void TGielda::Refresh_data_onet() { /* FIXME: jesli spolka, umarla ( jej cena to --- ) to nie zostanie * to sparsowane poprawnie i pominieta zostanie kolejna spolka * now blad - onet chyba teraz pokazuje cene w "[]", trzeba poprawic regexp */ char* bufor = NULL; pcre* re; const char* error = NULL; int erroffset; int index = 0; int rc; const int OVECCOUNT = 30; int ovector[OVECCOUNT]; char* pozycja; bufor = Download_file(curl, "http://gielda.onet.pl/indeksy-i-akcje,18633,100,0,notowania-gpw-start"); my_companies.clear(); my_companies.reserve(512); do { re = pcre_compile("<div class=\"name2\"><a.*?>(.*?)<.*?raitings.*?>\\s*?\\[?([-0-9, ]+)\\]?\\s*?<.*?raitings.*?>\\s*?\\[?([-0-9,]+)\\]?\\s*?<", PCRE_DOTALL, &error, &erroffset, NULL); rc = pcre_exec(re, NULL, bufor + index, strlen(bufor + index), 0, 0, ovector, OVECCOUNT); if (rc == PCRE_ERROR_NOMATCH) break; if (rc < 0) break; if (rc == 0) puts("za malo miejsca w buforze"); char* name; char* price; char* day_delta; pcre_get_substring(bufor + index, ovector, rc, 1, (const char** )&name); pcre_get_substring(bufor + index, ovector, rc, 2, (const char** )&price); pcre_get_substring(bufor + index, ovector, rc, 3, (const char** )&day_delta); if ((pozycja = strchr(day_delta, ','))) *pozycja = '.'; if ((pozycja = strchr(price, ','))) *pozycja = '.'; char* price_replaced = Replace_all(price, " ", ""); TSpolka spolka(name, price_replaced ? price_replaced : price, day_delta, "", "", "", "", ""); my_companies.push_back(spolka); pcre_free_substring(name); pcre_free_substring(price); pcre_free_substring(day_delta); index += ovector[1]; } while (true); my_last_update = time(NULL); delete[] bufor; }
static int DetectPayloadLenFieldParse(DetectPayloadLenFieldData *dt, const char * sig) { char *args[3] = {NULL,NULL,NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; dt->offset = 0; ret = pcre_exec(parse_regex, parse_regex_study, sig, strlen(sig), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3) goto error; const char *str_ptr; pcre_get_substring(sig, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (strlen(str_ptr)) { dt->offset = atoi(str_ptr); } pcre_get_substring(sig, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (strlen(str_ptr)) { dt->len = atoi(str_ptr); } return 1; error: return -1; }
void TGielda::Refresh_data() { char* bufor = NULL; pcre* re; const char* error = NULL; int erroffset; int index = 0; int rc; const int OVECCOUNT = 30; int ovector[OVECCOUNT]; char* pozycja; bufor = Download_file(curl, "http://www.parkiet.com/temat/63.html"); if (!bufor) return; my_companies.clear(); my_companies.reserve(512); do { re = pcre_compile("<tr.*?<td class=\"nazwa\"><a.*?>(.*?)<.*?<td class=\"c\">(.*?)<.*?<td class=\"zmiana.*?>(.*?)<", PCRE_DOTALL, &error, &erroffset, NULL); rc = pcre_exec(re, NULL, bufor + index, strlen(bufor + index), 0, 0, ovector, OVECCOUNT); if (rc == PCRE_ERROR_NOMATCH) break; if (rc < 0) break; if (rc == 0) puts("za malo miejsca w buforze"); char* name; char* price; char* day_delta; pcre_get_substring(bufor + index, ovector, rc, 1, (const char** )&name); pcre_get_substring(bufor + index, ovector, rc, 2, (const char** )&price); pcre_get_substring(bufor + index, ovector, rc, 3, (const char** )&day_delta); if ((pozycja = strchr(day_delta, ','))) *pozycja = '.'; TSpolka spolka(name, price, day_delta, "", "", "", "", ""); my_companies.push_back(spolka); pcre_free_substring(name); pcre_free_substring(price); pcre_free_substring(day_delta); index += ovector[1]; } while (true); my_last_update = time(NULL); delete[] bufor; }
static char * ccze_squid_cache_log_process (const char *str, int *offsets, int match) { char *date, *other; pcre_get_substring (str, offsets, match, 1, (const char **)&date); pcre_get_substring (str, offsets, match, 3, (const char **)&other); ccze_addstr (CCZE_COLOR_DATE, date); ccze_space(); free (date); return other; }
static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { const char *prio_str = NULL; #define MAX_SUBSTRINGS 30 int ret = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30); if (ret < 0) { SCLogError(SC_ERR_PCRE_MATCH, "Invalid Priority in Signature " "- %s", rawstr); return -1; } ret = pcre_get_substring((char *)rawstr, ov, 30, 1, &prio_str); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return -1; } /* if we have reached here, we have had a valid priority. Assign it */ s->prio = atoi(prio_str); return 0; }
// < 0 for error. >= 0 for len of extracted string int extractHTTPClientHeaderVal(const u_int8_t *buf, u_int32_t size, int pcreidx, int substringnum, char *valuebuf, int valuelen) { int result; int ovector[9]; int ovecsize = 9; const char *tmpstring; // printf("Searching for pcre %d (%s)\n", pcreidx, http_pcre_strings[pcreidx]); result = pcre_exec(http_pcre_structs[pcreidx].re, http_pcre_structs[pcreidx].pe, (const char *)buf, size, 0, 0, ovector, ovecsize); if(result < 0 || result == PCRE_ERROR_NOMATCH) { // printf("pcre not found\n"); return(-1); // We need to find the URL or this isn't a valid request } if(valuebuf) { result = pcre_get_substring((const char *)buf, ovector, result, substringnum, &tmpstring); if(result < 0) { // printf("unable to extract substring\n"); return(-2); } strncpy(valuebuf, tmpstring, valuelen); valuebuf[valuelen-1] = '\0'; pcre_free_substring(tmpstring); return(strlen(valuebuf)); } return(0); }
char *Regexp_Get_Substring_From_Buffer(pcre *regexp, char *buffer, int substring) { char *file; int rc, ovector[30]; char *viewstate; if (regexp == NULL) return NULL; if (buffer == NULL) return NULL; rc = pcre_exec(regexp, NULL, buffer, strlen(file), 0, 0, ovector, 30); if (rc != -1) { rc = pcre_get_substring(buffer, ovector, 30, substring, (const char **)&viewstate); if (rc != -1) { return viewstate; } else printf("Get_Regexp_From_File: could not get substring.\n"); } else printf("Get_Regexp_From_File: regexp didnt match.\n"); return NULL; }
std::string Pattern::group (int groupNumber) { const char * stringPtr; int rc = pcre_get_substring ( _subject.substr (_offset[0]).c_str(), _ovector, _count, groupNumber, &stringPtr); if (rc < 0) { switch (rc) { case PCRE_ERROR_NOSUBSTRING: throw std::out_of_range ("Invalid group reference."); case PCRE_ERROR_NOMEMORY: throw match_error ("Memory exhausted."); default: throw match_error ("Failed to get named substring."); } } std::string matchedStr (stringPtr); pcre_free_substring (stringPtr); return matchedStr; }
static uint32_t nvmRegExpCoproTestPattern (uint16_t pattern_id, uint8_t *haystack, uint32_t haylen, uint32_t start_offset, nvmRegExpCoproInternalData *redata) { nvmRegExpCoproPattern *rcp; int ovector[OVECTSIZE], m = 0, matchoffset = 0; //, matchlen = 0; #ifdef COPRO_REGEXP_DEBUG const char *tmp; #endif redata -> matched = 0; /* Do the actual search */ if (pattern_id < redata -> patterns_no) { rcp = &(redata -> patterns[pattern_id]); redebug ("Looking for RegExp: \"%s\"\n", rcp -> pattern); m = pcre_exec (rcp -> re, rcp -> re_extra, (char*) haystack + start_offset, haylen, 0, 0, ovector, OVECTSIZE); if (m > 0) { (redata -> match).rcp = rcp; (redata -> match).offset = matchoffset = ovector[0]; (redata -> match).len = ovector[1] - ovector[0]; redata -> matched = 1; #ifdef COPRO_REGEXP_DEBUG pcre_get_substring (haystack + start_offset, ovector, m, 0, &tmp); redebug ("RegExp match at offset %d, len = %d: \"%s\"\n", matchoffset, (redata -> match).len, tmp); pcre_free_substring (tmp); #endif } } else { printf ("RegExp coprocessor: tried to use inexistent pattern: %u\n", pattern_id); } return (redata -> matched); }
