Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RE Lexer improperly parsing dashes after character classes #1690

Closed
Sevaarcen opened this issue Apr 23, 2022 · 1 comment
Closed

RE Lexer improperly parsing dashes after character classes #1690

Sevaarcen opened this issue Apr 23, 2022 · 1 comment

Comments

@Sevaarcen
Copy link

When using a regular expression containing a character class, followed by a dash -, followed by anything else, Yara fails with the following error:

$ /usr/bin/yara -s ~/testrule.yara ~/yara_test_file.txt 
~/testrule.yara(3): error: invalid regular expression "$": bad character range

It appears this error message is related to the following section of the RE lexer, where it doesn't properly look for the ending square bracket of the character range and therefore over-matches on the dash outside.

<char_class>(\\x{hex_digit}{2}|\\.|[^\\])\-[^]] {

This is the test rule I'm using, and the test file being scanned.

$ cat ~/testrule.yara 
rule test {
        strings:
                $ = /[0-9]-2/
        condition:
                all of them
}
$ cat ~/yara_test_file.txt 
1-2-3-4-5

Using grep, regex101, or similar, we can confirm the regex works as expected and is valid.

$ cat ~/yara_test_file.txt | grep -o "[0-9]-2"
1-2
plusvic added a commit that referenced this issue Apr 25, 2022
Regular expressions with a character class followed by a dash (-) failed with "bad character range". For example,  /[0-9]-2/ was not accepted as a valid regexp.
plusvic added a commit that referenced this issue Apr 25, 2022
Regular expressions with a character class followed by a dash (-) failed with "bad character range". For example,  /[0-9]-2/ was not accepted as a valid regexp.
plusvic added a commit that referenced this issue Apr 25, 2022
Regular expressions with a character class followed by a dash (-) failed with "bad character range". For example,  /[0-9]-2/ was not accepted as a valid regexp.
@plusvic
Copy link
Member

plusvic commented Apr 25, 2022

Fixed in a91b8a1 and ee96a35.

@plusvic plusvic closed this as completed Apr 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants