yr_ac_automaton_create: 732| 2|{ 733| 2| YR_AC_AUTOMATON* new_automaton; 734| 2| YR_AC_STATE* root_state; 735| | 736| 2| new_automaton = (YR_AC_AUTOMATON*) yr_malloc(sizeof(YR_AC_AUTOMATON)); 737| 2| root_state = (YR_AC_STATE*) yr_malloc(sizeof(YR_AC_STATE)); 738| | 739| 2| if (new_automaton == NULL || root_state == NULL) ------------------ | Branch (739:7): [True: 0, False: 2] | Branch (739:32): [True: 0, False: 2] ------------------ 740| 0| { 741| 0| yr_free(new_automaton); 742| 0| yr_free(root_state); 743| | 744| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 745| 0| } 746| | 747| 2| root_state->depth = 0; 748| 2| root_state->matches_ref = YR_ARENA_NULL_REF; ------------------ | | 43| 2| (YR_ARENA_REF) \ | | 44| 2| { \ | | 45| 2| UINT32_MAX, UINT32_MAX \ | | 46| 2| } ------------------ 749| 2| root_state->failure = NULL; 750| 2| root_state->first_child = NULL; 751| 2| root_state->siblings = NULL; 752| 2| root_state->t_table_slot = 0; 753| | 754| 2| new_automaton->arena = arena; 755| 2| new_automaton->root = root_state; 756| 2| new_automaton->bitmask = NULL; 757| 2| new_automaton->tables_size = 0; 758| | 759| 2| *automaton = new_automaton; 760| | 761| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 762| 2|} yr_ac_automaton_destroy: 768| 2|{ 769| 2| _yr_ac_state_destroy(automaton->root); 770| | 771| 2| yr_free(automaton->bitmask); 772| 2| yr_free(automaton); 773| | 774| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 775| 2|} yr_ac_compile: 847| 2|{ 848| 2| FAIL_ON_ERROR(_yr_ac_create_failure_links(automaton)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 849| 2| FAIL_ON_ERROR(_yr_ac_optimize_failure_links(automaton)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 850| 2| FAIL_ON_ERROR(_yr_ac_build_transition_table(automaton)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 851| | 852| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 853| 2|} ahocorasick.c:_yr_ac_state_destroy: 196| 2|{ 197| 2| YR_AC_STATE* child_state = state->first_child; 198| | 199| 2| while (child_state != NULL) ------------------ | Branch (199:10): [True: 0, False: 2] ------------------ 200| 0| { 201| 0| YR_AC_STATE* next_child_state = child_state->siblings; 202| 0| _yr_ac_state_destroy(child_state); 203| 0| child_state = next_child_state; 204| 0| } 205| | 206| 2| yr_free(state); 207| | 208| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 209| 2|} ahocorasick.c:_yr_ac_create_failure_links: 218| 2|{ 219| 2| YR_AC_STATE* current_state; 220| 2| YR_AC_STATE* failure_state; 221| 2| YR_AC_STATE* temp_state; 222| 2| YR_AC_STATE* state; 223| 2| YR_AC_STATE* transition_state; 224| 2| YR_AC_STATE* root_state; 225| 2| YR_AC_MATCH* match; 226| | 227| 2| QUEUE queue; 228| | 229| 2| queue.head = NULL; 230| 2| queue.tail = NULL; 231| | 232| 2| root_state = automaton->root; 233| | 234| | // Set the failure link of root state to itself. 235| 2| root_state->failure = root_state; 236| | 237| | // Push root's children and set their failure link to root. 238| 2| state = root_state->first_child; 239| | 240| 2| while (state != NULL) ------------------ | Branch (240:10): [True: 0, False: 2] ------------------ 241| 0| { 242| 0| FAIL_ON_ERROR(_yr_ac_queue_push(&queue, state)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 243| 0| state->failure = root_state; 244| 0| state = state->siblings; 245| 0| } 246| | 247| | // Traverse the trie in BFS order calculating the failure link 248| | // for each state. 249| 2| while (!_yr_ac_queue_is_empty(&queue)) ------------------ | Branch (249:10): [True: 0, False: 2] ------------------ 250| 0| { 251| 0| current_state = _yr_ac_queue_pop(&queue); 252| 0| match = yr_arena_ref_to_ptr(automaton->arena, ¤t_state->matches_ref); 253| | 254| 0| if (match != NULL) ------------------ | Branch (254:9): [True: 0, False: 0] ------------------ 255| 0| { 256| | // Find the last match in the list of matches. 257| 0| while (match->next != NULL) match = match->next; ------------------ | Branch (257:14): [True: 0, False: 0] ------------------ 258| | 259| 0| if (match->backtrack > 0) ------------------ | Branch (259:11): [True: 0, False: 0] ------------------ 260| 0| match->next = yr_arena_ref_to_ptr( 261| 0| automaton->arena, &root_state->matches_ref); 262| 0| } 263| 0| else 264| 0| { 265| | // This state doesn't have any matches, its matches will be those 266| | // in the root state, if any. 267| 0| current_state->matches_ref = root_state->matches_ref; 268| 0| } 269| | 270| | // Iterate over all the states that the current state can transition to. 271| 0| transition_state = current_state->first_child; 272| | 273| 0| while (transition_state != NULL) ------------------ | Branch (273:12): [True: 0, False: 0] ------------------ 274| 0| { 275| 0| FAIL_ON_ERROR(_yr_ac_queue_push(&queue, transition_state)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 276| 0| failure_state = current_state->failure; 277| | 278| 0| while (1) ------------------ | Branch (278:14): [True: 0, Folded] ------------------ 279| 0| { 280| 0| temp_state = _yr_ac_next_state(failure_state, transition_state->input); 281| | 282| 0| if (temp_state != NULL) ------------------ | Branch (282:13): [True: 0, False: 0] ------------------ 283| 0| { 284| 0| transition_state->failure = temp_state; 285| | 286| 0| if (YR_ARENA_IS_NULL_REF(transition_state->matches_ref)) ------------------ | | 49| 0| (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | | Branch (49:3): [True: 0, False: 0] | | ------------------ ------------------ 287| 0| { 288| 0| transition_state->matches_ref = temp_state->matches_ref; 289| 0| } 290| 0| else 291| 0| { 292| 0| match = yr_arena_ref_to_ptr( 293| 0| automaton->arena, &transition_state->matches_ref); 294| | 295| 0| assert(match != NULL); ------------------ | Branch (295:13): [True: 0, False: 0] | Branch (295:13): [True: 0, False: 0] ------------------ 296| | 297| | // Find the last match in the list of matches. 298| 0| while (match->next != NULL) match = match->next; ------------------ | Branch (298:20): [True: 0, False: 0] ------------------ 299| | 300| 0| match->next = yr_arena_ref_to_ptr( 301| 0| automaton->arena, &temp_state->matches_ref); 302| 0| } 303| | 304| 0| break; 305| 0| } 306| 0| else 307| 0| { 308| 0| if (failure_state == root_state) ------------------ | Branch (308:15): [True: 0, False: 0] ------------------ 309| 0| { 310| 0| transition_state->failure = root_state; 311| 0| break; 312| 0| } 313| 0| else 314| 0| { 315| 0| failure_state = failure_state->failure; 316| 0| } 317| 0| } 318| 0| } // while(1) 319| | 320| 0| transition_state = transition_state->siblings; 321| 0| } 322| | 323| 0| } // while(!__yr_ac_queue_is_empty(&queue)) 324| | 325| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 326| 2|} ahocorasick.c:_yr_ac_queue_is_empty: 131| 6|{ 132| | return queue->head == NULL; 133| 6|} ahocorasick.c:_yr_ac_optimize_failure_links: 364| 2|{ 365| 2| QUEUE queue = {NULL, NULL}; 366| | 367| | // Push root's children. 368| 2| YR_AC_STATE* root_state = automaton->root; 369| 2| YR_AC_STATE* state = root_state->first_child; 370| | 371| 2| while (state != NULL) ------------------ | Branch (371:10): [True: 0, False: 2] ------------------ 372| 0| { 373| 0| FAIL_ON_ERROR(_yr_ac_queue_push(&queue, state)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 374| 0| state = state->siblings; 375| 0| } 376| | 377| 2| while (!_yr_ac_queue_is_empty(&queue)) ------------------ | Branch (377:10): [True: 0, False: 2] ------------------ 378| 0| { 379| 0| YR_AC_STATE* current_state = _yr_ac_queue_pop(&queue); 380| | 381| 0| if (current_state->failure != root_state) ------------------ | Branch (381:9): [True: 0, False: 0] ------------------ 382| 0| { 383| 0| if (_yr_ac_transitions_subset(current_state, current_state->failure)) ------------------ | Branch (383:11): [True: 0, False: 0] ------------------ 384| 0| current_state->failure = current_state->failure->failure; 385| 0| } 386| | 387| | // Push children of current_state 388| 0| state = current_state->first_child; 389| | 390| 0| while (state != NULL) ------------------ | Branch (390:12): [True: 0, False: 0] ------------------ 391| 0| { 392| 0| FAIL_ON_ERROR(_yr_ac_queue_push(&queue, state)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 393| 0| state = state->siblings; 394| 0| } 395| 0| } 396| | 397| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 398| 2|} ahocorasick.c:_yr_ac_build_transition_table: 526| 2|{ 527| 2| YR_AC_TRANSITION* t_table; 528| 2| uint32_t* m_table; 529| 2| YR_AC_STATE* state; 530| 2| YR_AC_STATE* child_state; 531| 2| YR_AC_STATE* root_state = automaton->root; 532| | 533| 2| uint32_t slot; 534| | 535| 2| QUEUE queue = {NULL, NULL}; 536| | 537| | // Both t_table and m_table have 512 slots initially, which is enough for the 538| | // root node's transition table. 539| 2| automaton->tables_size = 512; 540| | 541| 2| automaton->bitmask = yr_calloc( 542| 2| YR_BITMASK_SIZE(automaton->tables_size), sizeof(YR_BITMASK)); ------------------ | | 57| 2|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 2|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 543| | 544| 2| if (automaton->bitmask == NULL) ------------------ | Branch (544:7): [True: 0, False: 2] ------------------ 545| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 546| | 547| 2| FAIL_ON_ERROR(yr_arena_allocate_zeroed_memory( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 548| 2| automaton->arena, 549| 2| YR_AC_TRANSITION_TABLE, 550| 2| automaton->tables_size * sizeof(YR_AC_TRANSITION), 551| 2| NULL)); 552| | 553| 2| FAIL_ON_ERROR(yr_arena_allocate_zeroed_memory( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 554| 2| automaton->arena, 555| 2| YR_AC_STATE_MATCHES_TABLE, 556| 2| automaton->tables_size * sizeof(uint32_t), 557| 2| NULL)); 558| | 559| 2| t_table = yr_arena_get_ptr(automaton->arena, YR_AC_TRANSITION_TABLE, 0); ------------------ | | 65| 2|#define YR_AC_TRANSITION_TABLE 8 ------------------ 560| 2| m_table = yr_arena_get_ptr(automaton->arena, YR_AC_STATE_MATCHES_TABLE, 0); ------------------ | | 66| 2|#define YR_AC_STATE_MATCHES_TABLE 9 ------------------ 561| | 562| | // The failure link for the root node points to itself. 563| 2| t_table[0] = YR_AC_MAKE_TRANSITION(0, 0); ------------------ | | 50| 2| ((YR_AC_TRANSITION)( \ | | 51| 2| (((YR_AC_TRANSITION) state) << YR_AC_SLOT_OFFSET_BITS) | (code))) | | ------------------ | | | | 39| 2|#define YR_AC_SLOT_OFFSET_BITS 9 | | ------------------ ------------------ 564| | 565| | // Initialize the entry corresponding to the root node in the match table. 566| | // Entries in this table are the index within YR_AC_MATCH_POOL where resides 567| | // the YR_AC_MATCH structure that corresponds to the head of the matches list 568| | // for the node. The indexes start counting at 1, the zero is used for 569| | // indicating that the node has no associated matches. 570| 2| if (!YR_ARENA_IS_NULL_REF(root_state->matches_ref)) ------------------ | | 49| 2| (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 2| (YR_ARENA_REF) \ | | | | 44| 2| { \ | | | | 45| 2| UINT32_MAX, UINT32_MAX \ | | | | 46| 2| } | | ------------------ | | (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 2| (YR_ARENA_REF) \ | | | | 44| 2| { \ | | | | 45| 2| UINT32_MAX, UINT32_MAX \ | | | | 46| 2| } | | ------------------ ------------------ | Branch (570:7): [True: 0, False: 2] ------------------ 571| 0| m_table[0] = root_state->matches_ref.offset / sizeof(YR_AC_MATCH) + 1; 572| | 573| | // Mark the first slot in the transition table as used. 574| 2| yr_bitmask_set(automaton->bitmask, 0); ------------------ | | 60| 2| do \ | | 61| 2| { \ | | 62| 2| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 2|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 2|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 2| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 2] | | ------------------ ------------------ 575| | 576| | // Index 0 is for root node. Unused indexes start at 1. 577| 2| automaton->t_table_unused_candidate = 1; 578| | 579| 2| child_state = root_state->first_child; 580| | 581| 2| while (child_state != NULL) ------------------ | Branch (581:10): [True: 0, False: 2] ------------------ 582| 0| { 583| | // Each state stores its slot number. 584| 0| child_state->t_table_slot = child_state->input + 1; 585| | 586| 0| t_table[child_state->input + 1] = YR_AC_MAKE_TRANSITION( ------------------ | | 50| 0| ((YR_AC_TRANSITION)( \ | | 51| 0| (((YR_AC_TRANSITION) state) << YR_AC_SLOT_OFFSET_BITS) | (code))) | | ------------------ | | | | 39| 0|#define YR_AC_SLOT_OFFSET_BITS 9 | | ------------------ ------------------ 587| 0| 0, child_state->input + 1); 588| | 589| 0| yr_bitmask_set(automaton->bitmask, child_state->input + 1); ------------------ | | 60| 0| do \ | | 61| 0| { \ | | 62| 0| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 0| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 0] | | ------------------ ------------------ 590| | 591| 0| FAIL_ON_ERROR(_yr_ac_queue_push(&queue, child_state)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 592| 0| child_state = child_state->siblings; 593| 0| } 594| | 595| 2| while (!_yr_ac_queue_is_empty(&queue)) ------------------ | Branch (595:10): [True: 0, False: 2] ------------------ 596| 0| { 597| 0| state = _yr_ac_queue_pop(&queue); 598| | 599| 0| FAIL_ON_ERROR(_yr_ac_find_suitable_transition_table_slot( ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 600| 0| automaton, automaton->arena, state, &slot)); 601| | 602| | // _yr_ac_find_suitable_transition_table_slot can allocate more space in 603| | // both tables and cause the tables to be moved to a different memory 604| | // location, we must get their up-to-date addresses. 605| 0| t_table = yr_arena_get_ptr(automaton->arena, YR_AC_TRANSITION_TABLE, 0); ------------------ | | 65| 0|#define YR_AC_TRANSITION_TABLE 8 ------------------ 606| 0| m_table = yr_arena_get_ptr(automaton->arena, YR_AC_STATE_MATCHES_TABLE, 0); ------------------ | | 66| 0|#define YR_AC_STATE_MATCHES_TABLE 9 ------------------ 607| | 608| 0| t_table[state->t_table_slot] |= (slot << YR_AC_SLOT_OFFSET_BITS); ------------------ | | 39| 0|#define YR_AC_SLOT_OFFSET_BITS 9 ------------------ 609| 0| t_table[slot] = YR_AC_MAKE_TRANSITION(state->failure->t_table_slot, 0); ------------------ | | 50| 0| ((YR_AC_TRANSITION)( \ | | 51| 0| (((YR_AC_TRANSITION) state) << YR_AC_SLOT_OFFSET_BITS) | (code))) | | ------------------ | | | | 39| 0|#define YR_AC_SLOT_OFFSET_BITS 9 | | ------------------ ------------------ 610| | 611| | // The match table is an array of indexes within YR_AC_MATCHES_POOL. The 612| | // N-th item in the array is the index for the YR_AC_MATCH structure that 613| | // represents the head of the matches list for state N. The indexes start 614| | // at 1, the 0 indicates that there are no matches for the state. 615| 0| if (YR_ARENA_IS_NULL_REF(state->matches_ref)) ------------------ | | 49| 0| (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | | Branch (49:3): [True: 0, False: 0] | | ------------------ ------------------ 616| 0| m_table[slot] = 0; 617| 0| else 618| 0| m_table[slot] = state->matches_ref.offset / sizeof(YR_AC_MATCH) + 1; 619| | 620| 0| state->t_table_slot = slot; 621| | 622| 0| yr_bitmask_set(automaton->bitmask, slot); ------------------ | | 60| 0| do \ | | 61| 0| { \ | | 62| 0| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 0| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 0] | | ------------------ ------------------ 623| | 624| | // Push children of current_state 625| 0| child_state = state->first_child; 626| | 627| 0| while (child_state != NULL) ------------------ | Branch (627:12): [True: 0, False: 0] ------------------ 628| 0| { 629| 0| child_state->t_table_slot = slot + child_state->input + 1; 630| | 631| 0| t_table[child_state->t_table_slot] = YR_AC_MAKE_TRANSITION( ------------------ | | 50| 0| ((YR_AC_TRANSITION)( \ | | 51| 0| (((YR_AC_TRANSITION) state) << YR_AC_SLOT_OFFSET_BITS) | (code))) | | ------------------ | | | | 39| 0|#define YR_AC_SLOT_OFFSET_BITS 9 | | ------------------ ------------------ 632| 0| 0, child_state->input + 1); 633| | 634| 0| yr_bitmask_set(automaton->bitmask, child_state->t_table_slot); ------------------ | | 60| 0| do \ | | 61| 0| { \ | | 62| 0| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 0| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 0] | | ------------------ ------------------ 635| | 636| 0| FAIL_ON_ERROR(_yr_ac_queue_push(&queue, child_state)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 637| | 638| 0| child_state = child_state->siblings; 639| 0| } 640| 0| } 641| | 642| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 643| 2|} yr_arena_create: 236| 1.70k|{ 237| 1.70k| YR_ARENA* new_arena = (YR_ARENA*) yr_calloc(1, sizeof(YR_ARENA)); 238| | 239| 1.70k| if (new_arena == NULL) ------------------ | Branch (239:7): [True: 0, False: 1.70k] ------------------ 240| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 241| | 242| 1.70k| new_arena->xrefs = 1; 243| 1.70k| new_arena->num_buffers = num_buffers; 244| 1.70k| new_arena->initial_buffer_size = initial_buffer_size; 245| | 246| 1.70k| *arena = new_arena; 247| | 248| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 249| 1.70k|} yr_arena_acquire: 252| 2|{ 253| 2| arena->xrefs++; 254| 2|} yr_arena_release: 271| 1.70k|{ 272| 1.70k| arena->xrefs--; 273| | 274| 1.70k| if (arena->xrefs > 0) ------------------ | Branch (274:7): [True: 2, False: 1.70k] ------------------ 275| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 276| | 277| 3.41k| for (uint32_t i = 0; i < arena->num_buffers; i++) ------------------ | Branch (277:24): [True: 1.70k, False: 1.70k] ------------------ 278| 1.70k| { 279| 1.70k| if (arena->buffers[i].data != NULL) ------------------ | Branch (279:9): [True: 1.70k, False: 0] ------------------ 280| 1.70k| yr_free(arena->buffers[i].data); 281| 1.70k| } 282| | 283| 1.70k| YR_RELOC* reloc = arena->reloc_list_head; 284| | 285| 1.70k| while (reloc != NULL) ------------------ | Branch (285:10): [True: 0, False: 1.70k] ------------------ 286| 0| { 287| 0| YR_RELOC* next = reloc->next; 288| 0| yr_free(reloc); 289| 0| reloc = next; 290| 0| } 291| | 292| 1.70k| yr_free(arena); 293| | 294| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 295| 1.70k|} yr_arena_allocate_zeroed_memory: 341| 4|{ 342| 4| return _yr_arena_allocate_memory( 343| 4| arena, YR_ARENA_ZERO_MEMORY, buffer_id, size, ref); ------------------ | | 115| 4|#define YR_ARENA_ZERO_MEMORY 1 ------------------ 344| 4|} yr_arena_allocate_struct: 385| 6|{ 386| 6| YR_ARENA_REF r; 387| | 388| 6| int result = _yr_arena_allocate_memory( 389| 6| arena, YR_ARENA_ZERO_MEMORY, buffer_id, size, &r); ------------------ | | 115| 6|#define YR_ARENA_ZERO_MEMORY 1 ------------------ 390| | 391| 6| if (result != ERROR_SUCCESS) ------------------ | | 40| 6|#define ERROR_SUCCESS 0 ------------------ | Branch (391:7): [True: 0, False: 6] ------------------ 392| 0| return result; 393| | 394| 6| va_list field_offsets; 395| 6| va_start(field_offsets, ref); 396| | 397| 6| result = _yr_arena_make_ptr_relocatable( 398| 6| arena, buffer_id, r.offset, field_offsets); 399| | 400| 6| va_end(field_offsets); 401| | 402| 6| if (result == ERROR_SUCCESS && ref != NULL) ------------------ | | 40| 12|#define ERROR_SUCCESS 0 ------------------ | Branch (402:7): [True: 6, False: 0] | Branch (402:34): [True: 6, False: 0] ------------------ 403| 6| { 404| 6| ref->buffer_id = r.buffer_id; 405| 6| ref->offset = r.offset; 406| 6| } 407| | 408| 6| return result; 409| 6|} yr_arena_get_ptr: 415| 1.84k|{ 416| 1.84k| assert(buffer_id < arena->num_buffers); ------------------ | Branch (416:3): [True: 0, False: 1.84k] | Branch (416:3): [True: 1.84k, False: 0] ------------------ 417| 1.84k| assert(offset <= arena->buffers[buffer_id].used); ------------------ | Branch (417:3): [True: 0, False: 1.84k] | Branch (417:3): [True: 1.84k, False: 0] ------------------ 418| | 419| 1.84k| if (arena->buffers[buffer_id].data == NULL) ------------------ | Branch (419:7): [True: 6, False: 1.83k] ------------------ 420| 6| return NULL; 421| | 422| 1.83k| return arena->buffers[buffer_id].data + offset; 423| 1.84k|} yr_arena_get_current_offset: 426| 24|{ 427| 24| assert(buffer_id < arena->num_buffers); ------------------ | Branch (427:3): [True: 0, False: 24] | Branch (427:3): [True: 24, False: 0] ------------------ 428| | 429| 24| return (yr_arena_off_t) arena->buffers[buffer_id].used; 430| 24|} yr_arena_ptr_to_ref: 433| 34.7k|{ 434| 34.7k| *ref = YR_ARENA_NULL_REF; ------------------ | | 43| 34.7k| (YR_ARENA_REF) \ | | 44| 34.7k| { \ | | 45| 34.7k| UINT32_MAX, UINT32_MAX \ | | 46| 34.7k| } ------------------ 435| | 436| 34.7k| if (address == NULL) ------------------ | Branch (436:7): [True: 0, False: 34.7k] ------------------ 437| 0| return 1; 438| | 439| 194k| for (uint32_t i = 0; i < arena->num_buffers; ++i) ------------------ | Branch (439:24): [True: 194k, False: 0] ------------------ 440| 194k| { 441| | // If the buffer is completetly empty, skip it. 442| 194k| if (arena->buffers[i].data == NULL) ------------------ | Branch (442:9): [True: 62.6k, False: 132k] ------------------ 443| 62.6k| continue; 444| | 445| | // If the address falls within the limits of the buffer, then we found 446| | // the buffer that contains the data and return a reference to it. 447| 132k| if ((uint8_t*) address >= arena->buffers[i].data && ------------------ | Branch (447:9): [True: 97.3k, False: 34.7k] ------------------ 448| 97.3k| (uint8_t*) address < arena->buffers[i].data + arena->buffers[i].used) ------------------ | Branch (448:9): [True: 34.7k, False: 62.6k] ------------------ 449| 34.7k| { 450| 34.7k| ref->buffer_id = i; 451| 34.7k| ref->offset = 452| 34.7k| (yr_arena_off_t) ((uint8_t*) address - arena->buffers[i].data); 453| | 454| 34.7k| return 1; 455| 34.7k| } 456| 132k| } 457| | 458| 0| return 0; 459| 34.7k|} yr_arena_ref_to_ptr: 462| 96|{ 463| 96| if (YR_ARENA_IS_NULL_REF(*ref)) ------------------ | | 49| 96| (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 96| (YR_ARENA_REF) \ | | | | 44| 96| { \ | | | | 45| 96| UINT32_MAX, UINT32_MAX \ | | | | 46| 96| } | | ------------------ | | (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 96| (YR_ARENA_REF) \ | | | | 44| 96| { \ | | | | 45| 96| UINT32_MAX, UINT32_MAX \ | | | | 46| 96| } | | ------------------ | | | Branch (49:3): [True: 6, False: 90] | | ------------------ ------------------ 464| 6| return NULL; 465| | 466| |#if defined(__arm__) 467| | YR_ARENA_REF tmp_ref; 468| | memcpy(&tmp_ref, ref, sizeof(YR_ARENA_REF)); 469| | ref = &tmp_ref; 470| |#endif 471| | 472| 90| return yr_arena_get_ptr(arena, ref->buffer_id, ref->offset); 473| 96|} yr_arena_make_ptr_relocatable: 487| 56|{ 488| 56| int result; 489| | 490| 56| va_list offsets; 491| 56| va_start(offsets, buffer_id); 492| | 493| 56| result = _yr_arena_make_ptr_relocatable(arena, buffer_id, 0, offsets); 494| | 495| 56| va_end(offsets); 496| | 497| 56| return result; 498| 56|} yr_arena_write_data: 506| 15.1k|{ 507| 15.1k| YR_ARENA_REF r; 508| | 509| | // Allocate space in the buffer. 510| 15.1k| FAIL_ON_ERROR(_yr_arena_allocate_memory(arena, 0, buffer_id, size, &r)); ------------------ | | 134| 15.1k| { \ | | 135| 15.1k| int __error = (x); \ | | 136| 15.1k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 15.1k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 15.1k] | | ------------------ | | 137| 15.1k| return __error; \ | | 138| 15.1k| } ------------------ 511| | 512| | // Copy the data into the allocated space. 