char *execute_regex(char *pattern, char *subject, int desired_match) { pcre *re; const char *einfo; int eoffset; int stringcount = 0; int ovector[desired_match * 3]; int match_len; const char *match; char *match_returned; re = pcre_compile(pattern, 0, &einfo, &eoffset, NULL); if (!re) { fprintf(stderr, "%s\n", einfo); return NULL; } stringcount = pcre_exec(re, NULL, subject, strlen(subject), 0, 0, ovector, 30); match_len = pcre_get_substring(subject, ovector, stringcount, desired_match, &match); if (match_len <= 0) { return NULL; } match_returned = (char *) malloc(match_len); strncpy(match_returned, match, match_len); pcre_free_substring(match); return match_returned; }
/** Funkcja pobiera pierwszy czlon adresu email - tytulowy adresat w tresci maila @param email - adres email z którego pobrany zostanie człon adresu przed znakiem '@' @param out_recipient - nazwa konta email pobrana z adresu - wartość zwracana przez funkcję @retval 0 - ok @retval -1 - bład wywołania funkcji pcre_compile @retval -2 - bład wywołania funkcji pcre_exec */ long get_einvoice_recipient(char *email,char **out_recipient) { pcre *rc = NULL; long re = 0; const char *error = NULL; int erroroffset = 0; int ovector[6]; long len = 0; memset(ovector,0,6); rc=pcre_compile(EINVOICE_RECP_REGEXP,0,&error, &erroroffset,NULL); if(rc==NULL) { PRINT_DEBUG("LIBBMDMAILERR Error. Error=%i\n",-1); return -1; } re = pcre_exec(rc,NULL,email,(int)strlen(email),0,0,ovector,6); if(re<0) { PRINT_DEBUG("LIBBMDMAILERR Error. Error=%i\n",-2); return -2; } len=pcre_get_substring(email,ovector,re,1,(const char **)out_recipient); pcre_free(rc); rc=NULL; return 0; }
/** * \brief This function is used to parse icmp_seq option passed via icmp_seq: keyword * * \param icmpseqstr Pointer to the user provided icmp_seq options * * \retval iseq pointer to DetectIcmpSeqData on success * \retval NULL on failure */ DetectIcmpSeqData *DetectIcmpSeqParse (char *icmpseqstr) { DetectIcmpSeqData *iseq = NULL; char *substr[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i; const char *str_ptr; ret = pcre_exec(parse_regex, parse_regex_study, icmpseqstr, strlen(icmpseqstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH,"Parse error %s", icmpseqstr); goto error; } for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)icmpseqstr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed"); goto error; } substr[i-1] = (char *)str_ptr; } iseq = SCMalloc(sizeof(DetectIcmpSeqData)); if (iseq == NULL) goto error; iseq->seq = 0; if (substr[0] != NULL && strlen(substr[0]) != 0) { if (substr[2] == NULL) { SCLogError(SC_ERR_MISSING_QUOTE,"Missing quote in input"); goto error; } } else { if (substr[2] != NULL) { SCLogError(SC_ERR_MISSING_QUOTE,"Missing quote in input"); goto error; } } uint16_t seq = 0; ByteExtractStringUint16(&seq, 10, 0, substr[1]); iseq->seq = htons(seq); for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } return iseq; error: for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } if (iseq != NULL) DetectIcmpSeqFree(iseq); return NULL; }
/** * \brief This function is used to parse icmp_id option passed via icmp_id: keyword * * \param icmpidstr Pointer to the user provided icmp_id options * * \retval iid pointer to DetectIcmpIdData on success * \retval NULL on failure */ DetectIcmpIdData *DetectIcmpIdParse (char *icmpidstr) { DetectIcmpIdData *iid = NULL; char *substr[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, icmpidstr, strlen(icmpidstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "Parse error %s", icmpidstr); goto error; } int i; const char *str_ptr; for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)icmpidstr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } substr[i-1] = (char *)str_ptr; } iid = SCMalloc(sizeof(DetectIcmpIdData)); if (iid == NULL) goto error; iid->id = 0; if (substr[0]!