1565, 1569, 1579, -+ 1593, 1609, 1619, 1628, 1653, 1665, 1677, 1693, 1705, 1721, -+ 1766, 1785, 1803, 1821, 1839, 1865, 1883, 1893, 1903, 1913, -+ 1923, 1933, 1943 - }; - #endif - -@@ -2361,15 +2361,17 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - case EXPRESSION_TYPE_REGEXP: - strlcpy((yyval.c_string), "r", MAX_FUNCTION_ARGS); - break; -+ default: -+ assert(FALSE); - } - - ERROR_IF((yyval.c_string) == NULL); - } --#line 2369 "grammar.c" /* yacc.c:1646 */ -+#line 2371 "grammar.c" /* yacc.c:1646 */ - break; - - case 52: --#line 832 "grammar.y" /* yacc.c:1646 */ -+#line 834 "grammar.y" /* yacc.c:1646 */ - { - if (strlen((yyvsp[-2].c_string)) == MAX_FUNCTION_ARGS) - { -@@ -2394,6 +2396,8 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - case EXPRESSION_TYPE_REGEXP: - strlcat((yyvsp[-2].c_string), "r", MAX_FUNCTION_ARGS); - break; -+ default: -+ assert(FALSE); - } - } - -@@ -2401,11 +2405,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.c_string) = (yyvsp[-2].c_string); - } --#line 2405 "grammar.c" /* yacc.c:1646 */ -+#line 2409 "grammar.c" /* yacc.c:1646 */ - break; - - case 53: --#line 868 "grammar.y" /* yacc.c:1646 */ -+#line 872 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string = (yyvsp[0].sized_string); - RE* re; -@@ -2447,11 +2451,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_REGEXP; - } --#line 2451 "grammar.c" /* yacc.c:1646 */ -+#line 2455 "grammar.c" /* yacc.c:1646 */ - break; - - case 54: --#line 914 "grammar.y" /* yacc.c:1646 */ -+#line 918 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type == EXPRESSION_TYPE_STRING) - { -@@ -2470,11 +2474,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2474 "grammar.c" /* yacc.c:1646 */ -+#line 2478 "grammar.c" /* yacc.c:1646 */ - break; - - case 55: --#line 936 "grammar.y" /* yacc.c:1646 */ -+#line 940 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -2483,11 +2487,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2487 "grammar.c" /* yacc.c:1646 */ -+#line 2491 "grammar.c" /* yacc.c:1646 */ - break; - - case 56: --#line 945 "grammar.y" /* yacc.c:1646 */ -+#line 949 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 0, NULL, NULL); -@@ -2496,11 +2500,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2500 "grammar.c" /* yacc.c:1646 */ -+#line 2504 "grammar.c" /* yacc.c:1646 */ - break; - - case 57: --#line 954 "grammar.y" /* yacc.c:1646 */ -+#line 958 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "matches"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_REGEXP, "matches"); -@@ -2515,11 +2519,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2519 "grammar.c" /* yacc.c:1646 */ -+#line 2523 "grammar.c" /* yacc.c:1646 */ - break; - - case 58: --#line 969 "grammar.y" /* yacc.c:1646 */ -+#line 973 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "contains"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "contains"); -@@ -2531,11 +2535,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2535 "grammar.c" /* yacc.c:1646 */ -+#line 2539 "grammar.c" /* yacc.c:1646 */ - break; - - case 59: --#line 981 "grammar.y" /* yacc.c:1646 */ -+#line 985 "grammar.y" /* yacc.c:1646 */ - { - int result = yr_parser_reduce_string_identifier( - yyscanner, -@@ -2549,11 +2553,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2553 "grammar.c" /* yacc.c:1646 */ -+#line 2557 "grammar.c" /* yacc.c:1646 */ - break; - - case 60: --#line 995 "grammar.y" /* yacc.c:1646 */ -+#line 999 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "at"); - -@@ -2566,11 +2570,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2570 "grammar.c" /* yacc.c:1646 */ -+#line 2574 "grammar.c" /* yacc.c:1646 */ - break; - - case 61: --#line 1008 "grammar.y" /* yacc.c:1646 */ -+#line 1012 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-2].c_string), OP_FOUND_IN, UNDEFINED); -@@ -2581,23 +2585,25 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2585 "grammar.c" /* yacc.c:1646 */ -+#line 2589 "grammar.c" /* yacc.c:1646 */ - break; - - case 62: --#line 1019 "grammar.y" /* yacc.c:1646 */ -+#line 1023 "grammar.y" /* yacc.c:1646 */ - { - if (compiler->loop_depth > 0) - { - compiler->loop_depth--; - compiler->loop_identifier[compiler->loop_depth] = NULL; - } -+ -+ YYERROR; - } --#line 2597 "grammar.c" /* yacc.c:1646 */ -+#line 2603 "grammar.c" /* yacc.c:1646 */ - break; - - case 63: --#line 1027 "grammar.y" /* yacc.c:1646 */ -+#line 1033 "grammar.y" /* yacc.c:1646 */ - { - int var_index; - -@@ -2627,11 +2633,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 2631 "grammar.c" /* yacc.c:1646 */ -+#line 2637 "grammar.c" /* yacc.c:1646 */ - break; - - case 64: --#line 1057 "grammar.y" /* yacc.c:1646 */ -+#line 1063 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2666,11 +2672,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = (yyvsp[-4].c_string); - compiler->loop_depth++; - } --#line 2670 "grammar.c" /* yacc.c:1646 */ -+#line 2676 "grammar.c" /* yacc.c:1646 */ - break; - - case 65: --#line 1092 "grammar.y" /* yacc.c:1646 */ -+#line 1098 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2749,11 +2755,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2753 "grammar.c" /* yacc.c:1646 */ -+#line 2759 "grammar.c" /* yacc.c:1646 */ - break; - - case 66: --#line 1171 "grammar.y" /* yacc.c:1646 */ -+#line 1177 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth; - uint8_t* addr; -@@ -2783,11 +2789,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - compiler->loop_identifier[compiler->loop_depth] = NULL; - compiler->loop_depth++; - } --#line 2787 "grammar.c" /* yacc.c:1646 */ -+#line 2793 "grammar.c" /* yacc.c:1646 */ - break; - - case 67: --#line 1201 "grammar.y" /* yacc.c:1646 */ -+#line 1207 "grammar.y" /* yacc.c:1646 */ - { - int mem_offset; - -@@ -2836,31 +2842,31 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - - } --#line 2840 "grammar.c" /* yacc.c:1646 */ -+#line 2846 "grammar.c" /* yacc.c:1646 */ - break; - - case 68: --#line 1250 "grammar.y" /* yacc.c:1646 */ -+#line 1256 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_OF, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2850 "grammar.c" /* yacc.c:1646 */ -+#line 2856 "grammar.c" /* yacc.c:1646 */ - break; - - case 69: --#line 1256 "grammar.y" /* yacc.c:1646 */ -+#line 1262 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit(yyscanner, OP_NOT, NULL); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2860 "grammar.c" /* yacc.c:1646 */ -+#line 2866 "grammar.c" /* yacc.c:1646 */ - break; - - case 70: --#line 1262 "grammar.y" /* yacc.c:1646 */ -+#line 1268 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - void* jmp_destination_addr; -@@ -2886,11 +2892,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2890 "grammar.c" /* yacc.c:1646 */ -+#line 2896 "grammar.c" /* yacc.c:1646 */ - break; - - case 71: --#line 1288 "grammar.y" /* yacc.c:1646 */ -+#line 1294 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* and_addr; -@@ -2926,11 +2932,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2930 "grammar.c" /* yacc.c:1646 */ -+#line 2936 "grammar.c" /* yacc.c:1646 */ - break; - - case 72: --#line 1324 "grammar.y" /* yacc.c:1646 */ -+#line 1330 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - void* jmp_destination_addr; -@@ -2955,11 +2961,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - fixup->next = compiler->fixup_stack_head; - compiler->fixup_stack_head = fixup; - } --#line 2959 "grammar.c" /* yacc.c:1646 */ -+#line 2965 "grammar.c" /* yacc.c:1646 */ - break; - - case 73: --#line 1349 "grammar.y" /* yacc.c:1646 */ -+#line 1355 "grammar.y" /* yacc.c:1646 */ - { - YR_FIXUP* fixup; - uint8_t* or_addr; -@@ -2995,11 +3001,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 2999 "grammar.c" /* yacc.c:1646 */ -+#line 3005 "grammar.c" /* yacc.c:1646 */ - break; - - case 74: --#line 1385 "grammar.y" /* yacc.c:1646 */ -+#line 1391 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3008,11 +3014,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3012 "grammar.c" /* yacc.c:1646 */ -+#line 3018 "grammar.c" /* yacc.c:1646 */ - break; - - case 75: --#line 1394 "grammar.y" /* yacc.c:1646 */ -+#line 1400 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3021,11 +3027,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3025 "grammar.c" /* yacc.c:1646 */ -+#line 3031 "grammar.c" /* yacc.c:1646 */ - break; - - case 76: --#line 1403 "grammar.y" /* yacc.c:1646 */ -+#line 1409 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "<=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3034,11 +3040,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3038 "grammar.c" /* yacc.c:1646 */ -+#line 3044 "grammar.c" /* yacc.c:1646 */ - break; - - case 77: --#line 1412 "grammar.y" /* yacc.c:1646 */ -+#line 1418 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, ">=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3047,11 +3053,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3051 "grammar.c" /* yacc.c:1646 */ -+#line 3057 "grammar.c" /* yacc.c:1646 */ - break; - - case 78: --#line 1421 "grammar.y" /* yacc.c:1646 */ -+#line 1427 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "==", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3060,11 +3066,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3064 "grammar.c" /* yacc.c:1646 */ -+#line 3070 "grammar.c" /* yacc.c:1646 */ - break; - - case 79: --#line 1430 "grammar.y" /* yacc.c:1646 */ -+#line 1436 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "!=", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3073,39 +3079,39 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; - } --#line 3077 "grammar.c" /* yacc.c:1646 */ -+#line 3083 "grammar.c" /* yacc.c:1646 */ - break; - - case 80: --#line 1439 "grammar.y" /* yacc.c:1646 */ -+#line 1445 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3085 "grammar.c" /* yacc.c:1646 */ -+#line 3091 "grammar.c" /* yacc.c:1646 */ - break; - - case 81: --#line 1443 "grammar.y" /* yacc.c:1646 */ -+#line 1449 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3093 "grammar.c" /* yacc.c:1646 */ -+#line 3099 "grammar.c" /* yacc.c:1646 */ - break; - - case 82: --#line 1450 "grammar.y" /* yacc.c:1646 */ -+#line 1456 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_ENUMERATION; } --#line 3099 "grammar.c" /* yacc.c:1646 */ -+#line 3105 "grammar.c" /* yacc.c:1646 */ - break; - - case 83: --#line 1451 "grammar.y" /* yacc.c:1646 */ -+#line 1457 "grammar.y" /* yacc.c:1646 */ - { (yyval.integer) = INTEGER_SET_RANGE; } --#line 3105 "grammar.c" /* yacc.c:1646 */ -+#line 3111 "grammar.c" /* yacc.c:1646 */ - break; - - case 84: --#line 1457 "grammar.y" /* yacc.c:1646 */ -+#line 1463 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[-3].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3123,11 +3129,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3127 "grammar.c" /* yacc.c:1646 */ -+#line 3133 "grammar.c" /* yacc.c:1646 */ - break; - - case 85: --#line 1479 "grammar.y" /* yacc.c:1646 */ -+#line 1485 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3139,11 +3145,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3143 "grammar.c" /* yacc.c:1646 */ -+#line 3149 "grammar.c" /* yacc.c:1646 */ - break; - - case 86: --#line 1491 "grammar.y" /* yacc.c:1646 */ -+#line 1497 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) - { -@@ -3154,77 +3160,77 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3158 "grammar.c" /* yacc.c:1646 */ -+#line 3164 "grammar.c" /* yacc.c:1646 */ - break; - - case 87: --#line 1506 "grammar.y" /* yacc.c:1646 */ -+#line 1512 "grammar.y" /* yacc.c:1646 */ - { - // Push end-of-list marker - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3167 "grammar.c" /* yacc.c:1646 */ -+#line 3173 "grammar.c" /* yacc.c:1646 */ - break; - - case 89: --#line 1512 "grammar.y" /* yacc.c:1646 */ -+#line 1518 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - yr_parser_emit_pushes_for_strings(yyscanner, "$*"); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3178 "grammar.c" /* yacc.c:1646 */ -+#line 3184 "grammar.c" /* yacc.c:1646 */ - break; - - case 92: --#line 1529 "grammar.y" /* yacc.c:1646 */ -+#line 1535 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3189 "grammar.c" /* yacc.c:1646 */ -+#line 3195 "grammar.c" /* yacc.c:1646 */ - break; - - case 93: --#line 1536 "grammar.y" /* yacc.c:1646 */ -+#line 1542 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string)); - yr_free((yyvsp[0].c_string)); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3200 "grammar.c" /* yacc.c:1646 */ -+#line 3206 "grammar.c" /* yacc.c:1646 */ - break; - - case 95: --#line 1548 "grammar.y" /* yacc.c:1646 */ -+#line 1554 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL, NULL); - } --#line 3208 "grammar.c" /* yacc.c:1646 */ -+#line 3214 "grammar.c" /* yacc.c:1646 */ - break; - - case 96: --#line 1552 "grammar.y" /* yacc.c:1646 */ -+#line 1558 "grammar.y" /* yacc.c:1646 */ - { - yr_parser_emit_with_arg(yyscanner, OP_PUSH, 1, NULL, NULL); - } --#line 3216 "grammar.c" /* yacc.c:1646 */ -+#line 3222 "grammar.c" /* yacc.c:1646 */ - break; - - case 97: --#line 1560 "grammar.y" /* yacc.c:1646 */ -+#line 1566 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[-1].expression); - } --#line 3224 "grammar.c" /* yacc.c:1646 */ -+#line 3230 "grammar.c" /* yacc.c:1646 */ - break; - - case 98: --#line 1564 "grammar.y" /* yacc.c:1646 */ -+#line 1570 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit( - yyscanner, OP_FILESIZE, NULL); -@@ -3234,11 +3240,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3238 "grammar.c" /* yacc.c:1646 */ -+#line 3244 "grammar.c" /* yacc.c:1646 */ - break; - - case 99: --#line 1574 "grammar.y" /* yacc.c:1646 */ -+#line 1580 "grammar.y" /* yacc.c:1646 */ - { - yywarning(yyscanner, - "Using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " -@@ -3252,11 +3258,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3256 "grammar.c" /* yacc.c:1646 */ -+#line 3262 "grammar.c" /* yacc.c:1646 */ - break; - - case 100: --#line 1588 "grammar.y" /* yacc.c:1646 */ -+#line 1594 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-1].expression), EXPRESSION_TYPE_INTEGER, "intXXXX or uintXXXX"); - -@@ -3272,11 +3278,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3276 "grammar.c" /* yacc.c:1646 */ -+#line 3282 "grammar.c" /* yacc.c:1646 */ - break; - - case 101: --#line 1604 "grammar.y" /* yacc.c:1646 */ -+#line 1610 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, (yyvsp[0].integer), NULL, NULL); -@@ -3286,11 +3292,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = (yyvsp[0].integer); - } --#line 3290 "grammar.c" /* yacc.c:1646 */ -+#line 3296 "grammar.c" /* yacc.c:1646 */ - break; - - case 102: --#line 1614 "grammar.y" /* yacc.c:1646 */ -+#line 1620 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg_double( - yyscanner, OP_PUSH, (yyvsp[0].double_), NULL, NULL); -@@ -3299,11 +3305,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } --#line 3303 "grammar.c" /* yacc.c:1646 */ -+#line 3309 "grammar.c" /* yacc.c:1646 */ - break; - - case 103: --#line 1623 "grammar.y" /* yacc.c:1646 */ -+#line 1629 "grammar.y" /* yacc.c:1646 */ - { - SIZED_STRING* sized_string; - -@@ -3328,11 +3334,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_STRING; - (yyval.expression).value.sized_string = sized_string; - } --#line 3332 "grammar.c" /* yacc.c:1646 */ -+#line 3338 "grammar.c" /* yacc.c:1646 */ - break; - - case 104: --#line 1648 "grammar.y" /* yacc.c:1646 */ -+#line 1654 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[0].c_string), OP_COUNT, UNDEFINED); -@@ -3344,11 +3350,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3348 "grammar.c" /* yacc.c:1646 */ -+#line 3354 "grammar.c" /* yacc.c:1646 */ - break; - - case 105: --#line 1660 "grammar.y" /* yacc.c:1646 */ -+#line 1666 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_OFFSET, UNDEFINED); -@@ -3360,11 +3366,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3364 "grammar.c" /* yacc.c:1646 */ -+#line 3370 "grammar.c" /* yacc.c:1646 */ - break; - - case 106: --#line 1672 "grammar.y" /* yacc.c:1646 */ -+#line 1678 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3380,11 +3386,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3384 "grammar.c" /* yacc.c:1646 */ -+#line 3390 "grammar.c" /* yacc.c:1646 */ - break; - - case 107: --#line 1688 "grammar.y" /* yacc.c:1646 */ -+#line 1694 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_string_identifier( - yyscanner, (yyvsp[-3].c_string), OP_LENGTH, UNDEFINED); -@@ -3396,11 +3402,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3400 "grammar.c" /* yacc.c:1646 */ -+#line 3406 "grammar.c" /* yacc.c:1646 */ - break; - - case 108: --#line 1700 "grammar.y" /* yacc.c:1646 */ -+#line 1706 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_emit_with_arg( - yyscanner, OP_PUSH, 1, NULL, NULL); -@@ -3416,11 +3422,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = UNDEFINED; - } --#line 3420 "grammar.c" /* yacc.c:1646 */ -+#line 3426 "grammar.c" /* yacc.c:1646 */ - break; - - case 109: --#line 1716 "grammar.y" /* yacc.c:1646 */ -+#line 1722 "grammar.y" /* yacc.c:1646 */ - { - if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) // loop identifier - { -@@ -3465,11 +3471,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3469 "grammar.c" /* yacc.c:1646 */ -+#line 3475 "grammar.c" /* yacc.c:1646 */ - break; - - case 110: --#line 1761 "grammar.y" /* yacc.c:1646 */ -+#line 1767 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT, "-"); - -@@ -3488,11 +3494,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } --#line 3492 "grammar.c" /* yacc.c:1646 */ -+#line 3498 "grammar.c" /* yacc.c:1646 */ - break; - - case 111: --#line 1780 "grammar.y" /* yacc.c:1646 */ -+#line 1786 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "+", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3510,11 +3516,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3514 "grammar.c" /* yacc.c:1646 */ -+#line 3520 "grammar.c" /* yacc.c:1646 */ - break; - - case 112: --#line 1798 "grammar.y" /* yacc.c:1646 */ -+#line 1804 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "-", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3532,11 +3538,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3536 "grammar.c" /* yacc.c:1646 */ -+#line 3542 "grammar.c" /* yacc.c:1646 */ - break; - - case 113: --#line 1816 "grammar.y" /* yacc.c:1646 */ -+#line 1822 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "*", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3554,11 +3560,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3558 "grammar.c" /* yacc.c:1646 */ -+#line 3564 "grammar.c" /* yacc.c:1646 */ - break; - - case 114: --#line 1834 "grammar.y" /* yacc.c:1646 */ -+#line 1840 "grammar.y" /* yacc.c:1646 */ - { - compiler->last_result = yr_parser_reduce_operation( - yyscanner, "\\", (yyvsp[-2].expression), (yyvsp[0].expression)); -@@ -3584,11 +3590,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_FLOAT; - } - } --#line 3588 "grammar.c" /* yacc.c:1646 */ -+#line 3594 "grammar.c" /* yacc.c:1646 */ - break; - - case 115: --#line 1860 "grammar.y" /* yacc.c:1646 */ -+#line 1866 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "%"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "%"); -@@ -3606,11 +3612,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - ERROR_IF(compiler->last_result != ERROR_SUCCESS); - } - } --#line 3610 "grammar.c" /* yacc.c:1646 */ -+#line 3616 "grammar.c" /* yacc.c:1646 */ - break; - - case 116: --#line 1878 "grammar.y" /* yacc.c:1646 */ -+#line 1884 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3620,11 +3626,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(^, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3624 "grammar.c" /* yacc.c:1646 */ -+#line 3630 "grammar.c" /* yacc.c:1646 */ - break; - - case 117: --#line 1888 "grammar.y" /* yacc.c:1646 */ -+#line 1894 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); -@@ -3634,11 +3640,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(&, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3638 "grammar.c" /* yacc.c:1646 */ -+#line 3644 "grammar.c" /* yacc.c:1646 */ - break; - - case 118: --#line 1898 "grammar.y" /* yacc.c:1646 */ -+#line 1904 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "|"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "|"); -@@ -3648,11 +3654,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(|, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3652 "grammar.c" /* yacc.c:1646 */ -+#line 3658 "grammar.c" /* yacc.c:1646 */ - break; - - case 119: --#line 1908 "grammar.y" /* yacc.c:1646 */ -+#line 1914 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "~"); - -@@ -3662,11 +3668,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == UNDEFINED) ? - UNDEFINED : ~((yyvsp[0].expression).value.integer); - } --#line 3666 "grammar.c" /* yacc.c:1646 */ -+#line 3672 "grammar.c" /* yacc.c:1646 */ - break; - - case 120: --#line 1918 "grammar.y" /* yacc.c:1646 */ -+#line 1924 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "<<"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "<<"); -@@ -3676,11 +3682,11 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(<<, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3680 "grammar.c" /* yacc.c:1646 */ -+#line 3686 "grammar.c" /* yacc.c:1646 */ - break; - - case 121: --#line 1928 "grammar.y" /* yacc.c:1646 */ -+#line 1934 "grammar.y" /* yacc.c:1646 */ - { - CHECK_TYPE((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, ">>"); - CHECK_TYPE((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, ">>"); -@@ -3690,19 +3696,19 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - (yyval.expression).type = EXPRESSION_TYPE_INTEGER; - (yyval.expression).value.integer = OPERATION(>>, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); - } --#line 3694 "grammar.c" /* yacc.c:1646 */ -+#line 3700 "grammar.c" /* yacc.c:1646 */ - break; - - case 122: --#line 1938 "grammar.y" /* yacc.c:1646 */ -+#line 1944 "grammar.y" /* yacc.c:1646 */ - { - (yyval.expression) = (yyvsp[0].expression); - } --#line 3702 "grammar.c" /* yacc.c:1646 */ -+#line 3708 "grammar.c" /* yacc.c:1646 */ - break; - - --#line 3706 "grammar.c" /* yacc.c:1646 */ -+#line 3712 "grammar.c" /* yacc.c:1646 */ - default: break; - } - /* User semantic actions sometimes alter yychar, and that requires -@@ -3930,5 +3936,5 @@ YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); - #endif - return yyresult; - } --#line 1943 "grammar.y" /* yacc.c:1906 */ -+#line 1949 "grammar.y" /* yacc.c:1906 */ - -diff --git a/libyara/grammar.y b/libyara/grammar.y -index addb55d..9cb4be7 100644 ---- a/libyara/grammar.y -+++ b/libyara/grammar.y -@@ -824,6 +824,8 @@ arguments_list - case EXPRESSION_TYPE_REGEXP: - strlcpy($$, "r", MAX_FUNCTION_ARGS); - break; -+ default: -+ assert(FALSE); - } - - ERROR_IF($$ == NULL); -@@ -853,6 +855,8 @@ arguments_list - case EXPRESSION_TYPE_REGEXP: - strlcat($1, "r", MAX_FUNCTION_ARGS); - break; -+ default: -+ assert(FALSE); - } - } - -@@ -1022,6 +1026,8 @@ expression - compiler->loop_depth--; - compiler->loop_identifier[compiler->loop_depth] = NULL; - } -+ -+ YYERROR; - } - | _FOR_ for_expression _IDENTIFIER_ _IN_ - { - -From e91ceb150bd55d3249b0b523a3ce454f8dec5e81 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Tue, 7 Feb 2017 11:34:49 +0100 -Subject: [PATCH 29/36] Fix detection of bswap compiler features in endian.h - -Cherry picked from commits - -- 764f33dd04135f8d3f9428c8f9bed213494d538f -- 16c3dd1215ea013bf472820878e22aaaab0fd8cd -- ca3927fcebb85c429231087ef796753a37d5b079 -- 0541a7932517364f5ec042af710ce48f92f6e5bd ---- - libyara/Makefile.am | 1 + - libyara/endian.c | 53 +++++++++++++++++++++++++++++++++++++++ - libyara/include/yara/endian.h | 58 +++++++++++++++++++++++++++++++++++-------- - 3 files changed, 102 insertions(+), 10 deletions(-) - create mode 100644 libyara/endian.c - -diff --git a/libyara/Makefile.am b/libyara/Makefile.am -index 20dbe4a..6861843 100644 ---- a/libyara/Makefile.am -+++ b/libyara/Makefile.am -@@ -73,6 +73,7 @@ libyara_la_SOURCES = \ - arena.c \ - atoms.c \ - compiler.c \ -+ endian.c \ - exec.c \ - exefiles.c \ - exefiles.h \ -diff --git a/libyara/endian.c b/libyara/endian.c -new file mode 100644 -index 0000000..02fff63 ---- /dev/null -+++ b/libyara/endian.c -@@ -0,0 +1,53 @@ -+/* -+Copyright (c) 2017. The YARA Authors. All Rights Reserved. -+ -+Redistribution and use in source and binary forms, with or without modification, -+are permitted provided that the following conditions are met: -+ -+1. Redistributions of source code must retain the above copyright notice, this -+list of conditions and the following disclaimer. -+ -+2. Redistributions in binary form must reproduce the above copyright notice, -+this list of conditions and the following disclaimer in the documentation and/or -+other materials provided with the distribution. -+ -+3. Neither the name of the copyright holder nor the names of its contributors -+may be used to endorse or promote products derived from this software without -+specific prior written permission. -+ -+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -+*/ -+ -+#include -+ -+uint16_t _yr_bswap16(uint16_t x) -+{ -+ return (x >> 8 | x << 8); -+} -+ -+uint32_t _yr_bswap32(uint32_t x) -+{ -+ return ((((x) & 0xff000000) >> 24) | (((x) & 0x00ff0000) >> 8) | -+ (((x) & 0x0000ff00) << 8) | (((x) & 0x000000ff) << 24)); -+} -+ -+uint64_t _yr_bswap64(uint64_t x) -+{ -+ return ((((x) & 0xff00000000000000ull) >> 56) -+ | (((x) & 0x00ff000000000000ull) >> 40) -+ | (((x) & 0x0000ff0000000000ull) >> 24) -+ | (((x) & 0x000000ff00000000ull) >> 8) -+ | (((x) & 0x00000000ff000000ull) << 8) -+ | (((x) & 0x0000000000ff0000ull) << 24) -+ | (((x) & 0x000000000000ff00ull) << 40) -+ | (((x) & 0x00000000000000ffull) << 56)); -+} -diff --git a/libyara/include/yara/endian.h b/libyara/include/yara/endian.h -index 06d8c14..8d75012 100644 ---- a/libyara/include/yara/endian.h -+++ b/libyara/include/yara/endian.h -@@ -30,20 +30,58 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #ifndef YR_ENDIAN_H - #define YR_ENDIAN_H - -+#include - #include - --#if defined(__GNUC__) --#define yr_bswap16(x) __builtin_bswap16(x) --#define yr_bswap32(x) __builtin_bswap32(x) --#define yr_bswap64(x) __builtin_bswap64(x) --#elif defined(_MSC_VER) --#define yr_bswap16(x) _byteswap_ushort(x) --#define yr_bswap32(x) _byteswap_ulong(x) --#define yr_bswap64(x) _byteswap_uint64(x) --#else --#error Unknown compiler: Add yr_bswap* definitions -+ -+#if defined(__has_builtin) -+# if __has_builtin(__builtin_bswap16) -+# define yr_bswap16(x) __builtin_bswap16(x) -+# endif -+#endif -+ -+#if !defined(yr_bswap16) && defined(_MSC_VER) -+# define yr_bswap16(x) _byteswap_ushort(x) -+#endif -+ -+#if !defined(yr_bswap16) -+uint16_t _yr_bswap16(uint16_t x); -+# define yr_bswap16(x) _yr_bswap16(x) -+#endif -+ -+ -+#if defined(__has_builtin) -+# if __has_builtin(__builtin_bswap32) -+# define yr_bswap32(x) __builtin_bswap32(x) -+# endif -+#endif -+ -+#if !defined(yr_bswap32) && defined(_MSC_VER) -+# define yr_bswap32(x) _byteswap_ulong(x) - #endif - -+#if !defined(yr_bswap32) -+uint32_t _yr_bswap32(uint32_t x); -+#define yr_bswap32(x) _yr_bswap32(x) -+#endif -+ -+ -+#if defined(__has_builtin) -+# if __has_builtin(__builtin_bswap64) -+# define yr_bswap64(x) __builtin_bswap64(x) -+# endif -+#endif -+ -+#if !defined(yr_bswap64) && defined(_MSC_VER) -+# define yr_bswap64(x) _byteswap_uint64(x) -+#endif -+ -+#if !defined(yr_bswap64) -+uint64_t _yr_bswap64(uint64_t x); -+#define yr_bswap64(x) _yr_bswap64(x) -+#endif -+ -+ - #if defined(WORDS_BIGENDIAN) - #define yr_le16toh(x) yr_bswap16(x) - #define yr_le32toh(x) yr_bswap32(x) - -From ac82bbe68bf640658eb0d558dfc929c5fb54dfa3 Mon Sep 17 00:00:00 2001 -From: Jacob Baines -Date: Wed, 15 Feb 2017 03:36:45 -0500 -Subject: [PATCH 30/36] Fix endian issues with section name extraction (#607) - -(cherry picked from commit 0e2c3a7cf35639a369e4e86d82227de67668bdae) ---- - libyara/modules/elf.c | 3 +- - tests/blob.h | 155 ++++++++++++++++++++++++++++++++++++++++++++++++++ - tests/test-elf.c | 21 +++++++ - 3 files changed, 178 insertions(+), 1 deletion(-) - -diff --git a/libyara/modules/elf.c b/libyara/modules/elf.c -index dff586e..c6ee384 100644 ---- a/libyara/modules/elf.c -+++ b/libyara/modules/elf.c -@@ -164,7 +164,8 @@ void parse_elf_header_##bits##_##bo( \ - section = (elf##bits##_section_header_t*) \ - ((uint8_t*) elf + yr_##bo##bits##toh(elf->sh_offset)); \ - \ -- if (section[yr_##bo##16toh(elf->sh_str_table_index)].offset < elf_size) \ -+ if (yr_##bo##bits##toh( \ -+ section[yr_##bo##16toh(elf->sh_str_table_index)].offset) < elf_size) \ - { \ - str_table = (char*) elf + yr_##bo##bits##toh( \ - section[yr_##bo##16toh(elf->sh_str_table_index)].offset); \ -diff --git a/tests/blob.h b/tests/blob.h -index 08bf5b6..1659a91 100644 ---- a/tests/blob.h -+++ b/tests/blob.h -@@ -178,3 +178,158 @@ uint8_t ELF64_FILE[] = { - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }; -+ -+uint8_t ELF32_MIPS_FILE[] = { -+ 0x7f, 0x45, 0x4c, 0x46, 0x01, 0x02, 0x01, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x02, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x40, 0x00, 0xd0, 0x00, 0x00, 0x00, 0x34, -+ 0x00, 0x00, 0x03, 0x04, 0x00, 0x00, 0x10, 0x07, -+ 0x00, 0x34, 0x00, 0x20, 0x00, 0x03, 0x00, 0x28, -+ 0x00, 0x0b, 0x00, 0x08, 0x70, 0x00, 0x00, 0x03, -+ 0x00, 0x00, 0x00, 0x98, 0x00, 0x40, 0x00, 0x98, -+ 0x00, 0x40, 0x00, 0x98, 0x00, 0x00, 0x00, 0x18, -+ 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x04, -+ 0x00, 0x00, 0x00, 0x08, 0x70, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0xb0, 0x00, 0x40, 0x00, 0xb0, -+ 0x00, 0x40, 0x00, 0xb0, 0x00, 0x00, 0x00, 0x18, -+ 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x04, -+ 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, -+ 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, -+ 0x00, 0x00, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x05, -+ 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x80, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0x80, 0xd0, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0xe0, 0x00, 0x08, 0x24, 0x02, 0x00, 0x2a, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x47, 0x43, 0x43, 0x3a, 0x20, 0x28, 0x47, 0x4e, -+ 0x55, 0x29, 0x20, 0x35, 0x2e, 0x33, 0x2e, 0x30, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0xd0, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1d, -+ 0x00, 0x00, 0x00, 0x1f, 0x41, 0x00, 0x00, 0x00, -+ 0x0f, 0x67, 0x6e, 0x75, 0x00, 0x01, 0x00, 0x00, -+ 0x00, 0x07, 0x04, 0x01, 0x00, 0x2e, 0x73, 0x79, -+ 0x6d, 0x74, 0x61, 0x62, 0x00, 0x2e, 0x73, 0x74, -+ 0x72, 0x74, 0x61, 0x62, 0x00, 0x2e, 0x73, 0x68, -+ 0x73, 0x74, 0x72, 0x74, 0x61, 0x62, 0x00, 0x2e, -+ 0x4d, 0x49, 0x50, 0x53, 0x2e, 0x61, 0x62, 0x69, -+ 0x66, 0x6c, 0x61, 0x67, 0x73, 0x00, 0x2e, 0x72, -+ 0x65, 0x67, 0x69, 0x6e, 0x66, 0x6f, 0x00, 0x2e, -+ 0x74, 0x65, 0x78, 0x74, 0x00, 0x2e, 0x63, 0x6f, -+ 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x00, 0x2e, 0x70, -+ 0x64, 0x72, 0x00, 0x2e, 0x67, 0x6e, 0x75, 0x2e, -+ 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, -+ 0x65, 0x73, 0x00, 0x2e, 0x6d, 0x64, 0x65, 0x62, -+ 0x75, 0x67, 0x2e, 0x61, 0x62, 0x69, 0x33, 0x32, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x40, 0x00, 0x98, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x40, 0x00, 0xb0, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x40, 0x00, 0xd0, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x04, 0x00, 0xff, 0xf1, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x04, 0x00, 0xff, 0xf1, 0x00, 0x00, 0x00, 0x08, -+ 0x00, 0x41, 0x80, 0xd0, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0xff, 0xf1, 0x00, 0x00, 0x00, 0x0c, -+ 0x00, 0x41, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x13, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1b, -+ 0x00, 0x40, 0x00, 0xd0, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x22, -+ 0x00, 0x41, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x2e, -+ 0x00, 0x40, 0x00, 0xd0, 0x00, 0x00, 0x00, 0x08, -+ 0x12, 0x02, 0x00, 0x03, 0x00, 0x00, 0x00, 0x33, -+ 0x00, 0x41, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x3a, -+ 0x00, 0x41, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x3f, -+ 0x00, 0x41, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x03, 0x00, 0x6d, 0x61, 0x69, -+ 0x6e, 0x2e, 0x63, 0x00, 0x5f, 0x67, 0x70, 0x00, -+ 0x5f, 0x66, 0x64, 0x61, 0x74, 0x61, 0x00, 0x5f, -+ 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x00, 0x5f, -+ 0x66, 0x74, 0x65, 0x78, 0x74, 0x00, 0x5f, 0x5f, -+ 0x62, 0x73, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x72, -+ 0x74, 0x00, 0x6d, 0x61, 0x69, 0x6e, 0x00, 0x5f, -+ 0x65, 0x64, 0x61, 0x74, 0x61, 0x00, 0x5f, 0x65, -+ 0x6e, 0x64, 0x00, 0x5f, 0x66, 0x62, 0x73, 0x73, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1b, -+ 0x70, 0x00, 0x00, 0x2a, 0x00, 0x00, 0x00, 0x02, -+ 0x00, 0x40, 0x00, 0x98, 0x00, 0x00, 0x00, 0x98, -+ 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, -+ 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x2a, -+ 0x70, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x02, -+ 0x00, 0x40, 0x00, 0xb0, 0x00, 0x00, 0x00, 0xb0, -+ 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, -+ 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x33, -+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x06, -+ 0x00, 0x40, 0x00, 0xd0, 0x00, 0x00, 0x00, 0xd0, -+ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x39, -+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x30, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, -+ 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x42, -+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf4, -+ 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, -+ 0x6f, 0xff, 0xff, 0xf5, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x14, -+ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, -+ 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x24, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, -+ 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x24, -+ 0x00, 0x00, 0x00, 0x65, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x8c, -+ 0x00, 0x00, 0x01, 0x30, 0x00, 0x00, 0x00, 0x0a, -+ 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x04, -+ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x09, -+ 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xbc, -+ 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0x00, 0x00 -+}; -\ No newline at end of file -diff --git a/tests/test-elf.c b/tests/test-elf.c -index 8d13b47..6415933 100644 ---- a/tests/test-elf.c -+++ b/tests/test-elf.c -@@ -24,6 +24,27 @@ int main(int argc, char** argv) - condition: $a at elf.entry_point }", - ELF64_FILE); - -+ assert_true_rule_blob("import \"elf\" rule test { \ -+ condition: elf.sections[2].name == \".comment\" }", ELF64_FILE); -+ -+ assert_true_rule_blob("import \"elf\" rule test { \ -+ condition: elf.machine == elf.EM_MIPS }", ELF32_MIPS_FILE); -+ -+ assert_true_rule_blob("import \"elf\" rule test { \ -+ condition: elf.number_of_sections == 11 and \ -+ elf.number_of_segments == 3 }", ELF32_MIPS_FILE); -+ -+ assert_true_rule_blob("import \"elf\" rule test { \ -+ condition: for any i in (0..elf.number_of_sections): ( \ -+ elf.sections[i].type == elf.SHT_PROGBITS and \ -+ elf.sections[i].name == \".text\")}", ELF32_MIPS_FILE); -+ -+ assert_true_rule_blob("import \"elf\" rule test { \ -+ condition: for any i in (0..elf.number_of_segments): ( \ -+ elf.segments[i].type == elf.PT_LOAD and \ -+ elf.segments[i].virtual_address == 0x00400000 and \ -+ elf.segments[i].file_size == 0xe0)}", ELF32_MIPS_FILE); -+ - yr_finalize(); - return 0; - } - -From 5daf58f4f5b98f4aeb33c60a70b7abec4f13f9b8 Mon Sep 17 00:00:00 2001 -From: Jacob Baines -Date: Wed, 15 Feb 2017 03:50:18 -0500 -Subject: [PATCH 31/36] Use the program headers to determine the physical - offset of the ELF entry point (#606) - -(cherry picked from commit 8fc561b50121227b78baa85fd0d56482655c290d) ---- - libyara/exefiles.c | 189 ++++++++++----- - libyara/modules/elf.c | 100 +++++--- - tests/blob.h | 625 +++++++++++++++++++++++++++++++++++++++++++++++++- - tests/test-elf.c | 7 +- - 4 files changed, 834 insertions(+), 87 deletions(-) - -diff --git a/libyara/exefiles.c b/libyara/exefiles.c -index 05d1de7..293b905 100644 ---- a/libyara/exefiles.c -+++ b/libyara/exefiles.c -@@ -150,54 +150,95 @@ int yr_get_elf_type( - } - - --uint64_t yr_elf_rva_to_offset_32( -+static uint64_t yr_elf_rva_to_offset_32( - elf32_header_t* elf_header, - uint64_t rva, - size_t buffer_length) - { -- int i; -- elf32_section_header_t* section; -+ // if the binary is an executable then prefer the program headers to resolve -+ // the offset -+ if (elf_header->type == ELF_ET_EXEC) -+ { -+ int i; -+ elf32_program_header_t* program; -+ if (elf_header->ph_offset == 0 || elf_header->ph_entry_count == 0) -+ return 0; - -- if (elf_header->sh_offset == 0 || elf_header->sh_entry_count == 0) -- return 0; -+ // check to prevent integer wraps -+ if (ULONG_MAX - yr_le16toh(elf_header->ph_entry_count) < -+ sizeof(elf32_program_header_t) * yr_le16toh(elf_header->ph_entry_count)) -+ return 0; - -- // check to prevent integer wraps -+ // check that 'ph_offset' doesn't wrap when added to the -+ // size of entries. -+ if(ULONG_MAX - yr_le32toh(elf_header->ph_offset) < -+ sizeof(elf32_program_header_t) * yr_le16toh(elf_header->ph_entry_count)) -+ return 0; - -- if (ULONG_MAX - yr_le16toh(elf_header->sh_entry_count) < -- sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) -- return 0; -+ // ensure we don't exceed the buffer size -+ if (yr_le32toh(elf_header->ph_offset) + sizeof(elf32_program_header_t) * -+ yr_le16toh(elf_header->ph_entry_count) > buffer_length) -+ return 0; - -- // check that 'sh_offset' doesn't wrap when added to the -- // size of entries. -+ program = (elf32_program_header_t*) -+ ((uint8_t*) elf_header + yr_le32toh(elf_header->ph_offset)); - -- if (ULONG_MAX - yr_le32toh(elf_header->sh_offset) < -- sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) -- return 0; -+ for (i = 0; i < yr_le16toh(elf_header->ph_entry_count); i++) -+ { -+ if (rva >= yr_le32toh(program->virt_addr) && -+ rva < yr_le32toh(program->virt_addr) + yr_le32toh(program->mem_size)) -+ { -+ return yr_le32toh(program->offset) + (rva - yr_le32toh(program->virt_addr)); -+ } - -- if (yr_le32toh(elf_header->sh_offset) + \ -- sizeof(elf32_section_header_t) * \ -- yr_le16toh(elf_header->sh_entry_count) > buffer_length) -- return 0; -+ program++; -+ } -+ } -+ else -+ { -+ int i; -+ elf32_section_header_t* section; -+ -+ if (elf_header->sh_offset == 0 || elf_header->sh_entry_count == 0) -+ return 0; -+ -+ // check to prevent integer wraps - -- section = (elf32_section_header_t*) \ -+ if (ULONG_MAX - yr_le16toh(elf_header->sh_entry_count) < -+ sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) -+ return 0; -+ -+ // check that 'sh_offset' doesn't wrap when added to the -+ // size of entries. -+ -+ if (ULONG_MAX - yr_le32toh(elf_header->sh_offset) < -+ sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) -+ return 0; -+ -+ if (yr_le32toh(elf_header->sh_offset) + sizeof(elf32_section_header_t) * -+ yr_le16toh(elf_header->sh_entry_count) > buffer_length) -+ return 0; -+ -+ section = (elf32_section_header_t*) - ((unsigned char*) elf_header + yr_le32toh(elf_header->sh_offset)); - -- for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) -- { -- if (yr_le32toh(section->type) != ELF_SHT_NULL && -- yr_le32toh(section->type) != ELF_SHT_NOBITS && -- rva >= yr_le32toh(section->addr) && -- rva < yr_le32toh(section->addr) + yr_le32toh(section->size)) -+ for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) - { -- // prevent integer wrapping with the return value -+ if (yr_le32toh(section->type) != ELF_SHT_NULL && -+ yr_le32toh(section->type) != ELF_SHT_NOBITS && -+ rva >= yr_le32toh(section->addr) && -+ rva < yr_le32toh(section->addr) + yr_le32toh(section->size)) -+ { -+ // prevent integer wrapping with the return value - -- if (ULONG_MAX - yr_le32toh(section->offset) < (rva - yr_le32toh(section->addr))) -- return 0; -- else -- return yr_le32toh(section->offset) + (rva - yr_le32toh(section->addr)); -- } -+ if (ULONG_MAX - yr_le32toh(section->offset) < (rva - yr_le32toh(section->addr))) -+ return 0; -+ else -+ return yr_le32toh(section->offset) + (rva - yr_le32toh(section->addr)); -+ } - -- section++; -+ section++; -+ } - } - - return 0; -@@ -205,42 +246,78 @@ uint64_t yr_elf_rva_to_offset_32( - } - - --uint64_t yr_elf_rva_to_offset_64( -+static uint64_t yr_elf_rva_to_offset_64( - elf64_header_t* elf_header, - uint64_t rva, - size_t buffer_length) - { -- int i; -- elf64_section_header_t* section; -+ // if the binary is an executable then prefer the program headers to resolve -+ // the offset -+ if (elf_header->type == ELF_ET_EXEC) -+ { -+ int i; -+ elf64_program_header_t* program; -+ if (elf_header->ph_offset == 0 || elf_header->ph_entry_count == 0) -+ return 0; - -- if (elf_header->sh_offset == 0 || elf_header->sh_entry_count == 0) -- return 0; -+ // check that 'ph_offset' doesn't wrap when added to the -+ // size of entries. -+ if(ULONG_MAX - yr_le64toh(elf_header->ph_offset) < -+ sizeof(elf64_program_header_t) * yr_le16toh(elf_header->ph_entry_count)) -+ return 0; - -- // check that 'sh_offset' doesn't wrap when added to the -- // size of entries. -- if(ULONG_MAX - yr_le64toh(elf_header->sh_offset) < -- sizeof(elf64_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) -- return 0; -+ // ensure we don't exceed the buffer size -+ if (yr_le64toh(elf_header->ph_offset) + sizeof(elf64_program_header_t) * -+ yr_le16toh(elf_header->ph_entry_count) > buffer_length) -+ return 0; - -- if (yr_le64toh(elf_header->sh_offset) + \ -- sizeof(elf64_section_header_t) * \ -- yr_le16toh(elf_header->sh_entry_count) > buffer_length) -- return 0; -+ program = (elf64_program_header_t*) -+ ((uint8_t*) elf_header + yr_le64toh(elf_header->ph_offset)); - -- section = (elf64_section_header_t*) \ -- ((uint8_t*) elf_header + yr_le64toh(elf_header->sh_offset)); -+ for (i = 0; i < yr_le16toh(elf_header->ph_entry_count); i++) -+ { -+ if (rva >= yr_le64toh(program->virt_addr) && -+ rva < yr_le64toh(program->virt_addr) + yr_le64toh(program->mem_size)) -+ { -+ return yr_le64toh(program->offset) + (rva - yr_le64toh(program->virt_addr)); -+ } - -- for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) -+ program++; -+ } -+ } -+ else - { -- if (yr_le32toh(section->type) != ELF_SHT_NULL && -- yr_le32toh(section->type) != ELF_SHT_NOBITS && -- rva >= yr_le64toh(section->addr) && -- rva < yr_le64toh(section->addr) + yr_le64toh(section->size)) -+ int i; -+ elf64_section_header_t* section; -+ -+ if (elf_header->sh_offset == 0 || elf_header->sh_entry_count == 0) -+ return 0; -+ -+ // check that 'sh_offset' doesn't wrap when added to the -+ // size of entries. -+ if(ULONG_MAX - yr_le64toh(elf_header->sh_offset) < -+ sizeof(elf64_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) -+ return 0; -+ -+ if (yr_le64toh(elf_header->sh_offset) + sizeof(elf64_section_header_t) * -+ yr_le16toh(elf_header->sh_entry_count) > buffer_length) -+ return 0; -+ -+ section = (elf64_section_header_t*) -+ ((uint8_t*) elf_header + yr_le64toh(elf_header->sh_offset)); -+ -+ for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) - { -- return yr_le64toh(section->offset) + (rva - yr_le64toh(section->addr)); -- } -+ if (yr_le32toh(section->type) != ELF_SHT_NULL && -+ yr_le32toh(section->type) != ELF_SHT_NOBITS && -+ rva >= yr_le64toh(section->addr) && -+ rva < yr_le64toh(section->addr) + yr_le64toh(section->size)) -+ { -+ return yr_le64toh(section->offset) + (rva - yr_le64toh(section->addr)); -+ } - -- section++; -+ section++; -+ } - } - - return 0; -diff --git a/libyara/modules/elf.c b/libyara/modules/elf.c -index c6ee384..8ea6c94 100644 ---- a/libyara/modules/elf.c -+++ b/libyara/modules/elf.c -@@ -63,7 +63,8 @@ int get_elf_class_data( - #define ELF_SIZE_OF_SECTION_TABLE(bits,bo,h) \ - (sizeof(elf##bits##_section_header_t) * yr_##bo##16toh(h->sh_entry_count)) - -- -+#define ELF_SIZE_OF_PROGRAM_TABLE(bits,bo,h) \ -+ (sizeof(elf##bits##_program_header_t) * yr_##bo##16toh(h->ph_entry_count)) - - #define ELF_RVA_TO_OFFSET(bits,bo) \ - uint64_t elf_rva_to_offset_##bits##_##bo( \ -@@ -71,45 +72,86 @@ uint64_t elf_rva_to_offset_##bits##_##bo( \ - uint64_t rva, \ - size_t elf_size) \ - { \ -- int i; \ -+ if (elf_header->type == ELF_ET_EXEC) \ -+ { \ -+ int i; \ - \ -- elf##bits##_section_header_t* section; \ -+ elf##bits##_program_header_t* program; \ - \ -- /* check that sh_offset doesn't wrap when added to SIZE_OF_SECTION_TABLE */ \ -+ /* check that ph_offset doesn't wrap when added to SIZE_OF_PROGRAM_TABLE */\ - \ -- if(ULONG_MAX - yr_##bo##bits##toh(elf_header->sh_offset) < \ -- ELF_SIZE_OF_SECTION_TABLE(bits,bo,elf_header)) \ -- { \ -- return UNDEFINED; \ -- } \ -+ if(ULONG_MAX - yr_##bo##bits##toh(elf_header->ph_offset) < \ -+ ELF_SIZE_OF_PROGRAM_TABLE(bits,bo,elf_header)) \ -+ { \ -+ return UNDEFINED; \ -+ } \ - \ -- if (yr_##bo##bits##toh(elf_header->sh_offset) == 0 || \ -- yr_##bo##bits##toh(elf_header->sh_offset) > elf_size || \ -- yr_##bo##bits##toh(elf_header->sh_offset) + \ -- ELF_SIZE_OF_SECTION_TABLE(bits,bo,elf_header) > elf_size || \ -- yr_##bo##16toh(elf_header->sh_entry_count) == 0) \ -- { \ -- return UNDEFINED; \ -- } \ -+ if (yr_##bo##bits##toh(elf_header->ph_offset) == 0 || \ -+ yr_##bo##bits##toh(elf_header->ph_offset) > elf_size || \ -+ yr_##bo##bits##toh(elf_header->ph_offset) + \ -+ ELF_SIZE_OF_PROGRAM_TABLE(bits,bo,elf_header) > elf_size || \ -+ yr_##bo##16toh(elf_header->ph_entry_count) == 0) \ -+ { \ -+ return UNDEFINED; \ -+ } \ - \ -- section = (elf##bits##_section_header_t*) \ -- ((uint8_t*) elf_header + yr_##bo##bits##toh(elf_header->sh_offset)); \ -+ program = (elf##bits##_program_header_t*) \ -+ ((uint8_t*) elf_header + yr_##bo##bits##toh(elf_header->ph_offset)); \ - \ -- for (i = 0; i < yr_##bo##16toh(elf_header->sh_entry_count); i++) \ -+ for (i = 0; i < yr_##bo##16toh(elf_header->ph_entry_count); i++) \ -+ { \ -+ if (rva >= yr_##bo##bits##toh(program->virt_addr) && \ -+ rva < yr_##bo##bits##toh(program->virt_addr) + \ -+ yr_##bo##bits##toh(program->mem_size)) \ -+ { \ -+ return yr_##bo##bits##toh(program->offset) + \ -+ (rva - yr_##bo##bits##toh(program->virt_addr)); \ -+ } \ -+ \ -+ program++; \ -+ } \ -+ } \ -+ else \ - { \ -- if (yr_##bo##32toh(section->type) != ELF_SHT_NULL && \ -- yr_##bo##32toh(section->type) != ELF_SHT_NOBITS && \ -- rva >= yr_##bo##bits##toh(section->addr) && \ -- rva < yr_##bo##bits##toh(section->addr) + \ -- yr_##bo##bits##toh(section->size)) \ -+ int i; \ -+ \ -+ elf##bits##_section_header_t* section; \ -+ \ -+ /* check that sh_offset doesn't wrap when added to SIZE_OF_SECTION_TABLE */\ -+ \ -+ if(ULONG_MAX - yr_##bo##bits##toh(elf_header->sh_offset) < \ -+ ELF_SIZE_OF_SECTION_TABLE(bits,bo,elf_header)) \ - { \ -- return yr_##bo##bits##toh(section->offset) + \ -- (rva - yr_##bo##bits##toh(section->addr)); \ -+ return UNDEFINED; \ - } \ - \ -- section++; \ -- } \ -+ if (yr_##bo##bits##toh(elf_header->sh_offset) == 0 || \ -+ yr_##bo##bits##toh(elf_header->sh_offset) > elf_size || \ -+ yr_##bo##bits##toh(elf_header->sh_offset) + \ -+ ELF_SIZE_OF_SECTION_TABLE(bits,bo,elf_header) > elf_size || \ -+ yr_##bo##16toh(elf_header->sh_entry_count) == 0) \ -+ { \ -+ return UNDEFINED; \ -+ } \ -+ \ -+ section = (elf##bits##_section_header_t*) \ -+ ((uint8_t*) elf_header + yr_##bo##bits##toh(elf_header->sh_offset)); \ - \ -+ for (i = 0; i < yr_##bo##16toh(elf_header->sh_entry_count); i++) \ -+ { \ -+ if (yr_##bo##32toh(section->type) != ELF_SHT_NULL && \ -+ yr_##bo##32toh(section->type) != ELF_SHT_NOBITS && \ -+ rva >= yr_##bo##bits##toh(section->addr) && \ -+ rva < yr_##bo##bits##toh(section->addr) + \ -+ yr_##bo##bits##toh(section->size)) \ -+ { \ -+ return yr_##bo##bits##toh(section->offset) + \ -+ (rva - yr_##bo##bits##toh(section->addr)); \ -+ } \ -+ \ -+ section++; \ -+ } \ -+ } \ - return UNDEFINED; \ - } - -diff --git a/tests/blob.h b/tests/blob.h -index 1659a91..d7a617a 100644 ---- a/tests/blob.h -+++ b/tests/blob.h -@@ -179,6 +179,628 @@ uint8_t ELF64_FILE[] = { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }; - -+ -+uint8_t ELF32_NOSECTIONS[] = { -+ 0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0xa0, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x34, 0x00, 0x20, 0x00, 0x02, 0x00, 0x28, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x04, 0x08, -+ 0x00, 0x80, 0x04, 0x08, 0xac, 0x00, 0x00, 0x00, -+ 0xac, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, -+ 0x00, 0x10, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x74, 0x00, 0x00, 0x00, 0x74, 0x80, 0x04, 0x08, -+ 0x74, 0x80, 0x04, 0x08, 0x24, 0x00, 0x00, 0x00, -+ 0x24, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x04, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x14, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, -+ 0x47, 0x4e, 0x55, 0x00, 0x72, 0x5c, 0x33, 0xa6, -+ 0xcd, 0xed, 0x46, 0xf2, 0xc7, 0xa2, 0x8c, 0x1f, -+ 0xbd, 0x65, 0x7a, 0xd1, 0x9f, 0x0f, 0x51, 0x80, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0xb8, 0x01, 0x00, 0x00, 0x00, 0xbb, 0x2a, 0x00, -+ 0x00, 0x00, 0xcd, 0x80, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+uint8_t ELF32_SHAREDOBJ[] = { -+ 0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0xa0, 0x01, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, -+ 0x54, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x34, 0x00, 0x20, 0x00, 0x05, 0x00, 0x28, 0x00, -+ 0x09, 0x00, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0xac, 0x01, 0x00, 0x00, -+ 0xac, 0x01, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, -+ 0x00, 0x10, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0xa8, 0x0f, 0x00, 0x00, 0xa8, 0x1f, 0x00, 0x00, -+ 0xa8, 0x1f, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, -+ 0x58, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, -+ 0x00, 0x10, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, -+ 0xa8, 0x0f, 0x00, 0x00, 0xa8, 0x1f, 0x00, 0x00, -+ 0xa8, 0x1f, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, -+ 0x58, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, -+ 0x04, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0xd4, 0x00, 0x00, 0x00, 0xd4, 0x00, 0x00, 0x00, -+ 0xd4, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, -+ 0x24, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x04, 0x00, 0x00, 0x00, 0x52, 0xe5, 0x74, 0x64, -+ 0xa8, 0x0f, 0x00, 0x00, 0xa8, 0x1f, 0x00, 0x00, -+ 0xa8, 0x1f, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, -+ 0x58, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x14, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, -+ 0x47, 0x4e, 0x55, 0x00, 0x6e, 0x96, 0x9b, 0xbc, -+ 0x8b, 0x0c, 0x9d, 0x95, 0x29, 0xfc, 0x07, 0x04, -+ 0x15, 0x95, 0xc5, 0xf0, 0xb9, 0xd5, 0xcd, 0xae, -+ 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, -+ 0x08, 0x44, 0x06, 0x29, 0x01, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x42, 0x45, 0xd5, 0xec, 0xbb, 0xe3, 0x92, 0x7c, -+ 0x32, 0x62, 0xdb, 0xed, 0xd9, 0x71, 0x58, 0x1c, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x07, 0x00, -+ 0x14, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x07, 0x00, -+ 0x0d, 0x00, 0x00, 0x00, 0xa0, 0x01, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x05, 0x00, -+ 0x08, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x07, 0x00, -+ 0x00, 0x5f, 0x65, 0x64, 0x61, 0x74, 0x61, 0x00, -+ 0x5f, 0x5f, 0x62, 0x73, 0x73, 0x5f, 0x73, 0x74, -+ 0x61, 0x72, 0x74, 0x00, 0x5f, 0x65, 0x6e, 0x64, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0xb8, 0x01, 0x00, 0x00, 0x00, 0xbb, 0x2a, 0x00, -+ 0x00, 0x00, 0xcd, 0x80, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0xf5, 0xfe, 0xff, 0x6f, 0xf8, 0x00, 0x00, 0x00, -+ 0x05, 0x00, 0x00, 0x00, 0x78, 0x01, 0x00, 0x00, -+ 0x06, 0x00, 0x00, 0x00, 0x28, 0x01, 0x00, 0x00, -+ 0x0a, 0x00, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, -+ 0x0b, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x2e, 0x73, 0x68, 0x73, 0x74, 0x72, 0x74, -+ 0x61, 0x62, 0x00, 0x2e, 0x6e, 0x6f, 0x74, 0x65, -+ 0x2e, 0x67, 0x6e, 0x75, 0x2e, 0x62, 0x75, 0x69, -+ 0x6c, 0x64, 0x2d, 0x69, 0x64, 0x00, 0x2e, 0x67, -+ 0x6e, 0x75, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x00, -+ 0x2e, 0x64, 0x79, 0x6e, 0x73, 0x79, 0x6d, 0x00, -+ 0x2e, 0x64, 0x79, 0x6e, 0x73, 0x74, 0x72, 0x00, -+ 0x2e, 0x74, 0x65, 0x78, 0x74, 0x00, 0x2e, 0x65, -+ 0x68, 0x5f, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x00, -+ 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, -+ 0x07, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, -+ 0xd4, 0x00, 0x00, 0x00, 0xd4, 0x00, 0x00, 0x00, -+ 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x00, -+ 0xf6, 0xff, 0xff, 0x6f, 0x02, 0x00, 0x00, 0x00, -+ 0xf8, 0x00, 0x00, 0x00, 0xf8, 0x00, 0x00, 0x00, -+ 0x30, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x04, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, -+ 0x0b, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, -+ 0x28, 0x01, 0x00, 0x00, 0x28, 0x01, 0x00, 0x00, -+ 0x50, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, -+ 0x78, 0x01, 0x00, 0x00, 0x78, 0x01, 0x00, 0x00, -+ 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, -+ 0x01, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, -+ 0xa0, 0x01, 0x00, 0x00, 0xa0, 0x01, 0x00, 0x00, -+ 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x00, -+ 0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, -+ 0xac, 0x01, 0x00, 0x00, 0xac, 0x01, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, -+ 0x06, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, -+ 0xa8, 0x1f, 0x00, 0x00, 0xa8, 0x0f, 0x00, 0x00, -+ 0x58, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, -+ 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, -+ 0x51, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00 -+}; -+ -+ - uint8_t ELF32_MIPS_FILE[] = { - 0x7f, 0x45, 0x4c, 0x46, 0x01, 0x02, 0x01, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -@@ -332,4 +954,5 @@ uint8_t ELF32_MIPS_FILE[] = { - 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, - 0x00, 0x00, 0x00, 0x00 --}; -\ No newline at end of file -+}; -+ -diff --git a/tests/test-elf.c b/tests/test-elf.c -index 6415933..062f417 100644 ---- a/tests/test-elf.c -+++ b/tests/test-elf.c -@@ -24,6 +24,12 @@ int main(int argc, char** argv) - condition: $a at elf.entry_point }", - ELF64_FILE); - -+ assert_true_rule_blob( -+ "import \"elf\" rule test { condition: elf.entry_point == 0xa0 }", ELF32_NOSECTIONS); -+ -+ assert_true_rule_blob( -+ "import \"elf\" rule test { condition: elf.entry_point == 0x1a0 }", ELF32_SHAREDOBJ); -+ - assert_true_rule_blob("import \"elf\" rule test { \ - condition: elf.sections[2].name == \".comment\" }", ELF64_FILE); - -@@ -46,5 +52,4 @@ int main(int argc, char** argv) - elf.segments[i].file_size == 0xe0)}", ELF32_MIPS_FILE); - - yr_finalize(); -- return 0; - } - -From a2d40e616b831fbd81628479de7b62de306c8db1 Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Wed, 8 Mar 2017 16:56:17 +0100 -Subject: [PATCH 32/36] Fix issue #516 - -(cherry-picked from commit 2a36c168bb2097c0831d4ddf24a6c04bafe28dca) ---- - libyara/compiler.c | 7 +++++++ - libyara/hash.c | 3 +++ - libyara/include/yara/error.h | 1 + - libyara/parser.c | 21 +++++++++++++++++---- - 4 files changed, 28 insertions(+), 4 deletions(-) - -diff --git a/libyara/compiler.c b/libyara/compiler.c -index 4c0fdeb..9bbaa51 100644 ---- a/libyara/compiler.c -+++ b/libyara/compiler.c -@@ -914,6 +914,13 @@ YR_API char* yr_compiler_get_error_message( - "unknown module \"%s\"", - compiler->last_error_extra_info); - break; -+ case ERROR_INVALID_MODULE_NAME: -+ snprintf( -+ buffer, -+ buffer_size, -+ "invalid module name \"%s\"", -+ compiler->last_error_extra_info); -+ break; - case ERROR_DUPLICATED_STRUCTURE_MEMBER: - snprintf(buffer, - buffer_size, -diff --git a/libyara/hash.c b/libyara/hash.c -index 1ce2a53..5e5d8e9 100644 ---- a/libyara/hash.c -+++ b/libyara/hash.c -@@ -27,6 +27,7 @@ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -+#include - #include - - #include -@@ -90,6 +91,8 @@ uint32_t hash( - uint32_t result = seed; - size_t i; - -+ assert(len > 0); -+ - for (i = len - 1; i > 0; i--) - { - result ^= ROTATE_INT32(byte_to_int32[*b], i); -diff --git a/libyara/include/yara/error.h b/libyara/include/yara/error.h -index a5476b0..67e4bdb 100644 ---- a/libyara/include/yara/error.h -+++ b/libyara/include/yara/error.h -@@ -88,6 +88,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - #define ERROR_COULD_NOT_READ_PROCESS_MEMORY 47 - #define ERROR_INVALID_EXTERNAL_VARIABLE_TYPE 48 - #define ERROR_REGULAR_EXPRESSION_TOO_COMPLEX 49 -+#define ERROR_INVALID_MODULE_NAME 50 - - - #define FAIL_ON_ERROR(x) { \ -diff --git a/libyara/parser.c b/libyara/parser.c -index 9c99e17..95f5b37 100644 ---- a/libyara/parser.c -+++ b/libyara/parser.c -@@ -963,6 +963,19 @@ YR_META* yr_parser_reduce_meta_declaration( - } - - -+int _yr_parser_valid_module_name( -+ SIZED_STRING* module_name) -+{ -+ if (module_name->length == 0) -+ return FALSE; -+ -+ if (strlen(module_name->c_string) != module_name->length) -+ return FALSE; -+ -+ return TRUE; -+} -+ -+ - int yr_parser_reduce_import( - yyscan_t yyscanner, - SIZED_STRING* module_name) -@@ -972,12 +985,12 @@ int yr_parser_reduce_import( - - char* name; - -- if (module_name->length == 0) -+ if (!_yr_parser_valid_module_name(module_name)) - { -- compiler->last_result = ERROR_UNKNOWN_MODULE; -- yr_compiler_set_error_extra_info(compiler, ""); -+ compiler->last_result = ERROR_INVALID_MODULE_NAME; -+ yr_compiler_set_error_extra_info(compiler, module_name->c_string); - -- return ERROR_UNKNOWN_MODULE; -+ return ERROR_INVALID_MODULE_NAME; - } - - module_structure = (YR_OBJECT*) yr_hash_table_lookup( - -From f4003355bf05daf84cface923d9a21d399a1a9d5 Mon Sep 17 00:00:00 2001 -From: Jacob Baines -Date: Thu, 16 Mar 2017 08:38:51 -0700 -Subject: [PATCH 33/36] Fix ELF module issues on big endian system (#618) - -(cherry picked from commit 75dba10e60313d5dd44548b6f60f1386320556c7) ---- - libyara/exefiles.c | 16 ++++++++++------ - libyara/modules/elf.c | 8 ++++---- - 2 files changed, 14 insertions(+), 10 deletions(-) - -diff --git a/libyara/exefiles.c b/libyara/exefiles.c -index 293b905..5cac047 100644 ---- a/libyara/exefiles.c -+++ b/libyara/exefiles.c -@@ -157,11 +157,12 @@ static uint64_t yr_elf_rva_to_offset_32( - { - // if the binary is an executable then prefer the program headers to resolve - // the offset -- if (elf_header->type == ELF_ET_EXEC) -+ if (yr_le16toh(elf_header->type) == ELF_ET_EXEC) - { - int i; - elf32_program_header_t* program; -- if (elf_header->ph_offset == 0 || elf_header->ph_entry_count == 0) -+ if (yr_le32toh(elf_header->ph_offset) == 0 || -+ yr_le16toh(elf_header->ph_entry_count == 0)) - return 0; - - // check to prevent integer wraps -@@ -199,7 +200,8 @@ static uint64_t yr_elf_rva_to_offset_32( - int i; - elf32_section_header_t* section; - -- if (elf_header->sh_offset == 0 || elf_header->sh_entry_count == 0) -+ if (yr_le32toh(elf_header->sh_offset) == 0 || -+ yr_le16toh(elf_header->sh_entry_count == 0)) - return 0; - - // check to prevent integer wraps -@@ -253,11 +255,12 @@ static uint64_t yr_elf_rva_to_offset_64( - { - // if the binary is an executable then prefer the program headers to resolve - // the offset -- if (elf_header->type == ELF_ET_EXEC) -+ if (yr_le16toh(elf_header->type) == ELF_ET_EXEC) - { - int i; - elf64_program_header_t* program; -- if (elf_header->ph_offset == 0 || elf_header->ph_entry_count == 0) -+ if (yr_le64toh(elf_header->ph_offset) == 0 || -+ yr_le16toh(elf_header->ph_entry_count == 0)) - return 0; - - // check that 'ph_offset' doesn't wrap when added to the -@@ -290,7 +293,8 @@ static uint64_t yr_elf_rva_to_offset_64( - int i; - elf64_section_header_t* section; - -- if (elf_header->sh_offset == 0 || elf_header->sh_entry_count == 0) -+ if (yr_le64toh(elf_header->sh_offset) == 0 || -+ yr_le16toh(elf_header->sh_entry_count) == 0) - return 0; - - // check that 'sh_offset' doesn't wrap when added to the -diff --git a/libyara/modules/elf.c b/libyara/modules/elf.c -index 8ea6c94..a4f7568 100644 ---- a/libyara/modules/elf.c -+++ b/libyara/modules/elf.c -@@ -72,7 +72,7 @@ uint64_t elf_rva_to_offset_##bits##_##bo( \ - uint64_t rva, \ - size_t elf_size) \ - { \ -- if (elf_header->type == ELF_ET_EXEC) \ -+ if (yr_##bo##16toh(elf_header->type) == ELF_ET_EXEC) \ - { \ - int i; \ - \ -@@ -224,12 +224,12 @@ void parse_elf_header_##bits##_##bo( \ - set_integer(yr_##bo##bits##toh(section->offset), elf_obj, \ - "sections[%i].offset", i); \ - \ -- if (yr_##bo##bits##toh(section->name) < elf_size && \ -+ if (yr_##bo##32toh(section->name) < elf_size && \ - str_table > (char*) elf && \ -- str_table + yr_##bo##bits##toh(section->name) < \ -+ str_table + yr_##bo##32toh(section->name) < \ - (char*) elf + elf_size) \ - { \ -- set_string(str_table + yr_##bo##bits##toh(section->name), elf_obj, \ -+ set_string(str_table + yr_##bo##32toh(section->name), elf_obj, \ - "sections[%i].name", i); \ - } \ - \ - -From 3aa1d8ae08a07bdbde992f03edb8322d6cf6ad2c Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Thu, 16 Mar 2017 16:38:16 +0100 -Subject: [PATCH 34/36] Add missing endianness conversions - -(cherry picked from commit b6851ea05bfcc7938101aff26f48094cba3e07f5) ---- - libyara/modules/pe.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - -diff --git a/libyara/modules/pe.c b/libyara/modules/pe.c -index f78a9d5..1c90a6a 100644 ---- a/libyara/modules/pe.c -+++ b/libyara/modules/pe.c -@@ -542,7 +542,7 @@ void pe_parse_version_info( - yr_le16toh(string->Length) != 0 && - string < string_table) - { -- if (string->ValueLength > 0) -+ if (yr_le16toh(string->ValueLength) > 0) - { - char* string_value = (char*) ADD_OFFSET(string, - sizeof(VERSION_INFO) + 2 * (strnlen_w(string->Key) + 1)); -@@ -559,7 +559,7 @@ void pe_parse_version_info( - } - } - -- string = ADD_OFFSET(string, string->Length); -+ string = ADD_OFFSET(string, yr_le16toh(string->Length)); - } - } - } -@@ -953,7 +953,9 @@ void pe_parse_certificates( - } - - // Store the end of directory, making comparisons easier. -- eod = pe->data + yr_le32toh(directory->VirtualAddress) + directory->Size; -+ eod = pe->data + \ -+ yr_le32toh(directory->VirtualAddress) + \ -+ yr_le32toh(directory->Size); - - win_cert = (PWIN_CERTIFICATE) \ - (pe->data + yr_le32toh(directory->VirtualAddress)); -@@ -1137,7 +1139,10 @@ void pe_parse_certificates( - counter++; - } - -- uintptr_t end = (uintptr_t)((uint8_t *) win_cert) + win_cert->Length; -+ uintptr_t end = \ -+ (uintptr_t)((uint8_t *) win_cert) + \ -+ yr_le32toh(win_cert->Length); -+ - win_cert = (PWIN_CERTIFICATE)(end + (end % 8)); - - BIO_free(cert_bio); -@@ -1777,7 +1782,7 @@ static uint64_t rich_internal( - - for (i = 0; i < rich_count; i++) - { -- DWORD id_version = clear_rich_signature->versions[i].id_version; -+ DWORD id_version = yr_le32toh(clear_rich_signature->versions[i].id_version); - - int match_version = (version == RICH_VERSION_VERSION(id_version)); - int match_toolid = (toolid == RICH_VERSION_ID(id_version)); - -From f6553648f19ed33d9a1bbdcf9f458215e50d35a8 Mon Sep 17 00:00:00 2001 -From: Jacob Baines -Date: Mon, 20 Mar 2017 02:17:24 -0700 -Subject: [PATCH 35/36] Linux Memory Scan Can Leave Process In Stopped State - (#622) - -* Wait for process to stop - -* Specify which process to wait for - -(cherry picked from commit 68ffbbcdc992e3f1969d0aa37d3d0b1568b5514b) ---- - libyara/proc.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) - -diff --git a/libyara/proc.c b/libyara/proc.c -index 21c21cb..5879b44 100644 ---- a/libyara/proc.c -+++ b/libyara/proc.c -@@ -352,6 +352,7 @@ int _yr_process_attach( - int pid, - YR_PROC_ITERATOR_CTX* context) - { -+ int status; - char buffer[256]; - - context->pid = pid; -@@ -386,6 +387,22 @@ int _yr_process_attach( - return ERROR_COULD_NOT_ATTACH_TO_PROCESS; - } - -+ status = 0; -+ if (waitpid(pid, &status, 0) == -1) -+ { -+ // this is a strange error state where we attached but the proc didn't -+ // stop. Try to detach and clean up. -+ ptrace(PTRACE_DETACH, context->pid, NULL, 0); -+ -+ fclose(context->maps); -+ context->maps = NULL; -+ -+ close(context->mem_fd); -+ context->mem_fd = -1; -+ -+ return ERROR_COULD_NOT_ATTACH_TO_PROCESS; -+ } -+ - return ERROR_SUCCESS; - } - - -From 62ad5a701b04d0fa955ef5593bcd7ec789d1241e Mon Sep 17 00:00:00 2001 -From: plusvic -Date: Fri, 23 Sep 2016 12:03:30 +0200 -Subject: [PATCH 36/36] Add appveyor config file - -(cherry picked from commit b254eeef98a7042b6df28b3432c065860583e8cc) ---- - appveyor.yml | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - create mode 100644 appveyor.yml - -diff --git a/appveyor.yml b/appveyor.yml -new file mode 100644 -index 0000000..2ba177b ---- /dev/null -+++ b/appveyor.yml -@@ -0,0 +1,15 @@ -+# AppVeyor CI for Windows -+ -+version: 3.5.{build} -+pull_requests: -+ do_not_increment_build_number: true -+configuration: Release -+platform: -+- x64 -+- x86 -+before_build: -+- ps: nuget restore windows/vs2015/yara.sln -+build: -+ project: windows/vs2015/yara.sln -+ verbosity: minimal -+test: off From c13747c691f45e0897745104af228259edc511fa Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 28 May 2022 16:30:15 +0200 Subject: [PATCH 05/54] adding changes proposed by Mikel Olasagasti Uranga https://src.fedoraproject.org/fork/mikelo2/rpms/yara/c/96f6b94345feed3101a706e6274ef1fbb71795dd --- yara.spec | 43 ++++++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/yara.spec b/yara.spec index 434d50e..706e8f1 100644 --- a/yara.spec +++ b/yara.spec @@ -1,21 +1,21 @@ Name: yara -Version: 4.2.0 +Version: 4.2.1 Release: 1%{?dist} Summary: Pattern matching Swiss knife for malware researchers -# yara package itself is licensed as ASL 2.0 -# bison grammar parsers in libyara/* are dual licensed under ASL 2.0 and GPLv3+ license. -# resulting binary package licensed as ASL 2.0 -License: ASL 2.0 -VCS: http://github.com/VirusTotal/yara/ -# http://github.com/VirusTotal/yara/releases -URL: http://VirusTotal.github.io/yara/ +# yara package itself is licensed with BSD 3 clause license +# bison grammar parsers in libyara/* are licensed with GPLv3+ license with exception from FSF alloving usage in larger work +# resulting binary package licensed as BSD +License: BSD +VCS: https://github.com/VirusTotal/yara/ +# https://github.com/VirusTotal/yara/releases +URL: https://VirusTotal.github.io/yara/ %global gituser VirusTotal %global gitname yara -# Commit of version 4.2.0-rc1 -%global commit 45a2883daad5b40a516b7fa1245beb2a45d586a6 +# Commit of version 4.2.1 +%global commit 037c536fbefe58525895d30a5c9a29ff57ecdb48 %global shortcommit %(c=%{commit}; echo ${c:0:7}) # additional module for yara @@ -31,7 +31,7 @@ URL: http://VirusTotal.github.io/yara/ # Build from git release version Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz -# http://github.com/Koodous/androguard-yara/ +# https://github.com/Koodous/androguard-yara/ Source1: https://github.com/%{androguard_gituser}/%{androguard_gitname}/archive/%{androguard_commit}/%{androguard_gitname}-%{androguard_gitdate}-%{androguard_shortcommit}.tar.gz # Patch based on the androguard-yara installation guide to enable the androguard module @@ -41,16 +41,6 @@ Patch0: yara-androguard.patch # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch -# Fixed in 3.6.0 upstream -# Patch https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch -# Fixes: CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 -# Patch2: %%{name}-pull627.patch - -# API of yr_re_match changed, fix needed for Androguard -# https://github.com/Koodous/androguard-yara/issues/8 -# merged in https://github.com/Koodous/androguard-yara/commit/034f0a49e58d798abcaa28c9864451da9da29413 -# Patch3: yara-androguard-matchapi.patch - BuildRequires: git @@ -157,6 +147,9 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %ldconfig_scriptlets %endif +%check +make check + %files %license COPYING @@ -181,6 +174,14 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %changelog +* Mon May 23 2022 Michal Ambroz - 4.2.1-1 +- bump to 4.2.1 +- adding changes based on proposal of Mikel Olasagasti Uranga: +- change to BSD license as yara was relicensed in 2016 +- minor changes to spec, like using https for URL +- remove old patches +- enable checks + * Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 - bump to 4.2.0 From 6ede213604f3a905ec6fc5ec869c66e4a16b907d Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga Date: Mon, 18 Jul 2022 17:52:57 +0200 Subject: [PATCH 06/54] Update to 4.2.2 - Closes rhbz#2103444 --- .gitignore | 1 + sources | 3 +-- yara.spec | 13 ++++++++++--- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 0f7ab56..06867b5 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ /yara-4.2.0-rc1.tar.gz /yara-4.2.0.tar.gz /yara-4.2.1.tar.gz +/yara-4.2.2.tar.gz diff --git a/sources b/sources index 7a4e041..343aa31 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (yara-4.2.1.tar.gz) = 036a35d713647b23998135da0d27c13a8876aa44e18e3c9dc99fa425273d7c4a953cbdc78f413f29e8bf818d84b340d0719e241d2a83b7165a16d97e952c45b0 -SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be +SHA512 (yara-4.2.2.tar.gz) = 6eb42e63eff93ce636e1d2ae84e30621eeea0d91e1d72bb2cbe826aca6af306bb3564ac2314bc090fb59c9aca5436e72d33658009722ce0cfbaae7ef87cc894e diff --git a/yara.spec b/yara.spec index 706e8f1..8741f9e 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.2.1 +Version: 4.2.2 Release: 1%{?dist} Summary: Pattern matching Swiss knife for malware researchers @@ -14,8 +14,8 @@ URL: https://VirusTotal.github.io/yara/ %global gituser VirusTotal %global gitname yara -# Commit of version 4.2.1 -%global commit 037c536fbefe58525895d30a5c9a29ff57ecdb48 +# Commit of version 4.2.2 +%global commit d5a7565a8bd4f312dc75ac6cb064350ee9bd380e %global shortcommit %(c=%{commit}; echo ${c:0:7}) # additional module for yara @@ -174,6 +174,13 @@ make check %changelog +* Mon Jul 18 2022 Mikel Olasagasti Uranga - 4.2.2-1 +- Update to 4.2.2 (#2103444) +- BUGFIX: Fix buffer overrun in "dex" module (#1728). +- BUGFIX: Wrong offset used when checking Version string of .net metadata (#1708). +- BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). +- BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). + * Mon May 23 2022 Michal Ambroz - 4.2.1-1 - bump to 4.2.1 - adding changes based on proposal of Mikel Olasagasti Uranga: From ea6134a7c223711f4db7bc4cc126b5c0a296d515 Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga Date: Mon, 18 Jul 2022 18:09:57 +0200 Subject: [PATCH 07/54] Fix sources to include androguard-yara again --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index 343aa31..365cb2b 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (yara-4.2.2.tar.gz) = 6eb42e63eff93ce636e1d2ae84e30621eeea0d91e1d72bb2cbe826aca6af306bb3564ac2314bc090fb59c9aca5436e72d33658009722ce0cfbaae7ef87cc894e +SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be From 05e52569017438dcddbaf9807894bca8158a7667 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 13:42:22 +0000 Subject: [PATCH 08/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 8741f9e..9e78a1c 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.2.