int yr_arena_allocate_memory( YR_ARENA* arena, size_t size, void** allocated_memory) { FAIL_ON_ERROR(yr_arena_reserve_memory(arena, size)); *allocated_memory = arena->current_page->address + \ arena->current_page->used; arena->current_page->used += size; return ERROR_SUCCESS; }
int yr_re_emit_code( RE* re, YR_ARENA* arena) { RE_EMIT_CONTEXT emit_context; int code_size; int total_size; int emit_flags = 0; if (re->flags & RE_FLAGS_NO_CASE) emit_flags |= EMIT_NO_CASE; if (re->flags & RE_FLAGS_DOT_ALL) emit_flags |= EMIT_DOT_ALL; emit_context.arena = arena; emit_context.next_split_id = 0; // Ensure that we have enough contiguous memory space in the arena to // contain the regular expression code. The code can't span over multiple // non-contiguous pages. yr_arena_reserve_memory(arena, RE_MAX_CODE_SIZE); // Emit code for matching the regular expressions forwards. total_size = 0; FAIL_ON_ERROR(_yr_re_emit( &emit_context, re->root_node, emit_flags, &re->code, &code_size)); total_size += code_size; FAIL_ON_ERROR(_yr_emit_inst( &emit_context, RE_OPCODE_MATCH, NULL, &code_size)); total_size += code_size; if (total_size > RE_MAX_CODE_SIZE) return ERROR_REGULAR_EXPRESSION_TOO_LARGE; yr_arena_reserve_memory(arena, RE_MAX_CODE_SIZE); // Emit code for matching the regular expressions backwards. total_size = 0; FAIL_ON_ERROR(_yr_re_emit( &emit_context, re->root_node, emit_flags | EMIT_BACKWARDS, NULL, &code_size)); total_size += code_size; FAIL_ON_ERROR(_yr_emit_inst( &emit_context, RE_OPCODE_MATCH, NULL, &code_size)); total_size += code_size; if (total_size > RE_MAX_CODE_SIZE) return ERROR_REGULAR_EXPRESSION_TOO_LARGE; return ERROR_SUCCESS; }
int yr_re_emit_code( RE* re, YR_ARENA* arena) { int code_size; int total_size; int emit_flags = 0; if (re->flags & RE_FLAGS_NO_CASE) emit_flags |= EMIT_NO_CASE; if (re->flags & RE_FLAGS_DOT_ALL) emit_flags |= EMIT_DOT_ALL; // Ensure that we have enough contiguos memory space in the arena to // contain the regular expression code. The code can't span over multiple // non-contiguos pages. yr_arena_reserve_memory(arena, RE_MAX_CODE_SIZE); // Emit code for matching the regular expressions forwards. total_size = 0; FAIL_ON_ERROR(_yr_re_emit( re->root_node, arena, emit_flags, &re->code, &code_size)); total_size += code_size; FAIL_ON_ERROR(_yr_emit_inst( arena, RE_OPCODE_MATCH, NULL, &code_size)); total_size += code_size; assert(total_size < RE_MAX_CODE_SIZE); yr_arena_reserve_memory(arena, RE_MAX_CODE_SIZE); // Emit code for matching the regular expressions backwards. total_size = 0; FAIL_ON_ERROR(_yr_re_emit( re->root_node, arena, emit_flags | EMIT_BACKWARDS, NULL, &code_size)); total_size += code_size; FAIL_ON_ERROR(_yr_emit_inst( arena, RE_OPCODE_MATCH, NULL, &code_size)); total_size += code_size; assert(total_size < RE_MAX_CODE_SIZE); return ERROR_SUCCESS; }
int yr_ac_compile( YR_AC_AUTOMATON* automaton, YR_ARENA* arena, YR_AC_TABLES* tables) { uint32_t i; FAIL_ON_ERROR(_yr_ac_create_failure_links(automaton)); FAIL_ON_ERROR(_yr_ac_optimize_failure_links(automaton)); FAIL_ON_ERROR(_yr_ac_build_transition_table(automaton)); FAIL_ON_ERROR(yr_arena_reserve_memory( arena, automaton->tables_size * sizeof(tables->transitions[0]) + automaton->tables_size * sizeof(tables->matches[0]))); FAIL_ON_ERROR(yr_arena_write_data( arena, automaton->t_table, sizeof(YR_AC_TRANSITION), (void**) &tables->transitions)); for (i = 1; i < automaton->tables_size; i++) { FAIL_ON_ERROR(yr_arena_write_data( arena, automaton->t_table + i, sizeof(YR_AC_TRANSITION), NULL)); } FAIL_ON_ERROR(yr_arena_write_data( arena, automaton->m_table, sizeof(YR_AC_MATCH_TABLE_ENTRY), (void**) &tables->matches)); FAIL_ON_ERROR(yr_arena_make_relocatable( arena, tables->matches, offsetof(YR_AC_MATCH_TABLE_ENTRY, match), EOL)); for (i = 1; i < automaton->tables_size; i++) { void* ptr; FAIL_ON_ERROR(yr_arena_write_data( arena, automaton->m_table + i, sizeof(YR_AC_MATCH_TABLE_ENTRY), (void**) &ptr)); FAIL_ON_ERROR(yr_arena_make_relocatable( arena, ptr, offsetof(YR_AC_MATCH_TABLE_ENTRY, match), EOL)); } return ERROR_SUCCESS; }