= NULL && strlen(substr[0]) != 0) { if (substr[2] == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Missing close quote in input"); goto error; } } else { if (substr[2] != NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Missing open quote in input"); goto error; } } /** \todo can ByteExtractStringUint16 do this? */ uint16_t id = 0; ByteExtractStringUint16(&id, 10, 0, substr[1]); iid->id = htons(id); for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } return iid; error: for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } if (iid != NULL) DetectIcmpIdFree(iid); return NULL; }
int pcre_get_named_substring(const pcre *code, const pcre_char *subject, int *ovector, int stringcount, const pcre_char *stringname, const pcre_char **stringptr) { int n = pcre_get_stringnumber(code, stringname); if (n <= 0) return n; return pcre_get_substring(subject, ovector, stringcount, n, stringptr); }
int pcre_get_named_substring(const pcre *code, const char *subject, int *ovector, int stringcount, const char *stringname, const char **stringptr) { int n = get_first_set(code, stringname, ovector); if (n <= 0) return n; return pcre_get_substring(subject, ovector, stringcount, n, stringptr); }
/** Extract a subcapture value from the request * * @note This is the PCRE variant of the function. * * @param[in] ctx To allocate subcapture buffer in. * @param[out] out Where to write the subcapture string. * @param[in] request to extract. * @param[in] num Subcapture index (0 for entire match). * @return * - 0 on success. * - -1 on notfound. */ int regex_request_to_sub(TALLOC_CTX *ctx, char **out, REQUEST *request, uint32_t num) { fr_regcapture_t *rc; char const *p; int ret; rc = request_data_reference(request, request, REQUEST_DATA_REGEX); if (!rc) { RDEBUG4("No subcapture data found"); *out = NULL; return 1; } ret = pcre_get_substring(rc->regmatch->subject, (int *)rc->regmatch->match_data, (int)rc->regmatch->used, num, &p); switch (ret) { case PCRE_ERROR_NOMEMORY: MEM(NULL); /* * We can't really fall through, but GCC 7.3 is * too stupid to realise that we can never get * here despite _fr_exit_now being marked as * NEVER_RETURNS. * * If we did anything else, compilers and static * analysis tools would probably complain about * code that could never be executed *sigh*. */ /* FALL-THROUGH */ /* * Not finding a substring is fine */ case PCRE_ERROR_NOSUBSTRING: RDEBUG4("%i/%zu Not found", num + 1, rc->regmatch->used); *out = NULL; return -1; default: if (ret < 0) { *out = NULL; return -1; } talloc_set_type(p, char); p = talloc_steal(ctx, p); RDEBUG4("%i/%zu Found: %pV (%zu)", num + 1, rc->regmatch->used, fr_box_strvalue_buffer(p), talloc_array_length(p) - 1); memcpy(out, &p, sizeof(*out)); break; } return 0; }
/** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectSshVersionData on success * \retval NULL on failure */ DetectSshVersionData *DetectSshVersionParse (char *str) { DetectSshVersionData *ssh = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.protoversion option"); goto error; } if (ret > 1) { const char *str_ptr; res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ ssh = SCMalloc(sizeof(DetectSshVersionData)); if (ssh == NULL) goto error; memset(ssh, 0x00, sizeof(DetectSshVersionData)); /* If we expect a protocol version 2 or 1.99 (considered 2, we * will compare it with both strings) */ if (strcmp("2_compat", str_ptr) == 0) { ssh->flags |= SSH_FLAG_PROTOVERSION_2_COMPAT; SCLogDebug("will look for ssh protocol version 2 (2, 2.0, 1.99 that's considered as 2"); return ssh; } ssh->ver = (uint8_t *)SCStrdup((char*)str_ptr); if (ssh->ver == NULL) { goto error; } ssh->len = strlen((char *) ssh->ver); SCLogDebug("will look for ssh %s", ssh->ver); } return ssh; error: if (ssh != NULL) DetectSshVersionFree(ssh); return NULL; }