513| 15.1k| memcpy(arena->buffers[buffer_id].data + r.offset, data, size); 514| | 515| 15.1k| if (ref != NULL) ------------------ | Branch (515:7): [True: 104, False: 15.0k] ------------------ 516| 104| { 517| 104| ref->buffer_id = r.buffer_id; 518| 104| ref->offset = r.offset; 519| 104| } 520| | 521| 15.1k| return ERROR_SUCCESS; ------------------ | | 40| 15.1k|#define ERROR_SUCCESS 0 ------------------ 522| 15.1k|} arena.c:_yr_arena_allocate_memory: 139| 15.1k|{ 140| 15.1k| if (buffer_id > arena->num_buffers) ------------------ | Branch (140:7): [True: 0, False: 15.1k] ------------------ 141| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 142| | 143| 15.1k| YR_ARENA_BUFFER* b = &arena->buffers[buffer_id]; 144| | 145| | // If the new data doesn't fit in the remaining space the buffer must be 146| | // re-sized. This implies moving the buffer to a different memory location 147| | // and adjusting the pointers listed in the relocation list. 148| | 149| 15.1k| if (b->size - b->used < size) ------------------ | Branch (149:7): [True: 1.72k, False: 13.4k] ------------------ 150| 1.72k| { 151| 1.72k| size_t new_size = (b->size == 0) ? arena->initial_buffer_size : b->size * 2; ------------------ | Branch (151:23): [True: 1.72k, False: 0] ------------------ 152| | 153| 1.72k| while (new_size < b->used + size) new_size *= 2; ------------------ | Branch (153:12): [True: 0, False: 1.72k] ------------------ 154| | 155| | // Make sure that buffer size if not larger than 4GB. 156| 1.72k| if (new_size > 1ULL << 32) ------------------ | Branch (156:9): [True: 0, False: 1.72k] ------------------ 157| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 158| | 159| 1.72k| uint8_t* new_data = yr_realloc(b->data, new_size); 160| | 161| 1.72k| if (new_data == NULL) ------------------ | Branch (161:9): [True: 0, False: 1.72k] ------------------ 162| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 163| | 164| |// When yr_realloc uses the Windows API (HeapAlloc, HeapReAlloc) it is not 165| |// necessary to set the memory to zero because the API is called with the 166| |// HEAP_ZERO_MEMORY flag. 167| 1.72k|#if !defined(_WIN32) && !defined(__CYGWIN__) 168| 1.72k| if (flags & YR_ARENA_ZERO_MEMORY) ------------------ | | 115| 1.72k|#define YR_ARENA_ZERO_MEMORY 1 ------------------ | Branch (168:9): [True: 10, False: 1.71k] ------------------ 169| 10| memset(new_data + b->used, 0, new_size - b->used); 170| 1.72k|#endif 171| | 172| | // Fix pointers in the relocation list if the old buffer was not empty 173| | // and it was actually moved by yr_realloc. 174| 1.72k| if (b->data != NULL && b->data != new_data) ------------------ | Branch (174:9): [True: 0, False: 1.72k] | Branch (174:28): [True: 0, False: 0] ------------------ 175| 0| { 176| 0| YR_RELOC* reloc = arena->reloc_list_head; 177| | 178| 0| while (reloc != NULL) ------------------ | Branch (178:14): [True: 0, False: 0] ------------------ 179| 0| { 180| | // If the reloc entry is for the same buffer that is being relocated, 181| | // the base pointer that we use to access the buffer must be new_data 182| | // as arena->buffers[reloc->buffer_id].data (which is the same than 183| | // b->data) can't be accessed anymore after the call to yr_realloc. 184| 0| uint8_t* base = buffer_id == reloc->buffer_id ------------------ | Branch (184:25): [True: 0, False: 0] ------------------ 185| 0| ? new_data 186| 0| : arena->buffers[reloc->buffer_id].data; 187| | 188| | // reloc_target is the value of the relocatable pointer. 189| 0| void* reloc_target; 190| 0| memcpy(&reloc_target, base + reloc->offset, sizeof(reloc_target)); 191| | 192| 0| if ((uint8_t*) reloc_target >= b->data && ------------------ | Branch (192:13): [True: 0, False: 0] ------------------ 193| 0| (uint8_t*) reloc_target < b->data + b->used) ------------------ | Branch (193:13): [True: 0, False: 0] ------------------ 194| 0| { 195| | // reloc_target points to some data inside the buffer being moved, so 196| | // the pointer needs to be adjusted. 197| 0| void* new_target = (uint8_t*) reloc_target - b->data + new_data; 198| 0| memcpy(base + reloc->offset, &new_target, sizeof(new_target)); 199| 0| } 200| | 201| 0| reloc = reloc->next; 202| 0| } 203| 0| } 204| | 205| 1.72k| b->size = new_size; 206| 1.72k| b->data = new_data; 207| 1.72k| } 208| | 209| 15.1k| if (ref != NULL) ------------------ | Branch (209:7): [True: 15.1k, False: 4] ------------------ 210| 15.1k| { 211| 15.1k| ref->buffer_id = buffer_id; 212| 15.1k| ref->offset = (uint32_t) b->used; 213| 15.1k| } 214| | 215| 15.1k| b->used += size; 216| | 217| 15.1k| return ERROR_SUCCESS; ------------------ | | 40| 15.1k|#define ERROR_SUCCESS 0 ------------------ 218| 15.1k|} arena.c:_yr_arena_make_ptr_relocatable: 81| 62|{ 82| 62| size_t offset; 83| | 84| 62| int result = ERROR_SUCCESS; ------------------ | | 40| 62|#define ERROR_SUCCESS 0 ------------------ 85| | 86| | // The argument to va_arg is size_t because the offsets passed to this 87| | // function are obtained with offsetof(). 88| 62| offset = va_arg(offsets, size_t); 89| | 90| 130| while (offset != EOL) ------------------ | | 38| 130|#define EOL ((size_t) -1) ------------------ | Branch (90:10): [True: 68, False: 62] ------------------ 91| 68| { 92| 68| YR_RELOC* reloc = (YR_RELOC*) yr_malloc(sizeof(YR_RELOC)); 93| | 94| 68| if (reloc == NULL) ------------------ | Branch (94:9): [True: 0, False: 68] ------------------ 95| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 96| | 97| 68| reloc->buffer_id = buffer_id; 98| 68| reloc->offset = base_offset + (yr_arena_off_t) offset; 99| 68| reloc->next = NULL; 100| | 101| 68| if (arena->reloc_list_head == NULL) ------------------ | Branch (101:9): [True: 2, False: 66] ------------------ 102| 2| arena->reloc_list_head = reloc; 103| | 104| 68| if (arena->reloc_list_tail != NULL) ------------------ | Branch (104:9): [True: 66, False: 2] ------------------ 105| 66| arena->reloc_list_tail->next = reloc; 106| | 107| 68| arena->reloc_list_tail = reloc; 108| 68| offset = va_arg(offsets, size_t); 109| 68| } 110| | 111| 62| return result; 112| 62|} _yr_compiler_store_data: 177| 60|{ 178| | // Check if the data is already in YR_SZ_POOL by using a hash table. 179| 60| uint32_t offset = yr_hash_table_lookup_uint32_raw_key( 180| 60| compiler->sz_table, data, data_length, NULL); 181| | 182| 60| if (offset == UINT32_MAX) ------------------ | Branch (182:7): [True: 30, False: 30] ------------------ 183| 30| { 184| | // The data was not previously written to YR_SZ_POOL, write it and store 185| | // the reference's offset in the hash table. Storing the buffer number 186| | // is not necessary, it's always YR_SZ_POOL. 187| 30| FAIL_ON_ERROR(yr_arena_write_data( ------------------ | | 134| 30| { \ | | 135| 30| int __error = (x); \ | | 136| 30| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 30|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 30] | | ------------------ | | 137| 30| return __error; \ | | 138| 30| } ------------------ 188| 30| compiler->arena, YR_SZ_POOL, data, data_length, ref)); 189| | 190| 30| FAIL_ON_ERROR(yr_hash_table_add_uint32_raw_key( ------------------ | | 134| 30| { \ | | 135| 30| int __error = (x); \ | | 136| 30| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 30|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 30] | | ------------------ | | 137| 30| return __error; \ | | 138| 30| } ------------------ 191| 30| compiler->sz_table, data, data_length, NULL, ref->offset)); 192| 30| } 193| 30| else 194| 30| { 195| 30| ref->buffer_id = YR_SZ_POOL; ------------------ | | 62| 30|#define YR_SZ_POOL 5 ------------------ 196| 30| ref->offset = offset; 197| 30| } 198| | 199| 60| return ERROR_SUCCESS; ------------------ | | 40| 60|#define ERROR_SUCCESS 0 ------------------ 200| 60|} _yr_compiler_store_string: 209| 60|{ 210| 60| return _yr_compiler_store_data( 211| 60| compiler, 212| 60| (void*) string, 213| 60| strlen(string) + 1, // include the null terminator 214| 60| ref); 215| 60|} yr_compiler_create: 218| 2|{ 219| 2| int result; 220| 2| YR_COMPILER* new_compiler; 221| | 222| 2| new_compiler = (YR_COMPILER*) yr_calloc(1, sizeof(YR_COMPILER)); 223| | 224| 2| if (new_compiler == NULL) ------------------ | Branch (224:7): [True: 0, False: 2] ------------------ 225| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 226| | 227| 2| new_compiler->current_rule_idx = UINT32_MAX; 228| 2| new_compiler->next_rule_idx = 0; 229| 2| new_compiler->current_string_idx = 0; 230| 2| new_compiler->current_namespace_idx = 0; 231| 2| new_compiler->current_meta_idx = 0; 232| 2| new_compiler->num_namespaces = 0; 233| 2| new_compiler->errors = 0; 234| 2| new_compiler->callback = NULL; 235| 2| new_compiler->rules = NULL; 236| 2| new_compiler->include_callback = _yr_compiler_default_include_callback; 237| 2| new_compiler->incl_clbk_user_data = NULL; 238| 2| new_compiler->include_free = _yr_compiler_default_include_free; 239| 2| new_compiler->re_ast_callback = NULL; 240| 2| new_compiler->re_ast_clbk_user_data = NULL; 241| 2| new_compiler->last_error = ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 242| 2| new_compiler->last_error_line = 0; 243| 2| new_compiler->strict_escape = false; 244| 2| new_compiler->current_line = 0; 245| 2| new_compiler->file_name_stack_ptr = 0; 246| 2| new_compiler->fixup_stack_head = NULL; 247| 2| new_compiler->loop_index = -1; 248| 2| new_compiler->loop_for_of_var_index = -1; 249| | 250| 2| new_compiler->atoms_config.get_atom_quality = yr_atoms_heuristic_quality; 251| 2| new_compiler->atoms_config.quality_warning_threshold = 252| 2| YR_ATOM_QUALITY_WARNING_THRESHOLD; ------------------ | | 84| 2| YR_MAX_ATOM_QUALITY - 22 * YR_MAX_ATOM_LENGTH + 38 | | ------------------ | | | | 71| 2|#define YR_MAX_ATOM_QUALITY 255 | | ------------------ | | YR_MAX_ATOM_QUALITY - 22 * YR_MAX_ATOM_LENGTH + 38 | | ------------------ | | | | 67| 2|#define YR_MAX_ATOM_LENGTH 4 | | ------------------ ------------------ 253| | 254| 2| result = yr_hash_table_create(5000, &new_compiler->rules_table); 255| | 256| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (256:7): [True: 2, False: 0] ------------------ 257| 2| result = yr_hash_table_create(1000, &new_compiler->objects_table); 258| | 259| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (259:7): [True: 2, False: 0] ------------------ 260| 2| result = yr_hash_table_create(10000, &new_compiler->strings_table); 261| | 262| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (262:7): [True: 2, False: 0] ------------------ 263| 2| result = yr_hash_table_create( 264| 2| 1000, &new_compiler->wildcard_identifiers_table); 265| | 266| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (266:7): [True: 2, False: 0] ------------------ 267| 2| result = yr_hash_table_create(10000, &new_compiler->sz_table); 268| | 269| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (269:7): [True: 2, False: 0] ------------------ 270| 2| result = yr_arena_create(YR_NUM_SECTIONS, 1048576, &new_compiler->arena); ------------------ | | 72| 2|#define YR_NUM_SECTIONS 12 ------------------ 271| | 272| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (272:7): [True: 2, False: 0] ------------------ 273| 2| result = yr_ac_automaton_create( 274| 2| new_compiler->arena, &new_compiler->automaton); 275| | 276| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (276:7): [True: 2, False: 0] ------------------ 277| 2| { 278| 2| *compiler = new_compiler; 279| 2| } 280| 0| else // if error, do cleanup 281| 0| { 282| 0| yr_compiler_destroy(new_compiler); 283| 0| } 284| | 285| 2| return result; 286| 2|} yr_compiler_destroy: 289| 2|{ 290| 2| if (compiler->arena != NULL) ------------------ | Branch (290:7): [True: 2, False: 0] ------------------ 291| 2| yr_arena_release(compiler->arena); 292| | 293| 2| if (compiler->automaton != NULL) ------------------ | Branch (293:7): [True: 2, False: 0] ------------------ 294| 2| yr_ac_automaton_destroy(compiler->automaton); 295| | 296| 2| if (compiler->rules_table != NULL) ------------------ | Branch (296:7): [True: 2, False: 0] ------------------ 297| 2| yr_hash_table_destroy(compiler->rules_table, NULL); 298| | 299| 2| if (compiler->strings_table != NULL) ------------------ | Branch (299:7): [True: 2, False: 0] ------------------ 300| 2| yr_hash_table_destroy(compiler->strings_table, NULL); 301| | 302| 2| if (compiler->wildcard_identifiers_table != NULL) ------------------ | Branch (302:7): [True: 2, False: 0] ------------------ 303| 2| yr_hash_table_destroy(compiler->wildcard_identifiers_table, NULL); 304| | 305| 2| if (compiler->sz_table != NULL) ------------------ | Branch (305:7): [True: 2, False: 0] ------------------ 306| 2| yr_hash_table_destroy(compiler->sz_table, NULL); 307| | 308| 2| if (compiler->objects_table != NULL) ------------------ | Branch (308:7): [True: 2, False: 0] ------------------ 309| 2| yr_hash_table_destroy( 310| 2| compiler->objects_table, 311| 2| (YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy); 312| | 313| 2| if (compiler->atoms_config.free_quality_table) ------------------ | Branch (313:7): [True: 0, False: 2] ------------------ 314| 0| yr_free(compiler->atoms_config.quality_table); 315| | 316| 2| for (int i = 0; i < compiler->file_name_stack_ptr; i++) ------------------ | Branch (316:19): [True: 0, False: 2] ------------------ 317| 0| yr_free(compiler->file_name_stack[i]); 318| | 319| 2| YR_FIXUP* fixup = compiler->fixup_stack_head; 320| | 321| 2| while (fixup != NULL) ------------------ | Branch (321:10): [True: 0, False: 2] ------------------ 322| 0| { 323| 0| YR_FIXUP* next_fixup = fixup->next; 324| 0| yr_free(fixup); 325| 0| fixup = next_fixup; 326| 0| } 327| | 328| 2| yr_free(compiler); 329| 2|} yr_compiler_add_string: 662| 2|{ 663| | // Don't allow calls to yr_compiler_add_string() after 664| | // yr_compiler_get_rules() has been called. 665| 2| assert(compiler->rules == NULL); ------------------ | Branch (665:3): [True: 0, False: 2] | Branch (665:3): [True: 2, False: 0] ------------------ 666| | 667| | // Don't allow calls to yr_compiler_add_string() if a previous call to 668| | // yr_compiler_add_XXXX failed. 669| 2| assert(compiler->errors == 0); ------------------ | Branch (669:3): [True: 0, False: 2] | Branch (669:3): [True: 2, False: 0] ------------------ 670| | 671| 2| if (namespace_ != NULL) ------------------ | Branch (671:7): [True: 0, False: 2] ------------------ 672| 0| compiler->last_error = _yr_compiler_set_namespace(compiler, namespace_); 673| 2| else 674| 2| compiler->last_error = _yr_compiler_set_namespace(compiler, "default"); 675| | 676| 2| if (compiler->last_error != ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (676:7): [True: 0, False: 2] ------------------ 677| 0| return ++compiler->errors; 678| | 679| 2| return yr_lex_parse_rules_string(rules_string, compiler); 680| 2|} yr_compiler_get_rules: 730| 2|{ 731| | // Don't allow calls to yr_compiler_get_rules() if a previous call to 732| | // yr_compiler_add_XXXX failed. 733| 2| assert(compiler->errors == 0); ------------------ | Branch (733:3): [True: 0, False: 2] | Branch (733:3): [True: 2, False: 0] ------------------ 734| | 735| 2| *rules = NULL; 736| | 737| 2| if (compiler->rules == NULL) ------------------ | Branch (737:7): [True: 2, False: 0] ------------------ 738| 2| FAIL_ON_ERROR(_yr_compiler_compile_rules(compiler)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 739| | 740| 2| *rules = compiler->rules; 741| | 742| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 743| 2|} compiler.c:_yr_compiler_set_namespace: 519| 2|{ 520| 2| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 521| 2| compiler->arena, YR_NAMESPACES_TABLE, 0); ------------------ | | 57| 2|#define YR_NAMESPACES_TABLE 0 ------------------ 522| | 523| 2| bool found = false; 524| | 525| 2| for (int i = 0; i < compiler->num_namespaces; i++, ns++) ------------------ | Branch (525:19): [True: 0, False: 2] ------------------ 526| 0| { 527| 0| if (strcmp(ns->name, namespace_) == 0) ------------------ | Branch (527:9): [True: 0, False: 0] ------------------ 528| 0| { 529| 0| found = true; 530| 0| compiler->current_namespace_idx = i; 531| 0| break; 532| 0| } 533| 0| } 534| | 535| 2| if (!found) ------------------ | Branch (535:7): [True: 2, False: 0] ------------------ 536| 2| { 537| 2| YR_ARENA_REF ref; 538| | 539| 2| FAIL_ON_ERROR(yr_arena_allocate_struct( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 540| 2| compiler->arena, 541| 2| YR_NAMESPACES_TABLE, 542| 2| sizeof(YR_NAMESPACE), 543| 2| &ref, 544| 2| offsetof(YR_NAMESPACE, name), 545| 2| EOL)); 546| | 547| 2| ns = (YR_NAMESPACE*) yr_arena_ref_to_ptr(compiler->arena, &ref); 548| | 549| 2| FAIL_ON_ERROR(_yr_compiler_store_string(compiler, namespace_, &ref)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 550| | 551| 2| ns->name = (const char*) yr_arena_ref_to_ptr(compiler->arena, &ref); 552| 2| ns->idx = compiler->num_namespaces; 553| | 554| 2| compiler->current_namespace_idx = compiler->num_namespaces; 555| 2| compiler->num_namespaces++; 556| 2| } 557| | 558| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 559| 2|} compiler.c:_yr_compiler_compile_rules: 683| 2|{ 684| 2| YR_RULE null_rule; 685| 2| YR_EXTERNAL_VARIABLE null_external; 686| | 687| 2| uint8_t halt = OP_HALT; ------------------ | | 46| 2|#define OP_HALT 255 ------------------ 688| | 689| | // Write halt instruction at the end of code. 690| 2| FAIL_ON_ERROR(yr_arena_write_data( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 691| 2| compiler->arena, YR_CODE_SECTION, &halt, sizeof(uint8_t), NULL)); 692| | 693| | // Write a null rule indicating the end. 694| 2| memset(&null_rule, 0xFA, sizeof(YR_RULE)); 695| 2| null_rule.flags = RULE_FLAGS_NULL; ------------------ | | 54| 2|#define RULE_FLAGS_NULL 0x04 ------------------ 696| | 697| 2| FAIL_ON_ERROR(yr_arena_write_data( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 698| 2| compiler->arena, YR_RULES_TABLE, &null_rule, sizeof(YR_RULE), NULL)); 699| | 700| | // Write a null external indicating the end. 701| 2| memset(&null_external, 0xFA, sizeof(YR_EXTERNAL_VARIABLE)); 702| 2| null_external.type = EXTERNAL_VARIABLE_TYPE_NULL; ------------------ | | 144| 2|#define EXTERNAL_VARIABLE_TYPE_NULL 0 ------------------ 703| | 704| 2| FAIL_ON_ERROR(yr_arena_write_data( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 705| 2| compiler->arena, 706| 2| YR_EXTERNAL_VARIABLES_TABLE, 707| 2| &null_external, 708| 2| sizeof(YR_EXTERNAL_VARIABLE), 709| 2| NULL)); 710| | 711| | // Write Aho-Corasick automaton to arena. 712| 2| FAIL_ON_ERROR(yr_ac_compile(compiler->automaton, compiler->arena)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 713| | 714| 2| YR_ARENA_REF ref; 715| | 716| 2| FAIL_ON_ERROR(yr_arena_allocate_struct( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 717| 2| compiler->arena, YR_SUMMARY_SECTION, sizeof(YR_SUMMARY), &ref, EOL)); 718| | 719| 2| YR_SUMMARY* summary = (YR_SUMMARY*) yr_arena_ref_to_ptr( 720| 2| compiler->arena, &ref); 721| | 722| 2| summary->num_namespaces = compiler->num_namespaces; 723| 2| summary->num_rules = compiler->next_rule_idx; 724| 2| summary->num_strings = compiler->current_string_idx; 725| | 726| 2| return yr_rules_from_arena(compiler->arena, &compiler->rules); 727| 2|} yr_execute_code: 419| 1.70k|{ 420| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "+ %s() {\n", __FUNCTION__); 421| | 422| 1.70k| const uint8_t* ip = context->rules->code_start; 423| | 424| 1.70k| YR_VALUE mem[MEM_SIZE]; 425| 1.70k| YR_VALUE args[YR_MAX_FUNCTION_ARGS]; 426| 1.70k| YR_VALUE r1; 427| 1.70k| YR_VALUE r2; 428| 1.70k| YR_VALUE r3; 429| 1.70k| YR_VALUE r4; 430| | 431| 1.70k| YR_VALUE_STACK stack; 432| | 433| 1.70k| uint64_t elapsed_time; 434| | 435| |#ifdef YR_PROFILING_ENABLED 436| | uint64_t start_time; 437| |#endif 438| | 439| 1.70k| uint32_t current_rule_idx = 0; 440| 1.70k| YR_RULE* current_rule = NULL; 441| 1.70k| YR_RULE* rule; 442| 1.70k| YR_MATCH* match; 443| 1.70k| YR_OBJECT_FUNCTION* function; 444| 1.70k| YR_OBJECT** obj_ptr; 445| 1.70k| YR_ARENA* obj_arena; 446| 1.70k| YR_NOTEBOOK* it_notebook; 447| | 448| 1.70k| char* identifier; 449| 1.70k| char* args_fmt; 450| | 451| 1.70k| int found; 452| 1.70k| int count; 453| 1.70k| int result = ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 454| 1.70k| int cycle = 0; 455| 1.70k| int obj_count = 0; 456| | 457| 1.70k| bool stop = false; 458| | 459| 1.70k| uint8_t opcode; 460| | 461| 1.70k| yr_get_configuration_uint32(YR_CONFIG_STACK_SIZE, &stack.capacity); 462| | 463| 1.70k| stack.sp = 0; 464| 1.70k| stack.items = (YR_VALUE*) yr_malloc(stack.capacity * sizeof(YR_VALUE)); 465| | 466| 1.70k| if (stack.items == NULL) ------------------ | Branch (466:7): [True: 0, False: 1.70k] ------------------ 467| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 468| | 469| 1.70k| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 1.70k| { \ | | 143| 1.70k| int __error = (x); \ | | 144| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 1.70k] | | ------------------ | | 145| 1.70k| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 1.70k| } ------------------ 470| 1.70k| yr_arena_create(1, 512 * sizeof(YR_OBJECT*), &obj_arena), 471| 1.70k| yr_free(stack.items)); 472| | 473| 1.70k| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 1.70k| { \ | | 143| 1.70k| int __error = (x); \ | | 144| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 1.70k] | | ------------------ | | 145| 1.70k| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 1.70k| } ------------------ 474| 1.70k| yr_notebook_create(512 * sizeof(YR_ITERATOR), &it_notebook), 475| 1.70k| yr_arena_release(obj_arena); 476| 1.70k| yr_free(stack.items)); 477| | 478| |#ifdef YR_PROFILING_ENABLED 479| | start_time = yr_stopwatch_elapsed_ns(&context->stopwatch); 480| |#endif 481| | 482| 1.70k|#if YR_PARANOID_EXEC 483| 1.70k| memset(mem, 0, MEM_SIZE * sizeof(mem[0])); ------------------ | | 51| 1.70k|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | ------------------ | | | | 95| 1.70k|#define YR_MAX_LOOP_NESTING 4 | | ------------------ | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | ------------------ | | | | 102| 1.70k|#define YR_MAX_LOOP_VARS 2 | | ------------------ | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | ------------------ | | | | 76| 1.70k|#define YR_INTERNAL_LOOP_VARS 3 | | ------------------ ------------------ 484| 1.70k|#endif 485| | 486| 168k| while (!stop) ------------------ | Branch (486:10): [True: 166k, False: 1.70k] ------------------ 487| 166k| { 488| | // Read the opcode from the address indicated by the instruction pointer. 489| 166k| opcode = *ip; 490| | 491| | // Advance the instruction pointer, which now points past the opcode. 492| 166k| ip++; 493| | 494| 166k| switch (opcode) 495| 166k| { 496| 0| case OP_NOP: ------------------ | | 47| 0|#define OP_NOP 254 ------------------ | Branch (496:5): [True: 0, False: 166k] ------------------ 497| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_NOP: // %s()\n", __FUNCTION__); 498| 0| break; 499| | 500| 1.70k| case OP_HALT: ------------------ | | 46| 1.70k|#define OP_HALT 255 ------------------ | Branch (500:5): [True: 1.70k, False: 165k] ------------------ 501| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_HALT: // %s()\n", __FUNCTION__); 502| 1.70k| assert(stack.sp == 0); // When HALT is reached the stack should be empty. ------------------ | Branch (502:7): [True: 0, False: 1.70k] | Branch (502:7): [True: 1.70k, False: 0] ------------------ 503| 1.70k| stop = true; 504| 1.70k| break; 505| | 506| 0| case OP_ITER_START_ARRAY: ------------------ | | 102| 0|#define OP_ITER_START_ARRAY 54 ------------------ | Branch (506:5): [True: 0, False: 166k] ------------------ 507| 0| YR_DEBUG_FPRINTF( 508| 0| 2, stderr, "- case OP_ITER_START_ARRAY: // %s()\n", __FUNCTION__); 509| 0| r2.p = yr_notebook_alloc(it_notebook, sizeof(YR_ITERATOR)); 510| | 511| 0| if (r2.p == NULL) ------------------ | Branch (511:11): [True: 0, False: 0] ------------------ 512| 0| { 513| 0| result = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 514| 0| } 515| 0| else 516| 0| { 517| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (517:9): [True: 0, False: 0] | Branch (517:9): [True: 0, False: 0] ------------------ 518| 0| r2.it->array_it.array = r1.o; 519| 0| r2.it->array_it.index = 0; 520| 0| r2.it->next_func_idx = ITER_NEXT_ARRAY; ------------------ | | 411| 0|#define ITER_NEXT_ARRAY 0 ------------------ 521| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 522| 0| } 523| | 524| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 525| 0| break; 526| | 527| 0| case OP_ITER_START_DICT: ------------------ | | 103| 0|#define OP_ITER_START_DICT 55 ------------------ | Branch (527:5): [True: 0, False: 166k] ------------------ 528| 0| YR_DEBUG_FPRINTF( 529| 0| 2, stderr, "- case OP_ITER_START_DICT: // %s()\n", __FUNCTION__); 530| 0| r2.p = yr_notebook_alloc(it_notebook, sizeof(YR_ITERATOR)); 531| | 532| 0| if (r2.p == NULL) ------------------ | Branch (532:11): [True: 0, False: 0] ------------------ 533| 0| { 534| 0| result = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 535| 0| } 536| 0| else 537| 0| { 538| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (538:9): [True: 0, False: 0] | Branch (538:9): [True: 0, False: 0] ------------------ 539| 0| r2.it->dict_it.dict = r1.o; 540| 0| r2.it->dict_it.index = 0; 541| 0| r2.it->next_func_idx = ITER_NEXT_DICT; ------------------ | | 412| 0|#define ITER_NEXT_DICT 1 ------------------ 542| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 543| 0| } 544| | 545| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 546| 0| break; 547| | 548| 0| case OP_ITER_START_INT_RANGE: ------------------ | | 104| 0|#define OP_ITER_START_INT_RANGE 56 ------------------ | Branch (548:5): [True: 0, False: 166k] ------------------ 549| 0| YR_DEBUG_FPRINTF( 550| 0| 2, stderr, "- case OP_ITER_START_INT_RANGE: // %s()\n", __FUNCTION__); 551| | // Creates an iterator for an integer range. The higher bound of the 552| | // range is at the top of the stack followed by the lower bound. 