Yara hex string parsing, phase 2: Stuff the strings.

libclamav/readdb.c

@@ -2654,7 +2654,7 @@ static char **parse_yara_hex_string(YR_STRING *string)
     char **res=NULL, **tres;
     size_t nres=1, tnres, slen, *ssizes=NULL, *tssizes;
     char *str, *p1, *p2, *p3;
-    size_t i;
+    size_t i, j;
     unsigned long m, n;
 
     if (!(string) || !(string->string))
@@ -2663,7 +2663,7 @@ static char **parse_yara_hex_string(YR_STRING *string)
     if (!STRING_IS_HEX(string))
         return NULL;
 
-    str = string->string;
+    str = (char *)(string->string);
     slen = strlen(str);
 
     /* First calculate how many strings we need and how long each string needs to be */
@@ -2721,7 +2721,7 @@ static char **parse_yara_hex_string(YR_STRING *string)
 
             if (n - m == 0) {
                 for (i=0; i < nres; i++)
-                    ssizes[nres] += m * 2;
+                    ssizes[nres]++; /* [n-n] behaves as a match-all wildcard (*) */
                 p1 = p3;
                 break;
             }
@@ -2768,9 +2768,73 @@ static char **parse_yara_hex_string(YR_STRING *string)
         p1++;
     }
 
+    /* Allocate the space needed for the strings */
+    res = cli_calloc(nres+1, sizeof(char **)); /* +1 for terminating NULL */
+    if (!(res))
+        goto err;
+
+    for (i=0; i<nres; i++) {
+        res[i] = cli_calloc(ssizes[i]+1, 1);
+        if (!(res[i]))
+            goto err;
+    }
+
+    /* Copy over the strings */
+    tnres=1;
+    p1 = strchr(str, '{')+1;
+    while ((size_t)(p1 - str) < slen-1) {
+        switch (*p1) {
+        case ' ':
+        case '\n':
+        case '\r':
+        case '\t':
+            break;
+        case '[':
+            p2 = p1+1;
+            for (p2 = p1+1; (size_t)(p2 - str) < slen; p2++)
+                if (*p2 == ']')
+                    break;
+
+            for (p3 = p1+1; p3 < p2; p3++)
+                if (*p3 == '-')
+                    break;
+
+            m = strtoul(p1+1, &p3, 10);
+            if (m == 0 && errno == ERANGE)
+                goto err;
+
+            n = strtoul(p3+1, &p3, 10);
+
+            if (m > n)
+                goto err;
+
+            if (n - m == 0) {
+                for (i=0; i < nres; i++)
+                    res[i][strlen(res[i])-1] = '*';
+                p1 = p3;
+                break;
+            }
+
+            tnres += n - m;
+            for (i=1; i <= tnres; i++) {
+                for (j=0; j<i; j++)
+                    sprintf(res[i-1]+strlen(res[i-1]), "??");
+            }
+
+            p1=p3;
+            break;
+        default:
+            for (i=0; i < nres; i++)
+                res[i][strlen(res[i])] = *p1;
+            break;
+        }
+
+        p1++;
+    }
+
     cli_errmsg("Yara string \"%s\" has %zu substrings\n", str, nres);
     for (i = 0; i < nres; i++) {
-        cli_errmsg("    len(substring[%zu]) = %zu\n", i, ssizes[i]);
+        cli_errmsg("    substring[%zu] (%zu:%zu): \"%s\"\n", i, ssizes[i], strlen(res[i]), res[i]);
     }
 
     return NULL;