int parse_command (const char *cmd, int len, int *argc, char ***args) { const char *r_error; int r_error_offset; pcre *re; int rc; int r_ovector[OVECCOUNT]; int i = 0; re = pcre_compile ( "^(?P<command>[a-zA-Z\\-]+)(?:[ ]([^ ]+))*", 0, &r_error, &r_error_offset, NULL); if (re == NULL) { printf("PCRE compilation failed at offset %d: %s\n", r_error_offset, r_error); return 1; } rc = pcre_exec ( re, NULL, cmd, len, 0, 0, r_ovector, OVECCOUNT); if (rc < 0) { switch(rc) { case PCRE_ERROR_NOMATCH: printf("No match\n"); break; /* Handle other special cases if you like */ default: printf("Matching error %d\n", rc); break; } pcre_free(re); /* Release memory used for the compiled pattern */ return 1; } *argc = rc; *args = calloc(rc+1, sizeof(char *)); for (i = 1; i < rc; ++i) { pcre_get_substring(cmd, r_ovector, rc, i, (const char **)&(*args)[i-1]); } pcre_free(re); /* Release memory used for the compiled pattern */ return 0; }
DeprecatedString RegularExpression::cap(int n) const { const pcre_char *substring = NULL; int substringLength = pcre_get_substring(reinterpret_cast<const uint16_t *>(d->lastMatchString.unicode()), d->lastMatchOffsets, d->lastMatchCount, n, &substring); if (substringLength > 0) { DeprecatedString capture(reinterpret_cast<const DeprecatedChar *>(substring), substringLength); pcre_free_substring(substring); return capture; } return DeprecatedString(); }
char *regexp_substring( char *msg, int *ovector, int stringcount, int stringnum ) { char *string; if( pcre_get_substring( msg, ovector, stringcount, stringnum, (const char **)&string ) < 0 ) { return( NULL ); } else { return( string ); } }
int matcher_append(char * str) { int str_sz = strlen(str), exec_res; int groups[60], max_group = 60; if (str_sz > MBUF) { return -1; } if (str_sz + buff_offset >= MBUF) { strcpy(buff, str); buff_offset = 0; } else { strcpy(buff + buff_offset, str); } //printf("matcher: appending [%s]\n\n\n", str); exec_res = pcre_exec(regex, regex_opti, buff, buff_offset + str_sz, last_match, 0, groups, max_group); if (exec_res == PCRE_ERROR_NOMATCH) { puts(buff); } /*switch(exec_res) { case PCRE_ERROR_NOMATCH : printf("String did not match the pattern\n"); break; case PCRE_ERROR_NULL : printf("Something was null\n"); break; case PCRE_ERROR_BADOPTION : printf("A bad option was passed\n"); break; case PCRE_ERROR_BADMAGIC : printf("Magic number bad (compiled re corrupt?)\n"); break; case PCRE_ERROR_UNKNOWN_NODE : printf("Something kooky in the compiled re\n"); break; case PCRE_ERROR_NOMEMORY : printf("Ran out of memory\n"); break; default : printf("Unknown error\n"); break; }*/ if (exec_res >= 0) { int c; const char * match; exec_res = exec_res ? exec_res : max_group / 3; for (c = 0; c < exec_res; c += 2) { //if (c == 0 || c % 3 == 0) continue; pcre_get_substring(buff/* + offset ?*/, groups, exec_res, c, &match); //printf("Match(%2d/%2d): (%2d,%2d): '%s'\n", c, exec_res-1, groups[c*2], groups[c*2+1], match); callback(match); pcre_free_substring(match); last_match = c * 2 + 1; } } else { last_match = buff_offset; } //puts(buff); //printf("matcher: buff [%s]\n\n", buff); buff_offset = (buff_offset + str_sz) - last_match; memmove(buff, buff + last_match, buff_offset); buff[buff_offset] = '\0'; return 0; }
