Skip to content

Commit

Permalink
Fix issue with matches operator not matching empty strings
Browse files Browse the repository at this point in the history
The `matches` operator was returning false if the left operand was an empty strings. So, `"" matches <some regexp>` was returning false regardless of the regexp used. However, some regexp *do* match the empty strings, like for example `/foo|/`.
  • Loading branch information
plusvic committed Mar 20, 2024
1 parent 8748502 commit c80cd9d
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 7 deletions.
7 changes: 0 additions & 7 deletions libyara/exec.c
Original file line number Diff line number Diff line change
Expand Up @@ -1967,13 +1967,6 @@ int yr_execute_code(YR_SCAN_CONTEXT* context)
ensure_defined(r2);
ensure_defined(r1);

if (r1.ss->length == 0)
{
r1.i = false;
push(r1);
break;
}

result = yr_re_exec(
context,
(uint8_t*) r2.re->code,
Expand Down
4 changes: 4 additions & 0 deletions tests/test-rules.c
Original file line number Diff line number Diff line change
Expand Up @@ -2953,6 +2953,10 @@ static void test_matches_operator()
assert_false_rule(
"rule test { condition: \"foo\\nbar\" matches /foo.*bar/ }", NULL);

assert_true_rule("rule test { condition: \"\" matches /foo|/ }", NULL);

assert_true_rule("rule test { condition: \"\" matches /a||b/ }", NULL);

YR_DEBUG_FPRINTF(1, stderr, "} // %s()\n", __FUNCTION__);
}

Expand Down

0 comments on commit c80cd9d

Please sign in to comment.