553| 0| r3.p = yr_notebook_alloc(it_notebook, sizeof(YR_ITERATOR)); 554| | 555| 0| if (r3.p == NULL) ------------------ | Branch (555:11): [True: 0, False: 0] ------------------ 556| 0| { 557| 0| result = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 558| 0| } 559| 0| else 560| 0| { 561| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (561:9): [True: 0, False: 0] | Branch (561:9): [True: 0, False: 0] ------------------ 562| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (562:9): [True: 0, False: 0] | Branch (562:9): [True: 0, False: 0] ------------------ 563| 0| r3.it->int_range_it.next = r1.i; 564| 0| r3.it->int_range_it.last = r2.i; 565| 0| r3.it->next_func_idx = ITER_NEXT_INT_RANGE; ------------------ | | 413| 0|#define ITER_NEXT_INT_RANGE 2 ------------------ 566| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 567| 0| } 568| | 569| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 570| 0| break; 571| | 572| 0| case OP_ITER_START_INT_ENUM: ------------------ | | 105| 0|#define OP_ITER_START_INT_ENUM 57 ------------------ | Branch (572:5): [True: 0, False: 166k] ------------------ 573| 0| YR_DEBUG_FPRINTF( 574| 0| 2, stderr, "- case OP_ITER_START_INT_ENUM: // %s()\n", __FUNCTION__); 575| | // Creates an iterator for an integer enumeration. The number of items 576| | // in the enumeration is at the top of the stack, followed by the 577| | // items in reverse order. 578| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (578:7): [True: 0, False: 0] | Branch (578:7): [True: 0, False: 0] ------------------ 579| | 580| | // The count comes from the compiled rules and a hand-crafted file can 581| | // set it to a value that overflows the allocation size below or makes 582| | // the loop pop past the stack. It can't be larger than the number of 583| | // items currently on the stack. 584| 0| if (r1.i < 0 || (uint64_t) r1.i > stack.sp) ------------------ | Branch (584:11): [True: 0, False: 0] | Branch (584:23): [True: 0, False: 0] ------------------ 585| 0| { 586| 0| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 587| 0| stop = true; 588| 0| break; 589| 0| } 590| | 591| 0| r3.p = yr_notebook_alloc( 592| 0| it_notebook, sizeof(YR_ITERATOR) + sizeof(uint64_t) * (size_t) r1.i); 593| | 594| 0| if (r3.p == NULL) ------------------ | Branch (594:11): [True: 0, False: 0] ------------------ 595| 0| { 596| 0| result = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 597| 0| } 598| 0| else 599| 0| { 600| 0| r3.it->int_enum_it.count = r1.i; 601| 0| r3.it->int_enum_it.next = 0; 602| 0| r3.it->next_func_idx = ITER_NEXT_INT_ENUM; ------------------ | | 414| 0|#define ITER_NEXT_INT_ENUM 3 ------------------ 603| | 604| 0| for (int64_t i = r1.i; i > 0; i--) ------------------ | Branch (604:32): [True: 0, False: 0] ------------------ 605| 0| { 606| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (606:11): [True: 0, False: 0] | Branch (606:11): [True: 0, False: 0] ------------------ 607| 0| r3.it->int_enum_it.items[i - 1] = r2.i; 608| 0| } 609| | 610| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 611| 0| } 612| | 613| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 614| 0| break; 615| | 616| 0| case OP_ITER_START_STRING_SET: ------------------ | | 106| 0|#define OP_ITER_START_STRING_SET 58 ------------------ | Branch (616:5): [True: 0, False: 166k] ------------------ 617| 0| YR_DEBUG_FPRINTF( 618| 0| 2, 619| 0| stderr, 620| 0| "- case OP_ITER_START_STRING_SET: // %s()\n", 621| 0| __FUNCTION__); 622| | 623| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (623:7): [True: 0, False: 0] | Branch (623:7): [True: 0, False: 0] ------------------ 624| | 625| | // One extra value (the undefined string) is popped below, so the count 626| | // must be strictly smaller than the number of items on the stack. A 627| | // hand-crafted count would otherwise overflow the allocation or pop past 628| | // the stack. 629| 0| if (r1.i < 0 || (uint64_t) r1.i >= stack.sp) ------------------ | Branch (629:11): [True: 0, False: 0] | Branch (629:23): [True: 0, False: 0] ------------------ 630| 0| { 631| 0| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 632| 0| stop = true; 633| 0| break; 634| 0| } 635| | 636| 0| r3.p = yr_notebook_alloc( 637| 0| it_notebook, 638| 0| sizeof(YR_ITERATOR) + sizeof(YR_STRING*) * (size_t) r1.i); 639| | 640| 0| if (r3.p == NULL) ------------------ | Branch (640:11): [True: 0, False: 0] ------------------ 641| 0| { 642| 0| result = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 643| 0| } 644| 0| else 645| 0| { 646| 0| r3.it->string_set_it.count = r1.i; 647| 0| r3.it->string_set_it.index = 0; 648| 0| r3.it->next_func_idx = ITER_NEXT_STRING_SET; ------------------ | | 415| 0|#define ITER_NEXT_STRING_SET 4 ------------------ 649| | 650| 0| for (int64_t i = r1.i; i > 0; i--) ------------------ | Branch (650:32): [True: 0, False: 0] ------------------ 651| 0| { 652| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (652:11): [True: 0, False: 0] | Branch (652:11): [True: 0, False: 0] ------------------ 653| 0| r3.it->string_set_it.strings[i - 1] = r2.s; 654| 0| } 655| | 656| | // One last pop of the UNDEFINED string 657| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (657:9): [True: 0, False: 0] | Branch (657:9): [True: 0, False: 0] ------------------ 658| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 659| 0| } 660| | 661| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 662| 0| break; 663| | 664| 0| case OP_ITER_START_TEXT_STRING_SET: ------------------ | | 126| 0|#define OP_ITER_START_TEXT_STRING_SET 78 ------------------ | Branch (664:5): [True: 0, False: 166k] ------------------ 665| 0| YR_DEBUG_FPRINTF( 666| 0| 2, 667| 0| stderr, 668| 0| "- case OP_ITER_START_TEXT_STRING_SET: // %s()\n", 669| 0| __FUNCTION__); 670| | 671| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (671:7): [True: 0, False: 0] | Branch (671:7): [True: 0, False: 0] ------------------ 672| | 673| | // The count comes from the compiled rules and can't be larger than the 674| | // number of items on the stack, otherwise the allocation below overflows 675| | // or the loop pops past the stack. 676| 0| if (r1.i < 0 || (uint64_t) r1.i > stack.sp) ------------------ | Branch (676:11): [True: 0, False: 0] | Branch (676:23): [True: 0, False: 0] ------------------ 677| 0| { 678| 0| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 679| 0| stop = true; 680| 0| break; 681| 0| } 682| | 683| 0| r3.p = yr_notebook_alloc( 684| 0| it_notebook, 685| 0| sizeof(YR_ITERATOR) + sizeof(SIZED_STRING*) * (size_t) r1.i); 686| | 687| 0| if (r3.p == NULL) ------------------ | Branch (687:11): [True: 0, False: 0] ------------------ 688| 0| { 689| 0| result = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 690| 0| } 691| 0| else 692| 0| { 693| 0| r3.it->text_string_set_it.count = r1.i; 694| 0| r3.it->text_string_set_it.index = 0; 695| 0| r3.it->next_func_idx = ITER_NEXT_TEXT_STRING_SET; ------------------ | | 416| 0|#define ITER_NEXT_TEXT_STRING_SET 5 ------------------ 696| | 697| 0| for (int64_t i = r1.i; i > 0; i--) ------------------ | Branch (697:32): [True: 0, False: 0] ------------------ 698| 0| { 699| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (699:11): [True: 0, False: 0] | Branch (699:11): [True: 0, False: 0] ------------------ 700| 0| r3.it->text_string_set_it.strings[i - 1] = r2.ss; 701| 0| } 702| | 703| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 704| 0| } 705| | 706| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 707| 0| break; 708| | 709| 0| case OP_ITER_NEXT: ------------------ | | 101| 0|#define OP_ITER_NEXT 53 ------------------ | Branch (709:5): [True: 0, False: 166k] ------------------ 710| 0| YR_DEBUG_FPRINTF( 711| 0| 2, stderr, "- case OP_ITER_NEXT: // %s()\n", __FUNCTION__); 712| | // Loads the iterator in r1, but leaves the iterator in the stack. 713| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (713:7): [True: 0, False: 0] | Branch (713:7): [True: 0, False: 0] ------------------ 714| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 715| | 716| 0| if (r1.it->next_func_idx < ------------------ | Branch (716:11): [True: 0, False: 0] ------------------ 717| 0| sizeof(iter_next_func_table) / sizeof(YR_ITERATOR_NEXT_FUNC)) 718| 0| { 719| | // The iterator's next function is responsible for pushing the next 720| | // item in the stack, and a boolean indicating if there are more items 721| | // to retrieve. The boolean will be at the top of the stack after 722| | // calling "next". 723| 0| result = iter_next_func_table[r1.it->next_func_idx](r1.it, &stack); 724| 0| } 725| 0| else 726| 0| { 727| | // next_func_idx is outside the valid range, this should not happend. 728| 0| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 729| 0| } 730| | 731| 0| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 732| 0| break; 733| | 734| 0| case OP_ITER_CONDITION: ------------------ | | 107| 0|#define OP_ITER_CONDITION 59 ------------------ | Branch (734:5): [True: 0, False: 166k] ------------------ 735| 0| YR_DEBUG_FPRINTF( 736| 0| 2, stderr, "- case OP_ITER_CONDITION: // %s()\n", __FUNCTION__); 737| | 738| | // Evaluate the iteration condition of the loop. This instruction 739| | // evaluates to 1 if the loop should continue and 0 if it shouldn't 740| | // (due to short-circuit evaluation). 741| | 742| 0| pop(r2); // min. expression - all, any, none, integer ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (742:7): [True: 0, False: 0] | Branch (742:7): [True: 0, False: 0] ------------------ 743| 0| pop(r3); // number of true expressions ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (743:7): [True: 0, False: 0] | Branch (743:7): [True: 0, False: 0] ------------------ 744| 0| pop(r4); // last expression result ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (744:7): [True: 0, False: 0] | Branch (744:7): [True: 0, False: 0] ------------------ 745| | 746| | // In case of 'all' loop, end once we the body failed 747| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 748| 0| { 749| 0| r1.i = r4.i != 0 ? 1 : 0; ------------------ | Branch (749:16): [True: 0, False: 0] ------------------ 750| 0| } 751| | // In case of 'none' loop, end once the body succeed 752| 0| else if (r2.i == 0) ------------------ | Branch (752:16): [True: 0, False: 0] ------------------ 753| 0| { 754| 0| r1.i = r4.i != 1 ? 1 : 0; ------------------ | Branch (754:16): [True: 0, False: 0] ------------------ 755| 0| } 756| | // In case of other loops, end once we satified min. expr. 757| 0| else 758| 0| { 759| 0| r1.i = r3.i + r4.i < r2.i ? 1 : 0; ------------------ | Branch (759:16): [True: 0, False: 0] ------------------ 760| 0| } 761| | 762| | // Push whether loop should continue and repush 763| | // the last expression result 764| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 765| 0| push(r4); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 766| 0| break; 767| | 768| 0| case OP_ITER_END: ------------------ | | 108| 0|#define OP_ITER_END 60 ------------------ | Branch (768:5): [True: 0, False: 166k] ------------------ 769| 0| YR_DEBUG_FPRINTF( 770| 0| 2, stderr, "- case OP_ITER_END: // %s()\n", __FUNCTION__); 771| | 772| | // Evaluate the whole loop. Whether it was successful or not 773| | // and whether it satisfied it's quantifier. 774| | 775| 0| pop(r2); // min. expression - all, any, none, integer ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (775:7): [True: 0, False: 0] | Branch (775:7): [True: 0, False: 0] ------------------ 776| 0| pop(r3); // number of true expressions ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (776:7): [True: 0, False: 0] | Branch (776:7): [True: 0, False: 0] ------------------ 777| 0| pop(r4); // number of total iterations ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (777:7): [True: 0, False: 0] | Branch (777:7): [True: 0, False: 0] ------------------ 778| | 779| | // If there was 0 iterations in total, it doesn't 780| | // matter what other numbers show. We can't evaluate 781| | // the loop as true. 782| 0| if (r4.i == 0) ------------------ | Branch (782:11): [True: 0, False: 0] ------------------ 783| 0| { 784| 0| r1.i = 0; 785| 0| } 786| 0| else if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 787| 0| { 788| 0| r1.i = r3.i == r4.i ? 1 : 0; ------------------ | Branch (788:16): [True: 0, False: 0] ------------------ 789| 0| } 790| 0| else if (r2.i == 0) ------------------ | Branch (790:16): [True: 0, False: 0] ------------------ 791| 0| { 792| 0| r1.i = r3.i == 0 ? 1 : 0; ------------------ | Branch (792:16): [True: 0, False: 0] ------------------ 793| 0| } 794| 0| else 795| 0| { 796| 0| r1.i = r3.i >= r2.i ? 1 : 0; ------------------ | Branch (796:16): [True: 0, False: 0] ------------------ 797| 0| } 798| | 799| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 800| 0| break; 801| | 802| 1.70k| case OP_PUSH: ------------------ | | 61| 1.70k|#define OP_PUSH 13 ------------------ | Branch (802:5): [True: 1.70k, False: 165k] ------------------ 803| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_PUSH: // %s()\n", __FUNCTION__); 804| 1.70k| r1.i = yr_unaligned_u64(ip); 805| 1.70k| ip += sizeof(uint64_t); 806| 1.70k| push(r1); ------------------ | | 54| 1.70k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 1.70k, False: 0] | | ------------------ | | 55| 1.70k| { \ | | 56| 1.70k| stack.items[stack.sp++] = (x); \ | | 57| 1.70k| } \ | | 58| 1.70k| else \ | | 59| 1.70k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 807| 1.70k| break; 808| | 809| 32.7k| case OP_PUSH_8: ------------------ | | 111| 32.7k|#define OP_PUSH_8 63 ------------------ | Branch (809:5): [True: 32.7k, False: 134k] ------------------ 810| 32.7k| r1.i = *ip; 811| 32.7k| YR_DEBUG_FPRINTF( 812| 32.7k| 2, 813| 32.7k| stderr, 814| 32.7k| "- case OP_PUSH_8: r1.i=%" PRId64 " // %s()\n", 815| 32.7k| r1.i, 816| 32.7k| __FUNCTION__); 817| 32.7k| ip += sizeof(uint8_t); 818| 32.7k| push(r1); ------------------ | | 54| 32.7k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 32.7k, False: 0] | | ------------------ | | 55| 32.7k| { \ | | 56| 32.7k| stack.items[stack.sp++] = (x); \ | | 57| 32.7k| } \ | | 58| 32.7k| else \ | | 59| 32.7k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 819| 32.7k| break; 820| | 821| 0| case OP_PUSH_16: ------------------ | | 112| 0|#define OP_PUSH_16 64 ------------------ | Branch (821:5): [True: 0, False: 166k] ------------------ 822| 0| r1.i = yr_unaligned_u16(ip); 823| 0| YR_DEBUG_FPRINTF( 824| 0| 2, 825| 0| stderr, 826| 0| "- case OP_PUSH_16: r1.i=%" PRId64 " // %s()\n", 827| 0| r1.i, 828| 0| __FUNCTION__); 829| 0| ip += sizeof(uint16_t); 830| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 831| 0| break; 832| | 833| 0| case OP_PUSH_32: ------------------ | | 113| 0|#define OP_PUSH_32 65 ------------------ | Branch (833:5): [True: 0, False: 166k] ------------------ 834| 0| r1.i = yr_unaligned_u32(ip); 835| 0| YR_DEBUG_FPRINTF( 836| 0| 2, 837| 0| stderr, 838| 0| "- case OP_PUSH_32: r1.i=%" PRId64 " // %s()\n", 839| 0| r1.i, 840| 0| __FUNCTION__); 841| 0| ip += sizeof(uint32_t); 842| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 843| 0| break; 844| | 845| 0| case OP_PUSH_U: ------------------ | | 114| 0|#define OP_PUSH_U 66 ------------------ | Branch (845:5): [True: 0, False: 166k] ------------------ 846| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_PUSH_U: // %s()\n", __FUNCTION__); 847| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 848| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 849| 0| break; 850| | 851| 0| case OP_POP: ------------------ | | 62| 0|#define OP_POP 14 ------------------ | Branch (851:5): [True: 0, False: 166k] ------------------ 852| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_POP: // %s()\n", __FUNCTION__); 853| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (853:7): [True: 0, False: 0] | Branch (853:7): [True: 0, False: 0] ------------------ 854| 0| break; 855| | 856| 0| case OP_CLEAR_M: ------------------ | | 79| 0|#define OP_CLEAR_M 31 ------------------ | Branch (856:5): [True: 0, False: 166k] ------------------ 857| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_CLEAR_M: // %s()\n", __FUNCTION__); 858| 0| r1.i = yr_unaligned_u64(ip); 859| 0| ip += sizeof(uint64_t); 860| 0|#if YR_PARANOID_EXEC 861| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 862| 0|#endif 863| 0| mem[r1.i].i = 0; 864| 0| break; 865| | 866| 0| case OP_ADD_M: ------------------ | | 80| 0|#define OP_ADD_M 32 ------------------ | Branch (866:5): [True: 0, False: 166k] ------------------ 867| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_ADD_M: // %s()\n", __FUNCTION__); 868| 0| r1.i = yr_unaligned_u64(ip); 869| 0| ip += sizeof(uint64_t); 870| 0|#if YR_PARANOID_EXEC 871| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 872| 0|#endif 873| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (873:7): [True: 0, False: 0] | Branch (873:7): [True: 0, False: 0] ------------------ 874| 0| if (!is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (874:11): [True: 0, False: 0] ------------------ 875| 0| mem[r1.i].i += r2.i; 876| 0| break; 877| | 878| 0| case OP_INCR_M: ------------------ | | 78| 0|#define OP_INCR_M 30 ------------------ | Branch (878:5): [True: 0, False: 166k] ------------------ 879| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INCR_M: // %s()\n", __FUNCTION__); 880| 0| r1.i = yr_unaligned_u64(ip); 881| 0| ip += sizeof(uint64_t); 882| 0|#if YR_PARANOID_EXEC 883| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 884| 0|#endif 885| 0| mem[r1.i].i++; 886| 0| break; 887| | 888| 0| case OP_PUSH_M: ------------------ | | 82| 0|#define OP_PUSH_M 34 ------------------ | Branch (888:5): [True: 0, False: 166k] ------------------ 889| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_PUSH_M: // %s()\n", __FUNCTION__); 890| 0| r1.i = yr_unaligned_u64(ip); 891| 0| ip += sizeof(uint64_t); 892| 0|#if YR_PARANOID_EXEC 893| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 894| 0|#endif 895| 0| r1 = mem[r1.i]; 896| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 897| 0| break; 898| | 899| 0| case OP_POP_M: ------------------ | | 81| 0|#define OP_POP_M 33 ------------------ | Branch (899:5): [True: 0, False: 166k] ------------------ 900| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_POP_M: // %s()\n", __FUNCTION__); 901| 0| r1.i = yr_unaligned_u64(ip); 902| 0| ip += sizeof(uint64_t); 903| 0|#if YR_PARANOID_EXEC 904| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 905| 0|#endif 906| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (906:7): [True: 0, False: 0] | Branch (906:7): [True: 0, False: 0] ------------------ 907| 0| mem[r1.i] = r2; 908| 0| break; 909| | 910| 0| case OP_SET_M: ------------------ | | 83| 0|#define OP_SET_M 35 ------------------ | Branch (910:5): [True: 0, False: 166k] ------------------ 911| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_SET_M: // %s()\n", __FUNCTION__); 912| 0| r1.i = yr_unaligned_u64(ip); 913| 0| ip += sizeof(uint64_t); 914| 0|#if YR_PARANOID_EXEC 915| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 916| 0|#endif 917| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (917:7): [True: 0, False: 0] | Branch (917:7): [True: 0, False: 0] ------------------ 918| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 919| 0| if (!is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (919:11): [True: 0, False: 0] ------------------ 920| 0| mem[r1.i] = r2; 921| 0| break; 922| | 923| 0| case OP_SWAPUNDEF: ------------------ | | 84| 0|#define OP_SWAPUNDEF 36 ------------------ | Branch (923:5): [True: 0, False: 166k] ------------------ 924| 0| YR_DEBUG_FPRINTF( 925| 0| 2, stderr, "- case OP_SWAPUNDEF: // %s()\n", __FUNCTION__); 926| 0| r1.i = yr_unaligned_u64(ip); 927| 0| ip += sizeof(uint64_t); 928| 0|#if YR_PARANOID_EXEC 929| 0| ensure_within_mem(r1.i); ------------------ | | 82| 0| if (x < 0 || x >= MEM_SIZE) \ | | ------------------ | | | | 51| 0|#define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 95| 0|#define YR_MAX_LOOP_NESTING 4 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 102| 0|#define YR_MAX_LOOP_VARS 2 | | | | ------------------ | | | | #define MEM_SIZE YR_MAX_LOOP_NESTING*(YR_MAX_LOOP_VARS + YR_INTERNAL_LOOP_VARS) | | | | ------------------ | | | | | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 | | | | ------------------ | | ------------------ | | | Branch (82:7): [True: 0, False: 0] | | | Branch (82:16): [True: 0, False: 0] | | ------------------ | | 83| 0| { \ | | 84| 0| stop = true; \ | | 85| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 86| 0| break; \ | | 87| 0| } ------------------ 930| 0|#endif 931| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (931:7): [True: 0, False: 0] | Branch (931:7): [True: 0, False: 0] ------------------ 932| | 933| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 934| 0| { 935| 0| r1 = mem[r1.i]; 936| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 937| 0| } 938| 0| else 939| 0| { 940| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 941| 0| } 942| 0| break; 943| | 944| 0| case OP_JNUNDEF: ------------------ | | 93| 0|#define OP_JNUNDEF 45 ------------------ | Branch (944:5): [True: 0, False: 166k] ------------------ 945| | // Jump if the top the stack is not undefined without modifying the stack. 946| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JNUNDEF: // %s()\n", __FUNCTION__); 947| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (947:7): [True: 0, False: 0] | Branch (947:7): [True: 0, False: 0] ------------------ 948| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 949| 0| ip = jmp_if(!is_undef(r1), ip); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ 950| 0| break; 951| | 952| 0| case OP_JUNDEF_P: ------------------ | | 92| 0|#define OP_JUNDEF_P 44 ------------------ | Branch (952:5): [True: 0, False: 166k] ------------------ 953| | // Removes a value from the top of the stack and jump if the value is not 954| | // undefined. 955| 0| YR_DEBUG_FPRINTF( 956| 0| 2, stderr, "- case OP_JUNDEF_P: // %s()\n", __FUNCTION__); 957| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (957:7): [True: 0, False: 0] | Branch (957:7): [True: 0, False: 0] ------------------ 958| 0| ip = jmp_if(is_undef(r1), ip); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ 959| 0| break; 960| | 961| 0| case OP_JL_P: ------------------ | | 99| 0|#define OP_JL_P 51 ------------------ | Branch (961:5): [True: 0, False: 166k] ------------------ 962| | // Pops two values A and B from the stack and jump if A < B. B is popped 963| | // first, and then A. 964| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JL_P: // %s()\n", __FUNCTION__); 965| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (965:7): [True: 0, False: 0] | Branch (965:7): [True: 0, False: 0] ------------------ 966| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (966:7): [True: 0, False: 0] | Branch (966:7): [True: 0, False: 0] ------------------ 967| 0| ip = jmp_if(r1.i < r2.i, ip); 968| 0| break; 969| | 970| 0| case OP_JLE_P: ------------------ | | 100| 0|#define OP_JLE_P 52 ------------------ | Branch (970:5): [True: 0, False: 166k] ------------------ 971| | // Pops two values A and B from the stack and jump if A <= B. B is popped 972| | // first, and then A. 973| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JLE_P: // %s()\n", __FUNCTION__); 974| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (974:7): [True: 0, False: 0] | Branch (974:7): [True: 0, False: 0] ------------------ 975| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (975:7): [True: 0, False: 0] | Branch (975:7): [True: 0, False: 0] ------------------ 976| 0| ip = jmp_if(r1.i <= r2.i, ip); 977| 0| break; 978| | 979| 0| case OP_JTRUE: ------------------ | | 97| 0|#define OP_JTRUE 49 ------------------ | Branch (979:5): [True: 0, False: 166k] ------------------ 980| | // Jump if the top of the stack is true without modifying the stack. If 981| | // the top of the stack is undefined the jump is not taken. 982| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JTRUE: // %s()\n", __FUNCTION__); 983| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (983:7): [True: 0, False: 0] | Branch (983:7): [True: 0, False: 0] ------------------ 984| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 985| 0| ip = jmp_if(!is_undef(r1) && r1.i, ip); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (985:19): [True: 0, False: 0] | Branch (985:36): [True: 0, False: 0] ------------------ 986| 0| break; 987| | 988| 0| case OP_JTRUE_P: ------------------ | | 98| 0|#define OP_JTRUE_P 50 ------------------ | Branch (988:5): [True: 0, False: 166k] ------------------ 989| | // Removes a value from the stack and jump if it is true. If the value 990| | // is undefined the jump is not taken. 991| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JTRUE_P: // %s()\n", __FUNCTION__); 992| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (992:7): [True: 0, False: 0] | Branch (992:7): [True: 0, False: 0] ------------------ 993| 0| ip = jmp_if(!is_undef(r1) && r1.i, ip); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (993:19): [True: 0, False: 0] | Branch (993:36): [True: 0, False: 0] ------------------ 994| 0| break; 995| | 996| 13.6k| case OP_JFALSE: ------------------ | | 95| 13.6k|#define OP_JFALSE 47 ------------------ | Branch (996:5): [True: 13.6k, False: 153k] ------------------ 997| | // Jump if the top of the stack is false without modifying the stack. If 998| | // the top of the stack is undefined the jump is not taken. 999| 13.6k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JFALSE: // %s()\n", __FUNCTION__); 1000| 13.6k| pop(r1); ------------------ | | 66| 13.6k| { \ | | 67| 13.6k| assert(stack.sp > 0); \ | | 68| 13.6k| x = stack.items[--stack.sp]; \ | | 69| 13.6k| } ------------------ | Branch (1000:7): [True: 0, False: 13.6k] | Branch (1000:7): [True: 13.6k, False: 0] ------------------ 1001| 13.6k| push(r1); ------------------ | | 54| 13.6k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 13.6k, False: 0] | | ------------------ | | 55| 13.6k| { \ | | 56| 13.6k| stack.items[stack.sp++] = (x); \ | | 57| 13.6k| } \ | | 58| 13.6k| else \ | | 59| 13.6k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1002| 13.6k| ip = jmp_if(!is_undef(r1) && !r1.i, ip); ------------------ | | 71| 13.6k|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 27.3k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 13.6k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (1002:19): [True: 13.6k, False: 0] | Branch (1002:36): [True: 566, False: 13.0k] ------------------ 1003| 13.6k| break; 1004| | 1005| 0| case OP_JFALSE_P: ------------------ | | 96| 0|#define OP_JFALSE_P 48 ------------------ | Branch (1005:5): [True: 0, False: 166k] ------------------ 1006| | // Removes a value from the stack and jump if it is false. If the value 1007| | // is undefined the jump is not taken. 1008| 0| YR_DEBUG_FPRINTF( 1009| 0| 2, stderr, "- case OP_JFALSE_P: // %s()\n", __FUNCTION__); 1010| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1010:7): [True: 0, False: 0] | Branch (1010:7): [True: 0, False: 0] ------------------ 1011| 0| ip = jmp_if(!is_undef(r1) && !r1.i, ip); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (1011:19): [True: 0, False: 0] | Branch (1011:36): [True: 0, False: 0] ------------------ 1012| 0| break; 1013| | 1014| 0| case OP_JZ: ------------------ | | 109| 0|#define OP_JZ 61 ------------------ | Branch (1014:5): [True: 0, False: 166k] ------------------ 1015| | // Jump if the value at the top of the stack is 0 without modifying the 1016| | // stack. 1017| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JZ: // %s()\n", __FUNCTION__); 1018| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1018:7): [True: 0, False: 0] | Branch (1018:7): [True: 0, False: 0] ------------------ 1019| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1020| 0| ip = jmp_if(r1.i == 0, ip); 1021| 0| break; 1022| | 1023| 0| case OP_JZ_P: ------------------ | | 110| 0|#define OP_JZ_P 62 ------------------ | Branch (1023:5): [True: 0, False: 166k] ------------------ 1024| | // Removes a value from the stack and jump if the value is 0. 1025| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_JZ_P: // %s()\n", __FUNCTION__); 1026| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1026:7): [True: 0, False: 0] | Branch (1026:7): [True: 0, False: 0] ------------------ 1027| 0| ip = jmp_if(r1.i == 0, ip); 1028| 0| break; 1029| | 1030| 13.0k| case OP_AND: ------------------ | | 49| 13.0k|#define OP_AND 1 ------------------ | Branch (1030:5): [True: 13.0k, False: 153k] ------------------ 1031| 13.0k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_AND: // %s()\n", __FUNCTION__); 1032| 13.0k| pop(r2); ------------------ | | 66| 13.0k| { \ | | 67| 13.0k| assert(stack.sp > 0); \ | | 68| 13.0k| x = stack.items[--stack.sp]; \ | | 69| 13.0k| } ------------------ | Branch (1032:7): [True: 0, False: 13.0k] | Branch (1032:7): [True: 13.0k, False: 0] ------------------ 1033| 13.0k| pop(r1); ------------------ | | 66| 13.0k| { \ | | 67| 13.0k| assert(stack.sp > 0); \ | | 68| 13.0k| x = stack.items[--stack.sp]; \ | | 69| 13.0k| } ------------------ | Branch (1033:7): [True: 0, False: 13.0k] | Branch (1033:7): [True: 13.0k, False: 0] ------------------ 1034| | 1035| 13.0k| if (is_undef(r1)) ------------------ | | 71| 13.0k|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 13.0k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 13.0k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 13.0k] | | | | ------------------ | | ------------------ ------------------ 1036| 0| r1.i = 0; 1037| | 1038| 13.0k| if (is_undef(r2)) ------------------ | | 71| 13.0k|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 13.0k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 13.0k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 4, False: 13.0k] | | | | ------------------ | | ------------------ ------------------ 1039| 4| r2.i = 0; 1040| | 1041| 13.0k| r1.i = r1.i && r2.i; ------------------ | Branch (1041:14): [True: 13.0k, False: 0] | Branch (1041:22): [True: 12.9k, False: 114] ------------------ 1042| 13.0k| push(r1); ------------------ | | 54| 13.0k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 13.0k, False: 0] | | ------------------ | | 55| 13.0k| { \ | | 56| 13.0k| stack.items[stack.sp++] = (x); \ | | 57| 13.0k| } \ | | 58| 13.0k| else \ | | 59| 13.0k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1043| 13.0k| break; 1044| | 1045| 0| case OP_OR: ------------------ | | 50| 0|#define OP_OR 2 ------------------ | Branch (1045:5): [True: 0, False: 166k] ------------------ 1046| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_OR: // %s()\n", __FUNCTION__); 1047| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1047:7): [True: 0, False: 0] | Branch (1047:7): [True: 0, False: 0] ------------------ 1048| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1048:7): [True: 0, False: 0] | Branch (1048:7): [True: 0, False: 0] ------------------ 1049| | 1050| 0| if (is_undef(r1)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1051| 0| r1.i = 0; 1052| | 1053| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1054| 0| r2.i = 0; 1055| | 1056| 0| r1.i = r1.i || r2.i; ------------------ | Branch (1056:14): [True: 0, False: 0] | Branch (1056:22): [True: 0, False: 0] ------------------ 1057| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1058| 0| break; 1059| | 1060| 0| case OP_NOT: ------------------ | | 51| 0|#define OP_NOT 3 ------------------ | Branch (1060:5): [True: 0, False: 166k] ------------------ 1061| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_NOT: // %s()\n", __FUNCTION__); 1062| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1062:7): [True: 0, False: 0] | Branch (1062:7): [True: 0, False: 0] ------------------ 1063| | 1064| 0| if (is_undef(r1)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1065| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1066| 0| else 1067| 0| r1.i = !r1.i; 1068| | 1069| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1070| 0| break; 1071| | 1072| 0| case OP_DEFINED: ------------------ | | 125| 0|#define OP_DEFINED 77 ------------------ | Branch (1072:5): [True: 0, False: 166k] ------------------ 1073| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1073:7): [True: 0, False: 0] | Branch (1073:7): [True: 0, False: 0] ------------------ 1074| 0| r1.i = !is_undef(r1); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ 1075| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1076| 0| break; 1077| | 1078| 0| case OP_MOD: ------------------ | | 58| 0|#define OP_MOD 10 ------------------ | Branch (1078:5): [True: 0, False: 166k] ------------------ 1079| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_MOD: // %s()\n", __FUNCTION__); 1080| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1080:7): [True: 0, False: 0] | Branch (1080:7): [True: 0, False: 0] ------------------ 1081| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1081:7): [True: 0, False: 0] | Branch (1081:7): [True: 0, False: 0] ------------------ 1082| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1083| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1084| | // If divisor is zero the result is undefined. It's also undefined 1085| | // when dividing INT64_MIN by -1. 1086| 0| if (r2.i == 0 || (r1.i == INT64_MIN && r2.i == -1)) ------------------ | Branch (1086:11): [True: 0, False: 0] | Branch (1086:25): [True: 0, False: 0] | Branch (1086:46): [True: 0, False: 0] ------------------ 1087| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1088| 0| else 1089| 0| r1.i = r1.i % r2.i; 1090| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1091| 0| break; 1092| | 1093| 0| case OP_SHR: ------------------ | | 57| 0|#define OP_SHR 9 ------------------ | Branch (1093:5): [True: 0, False: 166k] ------------------ 1094| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_SHR: // %s()\n", __FUNCTION__); 1095| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1095:7): [True: 0, False: 0] | Branch (1095:7): [True: 0, False: 0] ------------------ 1096| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1096:7): [True: 0, False: 0] | Branch (1096:7): [True: 0, False: 0] ------------------ 1097| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1098| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1099| 0| if (r2.i < 0) ------------------ | Branch (1099:11): [True: 0, False: 0] ------------------ 1100| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1101| 0| else if (r2.i < 64) ------------------ | Branch (1101:16): [True: 0, False: 0] ------------------ 1102| 0| r1.i = r1.i >> r2.i; 1103| 0| else 1104| 0| r1.i = 0; 1105| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1106| 0| break; 1107| | 1108| 0| case OP_SHL: ------------------ | | 56| 0|#define OP_SHL 8 ------------------ | Branch (1108:5): [True: 0, False: 166k] ------------------ 1109| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_SHL: // %s()\n", __FUNCTION__); 1110| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1110:7): [True: 0, False: 0] | Branch (1110:7): [True: 0, False: 0] ------------------ 1111| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1111:7): [True: 0, False: 0] | Branch (1111:7): [True: 0, False: 0] ------------------ 1112| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1113| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1114| 0| if (r2.i < 0) ------------------ | Branch (1114:11): [True: 0, False: 0] ------------------ 1115| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1116| 0| else if (r2.i < 64) ------------------ | Branch (1116:16): [True: 0, False: 0] ------------------ 1117| 0| r1.i = r1.i << r2.i; 1118| 0| else 1119| 0| r1.i = 0; 1120| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1121| 0| break; 1122| | 1123| 0| case OP_BITWISE_NOT: ------------------ | | 52| 0|#define OP_BITWISE_NOT 4 ------------------ | Branch (1123:5): [True: 0, False: 166k] ------------------ 1124| 0| YR_DEBUG_FPRINTF( 1125| 0| 2, stderr, "- case OP_BITWISE_NOT: // %s()\n", __FUNCTION__); 1126| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1126:7): [True: 0, False: 0] | Branch (1126:7): [True: 0, False: 0] ------------------ 1127| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1128| 0| r1.i = ~r1.i; 1129| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1130| 0| break; 1131| | 1132| 0| case OP_BITWISE_AND: ------------------ | | 53| 0|#define OP_BITWISE_AND 5 ------------------ | Branch (1132:5): [True: 0, False: 166k] ------------------ 1133| 0| YR_DEBUG_FPRINTF( 1134| 0| 2, stderr, "- case OP_BITWISE_AND: // %s()\n", __FUNCTION__); 1135| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1135:7): [True: 0, False: 0] | Branch (1135:7): [True: 0, False: 0] ------------------ 1136| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1136:7): [True: 0, False: 0] | Branch (1136:7): [True: 0, False: 0] ------------------ 1137| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1138| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1139| 0| r1.i = r1.i & r2.i; 1140| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1141| 0| break; 1142| | 1143| 0| case OP_BITWISE_OR: ------------------ | | 54| 0|#define OP_BITWISE_OR 6 ------------------ | Branch (1143:5): [True: 0, False: 166k] ------------------ 1144| 0| YR_DEBUG_FPRINTF( 1145| 0| 2, stderr, "- case OP_BITWISE_OR: // %s()\n", __FUNCTION__); 1146| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1146:7): [True: 0, False: 0] | Branch (1146:7): [True: 0, False: 0] ------------------ 1147| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1147:7): [True: 0, False: 0] | Branch (1147:7): [True: 0, False: 0] ------------------ 1148| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1149| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1150| 0| r1.i = r1.i | r2.i; 1151| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1152| 0| break; 1153| | 1154| 0| case OP_BITWISE_XOR: ------------------ | | 55| 0|#define OP_BITWISE_XOR 7 ------------------ | Branch (1154:5): [True: 0, False: 166k] ------------------ 1155| 0| YR_DEBUG_FPRINTF( 1156| 0| 2, stderr, "- case OP_BITWISE_XOR: // %s()\n", __FUNCTION__); 1157| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1157:7): [True: 0, False: 0] | Branch (1157:7): [True: 0, False: 0] ------------------ 1158| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1158:7): [True: 0, False: 0] | Branch (1158:7): [True: 0, False: 0] ------------------ 1159| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1160| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1161| 0| r1.i = r1.i ^ r2.i; 1162| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1163| 0| break; 1164| | 1165| 0| case OP_PUSH_RULE: ------------------ | | 75| 0|#define OP_PUSH_RULE 27 ------------------ | Branch (1165:5): [True: 0, False: 166k] ------------------ 1166| 0| YR_DEBUG_FPRINTF( 1167| 0| 2, stderr, "- case OP_PUSH_RULE: // %s()\n", __FUNCTION__); 1168| 0| r1.i = yr_unaligned_u64(ip); 1169| 0| ip += sizeof(uint64_t); 1170| | 1171| 0| rule = &context->rules->rules_table[r1.i]; 1172| | 1173| 0|#if YR_PARANOID_EXEC 1174| 0| ensure_within_rules_arena(rule); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1175| 0|#endif 1176| | 1177| 0| if (RULE_IS_DISABLED(rule)) ------------------ | | 63| 0|#define RULE_IS_DISABLED(x) (((x)->flags) & RULE_FLAGS_DISABLED) | | ------------------ | | | | 55| 0|#define RULE_FLAGS_DISABLED 0x08 | | ------------------ | | | Branch (63:29): [True: 0, False: 0] | | ------------------ ------------------ 1178| 0| { 1179| 0| r2.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1180| 0| } 1181| 0| else 1182| 0| { 1183| 0| if (yr_bitmask_is_set(context->rule_matches_flags, r1.i)) ------------------ | | 75| 0| ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | | Branch (75:3): [True: 0, False: 0] | | ------------------ ------------------ 1184| 0| r2.i = 1; 1185| 0| else 1186| 0| r2.i = 0; 1187| 0| } 1188| | 1189| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1190| 0| break; 1191| | 1192| 1.70k| case OP_INIT_RULE: ------------------ | | 76| 1.70k|#define OP_INIT_RULE 28 ------------------ | Branch (1192:5): [True: 1.70k, False: 165k] ------------------ 1193| 1.70k| YR_DEBUG_FPRINTF( 1194| 1.70k| 2, stderr, "- case OP_INIT_RULE: // %s()\n", __FUNCTION__); 1195| | 1196| | // After the opcode there's an int32_t corresponding to the jump's 1197| | // offset and an uint32_t corresponding to the rule's index. 1198| 1.70k| current_rule_idx = yr_unaligned_u32(ip + sizeof(int32_t)); 1199| | 1200| | // The curent rule index can't be larger than the number of rules. 1201| 1.70k| assert(current_rule_idx < context->rules->num_rules); ------------------ | Branch (1201:7): [True: 0, False: 1.70k] | Branch (1201:7): [True: 1.70k, False: 0] ------------------ 1202| | 1203| 1.70k| current_rule = &context->rules->rules_table[current_rule_idx]; 1204| | 1205| 1.70k|#if YR_PARANOID_EXEC 1206| 1.70k| ensure_within_rules_arena(current_rule); ------------------ | | 91| 1.70k| { \ | | 92| 1.70k| YR_ARENA_REF ref; \ | | 93| 1.70k| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 1.70k] | | ------------------ | | 94| 1.70k| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 1.70k| } ------------------ 1207| 1.70k|#endif 1208| | 1209| | // If the rule is disabled, let's skip its code. 1210| 1.70k| bool skip_rule = RULE_IS_DISABLED(current_rule); ------------------ | | 63| 1.70k|#define RULE_IS_DISABLED(x) (((x)->flags) & RULE_FLAGS_DISABLED) | | ------------------ | | | | 55| 1.70k|#define RULE_FLAGS_DISABLED 0x08 | | ------------------ ------------------ 1211| | 1212| | // The rule is also skipped if it is not required to be evaluated. 1213| 1.70k| skip_rule |= yr_bitmask_is_not_set( ------------------ | | 77| 1.70k|#define yr_bitmask_is_not_set(bm, i) (!yr_bitmask_is_set(bm, i)) | | ------------------ | | | | 75| 1.70k| ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | | | ------------------ | | | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | | | ------------------ | | | | ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | | | ------------------ | | | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | | | ------------------ | | ------------------ ------------------ 1214| 1.70k| context->required_eval, current_rule_idx); 1215| | 1216| 1.70k| ip = jmp_if(skip_rule, ip); 1217| | 1218| 1.70k| if (skip_rule) ------------------ | Branch (1218:11): [True: 0, False: 1.70k] ------------------ 1219| 0| { 1220| | // If the rule is skipped it is false, and if a global rule is false 1221| | // we must mark its namespace as unsatisfied. 1222| 0| if (RULE_IS_GLOBAL(current_rule)) ------------------ | | 59| 0|#define RULE_IS_GLOBAL(x) (((x)->flags) & RULE_FLAGS_GLOBAL) | | ------------------ | | | | 53| 0|#define RULE_FLAGS_GLOBAL 0x02 | | ------------------ | | | Branch (59:27): [True: 0, False: 0] | | ------------------ ------------------ 1223| 0| yr_bitmask_set(context->ns_unsatisfied_flags, current_rule->ns->idx); ------------------ | | 60| 0| do \ | | 61| 0| { \ | | 62| 0| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 0| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 0] | | ------------------ ------------------ 1224| 0| } 1225| 1.70k| else 1226| 1.70k| { 1227| | // If not taking the jump, skip the bytes corresponding to the 1228| | // rule's index. 1229| 1.70k| ip += sizeof(uint32_t); 1230| 1.70k| } 1231| | 1232| 1.70k| break; 1233| | 1234| 1.70k| case OP_MATCH_RULE: ------------------ | | 77| 1.70k|#define OP_MATCH_RULE 29 ------------------ | Branch (1234:5): [True: 1.70k, False: 165k] ------------------ 1235| 1.70k| YR_DEBUG_FPRINTF( 1236| 1.70k| 2, stderr, "- case OP_MATCH_RULE: // %s()\n", __FUNCTION__); 1237| 1.70k| pop(r1); ------------------ | | 66| 1.70k| { \ | | 67| 1.70k| assert(stack.sp > 0); \ | | 68| 1.70k| x = stack.items[--stack.sp]; \ | | 69| 1.70k| } ------------------ | Branch (1237:7): [True: 0, False: 1.70k] | Branch (1237:7): [True: 1.70k, False: 0] ------------------ 1238| | 1239| 1.70k| r2.i = yr_unaligned_u64(ip); 1240| 1.70k| ip += sizeof(uint64_t); 1241| | 1242| 1.70k| rule = &context->rules->rules_table[r2.i]; 1243| | 1244| 1.70k|#if YR_PARANOID_EXEC 1245| 1.70k| ensure_within_rules_arena(rule); ------------------ | | 91| 1.70k| { \ | | 92| 1.70k| YR_ARENA_REF ref; \ | | 93| 1.70k| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 1.70k] | | ------------------ | | 94| 1.70k| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 1.70k| } ------------------ 1246| 1.70k|#endif 1247| | 1248| 1.70k| if (!is_undef(r1) && r1.i) ------------------ | | 71| 1.70k|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 3.41k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (1248:11): [True: 1.70k, False: 0] | Branch (1248:28): [True: 1.59k, False: 114] ------------------ 1249| 1.59k| yr_bitmask_set(context->rule_matches_flags, r2.i); ------------------ | | 60| 1.59k| do \ | | 61| 1.59k| { \ | | 62| 1.59k| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 1.59k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 1.59k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 1.59k| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 1.59k] | | ------------------ ------------------ 1250| 114| else if (RULE_IS_GLOBAL(rule)) ------------------ | | 59| 114|#define RULE_IS_GLOBAL(x) (((x)->flags) & RULE_FLAGS_GLOBAL) | | ------------------ | | | | 53| 114|#define RULE_FLAGS_GLOBAL 0x02 | | ------------------ | | | Branch (59:27): [True: 0, False: 114] | | ------------------ ------------------ 1251| 0| yr_bitmask_set(context->ns_unsatisfied_flags, rule->ns->idx); ------------------ | | 60| 0| do \ | | 61| 0| { \ | | 62| 0| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 0|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 0| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 0] | | ------------------ ------------------ 1252| | 1253| |#ifdef YR_PROFILING_ENABLED 1254| | elapsed_time = yr_stopwatch_elapsed_ns(&context->stopwatch); 1255| | context->profiling_info[r2.i].exec_time += (elapsed_time - start_time); 1256| | start_time = elapsed_time; 1257| |#endif 1258| | 1259| 1.70k| assert(stack.sp == 0); // at this point the stack should be empty. ------------------ | Branch (1259:7): [True: 0, False: 1.70k] | Branch (1259:7): [True: 1.70k, False: 0] ------------------ 1260| 1.70k| break; 1261| | 1262| 14.7k| case OP_OBJ_LOAD: ------------------ | | 64| 14.7k|#define OP_OBJ_LOAD 16 ------------------ | Branch (1262:5): [True: 14.7k, False: 152k] ------------------ 1263| 14.7k| YR_DEBUG_FPRINTF( 1264| 14.7k| 2, stderr, "- case OP_OBJ_LOAD: // %s()\n", __FUNCTION__); 1265| | 1266| 14.7k| identifier = yr_unaligned_char_ptr(ip); 1267| 14.7k| ip += sizeof(uint64_t); 1268| | 1269| 14.7k|#if YR_PARANOID_EXEC 1270| 14.7k| ensure_within_rules_arena(identifier); ------------------ | | 91| 14.7k| { \ | | 92| 14.7k| YR_ARENA_REF ref; \ | | 93| 14.7k| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 14.7k] | | ------------------ | | 94| 14.7k| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 14.7k| } ------------------ 1271| 14.7k|#endif 1272| | 1273| 14.7k| r1.o = (YR_OBJECT*) yr_hash_table_lookup( 1274| 14.7k| context->objects_table, identifier, NULL); 1275| | 1276| 14.7k| assert(r1.o != NULL); ------------------ | Branch (1276:7): [True: 0, False: 14.7k] | Branch (1276:7): [True: 14.7k, False: 0] ------------------ 1277| 14.7k| push(r1); ------------------ | | 54| 14.7k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 14.7k, False: 0] | | ------------------ | | 55| 14.7k| { \ | | 56| 14.7k| stack.items[stack.sp++] = (x); \ | | 57| 14.7k| } \ | | 58| 14.7k| else \ | | 59| 14.7k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1278| 14.7k| break; 1279| | 1280| 14.7k| case OP_OBJ_FIELD: ------------------ | | 66| 14.7k|#define OP_OBJ_FIELD 18 ------------------ | Branch (1280:5): [True: 14.7k, False: 152k] ------------------ 1281| 14.7k| YR_DEBUG_FPRINTF( 1282| 14.7k| 2, stderr, "- case OP_OBJ_FIELD: // %s()\n", __FUNCTION__); 1283| | 1284| 14.7k| identifier = yr_unaligned_char_ptr(ip); 1285| 14.7k| ip += sizeof(uint64_t); 1286| | 1287| 14.7k|#if YR_PARANOID_EXEC 1288| 14.7k| ensure_within_rules_arena(identifier); ------------------ | | 91| 14.7k| { \ | | 92| 14.7k| YR_ARENA_REF ref; \ | | 93| 14.7k| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 14.7k] | | ------------------ | | 94| 14.7k| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 14.7k| } ------------------ 1289| 14.7k|#endif 1290| | 1291| 14.7k| pop(r1); ------------------ | | 66| 14.7k| { \ | | 67| 14.7k| assert(stack.sp > 0); \ | | 68| 14.7k| x = stack.items[--stack.sp]; \ | | 69| 14.7k| } ------------------ | Branch (1291:7): [True: 0, False: 14.7k] | Branch (1291:7): [True: 14.7k, False: 0] ------------------ 1292| 14.7k| ensure_defined(r1); ------------------ | | 74| 14.7k| if (is_undef(x)) \ | | ------------------ | | | | 71| 14.7k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 14.7k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 14.7k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 14.7k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 14.7k| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1293| | 1294| 14.7k| r1.o = yr_object_lookup_field(r1.o, identifier); 1295| | 1296| 14.7k| if (r1.o == NULL) ------------------ | Branch (1296:11): [True: 0, False: 14.7k] ------------------ 1297| 0| { 1298| 0| result = ERROR_INVALID_FIELD_NAME; ------------------ | | 80| 0|#define ERROR_INVALID_FIELD_NAME 33 ------------------ 1299| 0| stop = true; 1300| 0| break; 1301| 0| } 1302| | 1303| 14.7k| push(r1); ------------------ | | 54| 14.7k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 14.7k, False: 0] | | ------------------ | | 55| 14.7k| { \ | | 56| 14.7k| stack.items[stack.sp++] = (x); \ | | 57| 14.7k| } \ | | 58| 14.7k| else \ | | 59| 14.7k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1304| 14.7k| break; 1305| | 1306| 14.7k| case OP_OBJ_VALUE: ------------------ | | 65| 14.7k|#define OP_OBJ_VALUE 17 ------------------ | Branch (1306:5): [True: 14.7k, False: 152k] ------------------ 1307| 14.7k| YR_DEBUG_FPRINTF( 1308| 14.7k| 2, stderr, "- case OP_OBJ_VALUE: // %s()\n", __FUNCTION__); 1309| 14.7k| pop(r1); ------------------ | | 66| 14.7k| { \ | | 67| 14.7k| assert(stack.sp > 0); \ | | 68| 14.7k| x = stack.items[--stack.sp]; \ | | 69| 14.7k| } ------------------ | Branch (1309:7): [True: 0, False: 14.7k] | Branch (1309:7): [True: 14.7k, False: 0] ------------------ 1310| 14.7k| ensure_defined(r1); ------------------ | | 74| 14.7k| if (is_undef(x)) \ | | ------------------ | | | | 71| 14.7k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 14.7k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 14.7k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 14.7k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 14.7k| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1311| | 1312| 14.7k|#if YR_PARANOID_EXEC 1313| 14.7k| check_object_canary(r1.o); ------------------ | | 102| 14.7k| if (o->canary != context->canary) \ | | ------------------ | | | Branch (102:7): [True: 0, False: 14.7k] | | ------------------ | | 103| 14.7k| { \ | | 104| 0| stop = true; \ | | 105| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 106| 0| break; \ | | 107| 0| } ------------------ 1314| 14.7k|#endif 1315| | 1316| 14.7k| switch (r1.o->type) 1317| 14.7k| { 1318| 4.77k| case OBJECT_TYPE_INTEGER: ------------------ | | 58| 4.77k|#define OBJECT_TYPE_INTEGER 1 ------------------ | Branch (1318:7): [True: 4.77k, False: 10.0k] ------------------ 1319| 4.77k| r1.i = r1.o->value.i; 1320| 4.77k| break; 1321| | 1322| 10.0k| case OBJECT_TYPE_FLOAT: ------------------ | | 64| 10.0k|#define OBJECT_TYPE_FLOAT 7 ------------------ | Branch (1322:7): [True: 10.0k, False: 4.77k] ------------------ 1323| 10.0k| if (yr_isnan(r1.o->value.d)) ------------------ | | 40| 10.0k| #define yr_isnan isnan ------------------ | Branch (1323:13): [True: 4, False: 10.0k] ------------------ 1324| 4| r1.i = YR_UNDEFINED; ------------------ | | 38| 4|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1325| 10.0k| else 1326| 10.0k| r1.d = r1.o->value.d; 1327| 10.0k| break; 1328| | 1329| 0| case OBJECT_TYPE_STRING: ------------------ | | 59| 0|#define OBJECT_TYPE_STRING 2 ------------------ | Branch (1329:7): [True: 0, False: 14.7k] ------------------ 1330| 0| if (r1.o->value.ss == NULL) ------------------ | Branch (1330:13): [True: 0, False: 0] ------------------ 1331| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1332| 0| else 1333| 0| r1.ss = r1.o->value.ss; 1334| 0| break; 1335| | 1336| 0| default: ------------------ | Branch (1336:7): [True: 0, False: 14.7k] ------------------ 1337| 0| assert(false); ------------------ | Branch (1337:9): [Folded, False: 0] | Branch (1337:9): [Folded, False: 0] ------------------ 1338| 14.7k| } 1339| | 1340| 14.7k| push(r1); ------------------ | | 54| 14.7k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 14.7k, False: 0] | | ------------------ | | 55| 14.7k| { \ | | 56| 14.7k| stack.items[stack.sp++] = (x); \ | | 57| 14.7k| } \ | | 58| 14.7k| else \ | | 59| 14.7k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1341| 14.7k| break; 1342| | 1343| 0| case OP_INDEX_ARRAY: ------------------ | | 67| 0|#define OP_INDEX_ARRAY 19 ------------------ | Branch (1343:5): [True: 0, False: 166k] ------------------ 1344| 0| YR_DEBUG_FPRINTF( 1345| 0| 2, stderr, "- case OP_INDEX_ARRAY: // %s()\n", __FUNCTION__); 1346| 0| pop(r1); // index ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1346:7): [True: 0, False: 0] | Branch (1346:7): [True: 0, False: 0] ------------------ 1347| 0| pop(r2); // array ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1347:7): [True: 0, False: 0] | Branch (1347:7): [True: 0, False: 0] ------------------ 1348| | 1349| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1350| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1351| | 1352| 0| assert(r2.o->type == OBJECT_TYPE_ARRAY); ------------------ | Branch (1352:7): [True: 0, False: 0] | Branch (1352:7): [True: 0, False: 0] ------------------ 1353| | 1354| 0|#if YR_PARANOID_EXEC 1355| 0| check_object_canary(r2.o); ------------------ | | 102| 0| if (o->canary != context->canary) \ | | ------------------ | | | Branch (102:7): [True: 0, False: 0] | | ------------------ | | 103| 0| { \ | | 104| 0| stop = true; \ | | 105| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 106| 0| break; \ | | 107| 0| } ------------------ 1356| 0|#endif 1357| | 1358| 0| r1.o = yr_object_array_get_item(r2.o, 0, (int) r1.i); 1359| | 1360| 0| if (r1.o == NULL) ------------------ | Branch (1360:11): [True: 0, False: 0] ------------------ 1361| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1362| | 1363| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1364| 0| break; 1365| | 1366| 0| case OP_LOOKUP_DICT: ------------------ | | 90| 0|#define OP_LOOKUP_DICT 42 ------------------ | Branch (1366:5): [True: 0, False: 166k] ------------------ 1367| 0| YR_DEBUG_FPRINTF( 1368| 0| 2, stderr, "- case OP_LOOKUP_DICT: // %s()\n", __FUNCTION__); 1369| 0| pop(r1); // key ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1369:7): [True: 0, False: 0] | Branch (1369:7): [True: 0, False: 0] ------------------ 1370| 0| pop(r2); // dictionary ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1370:7): [True: 0, False: 0] | Branch (1370:7): [True: 0, False: 0] ------------------ 1371| | 1372| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1373| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1374| | 1375| 0| assert(r2.o->type == OBJECT_TYPE_DICTIONARY); ------------------ | Branch (1375:7): [True: 0, False: 0] | Branch (1375:7): [True: 0, False: 0] ------------------ 1376| | 1377| 0|#if YR_PARANOID_EXEC 1378| 0| check_object_canary(r2.o); ------------------ | | 102| 0| if (o->canary != context->canary) \ | | ------------------ | | | Branch (102:7): [True: 0, False: 0] | | ------------------ | | 103| 0| { \ | | 104| 0| stop = true; \ | | 105| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 106| 0| break; \ | | 107| 0| } ------------------ 1379| 0|#endif 1380| | 1381| 0| r1.o = yr_object_dict_get_item(r2.o, 0, r1.ss->c_string); 1382| | 1383| 0| if (r1.o == NULL) ------------------ | Branch (1383:11): [True: 0, False: 0] ------------------ 1384| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1385| | 1386| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1387| 0| break; 1388| | 1389| 14.7k| case OP_CALL: ------------------ | | 63| 14.7k|#define OP_CALL 15 ------------------ | Branch (1389:5): [True: 14.7k, False: 152k] ------------------ 1390| 14.7k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_CALL: // %s()\n", __FUNCTION__); 1391| | 1392| 14.7k| args_fmt = yr_unaligned_char_ptr(ip); 1393| 14.7k| ip += sizeof(uint64_t); 1394| | 1395| 14.7k| int i = (int) strlen(args_fmt); 1396| 14.7k| count = 0; 1397| | 1398| 14.7k|#if YR_PARANOID_EXEC 1399| 14.7k| if (i > YR_MAX_FUNCTION_ARGS) ------------------ | | 130| 14.7k|#define YR_MAX_FUNCTION_ARGS 128 ------------------ | Branch (1399:11): [True: 0, False: 14.7k] ------------------ 1400| 0| { 1401| 0| stop = true; 1402| 0| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 1403| 0| break; 1404| 0| } 1405| 14.7k|#endif 1406| | 1407| | // pop arguments from stack and copy them to args array 1408| | 1409| 49.2k| while (i > 0) ------------------ | Branch (1409:14): [True: 34.4k, False: 14.7k] ------------------ 1410| 34.4k| { 1411| 34.4k| pop(r1); ------------------ | | 66| 34.4k| { \ | | 67| 34.4k| assert(stack.sp > 0); \ | | 68| 34.4k| x = stack.items[--stack.sp]; \ | | 69| 34.4k| } ------------------ | Branch (1411:9): [True: 0, False: 34.4k] | Branch (1411:9): [True: 34.4k, False: 0] ------------------ 1412| | 1413| 34.4k| if (is_undef(r1)) // count the number of undefined args ------------------ | | 71| 34.4k|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 34.4k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 34.4k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 34.4k] | | | | ------------------ | | ------------------ ------------------ 1414| 0| count++; 1415| | 1416| 34.4k| args[i - 1] = r1; 1417| 34.4k| i--; 1418| 34.4k| } 1419| | 1420| 29.5k| pop(r2); ------------------ | | 66| 14.7k| { \ | | 67| 14.7k| assert(stack.sp > 0); \ | | 68| 14.7k| x = stack.items[--stack.sp]; \ | | 69| 14.7k| } ------------------ | Branch (1420:7): [True: 0, False: 14.7k] | Branch (1420:7): [True: 14.7k, False: 0] ------------------ 1421| 29.5k| ensure_defined(r2); ------------------ | | 74| 14.7k| if (is_undef(x)) \ | | ------------------ | | | | 71| 14.7k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 14.7k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 14.7k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 14.7k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 14.7k| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1422| | 1423| 14.7k|#if YR_PARANOID_EXEC 1424| 14.7k| check_object_canary(r2.o); ------------------ | | 102| 14.7k| if (o->canary != context->canary) \ | | ------------------ | | | Branch (102:7): [True: 0, False: 14.7k] | | ------------------ | | 103| 14.7k| { \ | | 104| 0| stop = true; \ | | 105| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 106| 0| break; \ | | 107| 0| } ------------------ 1425| 14.7k|#endif 1426| | 1427| 14.7k| if (count > 0) ------------------ | Branch (1427:11): [True: 0, False: 14.7k] ------------------ 1428| 0| { 1429| | // If there are undefined args, result for function call 1430| | // is undefined as well. 1431| | 1432| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1433| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1434| 0| break; 1435| 0| } 1436| | 1437| 14.7k| function = object_as_function(r2.o); ------------------ | | 912| 14.7k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 1438| 14.7k| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 14.7k|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 1439| | 1440| 14.7k| for (i = 0; i < YR_MAX_OVERLOADED_FUNCTIONS; i++) ------------------ | | 135| 14.7k|#define YR_MAX_OVERLOADED_FUNCTIONS 10 ------------------ | Branch (1440:19): [True: 14.7k, False: 0] ------------------ 1441| 14.7k| { 1442| 14.7k| if (function->prototypes[i].arguments_fmt == NULL) ------------------ | Branch (1442:13): [True: 0, False: 14.7k] ------------------ 1443| 0| break; 1444| | 1445| 14.7k| if (strcmp(function->prototypes[i].arguments_fmt, args_fmt) == 0) ------------------ | Branch (1445:13): [True: 14.7k, False: 0] ------------------ 1446| 14.7k| { 1447| 14.7k| result = function->prototypes[i].code(args, context, function); 1448| 14.7k| break; 1449| 14.7k| } 1450| 14.7k| } 1451| | 1452| | // If i == YR_MAX_OVERLOADED_FUNCTIONS at this point no matching 1453| | // prototype was found, but this shouldn't happen. 1454| 14.7k| assert(i < YR_MAX_OVERLOADED_FUNCTIONS); ------------------ | Branch (1454:7): [True: 0, False: 14.7k] | Branch (1454:7): [True: 14.7k, False: 0] ------------------ 1455| | 1456| | // Make a copy of the returned object and push the copy into the stack, 1457| | // function->return_obj can't be pushed because it can change in 1458| | // subsequent calls to the same function. 1459| 14.7k| if (result == ERROR_SUCCESS) ------------------ | | 40| 14.7k|#define ERROR_SUCCESS 0 ------------------ | Branch (1459:11): [True: 14.7k, False: 0] ------------------ 1460| 14.7k| result = yr_object_copy(function->return_obj, &r1.o); 1461| | 1462| | // A pointer to the copied object is stored in a arena in order to 1463| | // free the object before exiting yr_execute_code, obj_count tracks 1464| | // the number of objects written. 1465| 14.7k| if (result == ERROR_SUCCESS) ------------------ | | 40| 14.7k|#define ERROR_SUCCESS 0 ------------------ | Branch (1465:11): [True: 14.7k, False: 0] ------------------ 1466| 14.7k| { 1467| 14.7k| result = yr_arena_write_data(obj_arena, 0, &r1.o, sizeof(r1.o), NULL); 1468| 14.7k| obj_count++; 1469| 14.7k| } 1470| 0| else 1471| 0| { 1472| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1473| 0| } 1474| | 1475| 14.7k| stop = (result != ERROR_SUCCESS); ------------------ | | 40| 14.7k|#define ERROR_SUCCESS 0 ------------------ 1476| 14.7k| push(r1); ------------------ | | 54| 14.7k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 14.7k, False: 0] | | ------------------ | | 55| 14.7k| { \ | | 56| 14.7k| stack.items[stack.sp++] = (x); \ | | 57| 14.7k| } \ | | 58| 14.7k| else \ | | 59| 14.7k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1477| 14.7k| break; 1478| | 1479| 0| case OP_FOUND: ------------------ | | 70| 0|#define OP_FOUND 22 ------------------ | Branch (1479:5): [True: 0, False: 166k] ------------------ 1480| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1480:7): [True: 0, False: 0] | Branch (1480:7): [True: 0, False: 0] ------------------ 1481| 0| r2.i = context->matches[r1.s->idx].tail != NULL ? 1 : 0; ------------------ | Branch (1481:14): [True: 0, False: 0] ------------------ 1482| 0| YR_DEBUG_FPRINTF( 1483| 0| 2, 1484| 0| stderr, 1485| 0| "- case OP_FOUND: r2.i=%" PRId64 " // %s()\n", 1486| 0| r2.i, 1487| 0| __FUNCTION__); 1488| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1489| 0| break; 1490| | 1491| 0| case OP_FOUND_AT: ------------------ | | 71| 0|#define OP_FOUND_AT 23 ------------------ | Branch (1491:5): [True: 0, False: 166k] ------------------ 1492| 0| YR_DEBUG_FPRINTF( 1493| 0| 2, stderr, "- case OP_FOUND_AT: // %s()\n", __FUNCTION__); 1494| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1494:7): [True: 0, False: 0] | Branch (1494:7): [True: 0, False: 0] ------------------ 1495| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1495:7): [True: 0, False: 0] | Branch (1495:7): [True: 0, False: 0] ------------------ 1496| | 1497| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1498| | 1499| 0|#if YR_PARANOID_EXEC 1500| 0| ensure_within_rules_arena(r2.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1501| 0|#endif 1502| | 1503| 0| match = context->matches[r2.s->idx].head; 1504| 0| r3.i = false; 1505| | 1506| 0| while (match != NULL) ------------------ | Branch (1506:14): [True: 0, False: 0] ------------------ 1507| 0| { 1508| 0| if (r1.i == match->base + match->offset) ------------------ | Branch (1508:13): [True: 0, False: 0] ------------------ 1509| 0| { 1510| 0| r3.i = true; 1511| 0| break; 1512| 0| } 1513| | 1514| 0| if (r1.i < match->base + match->offset) ------------------ | Branch (1514:13): [True: 0, False: 0] ------------------ 1515| 0| break; 1516| | 1517| 0| match = match->next; 1518| 0| } 1519| | 1520| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1521| 0| break; 1522| | 1523| 0| case OP_FOUND_IN: ------------------ | | 72| 0|#define OP_FOUND_IN 24 ------------------ | Branch (1523:5): [True: 0, False: 166k] ------------------ 1524| 0| YR_DEBUG_FPRINTF( 1525| 0| 2, stderr, "- case OP_FOUND_IN: // %s()\n", __FUNCTION__); 1526| 0| pop(r3); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1526:7): [True: 0, False: 0] | Branch (1526:7): [True: 0, False: 0] ------------------ 1527| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1527:7): [True: 0, False: 0] | Branch (1527:7): [True: 0, False: 0] ------------------ 1528| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1528:7): [True: 0, False: 0] | Branch (1528:7): [True: 0, False: 0] ------------------ 1529| | 1530| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1531| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1532| | 1533| 0|#if YR_PARANOID_EXEC 1534| 0| ensure_within_rules_arena(r3.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1535| 0|#endif 1536| | 1537| 0| match = context->matches[r3.s->idx].head; 1538| 0| r4.i = false; 1539| | 1540| 0| while (match != NULL && !r4.i) ------------------ | Branch (1540:14): [True: 0, False: 0] | Branch (1540:31): [True: 0, False: 0] ------------------ 1541| 0| { 1542| 0| if (match->base + match->offset >= r1.i && ------------------ | Branch (1542:13): [True: 0, False: 0] ------------------ 1543| 0| match->base + match->offset <= r2.i) ------------------ | Branch (1543:13): [True: 0, False: 0] ------------------ 1544| 0| { 1545| 0| r4.i = true; 1546| 0| } 1547| | 1548| 0| if (match->base + match->offset > r2.i) ------------------ | Branch (1548:13): [True: 0, False: 0] ------------------ 1549| 0| break; 1550| | 1551| 0| match = match->next; 1552| 0| } 1553| | 1554| 0| push(r4); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1555| 0| break; 1556| | 1557| 0| case OP_COUNT: ------------------ | | 68| 0|#define OP_COUNT 20 ------------------ | Branch (1557:5): [True: 0, False: 166k] ------------------ 1558| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_COUNT: // %s()\n", __FUNCTION__); 1559| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1559:7): [True: 0, False: 0] | Branch (1559:7): [True: 0, False: 0] ------------------ 1560| | 1561| 0|#if YR_PARANOID_EXEC 1562| 0| ensure_within_rules_arena(r1.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1563| 0|#endif 1564| | 1565| 0| r2.i = context->matches[r1.s->idx].count; 1566| 0| push(r2); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1567| 0| break; 1568| | 1569| 0| case OP_COUNT_IN: ------------------ | | 124| 0|#define OP_COUNT_IN 76 ------------------ | Branch (1569:5): [True: 0, False: 166k] ------------------ 1570| 0| YR_DEBUG_FPRINTF( 1571| 0| 2, stderr, "- case OP_COUNT_IN: // %s()\n", __FUNCTION__); 1572| 0| pop(r3); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1572:7): [True: 0, False: 0] | Branch (1572:7): [True: 0, False: 0] ------------------ 1573| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1573:7): [True: 0, False: 0] | Branch (1573:7): [True: 0, False: 0] ------------------ 1574| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1574:7): [True: 0, False: 0] | Branch (1574:7): [True: 0, False: 0] ------------------ 1575| | 1576| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1577| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1578| | 1579| 0|#if YR_PARANOID_EXEC 1580| 0| ensure_within_rules_arena(r3.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1581| 0|#endif 1582| | 1583| 0| match = context->matches[r3.s->idx].head; 1584| 0| r4.i = 0; 1585| | 1586| 0| while (match != NULL) ------------------ | Branch (1586:14): [True: 0, False: 0] ------------------ 1587| 0| { 1588| 0| if (match->base + match->offset >= r1.i && ------------------ | Branch (1588:13): [True: 0, False: 0] ------------------ 1589| 0| match->base + match->offset <= r2.i) ------------------ | Branch (1589:13): [True: 0, False: 0] ------------------ 1590| 0| { 1591| 0| r4.i++; 1592| 0| } 1593| | 1594| 0| if (match->base + match->offset > r2.i) ------------------ | Branch (1594:13): [True: 0, False: 0] ------------------ 1595| 0| break; 1596| | 1597| 0| match = match->next; 1598| 0| } 1599| | 1600| 0| push(r4); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1601| 0| break; 1602| | 1603| 0| case OP_OFFSET: ------------------ | | 73| 0|#define OP_OFFSET 25 ------------------ | Branch (1603:5): [True: 0, False: 166k] ------------------ 1604| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_OFFSET: // %s()\n", __FUNCTION__); 1605| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1605:7): [True: 0, False: 0] | Branch (1605:7): [True: 0, False: 0] ------------------ 1606| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1606:7): [True: 0, False: 0] | Branch (1606:7): [True: 0, False: 0] ------------------ 1607| | 1608| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1609| | 1610| 0|#if YR_PARANOID_EXEC 1611| 0| ensure_within_rules_arena(r2.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1612| 0|#endif 1613| | 1614| 0| match = context->matches[r2.s->idx].head; 1615| | 1616| 0| i = 1; 1617| 0| r3.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1618| | 1619| 0| while (match != NULL && r3.i == YR_UNDEFINED) ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ | Branch (1619:14): [True: 0, False: 0] | Branch (1619:31): [True: 0, False: 0] ------------------ 1620| 0| { 1621| 0| if (r1.i == i) ------------------ | Branch (1621:13): [True: 0, False: 0] ------------------ 1622| 0| r3.i = match->base + match->offset; 1623| | 1624| 0| i++; 1625| 0| match = match->next; 1626| 0| } 1627| | 1628| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1629| 0| break; 1630| | 1631| 0| case OP_LENGTH: ------------------ | | 69| 0|#define OP_LENGTH 21 ------------------ | Branch (1631:5): [True: 0, False: 166k] ------------------ 1632| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_LENGTH: // %s()\n", __FUNCTION__); 1633| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1633:7): [True: 0, False: 0] | Branch (1633:7): [True: 0, False: 0] ------------------ 1634| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1634:7): [True: 0, False: 0] | Branch (1634:7): [True: 0, False: 0] ------------------ 1635| | 1636| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 1637| | 1638| 0|#if YR_PARANOID_EXEC 1639| 0| ensure_within_rules_arena(r2.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1640| 0|#endif 1641| | 1642| 0| match = context->matches[r2.s->idx].head; 1643| | 1644| 0| i = 1; 1645| 0| r3.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1646| | 1647| 0| while (match != NULL && r3.i == YR_UNDEFINED) ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ | Branch (1647:14): [True: 0, False: 0] | Branch (1647:31): [True: 0, False: 0] ------------------ 1648| 0| { 1649| 0| if (r1.i == i) ------------------ | Branch (1649:13): [True: 0, False: 0] ------------------ 1650| 0| r3.i = match->match_length; 1651| | 1652| 0| i++; 1653| 0| match = match->next; 1654| 0| } 1655| | 1656| 0| push(r3); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1657| 0| break; 1658| | 1659| 0| case OP_OF: ------------------ | | 74| 0|#define OP_OF 26 ------------------ | Branch (1659:5): [True: 0, False: 166k] ------------------ 1660| 0| case OP_OF_PERCENT: ------------------ | | 122| 0|#define OP_OF_PERCENT 74 ------------------ | Branch (1660:5): [True: 0, False: 166k] ------------------ 1661| 0| r2.i = yr_unaligned_u64(ip); 1662| 0| ip += sizeof(uint64_t); 1663| 0| assert(r2.i == OF_STRING_SET || r2.i == OF_RULE_SET); ------------------ | Branch (1663:7): [True: 0, False: 0] | Branch (1663:7): [True: 0, False: 0] | Branch (1663:7): [True: 0, False: 0] | Branch (1663:7): [True: 0, False: 0] ------------------ 1664| 0| found = 0; 1665| 0| count = 0; 1666| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1666:7): [True: 0, False: 0] | Branch (1666:7): [True: 0, False: 0] ------------------ 1667| | 1668| 0| while (!is_undef(r1)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (1668:14): [True: 0, False: 0] ------------------ 1669| 0| { 1670| 0| if (r2.i == OF_STRING_SET) ------------------ | | 42| 0|#define OF_STRING_SET 0 ------------------ | Branch (1670:13): [True: 0, False: 0] ------------------ 1671| 0| { 1672| 0| if (context->matches[r1.s->idx].tail != NULL) ------------------ | Branch (1672:15): [True: 0, False: 0] ------------------ 1673| 0| { 1674| 0| found++; 1675| 0| } 1676| 0| } 1677| 0| else 1678| 0| { 1679| | // r1.i is 1 if the rule has already matched and zero otherwise. 