static char * ccze_exim_process (const char *str, int *offsets, int match) { char *date, *msg=NULL, *action=NULL, *uniqn=NULL, *msgfull; int match2, offsets2[99]; ccze_color_t color = CCZE_COLOR_UNKNOWN; pcre_get_substring (str, offsets, match, 1, (const char **)&date); pcre_get_substring (str, offsets, match, 2, (const char **)&msgfull); if ((match2 = pcre_exec (reg_exim_actiontype, NULL, msgfull, strlen (msgfull), 0, 0, offsets2, 99)) >= 0) { pcre_get_substring (msgfull, offsets2, match2, 1, (const char **)&uniqn); pcre_get_substring (msgfull, offsets2, match2, 2, (const char **)&action); pcre_get_substring (msgfull, offsets2, match2, 3, (const char **)&msg); if (action[0] == '<') color = CCZE_COLOR_INCOMING; else if (action[1] == '>') color = CCZE_COLOR_OUTGOING; else if (action[0] == '=' || action[0] == '*') color = CCZE_COLOR_ERROR; } else if ((match2 = pcre_exec (reg_exim_uniqn, NULL, msgfull, strlen (msgfull), 0, 0, offsets2, 99)) >= 0) { pcre_get_substring (msgfull, offsets2, match2, 1, (const char **)&uniqn); pcre_get_substring (msgfull, offsets2, match2, 2, (const char **)&msg); } else msg = strdup (msgfull); ccze_print_date (date); ccze_space (); if (uniqn && uniqn[0]) { ccze_addstr (CCZE_COLOR_UNIQN, uniqn); ccze_space(); } if (action && action[0]) { ccze_addstr (color, action); ccze_space(); } return msg; }
/** * \brief This function is used to parse decoder events options passed via decode-event: keyword * * \param rawstr Pointer to the user provided decode-event options * * \retval de pointer to DetectFlowData on success * \retval NULL on failure */ DetectEngineEventData *DetectEngineEventParse (char *rawstr) { int i; DetectEngineEventData *de = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0, found = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } const char *str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 0, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } for (i = 0; DEvents[i].event_name != NULL; i++) { if (strcasecmp(DEvents[i].event_name,str_ptr) == 0) { found = 1; break; } } if (found == 0) { SCLogError(SC_ERR_UNKNOWN_DECODE_EVENT, "unknown decode event \"%s\"", str_ptr); goto error; } de = SCMalloc(sizeof(DetectEngineEventData)); if (unlikely(de == NULL)) goto error; de->event = DEvents[i].code; if (de->event == STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA) { StreamTcpReassembleConfigEnableOverlapCheck(); } return de; error: if (de) SCFree(de); return NULL; }
PCRE_EXP_DEFN int PCRE_CALL_CONVENTION pcre16_get_named_substring(const pcre16 *code, PCRE_SPTR16 subject, int *ovector, int stringcount, PCRE_SPTR16 stringname, PCRE_SPTR16 *stringptr) #endif { int n = get_first_set(code, stringname, ovector); if (n <= 0) return n; #ifdef COMPILE_PCRE8 return pcre_get_substring(subject, ovector, stringcount, n, stringptr); #else return pcre16_get_substring(subject, ovector, stringcount, n, stringptr); #endif }
qbool Utils_RegExpGetGroup(char *regexp, char *matchstring, const char **resultstring, int *resultlength, int group) { int offsets[HUD_REGEXP_OFFSET_COUNT]; pcre *re = NULL; const char *error; int erroffset = 0; int match = 0; re = pcre_compile( regexp, // The pattern. PCRE_CASELESS, // Case insensitive. &error, // Error message. &erroffset, // Error offset. NULL); // use default character tables. if(error) { if(re) { Q_free(re); } return false; } if(re && (match = pcre_exec(re, NULL, matchstring, strlen(matchstring), 0, 0, offsets, HUD_REGEXP_OFFSET_COUNT)) >= 0) { int substring_length = 0; substring_length = pcre_get_substring (matchstring, offsets, match, group, resultstring); if (resultlength != NULL) { (*resultlength) = substring_length; } if(re) { Q_free(re); } return (substring_length != PCRE_ERROR_NOSUBSTRING && substring_length != PCRE_ERROR_NOMEMORY); } if(re) { Q_free(re); } return false; }
