YR_STRING* yr_parser_reduce_string_declaration(
yyscan_t yyscanner,
int32_t flags,
const char* identifier,
SIZED_STRING* str)
{
int min_atom_length;
int min_atom_length_aux;
int32_t min_gap;
int32_t max_gap;
char* file_name;
char message[512];
YR_COMPILER* compiler = yyget_extra(yyscanner);
YR_STRING* string = NULL;
YR_STRING* aux_string;
YR_STRING* prev_string;
RE* re = NULL;
RE* remainder_re;
if (strcmp(identifier,"$") == 0)
flags |= STRING_GFLAGS_ANONYMOUS;
if (!(flags & STRING_GFLAGS_WIDE))
flags |= STRING_GFLAGS_ASCII;
if (str->flags & SIZED_STRING_FLAGS_NO_CASE)
flags |= STRING_GFLAGS_NO_CASE;
if (str->flags & SIZED_STRING_FLAGS_DOT_ALL)
flags |= STRING_GFLAGS_REGEXP_DOT_ALL;
// The STRING_GFLAGS_SINGLE_MATCH flag indicates that finding
// a single match for the string is enough. This is true in
// most cases, except when the string count (#) and string offset (@)
// operators are used. All strings are marked STRING_FLAGS_SINGLE_MATCH
// initially, and unmarked later if required.
flags |= STRING_GFLAGS_SINGLE_MATCH;
if (flags & STRING_GFLAGS_HEXADECIMAL ||
flags & STRING_GFLAGS_REGEXP)
{
if (flags & STRING_GFLAGS_HEXADECIMAL)
compiler->last_result = yr_re_compile_hex(
str->c_string, &re);
else
compiler->last_result = yr_re_compile(
str->c_string, &re);
if (compiler->last_result != ERROR_SUCCESS)
{
snprintf(
message,
sizeof(message),
"invalid %s \"%s\": %s",
(flags & STRING_GFLAGS_HEXADECIMAL) ?
"hex string" : "regular expression",
identifier,
re->error_message);
yr_compiler_set_error_extra_info(
compiler, message);
goto _exit;
}
if (re->flags & RE_FLAGS_FAST_HEX_REGEXP)
flags |= STRING_GFLAGS_FAST_HEX_REGEXP;
compiler->last_result = yr_re_split_at_chaining_point(
re, &re, &remainder_re, &min_gap, &max_gap);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
compiler->last_result = _yr_parser_write_string(
identifier,
flags,
compiler,
NULL,
re,
&string,
&min_atom_length);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
if (remainder_re != NULL)
{
string->g_flags |= STRING_GFLAGS_CHAIN_TAIL | STRING_GFLAGS_CHAIN_PART;
string->chain_gap_min = min_gap;
string->chain_gap_max = max_gap;
}
// Use "aux_string" from now on, we want to keep the value of "string"
// because it will returned.
aux_string = string;
while (remainder_re != NULL)
{
// Destroy regexp pointed by 're' before yr_re_split_at_jmp
// overwrites 're' with another value.
yr_re_destroy(re);
compiler->last_result = yr_re_split_at_chaining_point(
remainder_re, &re, &remainder_re, &min_gap, &max_gap);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
prev_string = aux_string;
compiler->last_result = _yr_parser_write_string(
identifier,
flags,
compiler,
NULL,
re,
&aux_string,
&min_atom_length_aux);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
if (min_atom_length_aux < min_atom_length)
min_atom_length = min_atom_length_aux;
aux_string->g_flags |= STRING_GFLAGS_CHAIN_PART;
aux_string->chain_gap_min = min_gap;
aux_string->chain_gap_max = max_gap;
prev_string->chained_to = aux_string;
}
}
else
{
compiler->last_result = _yr_parser_write_string(
identifier,
flags,
compiler,
str,
NULL,
&string,
&min_atom_length);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
}
if (compiler->file_name_stack_ptr > 0)
file_name = compiler->file_name_stack[compiler->file_name_stack_ptr - 1];
else
file_name = NULL;
if (min_atom_length < 2 && compiler->error_report_function != NULL)
{
snprintf(
message,
sizeof(message),
"%s is slowing down scanning%s",
string->identifier,
min_atom_length == 0 ? " (critical!)" : "");
compiler->error_report_function(
YARA_ERROR_LEVEL_WARNING,
file_name,
yyget_lineno(yyscanner),
message);
}
_exit:
if (re != NULL)
yr_re_destroy(re);
if (compiler->last_result != ERROR_SUCCESS)
return NULL;
return string;
}
YR_STRING* yr_parser_reduce_string_declaration(
yyscan_t yyscanner,
int32_t string_flags,
const char* identifier,
SIZED_STRING* str)
{
int min_atom_quality;
int min_atom_quality_aux;
int re_flags = 0;
int32_t min_gap;
int32_t max_gap;
char message[512];
YR_COMPILER* compiler = yyget_extra(yyscanner);
YR_STRING* string = NULL;
YR_STRING* aux_string;
YR_STRING* prev_string;
RE* re = NULL;
RE* remainder_re;
RE_ERROR re_error;
// Determine if a string with the same identifier was already defined
// by searching for the identifier in string_table.