1680| 0| found += r1.i; 1681| 0| } 1682| 0| count++; 1683| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1683:9): [True: 0, False: 0] | Branch (1683:9): [True: 0, False: 0] ------------------ 1684| 0| } 1685| | 1686| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1686:7): [True: 0, False: 0] | Branch (1686:7): [True: 0, False: 0] ------------------ 1687| | 1688| 0| if (opcode == OP_OF) ------------------ | | 74| 0|#define OP_OF 26 ------------------ | Branch (1688:11): [True: 0, False: 0] ------------------ 1689| 0| { 1690| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_OF: // %s()\n", __FUNCTION__); 1691| | 1692| | // Quantifier is "all" 1693| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1694| 0| { 1695| 0| r1.i = found >= count ? 1 : 0; ------------------ | Branch (1695:18): [True: 0, False: 0] ------------------ 1696| 0| } 1697| | // Quantifier is 0 or none. This is a special case in which we want 1698| | // exactly 0 strings matching. More information at: 1699| | // https://github.com/VirusTotal/yara/issues/1695 1700| 0| else if (r2.i == 0) ------------------ | Branch (1700:18): [True: 0, False: 0] ------------------ 1701| 0| { 1702| 0| r1.i = found == 0 ? 1 : 0; ------------------ | Branch (1702:18): [True: 0, False: 0] ------------------ 1703| 0| } 1704| | // In all other cases the number of strings matching should be at 1705| | // least the amount specified by the quantifier. 1706| 0| else 1707| 0| { 1708| 0| r1.i = found >= r2.i ? 1 : 0; ------------------ | Branch (1708:18): [True: 0, False: 0] ------------------ 1709| 0| } 1710| 0| } 1711| 0| else // OP_OF_PERCENT 1712| 0| { 1713| 0| YR_DEBUG_FPRINTF( 1714| 0| 2, stderr, "- case OP_OF_PERCENT: // %s()\n", __FUNCTION__); 1715| | 1716| | // If, by some weird reason, we manage to get an undefined string 1717| | // reference as the first thing on the stack then count would be zero. 1718| | // I don't know how this could ever happen but better to check for it. 1719| 0| if (is_undef(r2) || count == 0) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ | Branch (1719:29): [True: 0, False: 0] ------------------ 1720| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1721| 0| else 1722| 0| r1.i = (((double) found / count) * 100) >= r2.i ? 1 : 0; ------------------ | Branch (1722:18): [True: 0, False: 0] ------------------ 1723| 0| } 1724| | 1725| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1726| 0| break; 1727| | 1728| 0| case OP_OF_FOUND_IN: ------------------ | | 123| 0|#define OP_OF_FOUND_IN 75 ------------------ | Branch (1728:5): [True: 0, False: 166k] ------------------ 1729| 0| YR_DEBUG_FPRINTF( 1730| 0| 2, stderr, "- case OP_OF_FOUND_IN: // %s()\n", __FUNCTION__); 1731| | 1732| 0| found = 0; 1733| 0| count = 0; 1734| | 1735| 0| pop(r2); // Offset range end ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1735:7): [True: 0, False: 0] | Branch (1735:7): [True: 0, False: 0] ------------------ 1736| 0| pop(r1); // Offset range start ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1736:7): [True: 0, False: 0] | Branch (1736:7): [True: 0, False: 0] ------------------ 1737| 0| pop(r3); // First string ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1737:7): [True: 0, False: 0] | Branch (1737:7): [True: 0, False: 0] ------------------ 1738| | 1739| | // If any of the range boundaries are undefined the result is also 1740| | // undefined, be we need to unwind the stack first. 1741| 0| if (is_undef(r1) || is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ if (is_undef(r1) || is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1742| 0| { 1743| | // Remove all the strings. 1744| 0| while (!is_undef(r3)) pop(r3); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ while (!is_undef(r3)) pop(r3); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1744:16): [True: 0, False: 0] | Branch (1744:31): [True: 0, False: 0] | Branch (1744:31): [True: 0, False: 0] ------------------ 1745| | // Remove the quantifier at the bottom of the stack. 1746| 0| pop(r3); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1746:9): [True: 0, False: 0] | Branch (1746:9): [True: 0, False: 0] ------------------ 1747| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1748| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1749| 0| break; 1750| 0| } 1751| | 1752| 0| while (!is_undef(r3)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (1752:14): [True: 0, False: 0] ------------------ 1753| 0| { 1754| 0|#if YR_PARANOID_EXEC 1755| 0| ensure_within_rules_arena(r3.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1756| 0|#endif 1757| 0| match = context->matches[r3.s->idx].head; 1758| | 1759| 0| while (match != NULL) ------------------ | Branch (1759:16): [True: 0, False: 0] ------------------ 1760| 0| { 1761| | // String match within range start and range end? 1762| 0| if (match->base + match->offset >= r1.i && ------------------ | Branch (1762:15): [True: 0, False: 0] ------------------ 1763| 0| match->base + match->offset <= r2.i) ------------------ | Branch (1763:15): [True: 0, False: 0] ------------------ 1764| 0| { 1765| 0| found++; 1766| 0| break; 1767| 0| } 1768| | 1769| | // If current match is past range end, we can stop as matches 1770| | // are sorted by offset in increasing order, so all remaining 1771| | // matches are part the range end too. 1772| 0| if (match->base + match->offset > r1.i) ------------------ | Branch (1772:15): [True: 0, False: 0] ------------------ 1773| 0| break; 1774| | 1775| 0| match = match->next; 1776| 0| } 1777| | 1778| 0| count++; 1779| 0| pop(r3); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1779:9): [True: 0, False: 0] | Branch (1779:9): [True: 0, False: 0] ------------------ 1780| 0| } 1781| | 1782| 0| pop(r2); // Quantifier X in expressions like "X of string_set in range" ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1782:7): [True: 0, False: 0] | Branch (1782:7): [True: 0, False: 0] ------------------ 1783| | 1784| | // Quantifier is "all". 1785| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1786| 0| { 1787| 0| r1.i = found >= count ? 1 : 0; ------------------ | Branch (1787:16): [True: 0, False: 0] ------------------ 1788| 0| } 1789| | // Quantifier is 0 or none. This is a special case in which we want 1790| | // exactly 0 strings matching. More information at: 1791| | // https://github.com/VirusTotal/yara/issues/1695 1792| 0| else if (r2.i == 0) ------------------ | Branch (1792:16): [True: 0, False: 0] ------------------ 1793| 0| { 1794| 0| r1.i = found == 0 ? 1 : 0; ------------------ | Branch (1794:16): [True: 0, False: 0] ------------------ 1795| 0| } 1796| | // In all other cases the number of strings matching should be at least 1797| | // the amount specified by the quantifier. 1798| 0| else 1799| 0| { 1800| 0| r1.i = found >= r2.i ? 1 : 0; ------------------ | Branch (1800:16): [True: 0, False: 0] ------------------ 1801| 0| } 1802| | 1803| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1804| 0| break; 1805| | 1806| 0| case OP_OF_FOUND_AT: ------------------ | | 127| 0|#define OP_OF_FOUND_AT 79 ------------------ | Branch (1806:5): [True: 0, False: 166k] ------------------ 1807| 0| YR_DEBUG_FPRINTF( 1808| 0| 2, stderr, "- case OP_OF_FOUND_AT: // %s()\n", __FUNCTION__); 1809| | 1810| 0| found = 0; 1811| 0| count = 0; 1812| | 1813| 0| pop(r2); // Match location ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1813:7): [True: 0, False: 0] | Branch (1813:7): [True: 0, False: 0] ------------------ 1814| 0| pop(r1); // First string ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1814:7): [True: 0, False: 0] | Branch (1814:7): [True: 0, False: 0] ------------------ 1815| | 1816| | // Match location must be defined. 1817| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1818| 0| { 1819| | // Remove all the strings. 1820| 0| while (!is_undef(r1)) pop(r1); ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ while (!is_undef(r1)) pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1820:16): [True: 0, False: 0] | Branch (1820:31): [True: 0, False: 0] | Branch (1820:31): [True: 0, False: 0] ------------------ 1821| | // Remove the quantifier at the bottom of the stack. 1822| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1822:9): [True: 0, False: 0] | Branch (1822:9): [True: 0, False: 0] ------------------ 1823| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 1824| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1825| 0| break; 1826| 0| } 1827| | 1828| 0| while (!is_undef(r1)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | ------------------ ------------------ | Branch (1828:14): [True: 0, False: 0] ------------------ 1829| 0| { 1830| 0|#if YR_PARANOID_EXEC 1831| 0| ensure_within_rules_arena(r1.p); ------------------ | | 91| 0| { \ | | 92| 0| YR_ARENA_REF ref; \ | | 93| 0| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 0] | | ------------------ | | 94| 0| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 0| } ------------------ 1832| 0|#endif 1833| 0| match = context->matches[r1.s->idx].head; 1834| | 1835| 0| while (match != NULL) ------------------ | Branch (1835:16): [True: 0, False: 0] ------------------ 1836| 0| { 1837| | // String match at the desired location? 1838| 0| if (match->base + match->offset == r2.i) ------------------ | Branch (1838:15): [True: 0, False: 0] ------------------ 1839| 0| { 1840| 0| found++; 1841| 0| break; 1842| 0| } 1843| | 1844| | // If current match is past desired location, we can stop as matches 1845| | // are sorted by offset in increasing order, so all remaining 1846| | // matches are past it. 1847| 0| if (match->base + match->offset > r2.i) ------------------ | Branch (1847:15): [True: 0, False: 0] ------------------ 1848| 0| break; 1849| | 1850| 0| match = match->next; 1851| 0| } 1852| | 1853| 0| count++; 1854| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1854:9): [True: 0, False: 0] | Branch (1854:9): [True: 0, False: 0] ------------------ 1855| 0| } 1856| | 1857| 0| pop(r2); // Quantifier X in expressions like "X of string_set in range" ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1857:7): [True: 0, False: 0] | Branch (1857:7): [True: 0, False: 0] ------------------ 1858| | 1859| | // Quantifier is "all". 1860| 0| if (is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1861| 0| { 1862| 0| r1.i = found >= count ? 1 : 0; ------------------ | Branch (1862:16): [True: 0, False: 0] ------------------ 1863| 0| } 1864| | // Quantifier is 0 or none. This is a special case in which we want 1865| | // exactly 0 strings matching. More information at: 1866| | // https://github.com/VirusTotal/yara/issues/1695 1867| 0| else if (r2.i == 0) ------------------ | Branch (1867:16): [True: 0, False: 0] ------------------ 1868| 0| { 1869| 0| r1.i = found == 0 ? 1 : 0; ------------------ | Branch (1869:16): [True: 0, False: 0] ------------------ 1870| 0| } 1871| | // In all other cases the number of strings matching should be at least 1872| | // the amount specified by the quantifier. 1873| 0| else 1874| 0| { 1875| 0| r1.i = found >= r2.i ? 1 : 0; ------------------ | Branch (1875:16): [True: 0, False: 0] ------------------ 1876| 0| } 1877| | 1878| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1879| 0| break; 1880| | 1881| 14.7k| case OP_FILESIZE: ------------------ | | 85| 14.7k|#define OP_FILESIZE 37 ------------------ | Branch (1881:5): [True: 14.7k, False: 152k] ------------------ 1882| 14.7k| r1.i = context->file_size; 1883| 14.7k| YR_DEBUG_FPRINTF( 1884| 14.7k| 2, 1885| 14.7k| stderr, 1886| 14.7k| "- case OP_FILESIZE: r1.i=%" PRId64 "%s // %s()\n", 1887| 14.7k| r1.i, 1888| 14.7k| r1.i == YR_UNDEFINED ? " AKA YR_UNDEFINED" : "", 1889| 14.7k| __FUNCTION__); 1890| 14.7k| push(r1); ------------------ | | 54| 14.7k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 14.7k, False: 0] | | ------------------ | | 55| 14.7k| { \ | | 56| 14.7k| stack.items[stack.sp++] = (x); \ | | 57| 14.7k| } \ | | 58| 14.7k| else \ | | 59| 14.7k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1891| 14.7k| break; 1892| | 1893| 0| case OP_ENTRYPOINT: ------------------ | | 86| 0|#define OP_ENTRYPOINT 38 ------------------ | Branch (1893:5): [True: 0, False: 166k] ------------------ 1894| 0| YR_DEBUG_FPRINTF( 1895| 0| 2, stderr, "- case OP_ENTRYPOINT: // %s()\n", __FUNCTION__); 1896| 0| r1.i = context->entry_point; 1897| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1898| 0| break; 1899| | 1900| 0| case OP_INT8: ------------------ | | 183| 0|#define OP_INT8 (OP_READ_INT + 0) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1900:5): [True: 0, False: 166k] ------------------ 1901| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT8: // %s()\n", __FUNCTION__); 1902| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1902:7): [True: 0, False: 0] | Branch (1902:7): [True: 0, False: 0] ------------------ 1903| 0| r1.i = read_int8_t_little_endian(context->iterator, (size_t) r1.i); 1904| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1905| 0| break; 1906| | 1907| 0| case OP_INT16: ------------------ | | 184| 0|#define OP_INT16 (OP_READ_INT + 1) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1907:5): [True: 0, False: 166k] ------------------ 1908| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT16: // %s()\n", __FUNCTION__); 1909| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1909:7): [True: 0, False: 0] | Branch (1909:7): [True: 0, False: 0] ------------------ 1910| 0| r1.i = read_int16_t_little_endian(context->iterator, (size_t) r1.i); 1911| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1912| 0| break; 1913| | 1914| 0| case OP_INT32: ------------------ | | 185| 0|#define OP_INT32 (OP_READ_INT + 2) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1914:5): [True: 0, False: 166k] ------------------ 1915| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT32: // %s()\n", __FUNCTION__); 1916| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1916:7): [True: 0, False: 0] | Branch (1916:7): [True: 0, False: 0] ------------------ 1917| 0| r1.i = read_int32_t_little_endian(context->iterator, (size_t) r1.i); 1918| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1919| 0| break; 1920| | 1921| 0| case OP_UINT8: ------------------ | | 186| 0|#define OP_UINT8 (OP_READ_INT + 3) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1921:5): [True: 0, False: 166k] ------------------ 1922| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_UINT8: // %s()\n", __FUNCTION__); 1923| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1923:7): [True: 0, False: 0] | Branch (1923:7): [True: 0, False: 0] ------------------ 1924| 0| r1.i = read_uint8_t_little_endian(context->iterator, (size_t) r1.i); 1925| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1926| 0| break; 1927| | 1928| 0| case OP_UINT16: ------------------ | | 187| 0|#define OP_UINT16 (OP_READ_INT + 4) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1928:5): [True: 0, False: 166k] ------------------ 1929| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_UINT16: // %s()\n", __FUNCTION__); 1930| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1930:7): [True: 0, False: 0] | Branch (1930:7): [True: 0, False: 0] ------------------ 1931| 0| r1.i = read_uint16_t_little_endian(context->iterator, (size_t) r1.i); 1932| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1933| 0| break; 1934| | 1935| 0| case OP_UINT32: ------------------ | | 188| 0|#define OP_UINT32 (OP_READ_INT + 5) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1935:5): [True: 0, False: 166k] ------------------ 1936| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_UINT32: // %s()\n", __FUNCTION__); 1937| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1937:7): [True: 0, False: 0] | Branch (1937:7): [True: 0, False: 0] ------------------ 1938| 0| r1.i = read_uint32_t_little_endian(context->iterator, (size_t) r1.i); 1939| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1940| 0| break; 1941| | 1942| 0| case OP_INT8BE: ------------------ | | 189| 0|#define OP_INT8BE (OP_READ_INT + 6) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1942:5): [True: 0, False: 166k] ------------------ 1943| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT8BE: // %s()\n", __FUNCTION__); 1944| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1944:7): [True: 0, False: 0] | Branch (1944:7): [True: 0, False: 0] ------------------ 1945| 0| r1.i = read_int8_t_big_endian(context->iterator, (size_t) r1.i); 1946| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1947| 0| break; 1948| | 1949| 0| case OP_INT16BE: ------------------ | | 190| 0|#define OP_INT16BE (OP_READ_INT + 7) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1949:5): [True: 0, False: 166k] ------------------ 1950| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT16BE: // %s()\n", __FUNCTION__); 1951| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1951:7): [True: 0, False: 0] | Branch (1951:7): [True: 0, False: 0] ------------------ 1952| 0| r1.i = read_int16_t_big_endian(context->iterator, (size_t) r1.i); 1953| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1954| 0| break; 1955| | 1956| 0| case OP_INT32BE: ------------------ | | 191| 0|#define OP_INT32BE (OP_READ_INT + 8) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1956:5): [True: 0, False: 166k] ------------------ 1957| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT32BE: // %s()\n", __FUNCTION__); 1958| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1958:7): [True: 0, False: 0] | Branch (1958:7): [True: 0, False: 0] ------------------ 1959| 0| r1.i = read_int32_t_big_endian(context->iterator, (size_t) r1.i); 1960| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1961| 0| break; 1962| | 1963| 0| case OP_UINT8BE: ------------------ | | 192| 0|#define OP_UINT8BE (OP_READ_INT + 9) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1963:5): [True: 0, False: 166k] ------------------ 1964| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_UINT8BE: // %s()\n", __FUNCTION__); 1965| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1965:7): [True: 0, False: 0] | Branch (1965:7): [True: 0, False: 0] ------------------ 1966| 0| r1.i = read_uint8_t_big_endian(context->iterator, (size_t) r1.i); 1967| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1968| 0| break; 1969| | 1970| 0| case OP_UINT16BE: ------------------ | | 193| 0|#define OP_UINT16BE (OP_READ_INT + 10) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1970:5): [True: 0, False: 166k] ------------------ 1971| 0| YR_DEBUG_FPRINTF( 1972| 0| 2, stderr, "- case OP_UINT16BE: // %s()\n", __FUNCTION__); 1973| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1973:7): [True: 0, False: 0] | Branch (1973:7): [True: 0, False: 0] ------------------ 1974| 0| r1.i = read_uint16_t_big_endian(context->iterator, (size_t) r1.i); 1975| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1976| 0| break; 1977| | 1978| 0| case OP_UINT32BE: ------------------ | | 194| 0|#define OP_UINT32BE (OP_READ_INT + 11) | | ------------------ | | | | 182| 0|#define OP_READ_INT 240 | | ------------------ ------------------ | Branch (1978:5): [True: 0, False: 166k] ------------------ 1979| 0| YR_DEBUG_FPRINTF( 1980| 0| 2, stderr, "- case OP_UINT32BE: // %s()\n", __FUNCTION__); 1981| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (1981:7): [True: 0, False: 0] | Branch (1981:7): [True: 0, False: 0] ------------------ 1982| 0| r1.i = read_uint32_t_big_endian(context->iterator, (size_t) r1.i); 1983| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 1984| 0| break; 1985| | 1986| 1.70k| case OP_IMPORT: ------------------ | | 89| 1.70k|#define OP_IMPORT 41 ------------------ | Branch (1986:5): [True: 1.70k, False: 165k] ------------------ 1987| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_IMPORT: // %s()\n", __FUNCTION__); 1988| 1.70k| r1.i = yr_unaligned_u64(ip); 1989| 1.70k| ip += sizeof(uint64_t); 1990| | 1991| 1.70k|#if YR_PARANOID_EXEC 1992| 1.70k| ensure_within_rules_arena(r1.p); ------------------ | | 91| 1.70k| { \ | | 92| 1.70k| YR_ARENA_REF ref; \ | | 93| 1.70k| if (yr_arena_ptr_to_ref(context->rules->arena, x, &ref) == 0) \ | | ------------------ | | | Branch (93:9): [True: 0, False: 1.70k] | | ------------------ | | 94| 1.70k| { \ | | 95| 0| stop = true; \ | | 96| 0| result = ERROR_INTERNAL_FATAL_ERROR; \ | | ------------------ | | | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 | | ------------------ | | 97| 0| break; \ | | 98| 0| } \ | | 99| 1.70k| } ------------------ 1993| 1.70k|#endif 1994| | 1995| 1.70k| result = yr_modules_load((char*) r1.p, context); 1996| | 1997| 1.70k| if (result != ERROR_SUCCESS) ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ | Branch (1997:11): [True: 0, False: 1.70k] ------------------ 1998| 0| stop = true; 1999| | 2000| 1.70k| break; 2001| | 2002| 0| case OP_MATCHES: ------------------ | | 88| 0|#define OP_MATCHES 40 ------------------ | Branch (2002:5): [True: 0, False: 166k] ------------------ 2003| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_MATCHES: // %s()\n", __FUNCTION__); 2004| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2004:7): [True: 0, False: 0] | Branch (2004:7): [True: 0, False: 0] ------------------ 2005| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2005:7): [True: 0, False: 0] | Branch (2005:7): [True: 0, False: 0] ------------------ 2006| | 2007| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2008| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2009| | 2010| 0| result = yr_re_exec( 2011| 0| context, 2012| 0| (uint8_t*) r2.re->code, 2013| 0| (uint8_t*) r1.ss->c_string, 2014| 0| r1.ss->length, 2015| 0| 0, 2016| 0| r2.re->flags | RE_FLAGS_SCAN, ------------------ | | 99| 0|#define RE_FLAGS_SCAN 0x40 ------------------ 2017| 0| NULL, 2018| 0| NULL, 2019| 0| &found); 2020| | 2021| 0| if (result != ERROR_SUCCESS) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ | Branch (2021:11): [True: 0, False: 0] ------------------ 2022| 0| stop = true; 2023| | 2024| 0| r1.i = found >= 0; 2025| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2026| 0| break; 2027| | 2028| 10.0k| case OP_INT_TO_DBL: ------------------ | | 59| 10.0k|#define OP_INT_TO_DBL 11 ------------------ | Branch (2028:5): [True: 10.0k, False: 156k] ------------------ 2029| 10.0k| YR_DEBUG_FPRINTF( 2030| 10.0k| 2, stderr, "- case OP_INT_TO_DBL: // %s()\n", __FUNCTION__); 2031| 10.0k| r1.i = yr_unaligned_u64(ip); 2032| 10.0k| ip += sizeof(uint64_t); 2033| | 2034| 10.0k|#if YR_PARANOID_EXEC 2035| 10.0k| if (r1.i > stack.sp || stack.sp - r1.i >= stack.capacity) ------------------ | Branch (2035:11): [True: 0, False: 10.0k] | Branch (2035:30): [True: 0, False: 10.0k] ------------------ 2036| 0| { 2037| 0| stop = true; 2038| 0| result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 2039| 0| break; 2040| 0| } 2041| 10.0k|#endif 2042| | 2043| 10.0k| r2 = stack.items[stack.sp - r1.i]; 2044| | 2045| 10.0k| if (is_undef(r2)) ------------------ | | 71| 10.0k|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 10.0k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 10.0k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 10.0k] | | | | ------------------ | | ------------------ ------------------ 2046| 0| stack.items[stack.sp - r1.i].i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 2047| 10.0k| else 2048| 10.0k| stack.items[stack.sp - r1.i].d = (double) r2.i; 2049| 10.0k| break; 2050| | 2051| 0| case OP_STR_TO_BOOL: ------------------ | | 60| 0|#define OP_STR_TO_BOOL 12 ------------------ | Branch (2051:5): [True: 0, False: 166k] ------------------ 2052| 0| YR_DEBUG_FPRINTF( 2053| 0| 2, stderr, "- case OP_STR_TO_BOOL: // %s()\n", __FUNCTION__); 2054| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2054:7): [True: 0, False: 0] | Branch (2054:7): [True: 0, False: 0] ------------------ 2055| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2056| 