SWITCH_DECLARE(void) switch_capture_regex(switch_regex_t *re, int match_count, const char *field_data, int *ovector, const char *var, switch_cap_callback_t callback, void *user_data) { const char *replace; int i; for (i = 0; i < match_count; i++) { if (pcre_get_substring(field_data, ovector, match_count, i, &replace) > 0) { callback(var, replace, user_data); pcre_free_substring(replace); } } }
void format(char* s, const char* fmt, const char* p, int* v, int n) { const char* t = fmt; while (1) { int c = (int)strcspn(t, ESCAPE_STR); memcpy(s, t, c); s += c; t += c; if (!*t) { break; } else if (*t == ESCAPE_CHAR) { if (isdigit(*++t)) { /* \N */ c = (*t-'0') * 2; ++t; memcpy(s, p+v[c], v[c+1]-v[c]); s += v[c+1] - v[c]; } else if (isalpha(*t) && isdigit(*(t+1))) { /* \xN */ const char* q; ++t; c = *t - '0'; if (pcre_get_substring(p, v, n, c, &q) <= 0) { ++t; /* TODO: handle error */ continue; } if (find_translation(q, s, to_section(*(t-1)))) { s += strlen(s); } else { s += pcre_copy_substring(p, v, n, c, s, 100); /* TODO: fix the use of magic number */ } ++t; pcre_free_substring(q); } else { ++t; /* do nothing */ } } else { printf("\nformat: impossible!\n"); system("pause"); } } *s = 0; }
/** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectSshSoftwareVersionData on success * \retval NULL on failure */ DetectSshSoftwareVersionData *DetectSshSoftwareVersionParse (char *str) { DetectSshSoftwareVersionData *ssh = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.softwareversion option"); goto error; } if (ret > 1) { const char *str_ptr = NULL; res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ ssh = SCMalloc(sizeof(DetectSshSoftwareVersionData)); if (unlikely(ssh == NULL)) goto error; ssh->software_ver = (uint8_t *)SCStrdup((char *)str_ptr); if (ssh->software_ver == NULL) { goto error; } pcre_free_substring(str_ptr); ssh->len = strlen((char *)ssh->software_ver); SCLogDebug("will look for ssh %s", ssh->software_ver); } return ssh; error: if (ssh != NULL) DetectSshSoftwareVersionFree(ssh); return NULL; }
SWITCH_DECLARE(void) switch_perform_substitution(switch_regex_t *re, int match_count, const char *data, const char *field_data, char *substituted, switch_size_t len, int *ovector) { char index[10] = ""; const char *replace = NULL; switch_size_t x, y = 0, z = 0; int num = 0; for (x = 0; x < (len - 1) && x < strlen(data);) { if (data[x] == '$') { x++; if (!(data[x] > 47 && data[x] < 58)) { substituted[y++] = data[x - 1]; continue; } while (data[x] > 47 && data[x] < 58) { index[z++] = data[x]; x++; } index[z++] = '\0'; z = 0; num = atoi(index); if (num < 0 || num > 256) { num = -1; } if (pcre_get_substring(field_data, ovector, match_count, num, &replace) > 0) { switch_size_t r; for (r = 0; r < strlen(replace); r++) { substituted[y++] = replace[r]; } pcre_free_substring(replace); } } else { substituted[y++] = data[x]; x++; } } substituted[y++] = '\0'; }
int check_regexp_match(const char *str, const char *pattern) { int options = PCRE_UTF8; const char *error; int erroffset; const unsigned char *tables = pcre_maketables(); pcre *re = pcre_compile(pattern, options, &error, &erroffset, tables); if (!re) { log_message(ERROR, _("Can't compile regular expression '%s'"), pattern); return FALSE; } int str_len = strlen(str); int ovector[50]; int count = pcre_exec(re, NULL, str, str_len, 0, 0, ovector, 50); if (count <= 0 && count != PCRE_ERROR_NOMATCH) { log_message(ERROR, _("Can't exec regular expression '%s', eror code %d"), pattern, count); pcre_free(re); pcre_free((void*)tables); return FALSE; } pcre_free(re); pcre_free((void*)tables); if (count == PCRE_ERROR_NOMATCH) return FALSE; const char *pcre_string = NULL; if(pcre_get_substring(str, ovector, count, 0, &pcre_string) < 0) return FALSE; //log_message(TRACE, _("Match word '%s' and PERL pattern '%s'"), str, pattern); pcre_free_substring(pcre_string); return TRUE; }