string = yr_hash_table_lookup(
compiler->strings_table,
identifier,
NULL);
if (string != NULL)
{
compiler->last_result = ERROR_DUPLICATED_STRING_IDENTIFIER;
yr_compiler_set_error_extra_info(compiler, identifier);
goto _exit;
}
// Empty strings are now allowed
if (str->length == 0)
{
compiler->last_result = ERROR_EMPTY_STRING;
yr_compiler_set_error_extra_info(compiler, identifier);
goto _exit;
}
if (str->flags & SIZED_STRING_FLAGS_NO_CASE)
string_flags |= STRING_GFLAGS_NO_CASE;
if (str->flags & SIZED_STRING_FLAGS_DOT_ALL)
re_flags |= RE_FLAGS_DOT_ALL;
if (strcmp(identifier,"$") == 0)
string_flags |= STRING_GFLAGS_ANONYMOUS;
if (!(string_flags & STRING_GFLAGS_WIDE))
string_flags |= STRING_GFLAGS_ASCII;
if (string_flags & STRING_GFLAGS_NO_CASE)
re_flags |= RE_FLAGS_NO_CASE;
// The STRING_GFLAGS_SINGLE_MATCH flag indicates that finding
// a single match for the string is enough. This is true in
// most cases, except when the string count (#) and string offset (@)
// operators are used. All strings are marked STRING_FLAGS_SINGLE_MATCH
// initially, and unmarked later if required.
string_flags |= STRING_GFLAGS_SINGLE_MATCH;
// The STRING_GFLAGS_FIXED_OFFSET indicates that the string doesn't
// need to be searched all over the file because the user is using the
// "at" operator. The string must be searched at a fixed offset in the
// file. All strings are marked STRING_GFLAGS_FIXED_OFFSET initially,
// and unmarked later if required.
string_flags |= STRING_GFLAGS_FIXED_OFFSET;
if (string_flags & STRING_GFLAGS_HEXADECIMAL ||
string_flags & STRING_GFLAGS_REGEXP)
{
if (string_flags & STRING_GFLAGS_HEXADECIMAL)
compiler->last_result = yr_re_parse_hex(
str->c_string, re_flags, &re, &re_error);
else
compiler->last_result = yr_re_parse(
str->c_string, re_flags, &re, &re_error);
if (compiler->last_result != ERROR_SUCCESS)
{
snprintf(
message,
sizeof(message),
"invalid %s \"%s\": %s",
(string_flags & STRING_GFLAGS_HEXADECIMAL) ?
"hex string" : "regular expression",
identifier,
re_error.message);
yr_compiler_set_error_extra_info(
compiler, message);
goto _exit;
}
if (re->flags & RE_FLAGS_FAST_HEX_REGEXP)
string_flags |= STRING_GFLAGS_FAST_HEX_REGEXP;
// Regular expressions in the strings section can't mix greedy and ungreedy
// quantifiers like .* and .*?. That's because these regular expressions can
// be matched forwards and/or backwards depending on the atom found, and we
// need the regexp to be all-greedy or all-ungreedy to be able to properly
// calculate the length of the match.
if ((re->flags & RE_FLAGS_GREEDY) &&
(re->flags & RE_FLAGS_UNGREEDY))
{
compiler->last_result = ERROR_INVALID_REGULAR_EXPRESSION;
yr_compiler_set_error_extra_info(compiler,
"greedy and ungreedy quantifiers can't be mixed in a regular "
"expression");
goto _exit;
}
if (re->flags & RE_FLAGS_GREEDY)
string_flags |= STRING_GFLAGS_GREEDY_REGEXP;
if (yr_re_contains_dot_star(re))
{
snprintf(
message,
sizeof(message),
"%s contains .*, consider using .{N} with a reasonable value for N",
identifier);
yywarning(yyscanner, message);
}
compiler->last_result = yr_re_split_at_chaining_point(
re, &re, &remainder_re, &min_gap, &max_gap);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
compiler->last_result = _yr_parser_write_string(
identifier,
string_flags,
compiler,
NULL,
re,
&string,
&min_atom_quality);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
if (remainder_re != NULL)
{
string->g_flags |= STRING_GFLAGS_CHAIN_TAIL | STRING_GFLAGS_CHAIN_PART;
string->chain_gap_min = min_gap;
string->chain_gap_max = max_gap;
}
// Use "aux_string" from now on, we want to keep the value of "string"
// because it will returned.
aux_string = string;
while (remainder_re != NULL)
{
// Destroy regexp pointed by 're' before yr_re_split_at_jmp
// overwrites 're' with another value.
yr_re_destroy(re);
compiler->last_result = yr_re_split_at_chaining_point(
remainder_re, &re, &remainder_re, &min_gap, &max_gap);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
prev_string = aux_string;
compiler->last_result = _yr_parser_write_string(
identifier,
string_flags,
compiler,
NULL,
re,
&aux_string,
&min_atom_quality_aux);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
if (min_atom_quality_aux < min_atom_quality)
min_atom_quality = min_atom_quality_aux;
aux_string->g_flags |= STRING_GFLAGS_CHAIN_PART;
aux_string->chain_gap_min = min_gap;
aux_string->chain_gap_max = max_gap;
prev_string->chained_to = aux_string;
// prev_string is now chained to aux_string, an string chained
// to another one can't have a fixed offset, only the head of the
// string chain can have a fixed offset.
prev_string->g_flags &= ~STRING_GFLAGS_FIXED_OFFSET;
}
}
else
{
compiler->last_result = _yr_parser_write_string(
identifier,
string_flags,
compiler,
str,
NULL,
&string,
&min_atom_quality);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
}
compiler->last_result = yr_hash_table_add(
compiler->strings_table,
identifier,
NULL,
string);
if (compiler->last_result != ERROR_SUCCESS)
goto _exit;
if (min_atom_quality < 3 && compiler->callback != NULL)
{
snprintf(
message,
sizeof(message),
"%s is slowing down scanning%s",
string->identifier,
min_atom_quality < 2 ? " (critical!)" : "");
yywarning(yyscanner, message);
}
_exit:
if (re != NULL)
yr_re_destroy(re);
if (compiler->last_result != ERROR_SUCCESS)
return NULL;
return string;
}
