|
|
@ -373,12 +373,14 @@ int cli_parse_add(struct cli_matcher *root, const char *virname, const char *hex |
|
|
|
/* get pcre-ed */ |
|
|
|
/* get pcre-ed */ |
|
|
|
if (start == end) { |
|
|
|
if (start == end) { |
|
|
|
cli_errmsg("cli_parseadd(): PCRE subsig mismatched '/' delimiter\n"); |
|
|
|
cli_errmsg("cli_parseadd(): PCRE subsig mismatched '/' delimiter\n"); |
|
|
|
|
|
|
|
free(hexcpy); |
|
|
|
return CL_EMALFDB; |
|
|
|
return CL_EMALFDB; |
|
|
|
} |
|
|
|
} |
|
|
|
#if HAVE_PCRE |
|
|
|
#if HAVE_PCRE |
|
|
|
/* get checked */ |
|
|
|
/* get checked */ |
|
|
|
if (hexsig[0] == '/') { |
|
|
|
if (hexsig[0] == '/') { |
|
|
|
cli_errmsg("cli_parseadd(): PCRE subsig must contain logical trigger\n"); |
|
|
|
cli_errmsg("cli_parseadd(): PCRE subsig must contain logical trigger\n"); |
|
|
|
|
|
|
|
free(hexcpy); |
|
|
|
return CL_EMALFDB; |
|
|
|
return CL_EMALFDB; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
@ -3261,11 +3263,14 @@ static int yara_subhex_verify(const char *hexstr, const char *end, size_t *maxsu |
|
|
|
cli_warnmsg("load_oneyara[verify]: string has unbounded wildcard on single byte subsequence\n"); |
|
|
|
cli_warnmsg("load_oneyara[verify]: string has unbounded wildcard on single byte subsequence\n"); |
|
|
|
return CL_EMALFDB; |
|
|
|
return CL_EMALFDB; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
if (maxsublen && (sublen > *maxsublen)) |
|
|
|
|
|
|
|
*maxsublen = sublen; |
|
|
|
|
|
|
|
sublen = 0; |
|
|
|
|
|
|
|
break; |
|
|
|
case '?': |
|
|
|
case '?': |
|
|
|
if (*track == '?') |
|
|
|
|
|
|
|
hexbyte = !hexbyte; |
|
|
|
|
|
|
|
if (maxsublen && (sublen > *maxsublen)) |
|
|
|
if (maxsublen && (sublen > *maxsublen)) |
|
|
|
*maxsublen = sublen; |
|
|
|
*maxsublen = sublen; |
|
|
|
|
|
|
|
hexbyte = !hexbyte; |
|
|
|
sublen = 0; |
|
|
|
sublen = 0; |
|
|
|
break; |
|
|
|
break; |
|
|
|
case '[': |
|
|
|
case '[': |
|
|
|