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -174,6 +174,9 @@ make check %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 4.2.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Mon Jul 18 2022 Mikel Olasagasti Uranga - 4.2.2-1 - Update to 4.2.2 (#2103444) - BUGFIX: Fix buffer overrun in "dex" module (#1728). From 30dacf9b039605c3e08ee9a8e8ee96fdb10d2518 Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga Date: Tue, 9 Aug 2022 11:32:04 +0200 Subject: [PATCH 09/54] Update to 4.2.3 - Closes rhbz#2116594 --- .gitignore | 1 + sources | 2 +- yara.spec | 11 +++++++---- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 06867b5..ce68c2d 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ /yara-4.2.0.tar.gz /yara-4.2.1.tar.gz /yara-4.2.2.tar.gz +/yara-4.2.3.tar.gz diff --git a/sources b/sources index 365cb2b..84a7020 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yara-4.2.2.tar.gz) = 6eb42e63eff93ce636e1d2ae84e30621eeea0d91e1d72bb2cbe826aca6af306bb3564ac2314bc090fb59c9aca5436e72d33658009722ce0cfbaae7ef87cc894e +SHA512 (yara-4.2.3.tar.gz) = 1df23837d14d3f9f72db901190e7412241514a8914d72b753df32ad8a44c7a49ad8f14941a95de83754e4d1dd0f23d712d8e6a43916343341b92cb1bc66f3c09 SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be diff --git a/yara.spec b/yara.spec index 9e78a1c..a7cffc3 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara -Version: 4.2.2 -Release: 2%{?dist} +Version: 4.2.3 +Release: 1%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -14,8 +14,8 @@ URL: https://VirusTotal.github.io/yara/ %global gituser VirusTotal %global gitname yara -# Commit of version 4.2.2 -%global commit d5a7565a8bd4f312dc75ac6cb064350ee9bd380e +# Commit of version 4.2.3 +%global commit ba94b4f8ebb6d56786d14f6a0f7529b32d7c216f %global shortcommit %(c=%{commit}; echo ${c:0:7}) # additional module for yara @@ -174,6 +174,9 @@ make check %changelog +* Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 +- Update to 4.2.3 (#2116594) + * Sat Jul 23 2022 Fedora Release Engineering - 4.2.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 8de6783ad20250d4faa533c05c3ec81f85debb95 Mon Sep 17 00:00:00 2001 From: nobody Date: Wed, 4 Jan 2023 10:23:48 +0100 Subject: [PATCH 10/54] bump to 4.3.0 rc1 --- .gitignore | 1 + sources | 3 +-- yara-androguard.patch | 24 ------------------------ yara.spec | 42 +++++++++++++----------------------------- 4 files changed, 15 insertions(+), 55 deletions(-) delete mode 100644 yara-androguard.patch diff --git a/.gitignore b/.gitignore index ce68c2d..32c4f50 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ /yara-4.2.1.tar.gz /yara-4.2.2.tar.gz /yara-4.2.3.tar.gz +/yara-4.3.0-rc1.tar.gz diff --git a/sources b/sources index 84a7020..256cc62 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (yara-4.2.3.tar.gz) = 1df23837d14d3f9f72db901190e7412241514a8914d72b753df32ad8a44c7a49ad8f14941a95de83754e4d1dd0f23d712d8e6a43916343341b92cb1bc66f3c09 -SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be +SHA512 (yara-4.3.0-rc1.tar.gz) = 7df91e67e55aef6a0b637640f353ca6c40dad636665ac86c960ab5e9f3bedaaeb8a3f2e16712da11594ac7a6dd772eb79df18cd6c088d2b951db84faf85c1374 diff --git a/yara-androguard.patch b/yara-androguard.patch deleted file mode 100644 index b7ad794..0000000 --- a/yara-androguard.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff --git a/libyara/Makefile.am b/libyara/Makefile.am -index 4fa363a..a9242b2 100644 ---- a/libyara/Makefile.am -+++ b/libyara/Makefile.am -@@ -48,6 +48,7 @@ MODULES += modules/pe/pe_utils.c - - if CUCKOO_MODULE - MODULES += modules/cuckoo/cuckoo.c -+MODULES += modules/androguard/androguard.c - endif - - if MAGIC_MODULE -diff --git a/libyara/modules/module_list b/libyara/modules/module_list -index d81b8f3..ba43609 100644 ---- a/libyara/modules/module_list -+++ b/libyara/modules/module_list -@@ -10,6 +10,7 @@ MODULE(dotnet) - - #ifdef CUCKOO_MODULE - MODULE(cuckoo) -+MODULE(androguard) - #endif - - #ifdef MAGIC_MODULE diff --git a/yara.spec b/yara.spec index a7cffc3..adf0926 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,8 @@ Name: yara -Version: 4.2.3 -Release: 1%{?dist} +Version: 4.3.0 +%global upversion %{version}-rc1 + +Release: 0.rc1.1%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -14,28 +16,17 @@ URL: https://VirusTotal.github.io/yara/ %global gituser VirusTotal %global gitname yara -# Commit of version 4.2.3 -%global commit ba94b4f8ebb6d56786d14f6a0f7529b32d7c216f +# Commit of version 4.3.0rc1 +%global commit 8b8384d15fc5358cee449d88070cc9c8be9ec4ce %global shortcommit %(c=%{commit}; echo ${c:0:7}) -# additional module for yara -%global androguard_gituser Koodous -%global androguard_gitname androguard-yara -# Commit from 2020-04-22 -%global androguard_commit 3eea86ae2c4ee6ad3cc1cb3c2711b03db078831a -%global androguard_shortcommit %(c=%{androguard_commit}; echo ${c:0:7}) -%global androguard_gitdate 2020-04-22 # Build from git commit baseline #Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz # Build from git release version -Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{version}.tar.gz#/%%{name}-%%{version}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.tar.gz#/%{name}-%{upversion}.tar.gz -# https://github.com/Koodous/androguard-yara/ -Source1: https://github.com/%{androguard_gituser}/%{androguard_gitname}/archive/%{androguard_commit}/%{androguard_gitname}-%{androguard_gitdate}-%{androguard_shortcommit}.tar.gz - -# Patch based on the androguard-yara installation guide to enable the androguard module -Patch0: yara-androguard.patch # Use default sphix theme to generate documentation rather than sphinx_rtd_theme # to avoid static installation of font files on fedora >= 24 @@ -96,18 +87,7 @@ developing applications that use %{name}. %prep # autosetup -n %%{gitname}-%%{commit} -p 1 -S git -%autosetup -n %{gitname}-%{version} -p 1 -S git - -# Add the Androguard module -# %%setup -qn %%{gitname}-%%{commit} -a 1 -D -T -%setup -n %{gitname}-%{version} -q -a 1 -D -T -pushd %{androguard_gitname}-%{androguard_commit} - -mkdir -p ../libyara/modules/androguard -cp -p androguard.c ../libyara/modules/androguard/ -popd - - +%autosetup -n %{gitname}-%{upversion} -p 1 -S git autoreconf --force --install @@ -174,6 +154,10 @@ make check %changelog +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 +- bump to 4.3.0 rc1 +- remove the androguard module which is no longer available from github + * Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 - Update to 4.2.3 (#2116594) From e1bcf94fe4024cf42f90f10b4d700c222ff8f241 Mon Sep 17 00:00:00 2001 From: nobody Date: Wed, 18 Jan 2023 10:44:53 +0100 Subject: [PATCH 11/54] provide more info if build fails due to checks --- yara.spec | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index adf0926..3f7d2fb 100644 --- a/yara.spec +++ b/yara.spec @@ -52,10 +52,15 @@ BuildRequires: flex BuildRequires: libtool BuildRequires: file-devel BuildRequires: jansson-devel >= 2.5 -BuildRequires: openssl-devel BuildRequires: protobuf-c-devel BuildRequires: protobuf-compiler +%if 0%{?rhel} && 0%{?rhel} == 7 +BuildRequires: openssl11-devel +%else +BuildRequires: openssl-devel +%endif + # html doc generation BuildRequires: /usr/bin/sphinx-build @@ -128,7 +133,19 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check -make check +%ifarch s390x + # test-pe and test-dotnet fails for x390x at this point + make check || ( + echo "===== ./test-suite.log" + [ -f ./test-suite.log ] && cat ./test-suite.log + echo "===== test-pe.log" + [ -f ./test-pe.log ] && cat ./test-pe.log + echo "===== test-dotnet.log" + [ -f ./test-dotnet.log ] && cat ./test-dotnet.log + ) +%else + make check +%endif %files From 51a2c01e449e46568906dcf60356211a3139d1b1 Mon Sep 17 00:00:00 2001 From: nobody Date: Thu, 19 Jan 2023 10:43:04 +0100 Subject: [PATCH 12/54] fix build for RHEL7 --- yara.spec | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/yara.spec b/yara.spec index 3f7d2fb..e17e599 100644 --- a/yara.spec +++ b/yara.spec @@ -43,6 +43,7 @@ BuildRequires: binutils BuildRequires: coreutils BuildRequires: sharutils BuildRequires: file +BuildRequires: sed BuildRequires: gawk BuildRequires: gzip BuildRequires: xz @@ -96,14 +97,18 @@ developing applications that use %{name}. autoreconf --force --install + + + %build -# Add missing definition on RHEL7 +# Add missing protobuf definition on RHEL7, and also configure for the libcrypto11/openssl11 from EPEL %if 0%{?rhel} && 0%{?rhel} == 7 -export CFLAGS="$CFLAGS -D PROTOBUF_C_FIELD_FLAG_ONEOF=4" +export CFLAGS="%{optflags} -D PROTOBUF_C_FIELD_FLAG_ONEOF=4 $(pkg-config --cflags libcrypto11)" +export LDFLAGS="$LDFLAGS $(pkg-config --libs libcrypto11)" %endif -# macro %%configure already does use CFLAGS="\{optflags}" and yara build +# macro %%configure already does use CFLAGS="%%{optflags}" and yara build # scripts configure/make already honors that CFLAGS %configure --enable-magic --enable-cuckoo --enable-debug --enable-dotnet \ --enable-macho --enable-dex --enable-pb-tests \ @@ -133,20 +138,18 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check +# test-pe fails for RHEL9 +make check || ( + echo "===== ./test-suite.log" + [ -f ./test-suite.log ] && cat ./test-suite.log %ifarch s390x # test-pe and test-dotnet fails for x390x at this point - make check || ( - echo "===== ./test-suite.log" - [ -f ./test-suite.log ] && cat ./test-suite.log - echo "===== test-pe.log" - [ -f ./test-pe.log ] && cat ./test-pe.log - echo "===== test-dotnet.log" - [ -f ./test-dotnet.log ] && cat ./test-dotnet.log - ) + true %else - make check + # test-pe fails for RHEL9 x86 at this point + false %endif - +) %files %license COPYING From 8e2b994c1236f3d19f54180aea093cf934bddc3d Mon Sep 17 00:00:00 2001 From: nobody Date: Fri, 20 Jan 2023 01:16:56 +0100 Subject: [PATCH 13/54] more verbose output on failed make check --- yara.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/yara.spec b/yara.spec index e17e599..7b31ab3 100644 --- a/yara.spec +++ b/yara.spec @@ -138,15 +138,22 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check -# test-pe fails for RHEL9 make check || ( + # print more verbose info in case the test(s) fail echo "===== ./test-suite.log" [ -f ./test-suite.log ] && cat ./test-suite.log + echo "===== /proc/cpu" + head -n 35 /proc/cpuinfo + echo "===== /etc/os-release" + cat /etc/os-release + echo "===== uname -a" + uname -a + %ifarch s390x - # test-pe and test-dotnet fails for x390x at this point + # test-pe and test-dotnet fails for x390x at this point - ignored for rc1 true %else - # test-pe fails for RHEL9 x86 at this point + # test-pe fails for RHEL9 x86 at this point in copr false %endif ) From 8407c9c4c52f2cfb89eeb1bb6c2f3a49d6056f9c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 08:02:32 +0000 Subject: [PATCH 14/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 3f7d2fb..212a1f1 100644 --- a/yara.spec +++ b/yara.spec @@ -2,7 +2,7 @@ Name: yara Version: 4.3.0 %global upversion %{version}-rc1 -Release: 0.rc1.1%{?dist} +Release: 0.rc1.1%{?dist}.1 Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -171,6 +171,9 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 - bump to 4.3.0 rc1 - remove the androguard module which is no longer available from github From ae883bfd1f65210565f6be24fdcf6487107fba1d Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 16:48:11 +0100 Subject: [PATCH 15/54] fix EPEL7 build, partially fix s390x bigendian issue --- yara.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/yara.spec b/yara.spec index 7b31ab3..8dce7ea 100644 --- a/yara.spec +++ b/yara.spec @@ -2,7 +2,7 @@ Name: yara Version: 4.3.0 %global upversion %{version}-rc1 -Release: 0.rc1.1%{?dist} +Release: 0.rc1.2%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -32,7 +32,10 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.t # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch - +# https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491 +# test-pe fails on s390x +Patch2: https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491.patch#/yara-4.3.0-test-pe-s390x.patch +Patch3: https://github.com/VirusTotal/yara/commit/d1a6ef20c049d86a136111dce53b4eb65c4df1bd.patch#/yara-4.3.0-test-pe2-s390x.patch BuildRequires: git BuildRequires: gcc @@ -142,6 +145,7 @@ make check || ( # print more verbose info in case the test(s) fail echo "===== ./test-suite.log" [ -f ./test-suite.log ] && cat ./test-suite.log + # Build in COPR lacking the hwinfo.log echo "===== /proc/cpu" head -n 35 /proc/cpuinfo echo "===== /etc/os-release" @@ -153,7 +157,7 @@ make check || ( # test-pe and test-dotnet fails for x390x at this point - ignored for rc1 true %else - # test-pe fails for RHEL9 x86 at this point in copr + # test-pe fails for RHEL9 x86-64 at this point in copr on "AMD EPYC" cpu, it doesn't affect Fedora build on Intel CPU false %endif ) @@ -181,6 +185,9 @@ make check || ( %changelog +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.2 +- fix EPEL7 build + * Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 - bump to 4.3.0 rc1 - remove the androguard module which is no longer available from github From 3e1ef1d276ce0fea55c365e26ac60439e45d92f9 Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 16:49:07 +0100 Subject: [PATCH 16/54] add partial s390x fix --- yara-4.3.0-test-pe-s390x.patch | 393 ++++++++++++++++++++++++++++++++ yara-4.3.0-test-pe2-s390x.patch | 24 ++ 2 files changed, 417 insertions(+) create mode 100644 yara-4.3.0-test-pe-s390x.patch create mode 100644 yara-4.3.0-test-pe2-s390x.patch diff --git a/yara-4.3.0-test-pe-s390x.patch b/yara-4.3.0-test-pe-s390x.patch new file mode 100644 index 0000000..76630e0 --- /dev/null +++ b/yara-4.3.0-test-pe-s390x.patch @@ -0,0 +1,393 @@ +From 90c43e24f0dedd130bea199e6c23094271c3f491 Mon Sep 17 00:00:00 2001 +From: "Victor M. Alvarez" +Date: Fri, 20 Jan 2023 10:24:55 +0100 +Subject: [PATCH] Try fixing issue #1855. + +PR #1768 added RVA field to function details in PE module. The new code had the following line: + +``` +rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); +``` + +The `yr_le64toh` should be used for converting the value of `import_descriptor->FirstThunk` from little-endian to the host's endianness *before* performing the add operation. However, the addition was performed before the conversion. + +This may be the cause of some test cases failing in big endian platforms. +--- + libyara/modules/pe/pe.c | 137 ++++++++++++++++++++++++++-------------- + 1 file changed, 89 insertions(+), 48 deletions(-) + +diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c +index 61da53cc0..354c6a103 100644 +--- a/libyara/modules/pe/pe.c ++++ b/libyara/modules/pe/pe.c +@@ -837,7 +837,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( + has_ordinal = 1; + } + +- rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); ++ rva_address = yr_le64toh(import_descriptor->FirstThunk) + ++ (sizeof(uint64_t) * func_idx); + + if (name != NULL || has_ordinal == 1) + { +@@ -911,7 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( + has_ordinal = 1; + } + +- rva_address = yr_le32toh(import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); ++ rva_address = yr_le32toh( ++ import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); + + if (name != NULL || has_ordinal == 1) + { +@@ -1013,7 +1015,8 @@ void pe_set_imports( + { + yr_set_string(func->name, pe->object, fun_name, dll_cnt, fun_cnt); + if (func->has_ordinal) +- yr_set_integer(func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); ++ yr_set_integer( ++ func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); + else + yr_set_integer(YR_UNDEFINED, pe->object, fun_ordinal, dll_cnt, fun_cnt); + if (func->rva) +@@ -1114,7 +1117,8 @@ static IMPORTED_DLL* pe_parse_imports(PE* pe) + } + + yr_set_integer(num_imports, pe->object, "number_of_imports"); +- yr_set_integer(num_function_imports, pe->object, "number_of_imported_functions"); ++ yr_set_integer( ++ num_function_imports, pe->object, "number_of_imported_functions"); + pe_set_imports( + pe, + head, +@@ -1369,7 +1373,7 @@ static void* pe_parse_delayed_imports(PE* pe) + imported_func->has_ordinal = 1; + } + +- imported_func->rva = yr_le64toh(func_rva); ++ imported_func->rva = yr_le64toh(func_rva); + + num_function_imports++; + name_rva += pointer_size; +@@ -1628,19 +1632,22 @@ static void pe_parse_exports(PE* pe) + for (int j = 0; j < cert->sha1.len; ++j) \ + sprintf(thumbprint_ascii + (j * 2), "%02x", cert->sha1.data[j]); \ + \ +- yr_set_string( \ ++ yr_set_string( \ + (char*) thumbprint_ascii, pe->object, fmt ".thumbprint", __VA_ARGS__); \ + \ +- yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ +- yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ ++ yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ ++ yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ + /* Versions are zero based, so add one. */ \ +- yr_set_integer(cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ +- yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ +- yr_set_string( \ ++ yr_set_integer( \ ++ cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ ++ yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ ++ yr_set_string( \ + cert->sig_alg_oid, pe->object, fmt ".algorithm_oid", __VA_ARGS__); \ +- yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ +- yr_set_integer(cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ +- yr_set_integer(cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ ++ yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ ++ yr_set_integer( \ ++ cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ ++ yr_set_integer( \ ++ cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ + } while (0) + + void _process_authenticode( +@@ -1677,7 +1684,8 @@ void _process_authenticode( + for (int j = 0; j < authenticode->digest.len; ++j) + sprintf(digest_ascii + (j * 2), "%02x", authenticode->digest.data[j]); + +- yr_set_string(digest_ascii, pe->object, "signatures[%i].digest", *sig_count); ++ yr_set_string( ++ digest_ascii, pe->object, "signatures[%i].digest", *sig_count); + yr_free(digest_ascii); + } + +@@ -2101,7 +2109,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) + pe->object, + "size_of_headers"); + +- yr_set_integer(yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); ++ yr_set_integer( ++ yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); + + yr_set_integer( + yr_le16toh(OptionalHeader(pe, Subsystem)), pe->object, "subsystem"); +@@ -2291,7 +2300,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) + if (last_section_end && (pe->data_size > last_section_end)) + { + yr_set_integer(last_section_end, pe->object, "overlay.offset"); +- yr_set_integer(pe->data_size - last_section_end, pe->object, "overlay.size"); ++ yr_set_integer( ++ pe->data_size - last_section_end, pe->object, "overlay.size"); + } + else + { +@@ -3058,7 +3068,8 @@ define_function(delayed_import_rva) + + for (int i = 0; i < num_imports; i++) + { +- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); ++ dll_name = yr_get_string( ++ module, "delayed_import_details[%i].library_name", i); + if (dll_name == NULL || IS_UNDEFINED(dll_name) || + ss_compare(in_dll_name, dll_name) != 0) + continue; +@@ -3103,7 +3114,8 @@ define_function(delayed_import_rva_ordinal) + + for (int i = 0; i < num_imports; i++) + { +- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); ++ dll_name = yr_get_string( ++ module, "delayed_import_details[%i].library_name", i); + if (dll_name == NULL || IS_UNDEFINED(dll_name) || + ss_compare(in_dll_name, dll_name) != 0) + continue; +@@ -3148,7 +3160,8 @@ define_function(locale) + + for (int i = 0; i < n; i++) + { +- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); ++ uint64_t rsrc_language = yr_get_integer( ++ module, "resources[%i].language", i); + + if ((rsrc_language & 0xFFFF) == locale) + return_integer(1); +@@ -3176,7 +3189,8 @@ define_function(language) + + for (int i = 0; i < n; i++) + { +- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); ++ uint64_t rsrc_language = yr_get_integer( ++ module, "resources[%i].language", i); + + if ((rsrc_language & 0xFF) == language) + return_integer(1); +@@ -3754,7 +3768,8 @@ begin_declarations + declare_string("digest"); + declare_string("file_digest"); + declare_integer("number_of_certificates"); +- begin_struct_array("certificates"); ++ begin_struct_array("certificates") ++ ; + declare_string("thumbprint"); + declare_string("issuer"); + declare_string("subject"); +@@ -3766,12 +3781,14 @@ begin_declarations + declare_integer("not_after"); + end_struct_array("certificates"); + +- begin_struct("signer_info"); ++ begin_struct("signer_info") ++ ; + declare_string("program_name"); + declare_string("digest"); + declare_string("digest_alg"); + declare_integer("length_of_chain"); +- begin_struct_array("chain"); ++ begin_struct_array("chain") ++ ; + declare_string("thumbprint"); + declare_string("issuer"); + declare_string("subject"); +@@ -3785,13 +3802,15 @@ begin_declarations + end_struct("signer_info"); + + declare_integer("number_of_countersignatures"); +- begin_struct_array("countersignatures"); ++ begin_struct_array("countersignatures") ++ ; + declare_integer("verified"); + declare_integer("sign_time"); + declare_string("digest_alg"); + declare_string("digest"); + declare_integer("length_of_chain"); +- begin_struct_array("chain"); ++ begin_struct_array("chain") ++ ; + declare_string("thumbprint"); + declare_string("issuer"); + declare_string("subject"); +@@ -3860,16 +3879,19 @@ int module_load( + yr_set_integer(IMAGE_FILE_MACHINE_M32R, module_object, "MACHINE_M32R"); + yr_set_integer(IMAGE_FILE_MACHINE_MIPS16, module_object, "MACHINE_MIPS16"); + yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU, module_object, "MACHINE_MIPSFPU"); +- yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); ++ yr_set_integer( ++ IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); + yr_set_integer(IMAGE_FILE_MACHINE_POWERPC, module_object, "MACHINE_POWERPC"); +- yr_set_integer(IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); ++ yr_set_integer( ++ IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); + yr_set_integer(IMAGE_FILE_MACHINE_R4000, module_object, "MACHINE_R4000"); + yr_set_integer(IMAGE_FILE_MACHINE_SH3, module_object, "MACHINE_SH3"); + yr_set_integer(IMAGE_FILE_MACHINE_SH3DSP, module_object, "MACHINE_SH3DSP"); + yr_set_integer(IMAGE_FILE_MACHINE_SH4, module_object, "MACHINE_SH4"); + yr_set_integer(IMAGE_FILE_MACHINE_SH5, module_object, "MACHINE_SH5"); + yr_set_integer(IMAGE_FILE_MACHINE_THUMB, module_object, "MACHINE_THUMB"); +- yr_set_integer(IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); ++ yr_set_integer( ++ IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); + yr_set_integer( + IMAGE_FILE_MACHINE_TARGET_HOST, module_object, "MACHINE_TARGET_HOST"); + yr_set_integer(IMAGE_FILE_MACHINE_R3000, module_object, "MACHINE_R3000"); +@@ -3889,7 +3911,8 @@ int module_load( + yr_set_integer( + IMAGE_SUBSYSTEM_WINDOWS_CUI, module_object, "SUBSYSTEM_WINDOWS_CUI"); + yr_set_integer(IMAGE_SUBSYSTEM_OS2_CUI, module_object, "SUBSYSTEM_OS2_CUI"); +- yr_set_integer(IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); ++ yr_set_integer( ++ IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); + yr_set_integer( + IMAGE_SUBSYSTEM_NATIVE_WINDOWS, + module_object, +@@ -3928,14 +3951,16 @@ int module_load( + IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, + module_object, + "FORCE_INTEGRITY"); +- yr_set_integer(IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); ++ yr_set_integer( ++ IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); + yr_set_integer( + IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, module_object, "NO_ISOLATION"); + yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_SEH, module_object, "NO_SEH"); + yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_BIND, module_object, "NO_BIND"); + yr_set_integer( + IMAGE_DLLCHARACTERISTICS_APPCONTAINER, module_object, "APPCONTAINER"); +- yr_set_integer(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); ++ yr_set_integer( ++ IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); + yr_set_integer(IMAGE_DLLCHARACTERISTICS_GUARD_CF, module_object, "GUARD_CF"); + yr_set_integer( + IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, +@@ -3943,26 +3968,31 @@ int module_load( + "TERMINAL_SERVER_AWARE"); + + yr_set_integer(IMAGE_FILE_RELOCS_STRIPPED, module_object, "RELOCS_STRIPPED"); +- yr_set_integer(IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); ++ yr_set_integer( ++ IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); + yr_set_integer( + IMAGE_FILE_LINE_NUMS_STRIPPED, module_object, "LINE_NUMS_STRIPPED"); + yr_set_integer( + IMAGE_FILE_LOCAL_SYMS_STRIPPED, module_object, "LOCAL_SYMS_STRIPPED"); +- yr_set_integer(IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); ++ yr_set_integer( ++ IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); + yr_set_integer( + IMAGE_FILE_LARGE_ADDRESS_AWARE, module_object, "LARGE_ADDRESS_AWARE"); +- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); ++ yr_set_integer( ++ IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); + yr_set_integer(IMAGE_FILE_32BIT_MACHINE, module_object, "MACHINE_32BIT"); + yr_set_integer(IMAGE_FILE_DEBUG_STRIPPED, module_object, "DEBUG_STRIPPED"); + yr_set_integer( + IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, + module_object, + "REMOVABLE_RUN_FROM_SWAP"); +- yr_set_integer(IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); ++ yr_set_integer( ++ IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); + yr_set_integer(IMAGE_FILE_SYSTEM, module_object, "SYSTEM"); + yr_set_integer(IMAGE_FILE_DLL, module_object, "DLL"); + yr_set_integer(IMAGE_FILE_UP_SYSTEM_ONLY, module_object, "UP_SYSTEM_ONLY"); +- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); ++ yr_set_integer( ++ IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); + + yr_set_integer( + IMAGE_DIRECTORY_ENTRY_EXPORT, +@@ -4056,7 +4086,8 @@ int module_load( + IMAGE_SCN_NO_DEFER_SPEC_EXC, module_object, "SECTION_NO_DEFER_SPEC_EXC"); + yr_set_integer(IMAGE_SCN_GPREL, module_object, "SECTION_GPREL"); + yr_set_integer(IMAGE_SCN_MEM_FARDATA, module_object, "SECTION_MEM_FARDATA"); +- yr_set_integer(IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); ++ yr_set_integer( ++ IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); + yr_set_integer(IMAGE_SCN_MEM_16BIT, module_object, "SECTION_MEM_16BIT"); + yr_set_integer(IMAGE_SCN_MEM_LOCKED, module_object, "SECTION_MEM_LOCKED"); + yr_set_integer(IMAGE_SCN_MEM_PRELOAD, module_object, "SECTION_MEM_PRELOAD"); +@@ -4064,9 +4095,12 @@ int module_load( + yr_set_integer(IMAGE_SCN_ALIGN_2BYTES, module_object, "SECTION_ALIGN_2BYTES"); + yr_set_integer(IMAGE_SCN_ALIGN_4BYTES, module_object, "SECTION_ALIGN_4BYTES"); + yr_set_integer(IMAGE_SCN_ALIGN_8BYTES, module_object, "SECTION_ALIGN_8BYTES"); +- yr_set_integer(IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); +- yr_set_integer(IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); +- yr_set_integer(IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); ++ yr_set_integer( ++ IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); ++ yr_set_integer( ++ IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); ++ yr_set_integer( ++ IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); + yr_set_integer( + IMAGE_SCN_ALIGN_128BYTES, module_object, "SECTION_ALIGN_128BYTES"); + yr_set_integer( +@@ -4088,7 +4122,8 @@ int module_load( + IMAGE_SCN_MEM_DISCARDABLE, module_object, "SECTION_MEM_DISCARDABLE"); + yr_set_integer( + IMAGE_SCN_MEM_NOT_CACHED, module_object, "SECTION_MEM_NOT_CACHED"); +- yr_set_integer(IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); ++ yr_set_integer( ++ IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); + yr_set_integer(IMAGE_SCN_MEM_SHARED, module_object, "SECTION_MEM_SHARED"); + yr_set_integer(IMAGE_SCN_MEM_EXECUTE, module_object, "SECTION_MEM_EXECUTE"); + yr_set_integer(IMAGE_SCN_MEM_READ, module_object, "SECTION_MEM_READ"); +@@ -4115,13 +4150,15 @@ int module_load( + yr_set_integer(RESOURCE_TYPE_VERSION, module_object, "RESOURCE_TYPE_VERSION"); + yr_set_integer( + RESOURCE_TYPE_DLGINCLUDE, module_object, "RESOURCE_TYPE_DLGINCLUDE"); +- yr_set_integer(RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); ++ yr_set_integer( ++ RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); + yr_set_integer(RESOURCE_TYPE_VXD, module_object, "RESOURCE_TYPE_VXD"); + yr_set_integer( + RESOURCE_TYPE_ANICURSOR, module_object, "RESOURCE_TYPE_ANICURSOR"); + yr_set_integer(RESOURCE_TYPE_ANIICON, module_object, "RESOURCE_TYPE_ANIICON"); + yr_set_integer(RESOURCE_TYPE_HTML, module_object, "RESOURCE_TYPE_HTML"); +- yr_set_integer(RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); ++ yr_set_integer( ++ RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); + + yr_set_integer( + IMAGE_DEBUG_TYPE_UNKNOWN, module_object, "IMAGE_DEBUG_TYPE_UNKNOWN"); +@@ -4132,7 +4169,8 @@ int module_load( + yr_set_integer(IMAGE_DEBUG_TYPE_MISC, module_object, "IMAGE_DEBUG_TYPE_MISC"); + yr_set_integer( + IMAGE_DEBUG_TYPE_EXCEPTION, module_object, "IMAGE_DEBUG_TYPE_EXCEPTION"); +- yr_set_integer(IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); + yr_set_integer( + IMAGE_DEBUG_TYPE_OMAP_TO_SRC, + module_object, +@@ -4147,15 +4185,18 @@ int module_load( + IMAGE_DEBUG_TYPE_RESERVED10, + module_object, + "IMAGE_DEBUG_TYPE_RESERVED10"); +- yr_set_integer(IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); + yr_set_integer( + IMAGE_DEBUG_TYPE_VC_FEATURE, + module_object, + "IMAGE_DEBUG_TYPE_VC_FEATURE"); + yr_set_integer(IMAGE_DEBUG_TYPE_POGO, module_object, "IMAGE_DEBUG_TYPE_POGO"); +- yr_set_integer(IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); + yr_set_integer(IMAGE_DEBUG_TYPE_MPX, module_object, "IMAGE_DEBUG_TYPE_MPX"); +- yr_set_integer(IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); + + yr_set_integer(0, module_object, "is_pe"); + diff --git a/yara-4.3.0-test-pe2-s390x.patch b/yara-4.3.0-test-pe2-s390x.patch new file mode 100644 index 0000000..d128b61 --- /dev/null +++ b/yara-4.3.0-test-pe2-s390x.patch @@ -0,0 +1,24 @@ +From d1a6ef20c049d86a136111dce53b4eb65c4df1bd Mon Sep 17 00:00:00 2001 +From: "Victor M. Alvarez" +Date: Fri, 20 Jan 2023 19:41:36 +0100 +Subject: [PATCH] Fix another issue with `yr_le32toh` used incorrectly. + +--- + libyara/modules/pe/pe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c +index 354c6a103..181a36879 100644 +--- a/libyara/modules/pe/pe.c ++++ b/libyara/modules/pe/pe.c +@@ -912,8 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( + has_ordinal = 1; + } + +- rva_address = yr_le32toh( +- import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); ++ rva_address = yr_le32toh(import_descriptor->FirstThunk) + ++ (sizeof(uint32_t) * func_idx); + + if (name != NULL || has_ordinal == 1) + { From ea4109aa72d21fe59d7db4e1bf67ed4d80ebdfc5 Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 17:54:26 +0100 Subject: [PATCH 17/54] fix wrong data in the changelog --- yara.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index d8baf19..8f6c38d 100644 --- a/yara.spec +++ b/yara.spec @@ -185,7 +185,7 @@ make check || ( %changelog -* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.2 +* Tue Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build * Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 From 89a3718502ec7aff67bdfb25df38554f9bcfd15d Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 17:56:32 +0100 Subject: [PATCH 18/54] fix wrong date in the changelog --- yara.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 8f6c38d..6a2f7f1 100644 --- a/yara.spec +++ b/yara.spec @@ -185,7 +185,7 @@ make check || ( %changelog -* Tue Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 +* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build * Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 From e8ce13d6c32e362f29b922b15ecdbf63921feb08 Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 24 Jan 2023 01:30:37 +0100 Subject: [PATCH 19/54] fix make check on EPEL9 (and possibly future Fedoras) --- yara.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index 6a2f7f1..0a61e27 100644 --- a/yara.spec +++ b/yara.spec @@ -2,7 +2,7 @@ Name: yara Version: 4.3.0 %global upversion %{version}-rc1 -Release: 0.rc1.2%{?dist} +Release: 0.rc1.3%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -141,6 +141,8 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check +# reenable the validation of SHA1 certificates in OPENSSL (RHEL9 disabled that by default) +export OPENSSL_ENABLE_SHA1_SIGNATURES=yes make check || ( # print more verbose info in case the test(s) fail echo "===== ./test-suite.log" @@ -157,7 +159,6 @@ make check || ( # test-pe and test-dotnet fails for x390x at this point - ignored for rc1 true %else - # test-pe fails for RHEL9 x86-64 at this point in copr on "AMD EPYC" cpu, it doesn't affect Fedora build on Intel CPU false %endif ) @@ -185,6 +186,9 @@ make check || ( %changelog +* Mon Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check + * Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build From 1848b165ac2dd28b5e911165ce7733c3e3b79bfc Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 24 Jan 2023 01:33:13 +0100 Subject: [PATCH 20/54] fix bogus date --- yara.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 0a61e27..445c6c9 100644 --- a/yara.spec +++ b/yara.spec @@ -186,7 +186,7 @@ make check || ( %changelog -* Mon Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 - fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check * Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 From 330d466bfdee9c357c29efc5df3ad36fc1edf119 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 31 Mar 2023 00:16:36 +0200 Subject: [PATCH 21/54] bump to 4.3.0 --- .gitignore | 34 ++------------------------- sources | 2 +- yara.spec | 69 ++++++++++++++++++++++++++++++------------------------ 3 files changed, 41 insertions(+), 64 deletions(-) diff --git a/.gitignore b/.gitignore index 32c4f50..ee07a5a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,32 +1,2 @@ -/androguard-yara-3.5.0-fc14c0f.tar.gz -/androguard-yara-3.6.0-e4cf5fa.tar.gz -/androguard-yara-3.6.2-e4cf5fa.tar.gz -/androguard-yara-3.6.3-e4cf5fa.tar.gz -/androguard-yara-e4cf5fa.tar.gz -/androguard-yara-fa11a84.tar.gz -/androguard-yara-3eea86a.tar.gz -/androguard-yara-2020-04-22-3eea86a.tar.gz -/yara-3.5.0-7473441.tar.gz -/yara-3.6.0.tar.gz -/yara-3.6.2.tar.gz -/yara-3.6.3.tar.gz -/yara-3.7.0.tar.gz -/yara-3.7.1.tar.gz -/yara-3.8.1.tar.gz -/yara-3.9.0.tar.gz -/yara-3.10.0.tar.gz -/yara-3.11.0.tar.gz -/yara-4.0.0.tar.gz -/yara-4.0.1.tar.gz -/yara-4.0.2.tar.gz -/yara-4.0.4.tar.gz -/yara-4.0.5.tar.gz -/yara-4.1.0.tar.gz -/yara-4.1.1.tar.gz -/yara-4.1.3.tar.gz -/yara-4.2.0-rc1.tar.gz -/yara-4.2.0.tar.gz -/yara-4.2.1.tar.gz -/yara-4.2.2.tar.gz -/yara-4.2.3.tar.gz -/yara-4.3.0-rc1.tar.gz +/androguard-yara-*.tar.gz +/yara-*.tar.gz diff --git a/sources b/sources index 256cc62..31775b1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.0-rc1.tar.gz) = 7df91e67e55aef6a0b637640f353ca6c40dad636665ac86c960ab5e9f3bedaaeb8a3f2e16712da11594ac7a6dd772eb79df18cd6c088d2b951db84faf85c1374 +SHA512 (yara-4.3.0.tar.gz) = fe239ae2f29fac7b4dbdc0ec84eba057dd4d93c6ae3a53d6bc2a333cc15ed45b1ff5cb896faf02813be667ce191ccbe1d64549552ea4f0834804ad0ec4b29092 diff --git a/yara.spec b/yara.spec index 445c6c9..5fb5ff7 100644 --- a/yara.spec +++ b/yara.spec @@ -1,41 +1,50 @@ Name: yara Version: 4.3.0 -%global upversion %{version}-rc1 - -Release: 0.rc1.3%{?dist} +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers +URL: https://VirusTotal.github.io/yara/ +VCS: https://github.com/VirusTotal/yara/ +# https://github.com/VirusTotal/yara/releases # yara package itself is licensed with BSD 3 clause license # bison grammar parsers in libyara/* are licensed with GPLv3+ license with exception from FSF alloving usage in larger work # resulting binary package licensed as BSD -License: BSD -VCS: https://github.com/VirusTotal/yara/ -# https://github.com/VirusTotal/yara/releases -URL: https://VirusTotal.github.io/yara/ +License: BSD-3-Clause + +%global common_description %{expand: +YARA is a tool aimed at (but not limited to) helping malware researchers to +identify and classify malware samples. With YARA you can create descriptions +of malware families (or whatever you want to describe) based on textual or +binary patterns. Each description, a.k.a rule, consists of a set of strings +and a Boolean expression which determine its logic. +} %global gituser VirusTotal %global gitname yara -# Commit of version 4.3.0rc1 -%global commit 8b8384d15fc5358cee449d88070cc9c8be9ec4ce +%global gitdate 20230322 +# Commit of version 4.3.0rc1 + fixes +%global commit 96790e56fc0fc0ce8598d215f969d8b7d8ca1015 %global shortcommit %(c=%{commit}; echo ${c:0:7}) +%bcond_without release + -# Build from git commit baseline -#Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz # Build from git release version -# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{version}.tar.gz#/%%{name}-%%{version}.tar.gz -Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.tar.gz#/%{name}-%{upversion}.tar.gz - +%if %{with release} +Release: %{baserelease}%{?dist} +# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +%else +# Build from git commit baseline +Release: %{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +%endif # Use default sphix theme to generate documentation rather than sphinx_rtd_theme # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch -# https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491 -# test-pe fails on s390x -Patch2: https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491.patch#/yara-4.3.0-test-pe-s390x.patch -Patch3: https://github.com/VirusTotal/yara/commit/d1a6ef20c049d86a136111dce53b4eb65c4df1bd.patch#/yara-4.3.0-test-pe2-s390x.patch BuildRequires: git BuildRequires: gcc @@ -69,12 +78,7 @@ BuildRequires: openssl-devel BuildRequires: /usr/bin/sphinx-build %description -YARA is a tool aimed at (but not limited to) helping malware researchers to -identify and classify malware samples. With YARA you can create descriptions -of malware families (or whatever you want to describe) based on textual or -binary patterns. Each description, a.k.a rule, consists of a set of strings -and a Boolean expression which determine its logic. - +%{common_description} %package doc Summary: Documentation for %{name} @@ -82,6 +86,7 @@ BuildArch: noarch %description doc This package contains documentation for %{name}. +%{common_description} %package devel @@ -92,17 +97,16 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %description devel The %{name}-devel package contains libraries and header files for developing applications that use %{name}. - +%{common_description} %prep -# autosetup -n %%{gitname}-%%{commit} -p 1 -S git -%autosetup -n %{gitname}-%{upversion} -p 1 -S git +%if %{with release} + %autosetup -n %{gitname}-%{version} -p 1 -S git +%else + %autosetup -n %{gitname}-%{commit} -p 1 -S git +%endif autoreconf --force --install - - - - %build # Add missing protobuf definition on RHEL7, and also configure for the libcrypto11/openssl11 from EPEL @@ -186,6 +190,9 @@ make check || ( %changelog +* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 +- bump to 4.3.0 + * Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 - fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check From dbd2ea6f4dfed46814b28041d0d3d4cbe8a8e109 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 31 Mar 2023 01:22:29 +0200 Subject: [PATCH 22/54] cleanup --- yara-4.3.0-test-pe-s390x.patch | 393 -------------------------------- yara-4.3.0-test-pe2-s390x.patch | 24 -- yara.spec | 3 +- 3 files changed, 1 insertion(+), 419 deletions(-) delete mode 100644 yara-4.3.0-test-pe-s390x.patch delete mode 100644 yara-4.3.0-test-pe2-s390x.patch diff --git a/yara-4.3.0-test-pe-s390x.patch b/yara-4.3.0-test-pe-s390x.patch deleted file mode 100644 index 76630e0..0000000 --- a/yara-4.3.0-test-pe-s390x.patch +++ /dev/null @@ -1,393 +0,0 @@ -From 90c43e24f0dedd130bea199e6c23094271c3f491 Mon Sep 17 00:00:00 2001 -From: "Victor M. Alvarez" -Date: Fri, 20 Jan 2023 10:24:55 +0100 -Subject: [PATCH] Try fixing issue #1855. - -PR #1768 added RVA field to function details in PE module. The new code had the following line: - -``` -rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); -``` - -The `yr_le64toh` should be used for converting the value of `import_descriptor->FirstThunk` from little-endian to the host's endianness *before* performing the add operation. However, the addition was performed before the conversion. - -This may be the cause of some test cases failing in big endian platforms. ---- - libyara/modules/pe/pe.c | 137 ++++++++++++++++++++++++++-------------- - 1 file changed, 89 insertions(+), 48 deletions(-) - -diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c -index 61da53cc0..354c6a103 100644 ---- a/libyara/modules/pe/pe.c -+++ b/libyara/modules/pe/pe.c -@@ -837,7 +837,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( - has_ordinal = 1; - } - -- rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); -+ rva_address = yr_le64toh(import_descriptor->FirstThunk) + -+ (sizeof(uint64_t) * func_idx); - - if (name != NULL || has_ordinal == 1) - { -@@ -911,7 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( - has_ordinal = 1; - } - -- rva_address = yr_le32toh(import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); -+ rva_address = yr_le32toh( -+ import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); - - if (name != NULL || has_ordinal == 1) - { -@@ -1013,7 +1015,8 @@ void pe_set_imports( - { - yr_set_string(func->name, pe->object, fun_name, dll_cnt, fun_cnt); - if (func->has_ordinal) -- yr_set_integer(func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); -+ yr_set_integer( -+ func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); - else - yr_set_integer(YR_UNDEFINED, pe->object, fun_ordinal, dll_cnt, fun_cnt); - if (func->rva) -@@ -1114,7 +1117,8 @@ static IMPORTED_DLL* pe_parse_imports(PE* pe) - } - - yr_set_integer(num_imports, pe->object, "number_of_imports"); -- yr_set_integer(num_function_imports, pe->object, "number_of_imported_functions"); -+ yr_set_integer( -+ num_function_imports, pe->object, "number_of_imported_functions"); - pe_set_imports( - pe, - head, -@@ -1369,7 +1373,7 @@ static void* pe_parse_delayed_imports(PE* pe) - imported_func->has_ordinal = 1; - } - -- imported_func->rva = yr_le64toh(func_rva); -+ imported_func->rva = yr_le64toh(func_rva); - - num_function_imports++; - name_rva += pointer_size; -@@ -1628,19 +1632,22 @@ static void pe_parse_exports(PE* pe) - for (int j = 0; j < cert->sha1.len; ++j) \ - sprintf(thumbprint_ascii + (j * 2), "%02x", cert->sha1.data[j]); \ - \ -- yr_set_string( \ -+ yr_set_string( \ - (char*) thumbprint_ascii, pe->object, fmt ".thumbprint", __VA_ARGS__); \ - \ -- yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ -- yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ -+ yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ -+ yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ - /* Versions are zero based, so add one. */ \ -- yr_set_integer(cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ -- yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ -- yr_set_string( \ -+ yr_set_integer( \ -+ cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ -+ yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ -+ yr_set_string( \ - cert->sig_alg_oid, pe->object, fmt ".algorithm_oid", __VA_ARGS__); \ -- yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ -- yr_set_integer(cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ -- yr_set_integer(cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ -+ yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ -+ yr_set_integer( \ -+ cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ -+ yr_set_integer( \ -+ cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ - } while (0) - - void _process_authenticode( -@@ -1677,7 +1684,8 @@ void _process_authenticode( - for (int j = 0; j < authenticode->digest.len; ++j) - sprintf(digest_ascii + (j * 2), "%02x", authenticode->digest.data[j]); - -- yr_set_string(digest_ascii, pe->object, "signatures[%i].digest", *sig_count); -+ yr_set_string( -+ digest_ascii, pe->object, "signatures[%i].digest", *sig_count); - yr_free(digest_ascii); - } - -@@ -2101,7 +2109,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) - pe->object, - "size_of_headers"); - -- yr_set_integer(yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); -+ yr_set_integer( -+ yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); - - yr_set_integer( - yr_le16toh(OptionalHeader(pe, Subsystem)), pe->object, "subsystem"); -@@ -2291,7 +2300,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) - if (last_section_end && (pe->data_size > last_section_end)) - { - yr_set_integer(last_section_end, pe->object, "overlay.offset"); -- yr_set_integer(pe->data_size - last_section_end, pe->object, "overlay.size"); -+ yr_set_integer( -+ pe->data_size - last_section_end, pe->object, "overlay.size"); - } - else - { -@@ -3058,7 +3068,8 @@ define_function(delayed_import_rva) - - for (int i = 0; i < num_imports; i++) - { -- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); -+ dll_name = yr_get_string( -+ module, "delayed_import_details[%i].library_name", i); - if (dll_name == NULL || IS_UNDEFINED(dll_name) || - ss_compare(in_dll_name, dll_name) != 0) - continue; -@@ -3103,7 +3114,8 @@ define_function(delayed_import_rva_ordinal) - - for (int i = 0; i < num_imports; i++) - { -- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); -+ dll_name = yr_get_string( -+ module, "delayed_import_details[%i].library_name", i); - if (dll_name == NULL || IS_UNDEFINED(dll_name) || - ss_compare(in_dll_name, dll_name) != 0) - continue; -@@ -3148,7 +3160,8 @@ define_function(locale) - - for (int i = 0; i < n; i++) - { -- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); -+ uint64_t rsrc_language = yr_get_integer( -+ module, "resources[%i].language", i); - - if ((rsrc_language & 0xFFFF) == locale) - return_integer(1); -@@ -3176,7 +3189,8 @@ define_function(language) - - for (int i = 0; i < n; i++) - { -- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); -+ uint64_t rsrc_language = yr_get_integer( -+ module, "resources[%i].language", i); - - if ((rsrc_language & 0xFF) == language) - return_integer(1); -@@ -3754,7 +3768,8 @@ begin_declarations - declare_string("digest"); - declare_string("file_digest"); - declare_integer("number_of_certificates"); -- begin_struct_array("certificates"); -+ begin_struct_array("certificates") -+ ; - declare_string("thumbprint"); - declare_string("issuer"); - declare_string("subject"); -@@ -3766,12 +3781,14 @@ begin_declarations - declare_integer("not_after"); - end_struct_array("certificates"); - -- begin_struct("signer_info"); -+ begin_struct("signer_info") -+ ; - declare_string("program_name"); - declare_string("digest"); - declare_string("digest_alg"); - declare_integer("length_of_chain"); -- begin_struct_array("chain"); -+ begin_struct_array("chain") -+ ; - declare_string("thumbprint"); - declare_string("issuer"); - declare_string("subject"); -@@ -3785,13 +3802,15 @@ begin_declarations - end_struct("signer_info"); - - declare_integer("number_of_countersignatures"); -- begin_struct_array("countersignatures"); -+ begin_struct_array("countersignatures") -+ ; - declare_integer("verified"); - declare_integer("sign_time"); - declare_string("digest_alg"); - declare_string("digest"); - declare_integer("length_of_chain"); -- begin_struct_array("chain"); -+ begin_struct_array("chain") -+ ; - declare_string("thumbprint"); - declare_string("issuer"); - declare_string("subject"); -@@ -3860,16 +3879,19 @@ int module_load( - yr_set_integer(IMAGE_FILE_MACHINE_M32R, module_object, "MACHINE_M32R"); - yr_set_integer(IMAGE_FILE_MACHINE_MIPS16, module_object, "MACHINE_MIPS16"); - yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU, module_object, "MACHINE_MIPSFPU"); -- yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); -+ yr_set_integer( -+ IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); - yr_set_integer(IMAGE_FILE_MACHINE_POWERPC, module_object, "MACHINE_POWERPC"); -- yr_set_integer(IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); -+ yr_set_integer( -+ IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); - yr_set_integer(IMAGE_FILE_MACHINE_R4000, module_object, "MACHINE_R4000"); - yr_set_integer(IMAGE_FILE_MACHINE_SH3, module_object, "MACHINE_SH3"); - yr_set_integer(IMAGE_FILE_MACHINE_SH3DSP, module_object, "MACHINE_SH3DSP"); - yr_set_integer(IMAGE_FILE_MACHINE_SH4, module_object, "MACHINE_SH4"); - yr_set_integer(IMAGE_FILE_MACHINE_SH5, module_object, "MACHINE_SH5"); - yr_set_integer(IMAGE_FILE_MACHINE_THUMB, module_object, "MACHINE_THUMB"); -- yr_set_integer(IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); -+ yr_set_integer( -+ IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); - yr_set_integer( - IMAGE_FILE_MACHINE_TARGET_HOST, module_object, "MACHINE_TARGET_HOST"); - yr_set_integer(IMAGE_FILE_MACHINE_R3000, module_object, "MACHINE_R3000"); -@@ -3889,7 +3911,8 @@ int module_load( - yr_set_integer( - IMAGE_SUBSYSTEM_WINDOWS_CUI, module_object, "SUBSYSTEM_WINDOWS_CUI"); - yr_set_integer(IMAGE_SUBSYSTEM_OS2_CUI, module_object, "SUBSYSTEM_OS2_CUI"); -- yr_set_integer(IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); -+ yr_set_integer( -+ IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); - yr_set_integer( - IMAGE_SUBSYSTEM_NATIVE_WINDOWS, - module_object, -@@ -3928,14 +3951,16 @@ int module_load( - IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, - module_object, - "FORCE_INTEGRITY"); -- yr_set_integer(IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); -+ yr_set_integer( -+ IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); - yr_set_integer( - IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, module_object, "NO_ISOLATION"); - yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_SEH, module_object, "NO_SEH"); - yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_BIND, module_object, "NO_BIND"); - yr_set_integer( - IMAGE_DLLCHARACTERISTICS_APPCONTAINER, module_object, "APPCONTAINER"); -- yr_set_integer(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); -+ yr_set_integer( -+ IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); - yr_set_integer(IMAGE_DLLCHARACTERISTICS_GUARD_CF, module_object, "GUARD_CF"); - yr_set_integer( - IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, -@@ -3943,26 +3968,31 @@ int module_load( - "TERMINAL_SERVER_AWARE"); - - yr_set_integer(IMAGE_FILE_RELOCS_STRIPPED, module_object, "RELOCS_STRIPPED"); -- yr_set_integer(IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); -+ yr_set_integer( -+ IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); - yr_set_integer( - IMAGE_FILE_LINE_NUMS_STRIPPED, module_object, "LINE_NUMS_STRIPPED"); - yr_set_integer( - IMAGE_FILE_LOCAL_SYMS_STRIPPED, module_object, "LOCAL_SYMS_STRIPPED"); -- yr_set_integer(IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); -+ yr_set_integer( -+ IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); - yr_set_integer( - IMAGE_FILE_LARGE_ADDRESS_AWARE, module_object, "LARGE_ADDRESS_AWARE"); -- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); -+ yr_set_integer( -+ IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); - yr_set_integer(IMAGE_FILE_32BIT_MACHINE, module_object, "MACHINE_32BIT"); - yr_set_integer(IMAGE_FILE_DEBUG_STRIPPED, module_object, "DEBUG_STRIPPED"); - yr_set_integer( - IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, - module_object, - "REMOVABLE_RUN_FROM_SWAP"); -- yr_set_integer(IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); -+ yr_set_integer( -+ IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); - yr_set_integer(IMAGE_FILE_SYSTEM, module_object, "SYSTEM"); - yr_set_integer(IMAGE_FILE_DLL, module_object, "DLL"); - yr_set_integer(IMAGE_FILE_UP_SYSTEM_ONLY, module_object, "UP_SYSTEM_ONLY"); -- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); -+ yr_set_integer( -+ IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); - - yr_set_integer( - IMAGE_DIRECTORY_ENTRY_EXPORT, -@@ -4056,7 +4086,8 @@ int module_load( - IMAGE_SCN_NO_DEFER_SPEC_EXC, module_object, "SECTION_NO_DEFER_SPEC_EXC"); - yr_set_integer(IMAGE_SCN_GPREL, module_object, "SECTION_GPREL"); - yr_set_integer(IMAGE_SCN_MEM_FARDATA, module_object, "SECTION_MEM_FARDATA"); -- yr_set_integer(IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); -+ yr_set_integer( -+ IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); - yr_set_integer(IMAGE_SCN_MEM_16BIT, module_object, "SECTION_MEM_16BIT"); - yr_set_integer(IMAGE_SCN_MEM_LOCKED, module_object, "SECTION_MEM_LOCKED"); - yr_set_integer(IMAGE_SCN_MEM_PRELOAD, module_object, "SECTION_MEM_PRELOAD"); -@@ -4064,9 +4095,12 @@ int module_load( - yr_set_integer(IMAGE_SCN_ALIGN_2BYTES, module_object, "SECTION_ALIGN_2BYTES"); - yr_set_integer(IMAGE_SCN_ALIGN_4BYTES, module_object, "SECTION_ALIGN_4BYTES"); - yr_set_integer(IMAGE_SCN_ALIGN_8BYTES, module_object, "SECTION_ALIGN_8BYTES"); -- yr_set_integer(IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); -- yr_set_integer(IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); -- yr_set_integer(IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); -+ yr_set_integer( -+ IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); -+ yr_set_integer( -+ IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); -+ yr_set_integer( -+ IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); - yr_set_integer( - IMAGE_SCN_ALIGN_128BYTES, module_object, "SECTION_ALIGN_128BYTES"); - yr_set_integer( -@@ -4088,7 +4122,8 @@ int module_load( - IMAGE_SCN_MEM_DISCARDABLE, module_object, "SECTION_MEM_DISCARDABLE"); - yr_set_integer( - IMAGE_SCN_MEM_NOT_CACHED, module_object, "SECTION_MEM_NOT_CACHED"); -- yr_set_integer(IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); -+ yr_set_integer( -+ IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); - yr_set_integer(IMAGE_SCN_MEM_SHARED, module_object, "SECTION_MEM_SHARED"); - yr_set_integer(IMAGE_SCN_MEM_EXECUTE, module_object, "SECTION_MEM_EXECUTE"); - yr_set_integer(IMAGE_SCN_MEM_READ, module_object, "SECTION_MEM_READ"); -@@ -4115,13 +4150,15 @@ int module_load( - yr_set_integer(RESOURCE_TYPE_VERSION, module_object, "RESOURCE_TYPE_VERSION"); - yr_set_integer( - RESOURCE_TYPE_DLGINCLUDE, module_object, "RESOURCE_TYPE_DLGINCLUDE"); -- yr_set_integer(RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); -+ yr_set_integer( -+ RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); - yr_set_integer(RESOURCE_TYPE_VXD, module_object, "RESOURCE_TYPE_VXD"); - yr_set_integer( - RESOURCE_TYPE_ANICURSOR, module_object, "RESOURCE_TYPE_ANICURSOR"); - yr_set_integer(RESOURCE_TYPE_ANIICON, module_object, "RESOURCE_TYPE_ANIICON"); - yr_set_integer(RESOURCE_TYPE_HTML, module_object, "RESOURCE_TYPE_HTML"); -- yr_set_integer(RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); -+ yr_set_integer( -+ RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); - - yr_set_integer( - IMAGE_DEBUG_TYPE_UNKNOWN, module_object, "IMAGE_DEBUG_TYPE_UNKNOWN"); -@@ -4132,7 +4169,8 @@ int module_load( - yr_set_integer(IMAGE_DEBUG_TYPE_MISC, module_object, "IMAGE_DEBUG_TYPE_MISC"); - yr_set_integer( - IMAGE_DEBUG_TYPE_EXCEPTION, module_object, "IMAGE_DEBUG_TYPE_EXCEPTION"); -- yr_set_integer(IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); - yr_set_integer( - IMAGE_DEBUG_TYPE_OMAP_TO_SRC, - module_object, -@@ -4147,15 +4185,18 @@ int module_load( - IMAGE_DEBUG_TYPE_RESERVED10, - module_object, - "IMAGE_DEBUG_TYPE_RESERVED10"); -- yr_set_integer(IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); - yr_set_integer( - IMAGE_DEBUG_TYPE_VC_FEATURE, - module_object, - "IMAGE_DEBUG_TYPE_VC_FEATURE"); - yr_set_integer(IMAGE_DEBUG_TYPE_POGO, module_object, "IMAGE_DEBUG_TYPE_POGO"); -- yr_set_integer(IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); - yr_set_integer(IMAGE_DEBUG_TYPE_MPX, module_object, "IMAGE_DEBUG_TYPE_MPX"); -- yr_set_integer(IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); - - yr_set_integer(0, module_object, "is_pe"); - diff --git a/yara-4.3.0-test-pe2-s390x.patch b/yara-4.3.0-test-pe2-s390x.patch deleted file mode 100644 index d128b61..0000000 --- a/yara-4.3.0-test-pe2-s390x.patch +++ /dev/null @@ -1,24 +0,0 @@ -From d1a6ef20c049d86a136111dce53b4eb65c4df1bd Mon Sep 17 00:00:00 2001 -From: "Victor M. Alvarez" -Date: Fri, 20 Jan 2023 19:41:36 +0100 -Subject: [PATCH] Fix another issue with `yr_le32toh` used incorrectly. - ---- - libyara/modules/pe/pe.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c -index 354c6a103..181a36879 100644 ---- a/libyara/modules/pe/pe.c -+++ b/libyara/modules/pe/pe.c -@@ -912,8 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( - has_ordinal = 1; - } - -- rva_address = yr_le32toh( -- import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); -+ rva_address = yr_le32toh(import_descriptor->FirstThunk) + -+ (sizeof(uint32_t) * func_idx); - - if (name != NULL || has_ordinal == 1) - { diff --git a/yara.spec b/yara.spec index 5fb5ff7..d5915a0 100644 --- a/yara.spec +++ b/yara.spec @@ -16,8 +16,7 @@ YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings -and a Boolean expression which determine its logic. -} +and a Boolean expression which determine its logic.} %global gituser VirusTotal From 2f65236464d70b7221002e3dfa7cde52ba8437b8 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 26 Apr 2023 02:20:10 +0200 Subject: [PATCH 23/54] bump to 4.3.1 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 31775b1..d5f9921 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.0.tar.gz) = fe239ae2f29fac7b4dbdc0ec84eba057dd4d93c6ae3a53d6bc2a333cc15ed45b1ff5cb896faf02813be667ce191ccbe1d64549552ea4f0834804ad0ec4b29092 +SHA512 (yara-4.3.1.tar.gz) = 93a2243d54397e76175fa0106451965b7f3a1f1918307c2bae6193f3725b69f60f70c3901a12c1690368f5b37e973a65c63a299624a521d204b12b48d5efe496 From ffc670dd42fb4819ae6aa94fa6ba434e0074495a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 26 Apr 2023 02:24:57 +0200 Subject: [PATCH 24/54] bump 4.3.1 --- yara.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index d5915a0..fbec20d 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.3.0 +Version: 4.3.1 %global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -%global gitdate 20230322 -# Commit of version 4.3.0rc1 + fixes -%global commit 96790e56fc0fc0ce8598d215f969d8b7d8ca1015 +%global gitdate 20230420 +# Commit of version 4.3.1 +%global commit a6f6ce1d6d74a03c396660db25765f2a794d9e30 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,6 +189,9 @@ make check || ( %changelog +* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 +- bump to 4.3.1 + * Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 - bump to 4.3.0 From e01185c6911c8b732082944727dc3fd0192a8adb Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 14 Jun 2023 01:29:48 +0200 Subject: [PATCH 25/54] bump to 4.3.2 --- sources | 2 +- yara.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/sources b/sources index d5f9921..903a84c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.1.tar.gz) = 93a2243d54397e76175fa0106451965b7f3a1f1918307c2bae6193f3725b69f60f70c3901a12c1690368f5b37e973a65c63a299624a521d204b12b48d5efe496 +SHA512 (yara-4.3.2.tar.gz) = dc77ec46a30ca2fff33b639166fc554c9c6d9e955642774e23da3ea7dbb25fe154cfd4ef83c9808920193028b9099258a63b3f1b9a66864a1f3905f0a8e8053f diff --git a/yara.spec b/yara.spec index fbec20d..7c123ad 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.3.1 +Version: 4.3.2 %global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 +- bump to 4.3.2 + * Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 - bump to 4.3.1 From 8f09637df69681be7c1307c0ba86931b3677f604 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 19:28:14 +0000 Subject: [PATCH 26/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 7c123ad..f0a19bf 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.3.2 -%global baserelease 1 +%global baserelease 2 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 - bump to 4.3.2 From ac1ea090f88dd8500a32c777909498b19ffc878c Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga Date: Sun, 17 Sep 2023 11:14:46 +0200 Subject: [PATCH 27/54] Update to 4.4.0 - Closes rhbz#2239308 --- sources | 2 +- yara.spec | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/sources b/sources index 903a84c..ca75bd5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.2.tar.gz) = dc77ec46a30ca2fff33b639166fc554c9c6d9e955642774e23da3ea7dbb25fe154cfd4ef83c9808920193028b9099258a63b3f1b9a66864a1f3905f0a8e8053f +SHA512 (yara-4.4.0.tar.gz) = 705db57b73e5165a26e0aaea728521f372b9f7f613665860dd22066c30e75a614815fb17ee8654780fcfc157f0137cbeda015ec088a698f31adcf071e233205f diff --git a/yara.spec b/yara.spec index f0a19bf..8fa3353 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara -Version: 4.3.2 -%global baserelease 2 +Version: 4.4.0 +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -%global gitdate 20230420 -# Commit of version 4.3.1 -%global commit a6f6ce1d6d74a03c396660db25765f2a794d9e30 +%global gitdate 20230915 +# Commit of version 4.4.0 +%global commit 1a85738e9af3c77acf035d0be4fe432e476bf82e %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,6 +189,9 @@ make check || ( %changelog +* Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 +- bump to 4.4.0 + * Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From d06cde77edab403690991083757a7df9720cad66 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 10:40:33 +0000 Subject: [PATCH 28/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 8fa3353..2e08551 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.4.0 -%global baserelease 1 +%global baserelease 2 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 4.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 - bump to 4.4.0 From 4e4f91d7dce67a9b5d58fba821bfef603c0e74e1 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 14 Feb 2024 11:53:20 +0100 Subject: [PATCH 29/54] bump to 4.5.0 --- sources | 2 +- yara.spec | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/sources b/sources index ca75bd5..c54568f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.4.0.tar.gz) = 705db57b73e5165a26e0aaea728521f372b9f7f613665860dd22066c30e75a614815fb17ee8654780fcfc157f0137cbeda015ec088a698f31adcf071e233205f +SHA512 (yara-4.5.0.tar.gz) = c9fe8a89879d1a742236101f1754e6b25e70356cdf5c020b2583e3ac509600c3b462756c412b01f2ebcb17df351c83afcf04d1cfaa87e6753eb25bab0f797aa3 diff --git a/yara.spec b/yara.spec index 2e08551..498a69d 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara -Version: 4.4.0 -%global baserelease 2 +Version: 4.5.0 +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 +- bump to 4.5.0 + * Sat Jan 27 2024 Fedora Release Engineering - 4.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From fd3d7a43377759745692012fee0d465df953a50b Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 14 Feb 2024 14:40:44 +0100 Subject: [PATCH 30/54] change also the git snapshot for 4.5.0 --- yara.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index 498a69d..97343b9 100644 --- a/yara.spec +++ b/yara.spec @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -%global gitdate 20230915 -# Commit of version 4.4.0 -%global commit 1a85738e9af3c77acf035d0be4fe432e476bf82e +# Commit of version 4.5.0 +%global gitdate 20240213 +%global commit 8fa55cde4c0cde8a1ba4ced1c131827eb4005f0d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -192,7 +192,10 @@ make check || ( * Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 - bump to 4.5.0 -* Sat Jan 27 2024 Fedora Release Engineering - 4.4.0-2 +* Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 4.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 From ed8ade685c667ad035cfa8404f386c286d9ca300 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 27 May 2024 11:58:24 +0200 Subject: [PATCH 31/54] bump to 4.5.1 --- yara.spec | 89 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 46 insertions(+), 43 deletions(-) diff --git a/yara.spec b/yara.spec index 97343b9..704d8c6 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.0 +Version: 4.5.1 %global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ @@ -22,8 +22,8 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara # Commit of version 4.5.0 -%global gitdate 20240213 -%global commit 8fa55cde4c0cde8a1ba4ced1c131827eb4005f0d +%global gitdate 20240525 +%global commit 0e5b6bb9660cba500eb58dbccb027757c82cc4cf %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,7 +189,10 @@ make check || ( %changelog -* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 +* Mon May 27 2024 Michal Ambroz - 4.5.1-1 +- bump to 4.5.1 + +* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 - bump to 4.5.0 * Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 @@ -204,25 +207,25 @@ make check || ( * Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 +* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 - bump to 4.3.2 -* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 +* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 - bump to 4.3.1 -* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 +* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 - bump to 4.3.0 -* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 - fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check -* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 +* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build * Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 - bump to 4.3.0 rc1 - remove the androguard module which is no longer available from github @@ -239,7 +242,7 @@ make check || ( - BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). - BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). -* Mon May 23 2022 Michal Ambroz - 4.2.1-1 +* Mon May 23 2022 Michal Ambroz - 4.2.1-1 - bump to 4.2.1 - adding changes based on proposal of Mikel Olasagasti Uranga: - change to BSD license as yara was relicensed in 2016 @@ -247,16 +250,16 @@ make check || ( - remove old patches - enable checks -* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 +* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 - bump to 4.2.0 -* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 +* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 - bump to 4.2.0-rc1 * Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild -* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 +* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 - bump to 4.1.3 * Sat Nov 06 2021 Adrian Reber - 4.1.1-5 @@ -271,58 +274,58 @@ make check || ( * Fri Jul 23 2021 Fedora Release Engineering - 4.1.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild -* Mon May 24 2021 Michal Ambroz - 4.1.1-1 +* Mon May 24 2021 Michal Ambroz - 4.1.1-1 - bump to 4.1.1 -* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 +* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 - bump to 4.1.0 -* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 +* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 - rebuild for epel -* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 +* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 - bump to yara bugfix 4.0.5 release -* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 +* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 - bump to yara bugfix 4.0.4 release -* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 +* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 - bump to yara bugfix 4.0.2 release - fix build on epel7 * Sun Jun 14 2020 Adrian Reber - 4.0.1-2 - Rebuilt for protobuf 3.12 -* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 +* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 - bump to yara bugfix 4.0.1 release -* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 +* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 - bump to yara 4.0.0 release * Fri Jan 31 2020 Fedora Release Engineering - 3.11.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 +* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 - bump to 3.11.0 release (#1760678) - BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117) - BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107) - BUGFIX: Buffer overrun in “dotnet” module (upstream #1108) - BUGFIX: Memory leak while attaching to a process fails (upstream #1070) -* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 +* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 - change the sphinx build dependency * Sat Jul 27 2019 Fedora Release Engineering - 3.10.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild -* Fri May 03 2019 Michal Ambroz - 3.10.0-1 +* Fri May 03 2019 Michal Ambroz - 3.10.0-1 - bump to 3.10.0 release (#1680204) - Harden virtual machine against malicious code. - BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025). - BUGFIX: Buffer overrun in “elf” module. - BUGFIX: Buffer overrun in “dotnet” module. -* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 +* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 - bump to 3.9.0 release (#1680203) - switch from python-sphinx to python3-sphinx for generating the documentation for fc31+ - should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976), @@ -335,7 +338,7 @@ make check || ( * Sun Feb 03 2019 Fedora Release Engineering - 3.8.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 +* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 - bump to 3.8.1 release (#1613093) * Sat Jul 14 2018 Fedora Release Engineering - 3.7.1-3 @@ -344,10 +347,10 @@ make check || ( * Fri Feb 09 2018 Fedora Release Engineering - 3.7.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild -* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 +* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 - bump to 3.7.1 release (#1534993) -* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 +* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 - bump to 3.7.0 release (#1511921) * Thu Aug 03 2017 Fedora Release Engineering - 3.6.3-3 @@ -356,17 +359,17 @@ make check || ( * Thu Jul 27 2017 Fedora Release Engineering - 3.6.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild -* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 +* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 - bump to 3.6.3 release - bugfix CVE-2017-11328 -* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 +* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 - bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465 -* Wed May 24 2017 Michal Ambroz - 3.6.0-1 +* Wed May 24 2017 Michal Ambroz - 3.6.0-1 - bump to 3.6.0 release - update the androguard-yara with bugfixes -* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 +* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 - Adding patch from pull request 627 until 3.5.1 is released - https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch - Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 @@ -374,40 +377,40 @@ make check || ( * Sat Feb 11 2017 Fedora Release Engineering - 3.5.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild -* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 +* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 - import package to Fedora - remove unnecessary .buildinfo tag from doc package -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 - package review - bugzilla #1362265 - cosmetics of the changelog - using default spinx theme to remove the static fonts -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 - package review - bugzilla #1362265 - dropped Buildroot, pkgconfig, zlib-devel, defattr - added buildrequires gcc - change license back to ASL 2.0 only -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 - package review - bugzilla #1362265 - changed packaging of doc sub-package -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 - bump to new 3.5.0 -* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 +* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 - package review - bugzilla #1362265 - dropped dependency of python-tools -* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 +* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 - compile with the androguard module -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 - jansson dependency >= 2.5 -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 - python3 stuff -* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 +* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 - initial build for Fedora Project From e9b10828c2fd0f0b373a29427994394e47644dd0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 30 May 2024 02:30:58 +0200 Subject: [PATCH 32/54] bump to 4.5.1 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index c54568f..f19de49 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.0.tar.gz) = c9fe8a89879d1a742236101f1754e6b25e70356cdf5c020b2583e3ac509600c3b462756c412b01f2ebcb17df351c83afcf04d1cfaa87e6753eb25bab0f797aa3 +SHA512 (yara-4.5.1.tar.gz) = 8bf1df7089f9bc5a448dbae0999e04f4ecdec06b4478e2cb5f42a2a3201b99fce68379e3f8f7c67a9db201205366250d7befe5c38451cced807ed692d436422c From 2dac5d6a776e118ef052db2ffc0e4d95f290bc78 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 10:39:07 +0000 Subject: [PATCH 33/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 704d8c6..5a1fc37 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.5.1 -%global baserelease 1 +%global baserelease 2 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Mon May 27 2024 Michal Ambroz - 4.5.1-1 - bump to 4.5.1 From ed9c1e010566c18fc3a2bf30b0b121f0c3c458d8 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 16 Sep 2024 02:56:06 +0200 Subject: [PATCH 34/54] bump to 4.5.2 --- sources | 2 +- yara.spec | 15 +++++++++------ 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/sources b/sources index f19de49..32ad6b8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.1.tar.gz) = 8bf1df7089f9bc5a448dbae0999e04f4ecdec06b4478e2cb5f42a2a3201b99fce68379e3f8f7c67a9db201205366250d7befe5c38451cced807ed692d436422c +SHA512 (yara-4.5.2.tar.gz) = 761f3930117c35d87b0e3be1a5d61a6887006470fdf578164feb1bd56a96b2d85770ab7c3a21258a2781ff3327cb705942f4f0eb959cff4b210f0c7fbec1fc30 diff --git a/yara.spec b/yara.spec index 5a1fc37..60c8563 100644 --- a/yara.spec +++ b/yara.spec @@ -1,9 +1,9 @@ Name: yara -Version: 4.5.1 -%global baserelease 2 +Version: 4.5.2 +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ -VCS: https://github.com/VirusTotal/yara/ +VCS: git:https://github.com/VirusTotal/yara/ # https://github.com/VirusTotal/yara/releases # yara package itself is licensed with BSD 3 clause license @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.0 -%global gitdate 20240525 -%global commit 0e5b6bb9660cba500eb58dbccb027757c82cc4cf +# Commit of version 4.5.2 +%global gitdate 20240910 +%global commit 688268d83983a0d61bb68ef3d8dfd28102b7d1b4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,6 +189,9 @@ make check || ( %changelog +* Mon Sep 16 2024 Michal Ambroz - 4.5.2-1 +- bump to 4.5.2 + * Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 55af515d5cca96b1171443d76e99fe1ef539a31d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 28 Sep 2024 20:03:03 +0200 Subject: [PATCH 35/54] switch to autochangelog --- changelog | 231 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 231 insertions(+) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..298d7f6 --- /dev/null +++ b/changelog @@ -0,0 +1,231 @@ +* Mon Sep 16 2024 Michal Ambroz - 4.5.2-1 +- bump to 4.5.2 + +* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon May 27 2024 Michal Ambroz - 4.5.1-1 +- bump to 4.5.1 + +* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 +- bump to 4.5.0 + +* Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 4.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 +- bump to 4.4.0 + +* Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 +- bump to 4.3.2 + +* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 +- bump to 4.3.1 + +* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 +- bump to 4.3.0 + +* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check + +* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 +- fix EPEL7 build + +* Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 +- bump to 4.3.0 rc1 +- remove the androguard module which is no longer available from github + +* Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 +- Update to 4.2.3 (#2116594) + +* Sat Jul 23 2022 Fedora Release Engineering - 4.2.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jul 18 2022 Mikel Olasagasti Uranga - 4.2.2-1 +- Update to 4.2.2 (#2103444) +- BUGFIX: Fix buffer overrun in "dex" module (#1728). +- BUGFIX: Wrong offset used when checking Version string of .net metadata (#1708). +- BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). +- BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). + +* Mon May 23 2022 Michal Ambroz - 4.2.1-1 +- bump to 4.2.1 +- adding changes based on proposal of Mikel Olasagasti Uranga: +- change to BSD license as yara was relicensed in 2016 +- minor changes to spec, like using https for URL +- remove old patches +- enable checks + +* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 +- bump to 4.2.0 + +* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 +- bump to 4.2.0-rc1 + +* Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 +- bump to 4.1.3 + +* Sat Nov 06 2021 Adrian Reber - 4.1.1-5 +- Rebuilt for protobuf 3.19.0 + +* Mon Oct 25 2021 Adrian Reber - 4.1.1-4 +- Rebuilt for protobuf 3.18.1 + +* Tue Sep 14 2021 Sahana Prasad - 4.1.1-3 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Jul 23 2021 Fedora Release Engineering - 4.1.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon May 24 2021 Michal Ambroz - 4.1.1-1 +- bump to 4.1.1 + +* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 +- bump to 4.1.0 + +* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 +- rebuild for epel + +* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 +- bump to yara bugfix 4.0.5 release + +* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 +- bump to yara bugfix 4.0.4 release + +* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 +- bump to yara bugfix 4.0.2 release +- fix build on epel7 + +* Sun Jun 14 2020 Adrian Reber - 4.0.1-2 +- Rebuilt for protobuf 3.12 + +* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 +- bump to yara bugfix 4.0.1 release + +* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 +- bump to yara 4.0.0 release + +* Fri Jan 31 2020 Fedora Release Engineering - 3.11.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 +- bump to 3.11.0 release (#1760678) +- BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117) +- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107) +- BUGFIX: Buffer overrun in “dotnet” module (upstream #1108) +- BUGFIX: Memory leak while attaching to a process fails (upstream #1070) + +* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 +- change the sphinx build dependency + +* Sat Jul 27 2019 Fedora Release Engineering - 3.10.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri May 03 2019 Michal Ambroz - 3.10.0-1 +- bump to 3.10.0 release (#1680204) +- Harden virtual machine against malicious code. +- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025). +- BUGFIX: Buffer overrun in “elf” module. +- BUGFIX: Buffer overrun in “dotnet” module. + +* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 +- bump to 3.9.0 release (#1680203) +- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+ +- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976), + but by design it might be always dangerous to run yara signatures compiled by 3rd party, + so it is advised to re-compile yara rules instead +- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020) +- BUGFIX: Buffer overflow in "dotnet" module. +- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018) + +* Sun Feb 03 2019 Fedora Release Engineering - 3.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 +- bump to 3.8.1 release (#1613093) + +* Sat Jul 14 2018 Fedora Release Engineering - 3.7.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Feb 09 2018 Fedora Release Engineering - 3.7.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 +- bump to 3.7.1 release (#1534993) + +* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 +- bump to 3.7.0 release (#1511921) + +* Thu Aug 03 2017 Fedora Release Engineering - 3.6.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 3.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 +- bump to 3.6.3 release - bugfix CVE-2017-11328 + +* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 +- bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465 + +* Wed May 24 2017 Michal Ambroz - 3.6.0-1 +- bump to 3.6.0 release +- update the androguard-yara with bugfixes + +* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 +- Adding patch from pull request 627 until 3.5.1 is released +- https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch +- Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 + +* Sat Feb 11 2017 Fedora Release Engineering - 3.5.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 +- import package to Fedora +- remove unnecessary .buildinfo tag from doc package + +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 +- package review - bugzilla #1362265 +- cosmetics of the changelog +- using default spinx theme to remove the static fonts + +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 +- package review - bugzilla #1362265 +- dropped Buildroot, pkgconfig, zlib-devel, defattr +- added buildrequires gcc +- change license back to ASL 2.0 only + +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 +- package review - bugzilla #1362265 +- changed packaging of doc sub-package + +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 +- bump to new 3.5.0 + +* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 +- package review - bugzilla #1362265 +- dropped dependency of python-tools + +* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 +- compile with the androguard module + +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 +- jansson dependency >= 2.5 + +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 +- python3 stuff + +* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 +- initial build for Fedora Project From 649da3935031188047be2f351cad08538e47b828 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 28 Sep 2024 20:03:32 +0200 Subject: [PATCH 36/54] switch to autochangelog --- yara.spec | 236 +----------------------------------------------------- 1 file changed, 3 insertions(+), 233 deletions(-) diff --git a/yara.spec b/yara.spec index 60c8563..cdfc9f8 100644 --- a/yara.spec +++ b/yara.spec @@ -31,12 +31,12 @@ and a Boolean expression which determine its logic.} # Build from git release version %if %{with release} -Release: %{baserelease}%{?dist} +Release: %autorelease -b %{baserelease} # Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz %else # Build from git commit baseline -Release: %{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Release: %autorelease -b %{baserelease} -s %{gitdate}git%{shortcommit} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -189,234 +189,4 @@ make check || ( %changelog -* Mon Sep 16 2024 Michal Ambroz - 4.5.2-1 -- bump to 4.5.2 - -* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Mon May 27 2024 Michal Ambroz - 4.5.1-1 -- bump to 4.5.1 - -* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 -- bump to 4.5.0 - -* Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 4.4.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 -- bump to 4.4.0 - -* Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 -- bump to 4.3.2 - -* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 -- bump to 4.3.1 - -* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 -- bump to 4.3.0 - -* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 -- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check - -* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 -- fix EPEL7 build - -* Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 -- bump to 4.3.0 rc1 -- remove the androguard module which is no longer available from github - -* Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 -- Update to 4.2.3 (#2116594) - -* Sat Jul 23 2022 Fedora Release Engineering - 4.2.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Mon Jul 18 2022 Mikel Olasagasti Uranga - 4.2.2-1 -- Update to 4.2.2 (#2103444) -- BUGFIX: Fix buffer overrun in "dex" module (#1728). -- BUGFIX: Wrong offset used when checking Version string of .net metadata (#1708). -- BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). -- BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). - -* Mon May 23 2022 Michal Ambroz - 4.2.1-1 -- bump to 4.2.1 -- adding changes based on proposal of Mikel Olasagasti Uranga: -- change to BSD license as yara was relicensed in 2016 -- minor changes to spec, like using https for URL -- remove old patches -- enable checks - -* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 -- bump to 4.2.0 - -* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 -- bump to 4.2.0-rc1 - -* Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 -- bump to 4.1.3 - -* Sat Nov 06 2021 Adrian Reber - 4.1.1-5 -- Rebuilt for protobuf 3.19.0 - -* Mon Oct 25 2021 Adrian Reber - 4.1.1-4 -- Rebuilt for protobuf 3.18.1 - -* Tue Sep 14 2021 Sahana Prasad - 4.1.1-3 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 4.1.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Mon May 24 2021 Michal Ambroz - 4.1.1-1 -- bump to 4.1.1 - -* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 -- bump to 4.1.0 - -* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 -- rebuild for epel - -* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 -- bump to yara bugfix 4.0.5 release - -* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 -- bump to yara bugfix 4.0.4 release - -* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 -- bump to yara bugfix 4.0.2 release -- fix build on epel7 - -* Sun Jun 14 2020 Adrian Reber - 4.0.1-2 -- Rebuilt for protobuf 3.12 - -* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 -- bump to yara bugfix 4.0.1 release - -* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 -- bump to yara 4.0.0 release - -* Fri Jan 31 2020 Fedora Release Engineering - 3.11.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 -- bump to 3.11.0 release (#1760678) -- BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117) -- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107) -- BUGFIX: Buffer overrun in “dotnet” module (upstream #1108) -- BUGFIX: Memory leak while attaching to a process fails (upstream #1070) - -* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 -- change the sphinx build dependency - -* Sat Jul 27 2019 Fedora Release Engineering - 3.10.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Fri May 03 2019 Michal Ambroz - 3.10.0-1 -- bump to 3.10.0 release (#1680204) -- Harden virtual machine against malicious code. -- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025). -- BUGFIX: Buffer overrun in “elf” module. -- BUGFIX: Buffer overrun in “dotnet” module. - -* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 -- bump to 3.9.0 release (#1680203) -- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+ -- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976), - but by design it might be always dangerous to run yara signatures compiled by 3rd party, - so it is advised to re-compile yara rules instead -- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020) -- BUGFIX: Buffer overflow in "dotnet" module. -- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018) - -* Sun Feb 03 2019 Fedora Release Engineering - 3.8.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 -- bump to 3.8.1 release (#1613093) - -* Sat Jul 14 2018 Fedora Release Engineering - 3.7.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Fri Feb 09 2018 Fedora Release Engineering - 3.7.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 -- bump to 3.7.1 release (#1534993) - -* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 -- bump to 3.7.0 release (#1511921) - -* Thu Aug 03 2017 Fedora Release Engineering - 3.6.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 3.6.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 -- bump to 3.6.3 release - bugfix CVE-2017-11328 - -* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 -- bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465 - -* Wed May 24 2017 Michal Ambroz - 3.6.0-1 -- bump to 3.6.0 release -- update the androguard-yara with bugfixes - -* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 -- Adding patch from pull request 627 until 3.5.1 is released -- https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch -- Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 - -* Sat Feb 11 2017 Fedora Release Engineering - 3.5.0-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 -- import package to Fedora -- remove unnecessary .buildinfo tag from doc package - -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 -- package review - bugzilla #1362265 -- cosmetics of the changelog -- using default spinx theme to remove the static fonts - -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 -- package review - bugzilla #1362265 -- dropped Buildroot, pkgconfig, zlib-devel, defattr -- added buildrequires gcc -- change license back to ASL 2.0 only - -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 -- package review - bugzilla #1362265 -- changed packaging of doc sub-package - -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 -- bump to new 3.5.0 - -* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 -- package review - bugzilla #1362265 -- dropped dependency of python-tools - -* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 -- compile with the androguard module - -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 -- jansson dependency >= 2.5 - -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 -- python3 stuff - -* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 -- initial build for Fedora Project +%autochangelog From d60650f58691cc1f2fe73451e7f0b29b7a0cf4a4 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 8 Oct 2024 13:36:29 -0400 Subject: [PATCH 37/54] Remove unused pcre dependency pcre (8.x) is deprecated, but is not used during the build. --- yara.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/yara.spec b/yara.spec index cdfc9f8..fd8aad7 100644 --- a/yara.spec +++ b/yara.spec @@ -58,7 +58,6 @@ BuildRequires: sed BuildRequires: gawk BuildRequires: gzip BuildRequires: xz -BuildRequires: pcre BuildRequires: bison BuildRequires: flex BuildRequires: libtool From 416511b0fbeab19afe8282164f90ecaca9359613 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 22 Oct 2024 13:42:06 +0100 Subject: [PATCH 38/54] Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) From 1f6342e7280f2c39a44b715caff18af61322b5d3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 16:30:40 +0000 Subject: [PATCH 39/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 226db1427f0910982af64d301a0d071243db3111 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 23 May 2025 19:04:31 +0200 Subject: [PATCH 40/54] bump to 4.5.3 --- sources | 2 +- yara.spec | 13 ++++++------- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/sources b/sources index 32ad6b8..7d8f897 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.2.tar.gz) = 761f3930117c35d87b0e3be1a5d61a6887006470fdf578164feb1bd56a96b2d85770ab7c3a21258a2781ff3327cb705942f4f0eb959cff4b210f0c7fbec1fc30 +SHA512 (yara-4.5.3.tar.gz) = 185c2e29655f1c874ba48b8b5a764e7fad6496b8f041b9dd1157deed28fdfde611343b7c331bb43876e4724bdc680d035a08dca101d3a48951cd2c5ae5071cbb diff --git a/yara.spec b/yara.spec index fd8aad7..459469e 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,5 @@ Name: yara -Version: 4.5.2 -%global baserelease 1 +Version: 4.5.3 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -21,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.2 -%global gitdate 20240910 -%global commit 688268d83983a0d61bb68ef3d8dfd28102b7d1b4 +# Commit of version 4.5.3 +%global gitdate 20250522 +%global commit 2e64b4c12d3ecc9accedb066bd9b77f97e20be38 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -31,12 +30,12 @@ and a Boolean expression which determine its logic.} # Build from git release version %if %{with release} -Release: %autorelease -b %{baserelease} +Release: %autorelease # Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz %else # Build from git commit baseline -Release: %autorelease -b %{baserelease} -s %{gitdate}git%{shortcommit} +Release: %autorelease -s %{gitdate}git%{shortcommit} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif From d45d9cc3d92d341f346e3c3e7f30a9b2bfb2dcdd Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 3 Jun 2025 17:12:55 +0200 Subject: [PATCH 41/54] bump to yara 4.5.4 --- yara.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index 459469e..1146855 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.3 +Version: 4.5.4 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.3 -%global gitdate 20250522 -%global commit 2e64b4c12d3ecc9accedb066bd9b77f97e20be38 +# Commit of version 4.5.4 +%global gitdate 20250527 +%global commit 7ff39042be5c63682a037e13a75221d59393cf8b %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From d8014c41828b2beed5be83f375d09f4095edfd4e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 21:10:43 +0000 Subject: [PATCH 42/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From ec3a8c26f3312d5d8c24c3e66d53cd8c75e416b3 Mon Sep 17 00:00:00 2001 From: Zephyr Lykos Date: Fri, 5 Sep 2025 18:07:09 +0800 Subject: [PATCH 43/54] Update sources file --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 7d8f897..97951e0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.3.tar.gz) = 185c2e29655f1c874ba48b8b5a764e7fad6496b8f041b9dd1157deed28fdfde611343b7c331bb43876e4724bdc680d035a08dca101d3a48951cd2c5ae5071cbb +SHA512 (yara-4.5.4.tar.gz) = b1da40636f9e55bb07cc911479e6dfa8dc7a4fa3f6b9f10b9f669d741d7af51a1d31e044f9842ec3ab9c6ac9788fbdb89a1686c9e3f22f68d1f9e5fb3db22167 From 91d3b2ea4c45d8205c788dd3c0b8fb92d03f125a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 16 Nov 2025 02:51:21 +0100 Subject: [PATCH 44/54] bump to 4.5.5 --- sources | 2 +- yara.spec | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/sources b/sources index 97951e0..914c229 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.4.tar.gz) = b1da40636f9e55bb07cc911479e6dfa8dc7a4fa3f6b9f10b9f669d741d7af51a1d31e044f9842ec3ab9c6ac9788fbdb89a1686c9e3f22f68d1f9e5fb3db22167 +SHA512 (yara-4.5.5.tar.gz) = e71d6e435cb2ad7b5875ccabcfe3abe42e2f37187a22e778867c5c5762134961369c2cbd4bea8da9193d5381af4569e39a50156d4077dc3a23b9a2240b741b60 diff --git a/yara.spec b/yara.spec index 1146855..e5a1b8b 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.4 +Version: 4.5.5 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.4 -%global gitdate 20250527 -%global commit 7ff39042be5c63682a037e13a75221d59393cf8b +# Commit of version 4.5.5 +%global gitdate 20251030 +%global commit f44a8958e88daa75d765a52a68876f2286d57a51 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 877ff5a104e654a1d9340e424436a76e905cc384 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 21:00:32 +0000 Subject: [PATCH 45/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From fdef2be6a36a77c46f9a5dcc223fe661eb36f223 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 7 May 2026 12:12:44 +0200 Subject: [PATCH 46/54] yara bump to 4.5.6 --- sources | 2 +- yara.spec | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/sources b/sources index 914c229..2648e40 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.5.tar.gz) = e71d6e435cb2ad7b5875ccabcfe3abe42e2f37187a22e778867c5c5762134961369c2cbd4bea8da9193d5381af4569e39a50156d4077dc3a23b9a2240b741b60 +SHA512 (yara-4.5.6.tar.gz) = 38554e4b2d67bd70673ae5aa8db3984c9b1e06a1e354012ea24bf81ddc2060ef0e873d56209c3f9a7823dfc1638aa9c5d16e6d03b04f0882a197c86554e5888a diff --git a/yara.spec b/yara.spec index e5a1b8b..8eb7778 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.5 +Version: 4.5.6 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.5 -%global gitdate 20251030 -%global commit f44a8958e88daa75d765a52a68876f2286d57a51 +# Commit of version 4.5.6 +%global gitdate 20260505 +%global commit db49ed032e9cc931c919baba2b057df563d28e40 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 3618af25ab53671ddd5092e93f2e27522388422e Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 3 Jun 2026 11:19:06 +0200 Subject: [PATCH 47/54] bump yara to 4.5.7 --- sources | 2 +- yara.spec | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sources b/sources index 2648e40..735eb3b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.6.tar.gz) = 38554e4b2d67bd70673ae5aa8db3984c9b1e06a1e354012ea24bf81ddc2060ef0e873d56209c3f9a7823dfc1638aa9c5d16e6d03b04f0882a197c86554e5888a +SHA512 (yara-4.5.7.tar.gz) = ff53b0606fa947a9ab882c1e4c610586c28b8383873c4ee589e380e7478229e5ef11572650884dbcd8e487061f744e2e0ce70807bc9d8685e2cb4f781301a05b diff --git a/yara.spec b/yara.spec index 8eb7778..cee413c 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.6 +Version: 4.5.7 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -21,8 +21,8 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara # Commit of version 4.5.6 -%global gitdate 20260505 -%global commit db49ed032e9cc931c919baba2b057df563d28e40 +%global gitdate 20260601 +%global commit d72b85f09fcd86583836eb8c4f349cb269ec875d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 8a0c6ab5ccca9aa870f6aa89dea67e0a9b93acb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 15 May 2026 17:27:35 +0200 Subject: [PATCH 48/54] Use protobuf in version 3.x only This is part of https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x This package does not sucessfully build with new protobuf per https://copr.fedorainfracloud.org/coprs/mochaa/protobuf/monitor/ so limiting to protobuf version 3. Once the protobuf is rebase this will automatically pick up compat package protobuf3 I am not bumping release as this does not need a rebuild now. --- yara.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index cee413c..3cbcf42 100644 --- a/yara.spec +++ b/yara.spec @@ -62,8 +62,8 @@ BuildRequires: flex BuildRequires: libtool BuildRequires: file-devel BuildRequires: jansson-devel >= 2.5 -BuildRequires: protobuf-c-devel -BuildRequires: protobuf-compiler +BuildRequires: protobuf3-c-devel +BuildRequires: protobuf-compiler < 4 %if 0%{?rhel} && 0%{?rhel} == 7 BuildRequires: openssl11-devel From 4c6bddf3a655f4ae6aca2b1fa839d52b966189e1 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 23 Apr 2026 18:05:28 -0400 Subject: [PATCH 49/54] OpenSSL 4 build fixes Signed-off-by: Simo Sorce --- ...L-accessor-functions-for-ASN1_STRING.patch | 235 ++++++++++++++++++ yara.spec | 3 +- 2 files changed, 237 insertions(+), 1 deletion(-) create mode 100644 0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch diff --git a/0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch b/0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch new file mode 100644 index 0000000..4cffbf9 --- /dev/null +++ b/0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch @@ -0,0 +1,235 @@ +From 05a1e87e77226c8dd7e2228d26e3aa462e968dc7 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Thu, 23 Apr 2026 17:55:01 -0400 +Subject: [PATCH] Use OpenSSL accessor functions for ASN1_STRING + +Directly accessing the `data` and `length` fields of `ASN1_STRING` structures +is incompatible with newer versions of OpenSSL, where these structures are +opaque. This change replaces direct field access with the standard +`ASN1_STRING_get0_data` and `ASN1_STRING_length` accessor functions to ensure +compatibility. Additionally, an `X509_NAME_ENTRY` pointer is made `const` to +align with modern OpenSSL API signatures. + +Co-authored-by: Gemini +Signed-off-by: rpm-build +--- + .../pe/authenticode-parser/authenticode.c | 32 +++++++++---------- + .../pe/authenticode-parser/certificate.c | 4 +-- + .../pe/authenticode-parser/countersignature.c | 28 ++++++++-------- + 3 files changed, 32 insertions(+), 32 deletions(-) + +diff --git a/libyara/modules/pe/authenticode-parser/authenticode.c b/libyara/modules/pe/authenticode-parser/authenticode.c +index f385860..a2f7f74 100644 +--- a/libyara/modules/pe/authenticode-parser/authenticode.c ++++ b/libyara/modules/pe/authenticode-parser/authenticode.c +@@ -78,8 +78,8 @@ static SpcIndirectDataContent* get_content(PKCS7* content) + if (!spcContent) + return NULL; + +- int len = content->d.other->value.sequence->length; +- const uint8_t* data = content->d.other->value.sequence->data; ++ int len = ASN1_STRING_length(content->d.other->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(content->d.other->value.sequence); + + d2i_SpcIndirectDataContent(&spcContent, &data, len); + +@@ -88,8 +88,8 @@ static SpcIndirectDataContent* get_content(PKCS7* content) + + static char* parse_program_name(ASN1_TYPE* spcAttr) + { +- const uint8_t* spcData = spcAttr->value.sequence->data; +- int spcLen = spcAttr->value.sequence->length; ++ const uint8_t* spcData = ASN1_STRING_get0_data(spcAttr->value.sequence); ++ int spcLen = ASN1_STRING_length(spcAttr->value.sequence); + SpcSpOpusInfo* spcInfo = d2i_SpcSpOpusInfo(NULL, &spcData, spcLen); + if (!spcInfo) + return NULL; +@@ -131,8 +131,8 @@ static void parse_nested_authenticode(PKCS7_SIGNER_INFO* si, AuthenticodeArray* + ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i); + if (nested == NULL) + break; +- int len = nested->value.sequence->length; +- const uint8_t* data = nested->value.sequence->data; ++ int len = ASN1_STRING_length(nested->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence); + AuthenticodeArray* auth = authenticode_new(data, len); + if (!auth) + continue; +@@ -162,8 +162,8 @@ static void parse_pkcs9_countersig(PKCS7* p7, Authenticode* auth) + ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i); + if (nested == NULL) + break; +- int len = nested->value.sequence->length; +- const uint8_t* data = nested->value.sequence->data; ++ int len = ASN1_STRING_length(nested->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence); + + Countersignature* sig = pkcs9_countersig_new(data, len, p7->d.sign->cert, si->enc_digest); + if (!sig) +@@ -193,8 +193,8 @@ static void parse_ms_countersig(PKCS7* p7, Authenticode* auth) + ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i); + if (nested == NULL) + break; +- int len = nested->value.sequence->length; +- const uint8_t* data = nested->value.sequence->data; ++ int len = ASN1_STRING_length(nested->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence); + + Countersignature* csig = ms_countersig_new(data, len, si->enc_digest); + if (!csig) +@@ -209,8 +209,8 @@ static void parse_ms_countersig(PKCS7* p7, Authenticode* auth) + + static bool authenticode_verify(PKCS7* p7, PKCS7_SIGNER_INFO* si, X509* signCert) + { +- const uint8_t* contentData = p7->d.sign->contents->d.other->value.sequence->data; +- long contentLen = p7->d.sign->contents->d.other->value.sequence->length; ++ const uint8_t* contentData = ASN1_STRING_get0_data(p7->d.sign->contents->d.other->value.sequence); ++ long contentLen = ASN1_STRING_length(p7->d.sign->contents->d.other->value.sequence); + + uint64_t version = 0; + ASN1_INTEGER_get_uint64(&version, p7->d.sign->version); +@@ -315,8 +315,8 @@ AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len) + int digestnid = OBJ_obj2nid(messageDigest->digestAlgorithm->algorithm); + auth->digest_alg = strdup(OBJ_nid2ln(digestnid)); + +- int digestLen = messageDigest->digest->length; +- const uint8_t* digestData = messageDigest->digest->data; ++ int digestLen = ASN1_STRING_length(messageDigest->digest); ++ const uint8_t* digestData = ASN1_STRING_get0_data(messageDigest->digest); + byte_array_init(&auth->digest, digestData, digestLen); + + SpcIndirectDataContent_free(dataContent); +@@ -372,8 +372,8 @@ AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len) + digestnid = OBJ_obj2nid(si->digest_alg->algorithm); + signer->digest_alg = strdup(OBJ_nid2ln(digestnid)); + +- digestLen = digest->value.asn1_string->length; +- digestData = digest->value.asn1_string->data; ++ digestLen = ASN1_STRING_length(digest->value.asn1_string); ++ digestData = ASN1_STRING_get0_data(digest->value.asn1_string); + byte_array_init(&signer->digest, digestData, digestLen); + + /* Authenticode stores optional programName in non-optional SpcSpOpusInfo attribute */ +diff --git a/libyara/modules/pe/authenticode-parser/certificate.c b/libyara/modules/pe/authenticode-parser/certificate.c +index fc754e4..97c7e3e 100644 +--- a/libyara/modules/pe/authenticode-parser/certificate.c ++++ b/libyara/modules/pe/authenticode-parser/certificate.c +@@ -59,13 +59,13 @@ static void parse_name_attributes(X509_NAME* raw, Attributes* attr) + + int entryCount = X509_NAME_entry_count(raw); + for (int i = entryCount - 1; i >= 0; --i) { +- X509_NAME_ENTRY* entryName = X509_NAME_get_entry(raw, i); ++ const X509_NAME_ENTRY* entryName = X509_NAME_get_entry(raw, i); + ASN1_STRING* asn1String = X509_NAME_ENTRY_get_data(entryName); + + const char* key = OBJ_nid2sn(OBJ_obj2nid(X509_NAME_ENTRY_get_object(entryName))); + + ByteArray array = {0}; +- if (byte_array_init(&array, asn1String->data, asn1String->length) == -1) ++ if (byte_array_init(&array, ASN1_STRING_get0_data(asn1String), ASN1_STRING_length(asn1String)) == -1) + break; + + if (strcmp(key, "C") == 0 && !attr->country.data) +diff --git a/libyara/modules/pe/authenticode-parser/countersignature.c b/libyara/modules/pe/authenticode-parser/countersignature.c +index 0fb4576..6cb5eed 100644 +--- a/libyara/modules/pe/authenticode-parser/countersignature.c ++++ b/libyara/modules/pe/authenticode-parser/countersignature.c +@@ -141,13 +141,13 @@ Countersignature* pkcs9_countersig_new( + result->chain = parse_signer_chain(signCert, certs); + + /* Get digest that corresponds to decrypted encrypted digest in signature */ +- ASN1_TYPE* messageDigest = PKCS7_get_signed_attribute(si, NID_pkcs9_messageDigest); ++ const ASN1_TYPE* messageDigest = PKCS7_get_signed_attribute(si, NID_pkcs9_messageDigest); + if (!messageDigest) { + result->verify_flags = COUNTERSIGNATURE_VFY_DIGEST_MISSING; + goto end; + } + +- size_t digestLen = messageDigest->value.octet_string->length; ++ size_t digestLen = ASN1_STRING_length(messageDigest->value.octet_string); + + if (!digestLen) { + result->verify_flags = COUNTERSIGNATURE_VFY_DIGEST_MISSING; +@@ -160,7 +160,7 @@ Countersignature* pkcs9_countersig_new( + goto end; + } + +- const uint8_t* digestData = messageDigest->value.octet_string->data; ++ const uint8_t* digestData = ASN1_STRING_get0_data(messageDigest->value.octet_string); + byte_array_init(&result->digest, digestData, digestLen); + + /* By this point we all necessary things for verification +@@ -187,8 +187,8 @@ Countersignature* pkcs9_countersig_new( + goto end; + } + +- uint8_t* encData = si->enc_digest->data; +- size_t encLen = si->enc_digest->length; ++ const uint8_t* encData = ASN1_STRING_get0_data(si->enc_digest); ++ size_t encLen = ASN1_STRING_length(si->enc_digest); + + /* Decrypt the encrypted digest */ + EVP_PKEY_verify_recover_init(ctx); +@@ -220,7 +220,7 @@ Countersignature* pkcs9_countersig_new( + const uint8_t* data_ptr = decData; + DigestInfo* digest_info = d2i_DigestInfo(NULL, &data_ptr, decLen); + if (digest_info) { +- isValid = !memcmp(digest_info->digest->data, calc_digest, mdLen); ++ isValid = !memcmp(ASN1_STRING_get0_data(digest_info->digest), calc_digest, mdLen); + DigestInfo_free(digest_info); + } else { + isValid = false; +@@ -235,7 +235,7 @@ Countersignature* pkcs9_countersig_new( + + /* Now check the countersignature message-digest that should correspond + * to Signatures encrypted digest it countersigns */ +- calculate_digest(md, enc_digest->data, enc_digest->length, calc_digest); ++ calculate_digest(md, ASN1_STRING_get0_data(enc_digest), ASN1_STRING_length(enc_digest), calc_digest); + + /* Check if calculated one matches the stored one */ + if (digestLen != mdLen || memcmp(calc_digest, digestData, mdLen) != 0) { +@@ -269,8 +269,8 @@ TS_TST_INFO* IMPL_FUNC_NAME(get_ts_tst_info, cms)(CountersignatureImpl* impl) + return NULL; + } + +- const uint8_t* data = (*content)->data; +- TS_TST_INFO* ts_tst_info = d2i_TS_TST_INFO(NULL, &data, (*content)->length); ++ const uint8_t* data = ASN1_STRING_get0_data(*content); ++ TS_TST_INFO* ts_tst_info = d2i_TS_TST_INFO(NULL, &data, ASN1_STRING_length(*content)); + if (!ts_tst_info) { + return NULL; + } +@@ -400,8 +400,8 @@ int IMPL_FUNC_NAME(verify_digest, cms)( + return 0; + } + +- if (ts_imprint_digest->length != (int)digest_size || +- memcmp(ts_imprint_digest->data, digest, digest_size) != 0) { ++ if (ASN1_STRING_length(ts_imprint_digest) != (int)digest_size || ++ memcmp(ASN1_STRING_get0_data(ts_imprint_digest), digest, digest_size) != 0) { + TS_TST_INFO_free(ts_tst_info); + return 0; + } +@@ -554,8 +554,8 @@ Countersignature* ms_countersig_new(const uint8_t* data, long size, ASN1_STRING* + + ASN1_STRING* rawDigest = TS_MSG_IMPRINT_get_msg(imprint); + +- int digestLen = rawDigest->length; +- uint8_t* digestData = rawDigest->data; ++ int digestLen = ASN1_STRING_length(rawDigest); ++ const uint8_t* digestData = ASN1_STRING_get0_data(rawDigest); + + byte_array_init(&result->digest, digestData, digestLen); + +@@ -571,7 +571,7 @@ Countersignature* ms_countersig_new(const uint8_t* data, long size, ASN1_STRING* + } + + uint8_t calc_digest[EVP_MAX_MD_SIZE]; +- calculate_digest(md, enc_digest->data, enc_digest->length, calc_digest); ++ calculate_digest(md, ASN1_STRING_get0_data(enc_digest), ASN1_STRING_length(enc_digest), calc_digest); + + #if OPENSSL_VERSION_NUMBER >= 0x3000000fL + int mdLen = EVP_MD_get_size(md); +-- +2.53.0 + diff --git a/yara.spec b/yara.spec index 3cbcf42..9469cec 100644 --- a/yara.spec +++ b/yara.spec @@ -42,7 +42,8 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name # Use default sphix theme to generate documentation rather than sphinx_rtd_theme # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch - +# OpenSSL 4 build fixes +Patch2: 0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch BuildRequires: git BuildRequires: gcc From d0019a2f8ded2be5b7bbd12c32167f4a19ea9240 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 16:41:38 -0400 Subject: [PATCH 50/54] Rebuilt for openssl 4.0 From 52aec2fd900da6e76ed6f1e4d626f5d10f1b76e6 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 1 Jul 2026 18:33:33 -0400 Subject: [PATCH 51/54] Rebuild with latest protobuf --- yara.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index 9469cec..27b1ef1 100644 --- a/yara.spec +++ b/yara.spec @@ -63,8 +63,8 @@ BuildRequires: flex BuildRequires: libtool BuildRequires: file-devel BuildRequires: jansson-devel >= 2.5 -BuildRequires: protobuf3-c-devel -BuildRequires: protobuf-compiler < 4 +BuildRequires: protobuf-c-devel +BuildRequires: protobuf-compiler %if 0%{?rhel} && 0%{?rhel} == 7 BuildRequires: openssl11-devel From 1e1e2ca243ef6312cb31a553c6923ca6a30cac67 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 09:33:00 +0000 Subject: [PATCH 52/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild From 540af1acd5761aeca826f97deca109c2182bbed4 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 24 Aug 2026 18:03:20 +0200 Subject: [PATCH 53/54] bump to 4.5.8 --- yara.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index 27b1ef1..2da48b6 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.7 +Version: 4.5.8 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.6 -%global gitdate 20260601 -%global commit d72b85f09fcd86583836eb8c4f349cb269ec875d +# Commit of version 4.5.8 +%global gitdate 20260728 +%global commit 84b0e3cc0e42f8f8e6b84d19c97ec3ac6ff8aee8 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 60a93fd33bff98078e0254e8caab125d6c43b0f3 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 24 Aug 2026 18:04:01 +0200 Subject: [PATCH 54/54] bump to 4.5.8 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 735eb3b..967aa60 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.7.tar.gz) = ff53b0606fa947a9ab882c1e4c610586c28b8383873c4ee589e380e7478229e5ef11572650884dbcd8e487061f744e2e0ce70807bc9d8685e2cb4f781301a05b +SHA512 (yara-4.5.8.tar.gz) = 12bbe1bebb6d51f7ae90ad6a725bdb096f3e884b757913e9ba37bfa1557bced32ef56895eb358af5f3165890336be57dc51e9fe2ad672c1e523cb30e00483c86