0| r1.i = r1.ss->length > 0; 2057| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2058| 0| break; 2059| | 2060| 0| case OP_INT_EQ: ------------------ | | 142| 0|#define OP_INT_EQ (OP_INT_BEGIN + _OP_EQ) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_EQ (OP_INT_BEGIN + _OP_EQ) | | ------------------ | | | | 129| 0|#define _OP_EQ 0 | | ------------------ ------------------ | Branch (2060:5): [True: 0, False: 166k] ------------------ 2061| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_EQ: // %s()\n", __FUNCTION__); 2062| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2062:7): [True: 0, False: 0] | Branch (2062:7): [True: 0, False: 0] ------------------ 2063| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2063:7): [True: 0, False: 0] | Branch (2063:7): [True: 0, False: 0] ------------------ 2064| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2065| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2066| 0| r1.i = r1.i == r2.i; 2067| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2068| 0| break; 2069| | 2070| 0| case OP_INT_NEQ: ------------------ | | 143| 0|#define OP_INT_NEQ (OP_INT_BEGIN + _OP_NEQ) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_NEQ (OP_INT_BEGIN + _OP_NEQ) | | ------------------ | | | | 130| 0|#define _OP_NEQ 1 | | ------------------ ------------------ | Branch (2070:5): [True: 0, False: 166k] ------------------ 2071| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_NEQ: // %s()\n", __FUNCTION__); 2072| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2072:7): [True: 0, False: 0] | Branch (2072:7): [True: 0, False: 0] ------------------ 2073| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2073:7): [True: 0, False: 0] | Branch (2073:7): [True: 0, False: 0] ------------------ 2074| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2075| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2076| 0| r1.i = r1.i != r2.i; 2077| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2078| 0| break; 2079| | 2080| 0| case OP_INT_LT: ------------------ | | 144| 0|#define OP_INT_LT (OP_INT_BEGIN + _OP_LT) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_LT (OP_INT_BEGIN + _OP_LT) | | ------------------ | | | | 131| 0|#define _OP_LT 2 | | ------------------ ------------------ | Branch (2080:5): [True: 0, False: 166k] ------------------ 2081| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_LT: // %s()\n", __FUNCTION__); 2082| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2082:7): [True: 0, False: 0] | Branch (2082:7): [True: 0, False: 0] ------------------ 2083| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2083:7): [True: 0, False: 0] | Branch (2083:7): [True: 0, False: 0] ------------------ 2084| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2085| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2086| 0| r1.i = r1.i < r2.i; 2087| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2088| 0| break; 2089| | 2090| 0| case OP_INT_GT: ------------------ | | 145| 0|#define OP_INT_GT (OP_INT_BEGIN + _OP_GT) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_GT (OP_INT_BEGIN + _OP_GT) | | ------------------ | | | | 132| 0|#define _OP_GT 3 | | ------------------ ------------------ | Branch (2090:5): [True: 0, False: 166k] ------------------ 2091| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_GT: // %s()\n", __FUNCTION__); 2092| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2092:7): [True: 0, False: 0] | Branch (2092:7): [True: 0, False: 0] ------------------ 2093| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2093:7): [True: 0, False: 0] | Branch (2093:7): [True: 0, False: 0] ------------------ 2094| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2095| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2096| 0| r1.i = r1.i > r2.i; 2097| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2098| 0| break; 2099| | 2100| 0| case OP_INT_LE: ------------------ | | 146| 0|#define OP_INT_LE (OP_INT_BEGIN + _OP_LE) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_LE (OP_INT_BEGIN + _OP_LE) | | ------------------ | | | | 133| 0|#define _OP_LE 4 | | ------------------ ------------------ | Branch (2100:5): [True: 0, False: 166k] ------------------ 2101| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_LE: // %s()\n", __FUNCTION__); 2102| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2102:7): [True: 0, False: 0] | Branch (2102:7): [True: 0, False: 0] ------------------ 2103| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2103:7): [True: 0, False: 0] | Branch (2103:7): [True: 0, False: 0] ------------------ 2104| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2105| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2106| 0| r1.i = r1.i <= r2.i; 2107| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2108| 0| break; 2109| | 2110| 4.77k| case OP_INT_GE: ------------------ | | 147| 4.77k|#define OP_INT_GE (OP_INT_BEGIN + _OP_GE) | | ------------------ | | | | 141| 4.77k|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_GE (OP_INT_BEGIN + _OP_GE) | | ------------------ | | | | 134| 4.77k|#define _OP_GE 5 | | ------------------ ------------------ | Branch (2110:5): [True: 4.77k, False: 162k] ------------------ 2111| 4.77k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_GE: // %s()\n", __FUNCTION__); 2112| 4.77k| pop(r2); ------------------ | | 66| 4.77k| { \ | | 67| 4.77k| assert(stack.sp > 0); \ | | 68| 4.77k| x = stack.items[--stack.sp]; \ | | 69| 4.77k| } ------------------ | Branch (2112:7): [True: 0, False: 4.77k] | Branch (2112:7): [True: 4.77k, False: 0] ------------------ 2113| 4.77k| pop(r1); ------------------ | | 66| 4.77k| { \ | | 67| 4.77k| assert(stack.sp > 0); \ | | 68| 4.77k| x = stack.items[--stack.sp]; \ | | 69| 4.77k| } ------------------ | Branch (2113:7): [True: 0, False: 4.77k] | Branch (2113:7): [True: 4.77k, False: 0] ------------------ 2114| 4.77k| ensure_defined(r2); ------------------ | | 74| 4.77k| if (is_undef(x)) \ | | ------------------ | | | | 71| 4.77k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 4.77k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 4.77k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 4.77k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 4.77k| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2115| 4.77k| ensure_defined(r1); ------------------ | | 74| 4.77k| if (is_undef(x)) \ | | ------------------ | | | | 71| 4.77k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 4.77k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 4.77k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 4.77k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 4.77k| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2116| 4.77k| r1.i = r1.i >= r2.i; 2117| 4.77k| push(r1); ------------------ | | 54| 4.77k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 4.77k, False: 0] | | ------------------ | | 55| 4.77k| { \ | | 56| 4.77k| stack.items[stack.sp++] = (x); \ | | 57| 4.77k| } \ | | 58| 4.77k| else \ | | 59| 4.77k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2118| 4.77k| break; 2119| | 2120| 0| case OP_INT_ADD: ------------------ | | 148| 0|#define OP_INT_ADD (OP_INT_BEGIN + _OP_ADD) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_ADD (OP_INT_BEGIN + _OP_ADD) | | ------------------ | | | | 135| 0|#define _OP_ADD 6 | | ------------------ ------------------ | Branch (2120:5): [True: 0, False: 166k] ------------------ 2121| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_ADD: // %s()\n", __FUNCTION__); 2122| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2122:7): [True: 0, False: 0] | Branch (2122:7): [True: 0, False: 0] ------------------ 2123| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2123:7): [True: 0, False: 0] | Branch (2123:7): [True: 0, False: 0] ------------------ 2124| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2125| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2126| 0| r1.i = r1.i + r2.i; 2127| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2128| 0| break; 2129| | 2130| 0| case OP_INT_SUB: ------------------ | | 149| 0|#define OP_INT_SUB (OP_INT_BEGIN + _OP_SUB) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_SUB (OP_INT_BEGIN + _OP_SUB) | | ------------------ | | | | 136| 0|#define _OP_SUB 7 | | ------------------ ------------------ | Branch (2130:5): [True: 0, False: 166k] ------------------ 2131| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_SUB: // %s()\n", __FUNCTION__); 2132| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2132:7): [True: 0, False: 0] | Branch (2132:7): [True: 0, False: 0] ------------------ 2133| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2133:7): [True: 0, False: 0] | Branch (2133:7): [True: 0, False: 0] ------------------ 2134| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2135| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2136| 0| r1.i = r1.i - r2.i; 2137| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2138| 0| break; 2139| | 2140| 0| case OP_INT_MUL: ------------------ | | 150| 0|#define OP_INT_MUL (OP_INT_BEGIN + _OP_MUL) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_MUL (OP_INT_BEGIN + _OP_MUL) | | ------------------ | | | | 137| 0|#define _OP_MUL 8 | | ------------------ ------------------ | Branch (2140:5): [True: 0, False: 166k] ------------------ 2141| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_MUL: // %s()\n", __FUNCTION__); 2142| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2142:7): [True: 0, False: 0] | Branch (2142:7): [True: 0, False: 0] ------------------ 2143| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2143:7): [True: 0, False: 0] | Branch (2143:7): [True: 0, False: 0] ------------------ 2144| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2145| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2146| 0| r1.i = r1.i * r2.i; 2147| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2148| 0| break; 2149| | 2150| 0| case OP_INT_DIV: ------------------ | | 151| 0|#define OP_INT_DIV (OP_INT_BEGIN + _OP_DIV) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_DIV (OP_INT_BEGIN + _OP_DIV) | | ------------------ | | | | 138| 0|#define _OP_DIV 9 | | ------------------ ------------------ | Branch (2150:5): [True: 0, False: 166k] ------------------ 2151| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_INT_DIV: // %s()\n", __FUNCTION__); 2152| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2152:7): [True: 0, False: 0] | Branch (2152:7): [True: 0, False: 0] ------------------ 2153| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2153:7): [True: 0, False: 0] | Branch (2153:7): [True: 0, False: 0] ------------------ 2154| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2155| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2156| | // If divisor is zero the result is undefined. It's also undefined 2157| | // when dividing INT64_MIN by -1. 2158| 0| if (r2.i == 0 || (r1.i == INT64_MIN && r2.i == -1)) ------------------ | Branch (2158:11): [True: 0, False: 0] | Branch (2158:25): [True: 0, False: 0] | Branch (2158:46): [True: 0, False: 0] ------------------ 2159| 0| r1.i = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 2160| 0| else 2161| 0| r1.i = r1.i / r2.i; 2162| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2163| 0| break; 2164| | 2165| 0| case OP_INT_MINUS: ------------------ | | 152| 0|#define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS) | | ------------------ | | | | 139| 0|#define _OP_MINUS 10 | | ------------------ ------------------ | Branch (2165:5): [True: 0, False: 166k] ------------------ 2166| 0| YR_DEBUG_FPRINTF( 2167| 0| 2, stderr, "- case OP_INT_MINUS: // %s()\n", __FUNCTION__); 2168| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2168:7): [True: 0, False: 0] | Branch (2168:7): [True: 0, False: 0] ------------------ 2169| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2170| 0| r1.i = -r1.i; 2171| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2172| 0| break; 2173| | 2174| 0| case OP_DBL_LT: ------------------ | | 158| 0|#define OP_DBL_LT (OP_DBL_BEGIN + _OP_LT) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_LT (OP_DBL_BEGIN + _OP_LT) | | ------------------ | | | | 131| 0|#define _OP_LT 2 | | ------------------ ------------------ | Branch (2174:5): [True: 0, False: 166k] ------------------ 2175| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_LT: // %s()\n", __FUNCTION__); 2176| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2176:7): [True: 0, False: 0] | Branch (2176:7): [True: 0, False: 0] ------------------ 2177| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2177:7): [True: 0, False: 0] | Branch (2177:7): [True: 0, False: 0] ------------------ 2178| 0| if (is_undef(r1) || is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ if (is_undef(r1) || is_undef(r2)) ------------------ | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 2179| 0| r1.i = false; 2180| 0| else 2181| 0| r1.i = r1.d < r2.d; 2182| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2183| 0| break; 2184| | 2185| 0| case OP_DBL_GT: ------------------ | | 159| 0|#define OP_DBL_GT (OP_DBL_BEGIN + _OP_GT) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_GT (OP_DBL_BEGIN + _OP_GT) | | ------------------ | | | | 132| 0|#define _OP_GT 3 | | ------------------ ------------------ | Branch (2185:5): [True: 0, False: 166k] ------------------ 2186| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_GT: // %s()\n", __FUNCTION__); 2187| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2187:7): [True: 0, False: 0] | Branch (2187:7): [True: 0, False: 0] ------------------ 2188| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2188:7): [True: 0, False: 0] | Branch (2188:7): [True: 0, False: 0] ------------------ 2189| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2190| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2191| 0| r1.i = r1.d > r2.d; 2192| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2193| 0| break; 2194| | 2195| 0| case OP_DBL_LE: ------------------ | | 160| 0|#define OP_DBL_LE (OP_DBL_BEGIN + _OP_LE) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_LE (OP_DBL_BEGIN + _OP_LE) | | ------------------ | | | | 133| 0|#define _OP_LE 4 | | ------------------ ------------------ | Branch (2195:5): [True: 0, False: 166k] ------------------ 2196| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_LE: // %s()\n", __FUNCTION__); 2197| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2197:7): [True: 0, False: 0] | Branch (2197:7): [True: 0, False: 0] ------------------ 2198| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2198:7): [True: 0, False: 0] | Branch (2198:7): [True: 0, False: 0] ------------------ 2199| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2200| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2201| 0| r1.i = r1.d <= r2.d; 2202| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2203| 0| break; 2204| | 2205| 10.0k| case OP_DBL_GE: ------------------ | | 161| 10.0k|#define OP_DBL_GE (OP_DBL_BEGIN + _OP_GE) | | ------------------ | | | | 155| 10.0k|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_GE (OP_DBL_BEGIN + _OP_GE) | | ------------------ | | | | 134| 10.0k|#define _OP_GE 5 | | ------------------ ------------------ | Branch (2205:5): [True: 10.0k, False: 156k] ------------------ 2206| 10.0k| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_GE: // %s()\n", __FUNCTION__); 2207| 10.0k| pop(r2); ------------------ | | 66| 10.0k| { \ | | 67| 10.0k| assert(stack.sp > 0); \ | | 68| 10.0k| x = stack.items[--stack.sp]; \ | | 69| 10.0k| } ------------------ | Branch (2207:7): [True: 0, False: 10.0k] | Branch (2207:7): [True: 10.0k, False: 0] ------------------ 2208| 10.0k| pop(r1); ------------------ | | 66| 10.0k| { \ | | 67| 10.0k| assert(stack.sp > 0); \ | | 68| 10.0k| x = stack.items[--stack.sp]; \ | | 69| 10.0k| } ------------------ | Branch (2208:7): [True: 0, False: 10.0k] | Branch (2208:7): [True: 10.0k, False: 0] ------------------ 2209| 10.0k| ensure_defined(r2); ------------------ | | 74| 10.0k| if (is_undef(x)) \ | | ------------------ | | | | 71| 10.0k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 10.0k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 10.0k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 10.0k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 10.0k| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2210| 10.0k| ensure_defined(r1); ------------------ | | 74| 10.0k| if (is_undef(x)) \ | | ------------------ | | | | 71| 10.0k|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 10.0k|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 10.0k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 4, False: 10.0k] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 10.0k| { \ | | 76| 4| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 4|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 4| push(r1); \ | | ------------------ | | | | 54| 4| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 4, False: 0] | | | | ------------------ | | | | 55| 4| { \ | | | | 56| 4| stack.items[stack.sp++] = (x); \ | | | | 57| 4| } \ | | | | 58| 4| else \ | | | | 59| 4| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 4| break; \ | | 79| 4| } ------------------ 2211| 10.0k| r1.i = r1.d >= r2.d; 2212| 10.0k| push(r1); ------------------ | | 54| 10.0k| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 10.0k, False: 0] | | ------------------ | | 55| 10.0k| { \ | | 56| 10.0k| stack.items[stack.sp++] = (x); \ | | 57| 10.0k| } \ | | 58| 10.0k| else \ | | 59| 10.0k| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2213| 10.0k| break; 2214| | 2215| 0| case OP_DBL_EQ: ------------------ | | 156| 0|#define OP_DBL_EQ (OP_DBL_BEGIN + _OP_EQ) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_EQ (OP_DBL_BEGIN + _OP_EQ) | | ------------------ | | | | 129| 0|#define _OP_EQ 0 | | ------------------ ------------------ | Branch (2215:5): [True: 0, False: 166k] ------------------ 2216| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_EQ: // %s()\n", __FUNCTION__); 2217| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2217:7): [True: 0, False: 0] | Branch (2217:7): [True: 0, False: 0] ------------------ 2218| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2218:7): [True: 0, False: 0] | Branch (2218:7): [True: 0, False: 0] ------------------ 2219| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2220| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2221| 0| r1.i = fabs(r1.d - r2.d) < DBL_EPSILON; 2222| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2223| 0| break; 2224| | 2225| 0| case OP_DBL_NEQ: ------------------ | | 157| 0|#define OP_DBL_NEQ (OP_DBL_BEGIN + _OP_NEQ) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_NEQ (OP_DBL_BEGIN + _OP_NEQ) | | ------------------ | | | | 130| 0|#define _OP_NEQ 1 | | ------------------ ------------------ | Branch (2225:5): [True: 0, False: 166k] ------------------ 2226| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_NEQ: // %s()\n", __FUNCTION__); 2227| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2227:7): [True: 0, False: 0] | Branch (2227:7): [True: 0, False: 0] ------------------ 2228| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2228:7): [True: 0, False: 0] | Branch (2228:7): [True: 0, False: 0] ------------------ 2229| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2230| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2231| 0| r1.i = fabs(r1.d - r2.d) >= DBL_EPSILON; 2232| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2233| 0| break; 2234| | 2235| 0| case OP_DBL_ADD: ------------------ | | 162| 0|#define OP_DBL_ADD (OP_DBL_BEGIN + _OP_ADD) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_ADD (OP_DBL_BEGIN + _OP_ADD) | | ------------------ | | | | 135| 0|#define _OP_ADD 6 | | ------------------ ------------------ | Branch (2235:5): [True: 0, False: 166k] ------------------ 2236| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_ADD: // %s()\n", __FUNCTION__); 2237| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2237:7): [True: 0, False: 0] | Branch (2237:7): [True: 0, False: 0] ------------------ 2238| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2238:7): [True: 0, False: 0] | Branch (2238:7): [True: 0, False: 0] ------------------ 2239| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2240| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2241| 0| r1.d = r1.d + r2.d; 2242| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2243| 0| break; 2244| | 2245| 0| case OP_DBL_SUB: ------------------ | | 163| 0|#define OP_DBL_SUB (OP_DBL_BEGIN + _OP_SUB) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_SUB (OP_DBL_BEGIN + _OP_SUB) | | ------------------ | | | | 136| 0|#define _OP_SUB 7 | | ------------------ ------------------ | Branch (2245:5): [True: 0, False: 166k] ------------------ 2246| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_SUB: // %s()\n", __FUNCTION__); 2247| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2247:7): [True: 0, False: 0] | Branch (2247:7): [True: 0, False: 0] ------------------ 2248| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2248:7): [True: 0, False: 0] | Branch (2248:7): [True: 0, False: 0] ------------------ 2249| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2250| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2251| 0| r1.d = r1.d - r2.d; 2252| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2253| 0| break; 2254| | 2255| 0| case OP_DBL_MUL: ------------------ | | 164| 0|#define OP_DBL_MUL (OP_DBL_BEGIN + _OP_MUL) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_MUL (OP_DBL_BEGIN + _OP_MUL) | | ------------------ | | | | 137| 0|#define _OP_MUL 8 | | ------------------ ------------------ | Branch (2255:5): [True: 0, False: 166k] ------------------ 2256| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_MUL: // %s()\n", __FUNCTION__); 2257| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2257:7): [True: 0, False: 0] | Branch (2257:7): [True: 0, False: 0] ------------------ 2258| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2258:7): [True: 0, False: 0] | Branch (2258:7): [True: 0, False: 0] ------------------ 2259| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2260| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2261| 0| r1.d = r1.d * r2.d; 2262| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2263| 0| break; 2264| | 2265| 0| case OP_DBL_DIV: ------------------ | | 165| 0|#define OP_DBL_DIV (OP_DBL_BEGIN + _OP_DIV) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_DIV (OP_DBL_BEGIN + _OP_DIV) | | ------------------ | | | | 138| 0|#define _OP_DIV 9 | | ------------------ ------------------ | Branch (2265:5): [True: 0, False: 166k] ------------------ 2266| 0| YR_DEBUG_FPRINTF(2, stderr, "- case OP_DBL_DIV: // %s()\n", __FUNCTION__); 2267| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2267:7): [True: 0, False: 0] | Branch (2267:7): [True: 0, False: 0] ------------------ 2268| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2268:7): [True: 0, False: 0] | Branch (2268:7): [True: 0, False: 0] ------------------ 2269| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2270| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2271| 0| r1.d = r1.d / r2.d; 2272| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2273| 0| break; 2274| | 2275| 0| case OP_DBL_MINUS: ------------------ | | 166| 0|#define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS) | | ------------------ | | | | 139| 0|#define _OP_MINUS 10 | | ------------------ ------------------ | Branch (2275:5): [True: 0, False: 166k] ------------------ 2276| 0| YR_DEBUG_FPRINTF( 2277| 0| 2, stderr, "- case OP_DBL_MINUS: // %s()\n", __FUNCTION__); 2278| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2278:7): [True: 0, False: 0] | Branch (2278:7): [True: 0, False: 0] ------------------ 2279| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2280| 0| r1.d = -r1.d; 2281| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2282| 0| break; 2283| | 2284| 0| case OP_STR_EQ: ------------------ | | 170| 0|#define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ) | | ------------------ | | | | 129| 0|#define _OP_EQ 0 | | ------------------ ------------------ | Branch (2284:5): [True: 0, False: 166k] ------------------ 2285| 0| case OP_STR_NEQ: ------------------ | | 171| 0|#define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ) | | ------------------ | | | | 130| 0|#define _OP_NEQ 1 | | ------------------ ------------------ | Branch (2285:5): [True: 0, False: 166k] ------------------ 2286| 0| case OP_STR_LT: ------------------ | | 172| 0|#define OP_STR_LT (OP_STR_BEGIN + _OP_LT) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_LT (OP_STR_BEGIN + _OP_LT) | | ------------------ | | | | 131| 0|#define _OP_LT 2 | | ------------------ ------------------ | Branch (2286:5): [True: 0, False: 166k] ------------------ 2287| 0| case OP_STR_LE: ------------------ | | 174| 0|#define OP_STR_LE (OP_STR_BEGIN + _OP_LE) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_LE (OP_STR_BEGIN + _OP_LE) | | ------------------ | | | | 133| 0|#define _OP_LE 4 | | ------------------ ------------------ | Branch (2287:5): [True: 0, False: 166k] ------------------ 2288| 0| case OP_STR_GT: ------------------ | | 173| 0|#define OP_STR_GT (OP_STR_BEGIN + _OP_GT) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_GT (OP_STR_BEGIN + _OP_GT) | | ------------------ | | | | 132| 0|#define _OP_GT 3 | | ------------------ ------------------ | Branch (2288:5): [True: 0, False: 166k] ------------------ 2289| 0| case OP_STR_GE: ------------------ | | 175| 0|#define OP_STR_GE (OP_STR_BEGIN + _OP_GE) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_GE (OP_STR_BEGIN + _OP_GE) | | ------------------ | | | | 134| 0|#define _OP_GE 5 | | ------------------ ------------------ | Branch (2289:5): [True: 0, False: 166k] ------------------ 2290| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2290:7): [True: 0, False: 0] | Branch (2290:7): [True: 0, False: 0] ------------------ 2291| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2291:7): [True: 0, False: 0] | Branch (2291:7): [True: 0, False: 0] ------------------ 2292| | 2293| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2294| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2295| | 2296| 0| switch (opcode) ------------------ | Branch (2296:15): [True: 0, False: 0] ------------------ 2297| 0| { 2298| 0| case OP_STR_EQ: ------------------ | | 170| 0|#define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ) | | ------------------ | | | | 129| 0|#define _OP_EQ 0 | | ------------------ ------------------ | Branch (2298:7): [True: 0, False: 0] ------------------ 2299| 0| YR_DEBUG_FPRINTF( 2300| 0| 2, stderr, "- case OP_STR_EQ: // %s()\n", __FUNCTION__); 2301| 0| r1.i = (ss_compare(r1.ss, r2.ss) == 0); 2302| 0| break; 2303| 0| case OP_STR_NEQ: ------------------ | | 171| 0|#define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ) | | ------------------ | | | | 130| 0|#define _OP_NEQ 1 | | ------------------ ------------------ | Branch (2303:7): [True: 0, False: 0] ------------------ 2304| 0| YR_DEBUG_FPRINTF( 2305| 0| 2, stderr, "- case OP_STR_NEQ: // %s()\n", __FUNCTION__); 2306| 0| r1.i = (ss_compare(r1.ss, r2.ss) != 0); 2307| 0| break; 2308| 0| case OP_STR_LT: ------------------ | | 172| 0|#define OP_STR_LT (OP_STR_BEGIN + _OP_LT) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_LT (OP_STR_BEGIN + _OP_LT) | | ------------------ | | | | 131| 0|#define _OP_LT 2 | | ------------------ ------------------ | Branch (2308:7): [True: 0, False: 0] ------------------ 2309| 0| YR_DEBUG_FPRINTF( 2310| 0| 2, stderr, "- case OP_STR_LT: // %s()\n", __FUNCTION__); 2311| 0| r1.i = (ss_compare(r1.ss, r2.ss) < 0); 2312| 0| break; 2313| 0| case OP_STR_LE: ------------------ | | 174| 0|#define OP_STR_LE (OP_STR_BEGIN + _OP_LE) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_LE (OP_STR_BEGIN + _OP_LE) | | ------------------ | | | | 133| 0|#define _OP_LE 4 | | ------------------ ------------------ | Branch (2313:7): [True: 0, False: 0] ------------------ 2314| 0| YR_DEBUG_FPRINTF( 2315| 0| 2, stderr, "- case OP_STR_LE: // %s()\n", __FUNCTION__); 2316| 0| r1.i = (ss_compare(r1.ss, r2.ss) <= 0); 2317| 0| break; 2318| 0| case OP_STR_GT: ------------------ | | 173| 0|#define OP_STR_GT (OP_STR_BEGIN + _OP_GT) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_GT (OP_STR_BEGIN + _OP_GT) | | ------------------ | | | | 132| 0|#define _OP_GT 3 | | ------------------ ------------------ | Branch (2318:7): [True: 0, False: 0] ------------------ 2319| 0| YR_DEBUG_FPRINTF( 2320| 0| 2, stderr, "- case OP_STR_GT: // %s()\n", __FUNCTION__); 2321| 0| r1.i = (ss_compare(r1.ss, r2.ss) > 0); 2322| 0| break; 2323| 0| case OP_STR_GE: ------------------ | | 175| 0|#define OP_STR_GE (OP_STR_BEGIN + _OP_GE) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define OP_STR_GE (OP_STR_BEGIN + _OP_GE) | | ------------------ | | | | 134| 0|#define _OP_GE 5 | | ------------------ ------------------ | Branch (2323:7): [True: 0, False: 0] ------------------ 2324| 0| YR_DEBUG_FPRINTF( 2325| 0| 2, stderr, "- case OP_STR_GE: // %s()\n", __FUNCTION__); 2326| 0| r1.i = (ss_compare(r1.ss, r2.ss) >= 0); 2327| 0| break; 2328| 0| } 2329| | 2330| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2331| 0| break; 2332| | 2333| 0| case OP_CONTAINS: ------------------ | | 115| 0|#define OP_CONTAINS 67 ------------------ | Branch (2333:5): [True: 0, False: 166k] ------------------ 2334| 0| case OP_ICONTAINS: ------------------ | | 118| 0|#define OP_ICONTAINS 70 ------------------ | Branch (2334:5): [True: 0, False: 166k] ------------------ 2335| 0| case OP_STARTSWITH: ------------------ | | 116| 0|#define OP_STARTSWITH 68 ------------------ | Branch (2335:5): [True: 0, False: 166k] ------------------ 2336| 0| case OP_ISTARTSWITH: ------------------ | | 119| 0|#define OP_ISTARTSWITH 71 ------------------ | Branch (2336:5): [True: 0, False: 166k] ------------------ 2337| 0| case OP_ENDSWITH: ------------------ | | 117| 0|#define OP_ENDSWITH 69 ------------------ | Branch (2337:5): [True: 0, False: 166k] ------------------ 2338| 0| case OP_IENDSWITH: ------------------ | | 120| 0|#define OP_IENDSWITH 72 ------------------ | Branch (2338:5): [True: 0, False: 166k] ------------------ 2339| 0| case OP_IEQUALS: ------------------ | | 121| 0|#define OP_IEQUALS 73 ------------------ | Branch (2339:5): [True: 0, False: 166k] ------------------ 2340| 0| pop(r2); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2340:7): [True: 0, False: 0] | Branch (2340:7): [True: 0, False: 0] ------------------ 2341| 0| pop(r1); ------------------ | | 66| 0| { \ | | 67| 0| assert(stack.sp > 0); \ | | 68| 0| x = stack.items[--stack.sp]; \ | | 69| 0| } ------------------ | Branch (2341:7): [True: 0, False: 0] | Branch (2341:7): [True: 0, False: 0] ------------------ 2342| | 2343| 0| ensure_defined(r1); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2344| 0| ensure_defined(r2); ------------------ | | 74| 0| if (is_undef(x)) \ | | ------------------ | | | | 71| 0|#define is_undef(x) IS_UNDEFINED((x).i) | | | | ------------------ | | | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | | | ------------------ | | | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | | | ------------------ | | | | | | | Branch (39:25): [True: 0, False: 0] | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 75| 0| { \ | | 76| 0| r1.i = YR_UNDEFINED; \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | 77| 0| push(r1); \ | | ------------------ | | | | 54| 0| if (stack.sp < stack.capacity) \ | | | | ------------------ | | | | | Branch (54:7): [True: 0, False: 0] | | | | ------------------ | | | | 55| 0| { \ | | | | 56| 0| stack.items[stack.sp++] = (x); \ | | | | 57| 0| } \ | | | | 58| 0| else \ | | | | 59| 0| { \ | | | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | | | ------------------ | | | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | | | ------------------ | | | | 61| 0| stop = true; \ | | | | 62| 0| break; \ | | | | 63| 0| } | | ------------------ | | 78| 0| break; \ | | 79| 0| } ------------------ 2345| | 2346| 0| switch (opcode) ------------------ | Branch (2346:15): [True: 0, False: 0] ------------------ 2347| 0| { 2348| 0| case OP_CONTAINS: ------------------ | | 115| 0|#define OP_CONTAINS 67 ------------------ | Branch (2348:7): [True: 0, False: 0] ------------------ 2349| 0| YR_DEBUG_FPRINTF( 2350| 0| 2, stderr, "- case OP_CONTAINS: // %s()\n", __FUNCTION__); 2351| 0| r1.i = ss_contains(r1.ss, r2.ss); 2352| 0| break; 2353| 0| case OP_ICONTAINS: ------------------ | | 118| 0|#define OP_ICONTAINS 70 ------------------ | Branch (2353:7): [True: 0, False: 0] ------------------ 2354| 0| YR_DEBUG_FPRINTF( 2355| 0| 2, stderr, "- case OP_ICONTAINS: // %s()\n", __FUNCTION__); 2356| 0| r1.i = ss_icontains(r1.ss, r2.ss); 2357| 0| break; 2358| 0| case OP_STARTSWITH: ------------------ | | 116| 0|#define OP_STARTSWITH 68 ------------------ | Branch (2358:7): [True: 0, False: 0] ------------------ 2359| 0| YR_DEBUG_FPRINTF( 2360| 0| 2, stderr, "- case OP_STARTSWITH: // %s()\n", __FUNCTION__); 2361| 0| r1.i = ss_startswith(r1.ss, r2.ss); 2362| 0| break; 2363| 0| case OP_ISTARTSWITH: ------------------ | | 119| 0|#define OP_ISTARTSWITH 71 ------------------ | Branch (2363:7): [True: 0, False: 0] ------------------ 2364| 0| YR_DEBUG_FPRINTF( 2365| 0| 2, stderr, "- case OP_ISTARTSWITH: // %s()\n", __FUNCTION__); 2366| 0| r1.i = ss_istartswith(r1.ss, r2.ss); 2367| 0| break; 2368| 0| case OP_ENDSWITH: ------------------ | | 117| 0|#define OP_ENDSWITH 69 ------------------ | Branch (2368:7): [True: 0, False: 0] ------------------ 2369| 0| YR_DEBUG_FPRINTF( 2370| 0| 2, stderr, "- case OP_ENDSWITH: // %s()\n", __FUNCTION__); 2371| 0| r1.i = ss_endswith(r1.ss, r2.ss); 2372| 0| break; 2373| 0| case OP_IENDSWITH: ------------------ | | 120| 0|#define OP_IENDSWITH 72 ------------------ | Branch (2373:7): [True: 0, False: 0] ------------------ 2374| 0| YR_DEBUG_FPRINTF( 2375| 0| 2, stderr, "- case OP_IENDSWITH: // %s()\n", __FUNCTION__); 2376| 0| r1.i = ss_iendswith(r1.ss, r2.ss); 2377| 0| break; 2378| 0| case OP_IEQUALS: ------------------ | | 121| 0|#define OP_IEQUALS 73 ------------------ | Branch (2378:7): [True: 0, False: 0] ------------------ 2379| 0| YR_DEBUG_FPRINTF( 2380| 0| 2, stderr, "- case OP_IEQUALS: // %s()\n", __FUNCTION__); 2381| 0| r1.i = ss_icompare(r1.ss, r2.ss) == 0; 2382| 0| break; 2383| 0| } 2384| | 2385| 0| push(r1); ------------------ | | 54| 0| if (stack.sp < stack.capacity) \ | | ------------------ | | | Branch (54:7): [True: 0, False: 0] | | ------------------ | | 55| 0| { \ | | 56| 0| stack.items[stack.sp++] = (x); \ | | 57| 0| } \ | | 58| 0| else \ | | 59| 0| { \ | | 60| 0| result = ERROR_EXEC_STACK_OVERFLOW; \ | | ------------------ | | | | 70| 0|#define ERROR_EXEC_STACK_OVERFLOW 25 | | ------------------ | | 61| 0| stop = true; \ | | 62| 0| break; \ | | 63| 0| } ------------------ 2386| 0| break; 2387| | 2388| 0| default: ------------------ | Branch (2388:5): [True: 0, False: 166k] ------------------ 2389| 0| YR_DEBUG_FPRINTF( 2390| 0| 2, stderr, "- case : // %s()\n", __FUNCTION__); 2391| | // Unknown instruction, this shouldn't happen. 2392| 0| assert(false); ------------------ | Branch (2392:7): [Folded, False: 0] | Branch (2392:7): [Folded, False: 0] ------------------ 2393| 166k| } 2394| | 2395| | // Check for timeout every 100 instruction cycles. If timeout == 0 it means 2396| | // no timeout at all. 2397| | 2398| 166k| if (context->timeout > 0ULL && ++cycle == 100) ------------------ | Branch (2398:9): [True: 0, False: 166k] | Branch (2398:36): [True: 0, False: 0] ------------------ 2399| 0| { 2400| 0| elapsed_time = yr_stopwatch_elapsed_ns(&context->stopwatch); 2401| | 2402| 0| if (elapsed_time > context->timeout) ------------------ | Branch (2402:11): [True: 0, False: 0] ------------------ 2403| 0| { 2404| |#ifdef YR_PROFILING_ENABLED 2405| | context->profiling_info[current_rule_idx].exec_time += 2406| | (elapsed_time - start_time); 2407| |#endif 2408| 0| result = ERROR_SCAN_TIMEOUT; ------------------ | | 71| 0|#define ERROR_SCAN_TIMEOUT 26 ------------------ 2409| 0| stop = true; 2410| 0| } 2411| | 2412| 0| cycle = 0; 2413| 0| } 2414| 166k| } 2415| | 2416| 1.70k| obj_ptr = yr_arena_get_ptr(obj_arena, 0, 0); 2417| | 2418| 16.5k| for (int i = 0; i < obj_count; i++) yr_object_destroy(obj_ptr[i]); ------------------ | Branch (2418:19): [True: 14.7k, False: 1.70k] ------------------ 2419| | 2420| 1.70k| yr_arena_release(obj_arena); 2421| 1.70k| yr_notebook_destroy(it_notebook); 2422| 1.70k| yr_modules_unload_all(context); 2423| 1.70k| yr_free(stack.items); 2424| | 2425| 1.70k| YR_DEBUG_FPRINTF( 2426| 1.70k| 2, 2427| 1.70k| stderr, 2428| 1.70k| "} = %d AKA %s // %s()\n", 2429| 1.70k| result, 2430| 1.70k| yr_debug_error_as_string(result), 2431| 1.70k| __FUNCTION__); 2432| | 2433| 1.70k| return result; 2434| 1.70k|} exec.c:jmp_if: 160| 15.3k|{ 161| 15.3k| int32_t off = 0; 162| | 163| 15.3k| if (condition) ------------------ | Branch (163:7): [True: 566, False: 14.7k] ------------------ 164| 566| { 165| | // The condition is true, the instruction pointer (ip) is incremented in 166| | // the amount specified by the jump's offset, which is a int32_t following 167| | // the jump opcode. The ip is currently past the opcode and pointing to 168| | // the offset. 169| | 170| | // Copy the offset from the instruction stream to a local variable. 171| 566| off = yr_unaligned_u32(ip); 172| | 173| | // The offset is relative to the jump opcode, but now the ip is one byte 174| | // past the opcode, so we need to decrement it by one. 175| 566| off -= 1; 176| 566| } 177| 14.7k| else 178| 14.7k| { 179| | // The condition is false, the execution flow proceeds with the instruction 180| | // right after the jump. 181| 14.7k| off = sizeof(int32_t); 182| 14.7k| } 183| | 184| 15.3k| return ip + off; 185| 15.3k|} yr_get_pe_header: 48| 1.70k|{ 49| 1.70k| PIMAGE_DOS_HEADER mz_header; 50| 1.70k| PIMAGE_NT_HEADERS32 pe_header; 51| | 52| 1.70k| size_t headers_size = 0; 53| | 54| 1.70k| if (buffer_length < sizeof(IMAGE_DOS_HEADER)) ------------------ | Branch (54:7): [True: 491, False: 1.21k] ------------------ 55| 491| return NULL; 56| | 57| 1.21k| mz_header = (PIMAGE_DOS_HEADER) buffer; 58| | 59| 1.21k| if (yr_le16toh(mz_header->e_magic) != IMAGE_DOS_SIGNATURE) ------------------ | | 88| 1.21k|#define yr_le16toh(x) (x) ------------------ if (yr_le16toh(mz_header->e_magic) != IMAGE_DOS_SIGNATURE) ------------------ | | 81| 1.21k|#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ ------------------ | Branch (59:7): [True: 909, False: 307] ------------------ 60| 909| return NULL; 61| | 62| 307| if ((int32_t) yr_le32toh(mz_header->e_lfanew) < 0) ------------------ | | 89| 307|#define yr_le32toh(x) (x) ------------------ | Branch (62:7): [True: 36, False: 271] ------------------ 63| 36| return NULL; 64| | 65| 271| headers_size = yr_le32toh(mz_header->e_lfanew) + ------------------ | | 89| 271|#define yr_le32toh(x) (x) ------------------ 66| 271| sizeof(pe_header->Signature) + sizeof(IMAGE_FILE_HEADER); 67| | 68| 271| if (buffer_length < headers_size) ------------------ | Branch (68:7): [True: 31, False: 240] ------------------ 69| 31| return NULL; 70| | 71| 240| pe_header = (PIMAGE_NT_HEADERS32)(buffer + yr_le32toh(mz_header->e_lfanew)); ------------------ | | 89| 240|#define yr_le32toh(x) (x) ------------------ 72| | 73| 240| headers_size += sizeof(IMAGE_OPTIONAL_HEADER32); 74| | 75| 240| if (yr_le32toh(pe_header->Signature) == IMAGE_NT_SIGNATURE && ------------------ | | 89| 240|#define yr_le32toh(x) (x) ------------------ if (yr_le32toh(pe_header->Signature) == IMAGE_NT_SIGNATURE && ------------------ | | 85| 480|#define IMAGE_NT_SIGNATURE 0x00004550 // PE00 ------------------ | Branch (75:7): [True: 175, False: 65] ------------------ 76| 175| (yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_I386 || ------------------ | | 88| 175|#define yr_le16toh(x) (x) ------------------ (yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_I386 || ------------------ | | 172| 350|#define IMAGE_FILE_MACHINE_I386 0x014c ------------------ | Branch (76:8): [True: 131, False: 44] ------------------ 77| 44| yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_AMD64) && ------------------ | | 88| 44|#define yr_le16toh(x) (x) ------------------ yr_le16toh(pe_header->FileHeader.Machine) == IMAGE_FILE_MACHINE_AMD64) && ------------------ | | 167| 44|#define IMAGE_FILE_MACHINE_AMD64 0x8664 ------------------ | Branch (77:8): [True: 4, False: 40] ------------------ 78| 135| buffer_length > headers_size) ------------------ | Branch (78:7): [True: 125, False: 10] ------------------ 79| 125| { 80| 125| return pe_header; 81| 125| } 82| 115| else 83| 115| { 84| | return NULL; 85| 115| } 86| 240|} yr_pe_rva_to_offset: 92| 125|{ 93| 125| int i = 0; 94| 125| PIMAGE_SECTION_HEADER section; 95| 125| DWORD section_rva; 96| 125| DWORD section_offset; 97| | 98| 125| section = IMAGE_FIRST_SECTION(pe_header); ------------------ | | 369| 125| ((PIMAGE_SECTION_HEADER) ((BYTE*) ntheader + \ | | 370| 125| offsetof(IMAGE_NT_HEADERS32, OptionalHeader) + \ | | 371| 125| yr_le16toh( \ | | ------------------ | | | | 88| 125|#define yr_le16toh(x) (x) | | ------------------ | | 372| 125| ((PIMAGE_NT_HEADERS32) (ntheader)) \ | | 373| 125| ->FileHeader.SizeOfOptionalHeader))) ------------------ 99| 125| section_rva = 0; 100| 125| section_offset = 0; 101| | 102| 2.58k| while (i < MIN(yr_le16toh(pe_header->FileHeader.NumberOfSections), 60)) ------------------ | | 42| 2.58k|#define MIN(x, y) ((x < y) ? (x) : (y)) | | ------------------ | | | Branch (42:20): [True: 253, False: 2.32k] | | ------------------ ------------------ | Branch (102:10): [True: 2.54k, False: 36] ------------------ 103| 2.54k| { 104| 2.54k| if ((uint8_t*) section - (uint8_t*) pe_header + ------------------ | Branch (104:9): [True: 2.45k, False: 89] ------------------ 105| 2.54k| sizeof(IMAGE_SECTION_HEADER) < 106| 2.54k| buffer_length) 107| 2.45k| { 108| 2.45k| if (rva >= yr_le32toh(section->VirtualAddress) && ------------------ | | 89| 4.91k|#define yr_le32toh(x) (x) ------------------ | Branch (108:11): [True: 1.83k, False: 618] ------------------ 109| 1.83k| section_rva <= yr_le32toh(section->VirtualAddress)) ------------------ | | 89| 1.83k|#define yr_le32toh(x) (x) ------------------ | Branch (109:11): [True: 544, False: 1.29k] ------------------ 110| 544| { 111| 544| section_rva = yr_le32toh(section->VirtualAddress); ------------------ | | 89| 544|#define yr_le32toh(x) (x) ------------------ 112| 544| section_offset = yr_le32toh(section->PointerToRawData); ------------------ | | 89| 544|#define yr_le32toh(x) (x) ------------------ 113| 544| } 114| | 115| 2.45k| section++; 116| 2.45k| i++; 117| 2.45k| } 118| 89| else 119| 89| { 120| 89| return 0; 121| 89| } 122| 2.54k| } 123| | 124| 36| return section_offset + (rva - section_rva); 125| 125|} yr_get_elf_type: 128| 1.58k|{ 129| 1.58k| elf_ident_t* elf_ident; 130| | 131| 1.58k| if (buffer_length < sizeof(elf_ident_t)) ------------------ | Branch (131:7): [True: 69, False: 1.51k] ------------------ 132| 69| return 0; 133| | 134| 1.51k| elf_ident = (elf_ident_t*) buffer; 135| | 136| 1.51k| if (yr_le32toh(elf_ident->magic) != ELF_MAGIC) ------------------ | | 89| 1.51k|#define yr_le32toh(x) (x) ------------------ if (yr_le32toh(elf_ident->magic) != ELF_MAGIC) ------------------ | | 50| 1.51k|#define ELF_MAGIC 0x464C457F ------------------ | Branch (136:7): [True: 315, False: 1.19k] ------------------ 137| 315| { 138| 315| return 0; 139| 315| } 140| | 141| 1.19k| switch (elf_ident->_class) 142| 1.19k| { 143| 448| case ELF_CLASS_32: ------------------ | | 76| 448|#define ELF_CLASS_32 0x0001 // 32bit file ------------------ | Branch (143:3): [True: 448, False: 750] ------------------ 144| 448| if (buffer_length < sizeof(elf32_header_t)) ------------------ | Branch (144:9): [True: 11, False: 437] ------------------ 145| 11| { 146| 11| return 0; 147| 11| } 148| 437| break; 149| 747| case ELF_CLASS_64: ------------------ | | 77| 747|#define ELF_CLASS_64 0x0002 // 64bit file ------------------ | Branch (149:3): [True: 747, False: 451] ------------------ 150| 747| if (buffer_length < sizeof(elf64_header_t)) ------------------ | Branch (150:9): [True: 7, False: 740] ------------------ 151| 7| { 152| 7| return 0; 153| 7| } 154| 740| break; 155| 740| default: ------------------ | Branch (155:3): [True: 3, False: 1.19k] ------------------ 156| | /* Unexpected class */ 157| 3| return 0; 158| 1.19k| } 159| | 160| 1.17k| return elf_ident->_class; 161| 1.19k|} yr_get_entry_point_offset: 351| 1.70k|{ 352| 1.70k| PIMAGE_NT_HEADERS32 pe_header; 353| 1.70k| elf32_header_t* elf_header32; 354| 1.70k| elf64_header_t* elf_header64; 355| | 356| 1.70k| pe_header = yr_get_pe_header(buffer, buffer_length); 357| | 358| 1.70k| if (pe_header != NULL) ------------------ | Branch (358:7): [True: 125, False: 1.58k] ------------------ 359| 125| { 360| 125| return yr_pe_rva_to_offset( 361| 125| pe_header, 362| 125| yr_le32toh(pe_header->OptionalHeader.AddressOfEntryPoint), ------------------ | | 89| 125|#define yr_le32toh(x) (x) ------------------ 363| 125| buffer_length - ((uint8_t*) pe_header - buffer)); 364| 125| } 365| | 366| 1.58k| switch (yr_get_elf_type(buffer, buffer_length)) ------------------ | Branch (366:11): [True: 1.17k, False: 405] ------------------ 367| 1.58k| { 368| 437| case ELF_CLASS_32: ------------------ | | 76| 437|#define ELF_CLASS_32 0x0001 // 32bit file ------------------ | Branch (368:3): [True: 437, False: 1.14k] ------------------ 369| 437| elf_header32 = (elf32_header_t*) buffer; 370| 437| return yr_elf_rva_to_offset_32( 371| 437| elf_header32, yr_le32toh(elf_header32->entry), buffer_length); ------------------ | | 89| 437|#define yr_le32toh(x) (x) ------------------ 372| | 373| 740| case ELF_CLASS_64: ------------------ | | 77| 740|#define ELF_CLASS_64 0x0002 // 64bit file ------------------ | Branch (373:3): [True: 740, False: 842] ------------------ 374| 740| elf_header64 = (elf64_header_t*) buffer; 375| 740| return yr_elf_rva_to_offset_64( 376| 740| elf_header64, yr_le64toh(elf_header64->entry), buffer_length); ------------------ | | 90| 740|#define yr_le64toh(x) (x) ------------------ 377| 1.58k| } 378| | 379| 405| return YR_UNDEFINED; ------------------ | | 38| 405|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 380| 1.58k|} exefiles.c:yr_elf_rva_to_offset_32: 167| 437|{ 168| | // if the binary is an executable then prefer the program headers to resolve 169| | // the offset 170| 437| if (yr_le16toh(elf_header->type) == ELF_ET_EXEC) ------------------ | | 88| 437|#define yr_le16toh(x) (x) ------------------ if (yr_le16toh(elf_header->type) == ELF_ET_EXEC) ------------------ | | 54| 437|#define ELF_ET_EXEC 0x0002 // executable ------------------ | Branch (170:7): [True: 186, False: 251] ------------------ 171| 186| { 172| 186| int i; 173| 186| elf32_program_header_t* program; 174| 186| if (yr_le32toh(elf_header->ph_offset) == 0 || ------------------ | | 89| 186|#define yr_le32toh(x) (x) ------------------ | Branch (174:9): [True: 1, False: 185] ------------------ 175| 185| yr_le16toh(elf_header->ph_entry_count == 0)) ------------------ | | 88| 185|#define yr_le16toh(x) (x) | | ------------------ | | | Branch (88:23): [True: 7, False: 178] | | ------------------ ------------------ 176| 8| return 0; 177| | 178| | // check to prevent integer wraps 179| 178| if (ULONG_MAX - yr_le16toh(elf_header->ph_entry_count) < ------------------ | | 88| 178|#define yr_le16toh(x) (x) ------------------ | Branch (179:9): [True: 0, False: 178] ------------------ 180| 178| sizeof(elf32_program_header_t) * yr_le16toh(elf_header->ph_entry_count)) ------------------ | | 88| 178|#define yr_le16toh(x) (x) ------------------ 181| 0| return 0; 182| | 183| | // check that 'ph_offset' doesn't wrap when added to the 184| | // size of entries. 185| 178| if (ULONG_MAX - yr_le32toh(elf_header->ph_offset) < ------------------ | | 89| 178|#define yr_le32toh(x) (x) ------------------ | Branch (185:9): [True: 0, False: 178] ------------------ 186| 178| sizeof(elf32_program_header_t) * yr_le16toh(elf_header->ph_entry_count)) ------------------ | | 88| 178|#define yr_le16toh(x) (x) ------------------ 187| 0| return 0; 188| | 189| | // ensure we don't exceed the buffer size 190| 178| if (yr_le32toh(elf_header->ph_offset) + ------------------ | | 89| 178|#define yr_le32toh(x) (x) ------------------ | Branch (190:9): [True: 83, False: 95] ------------------ 191| 178| sizeof(elf32_program_header_t) * 192| 178| yr_le16toh(elf_header->ph_entry_count) > ------------------ | | 88| 178|#define yr_le16toh(x) (x) ------------------ 193| 178| buffer_length) 194| 83| return 0; 195| | 196| 95| program = 197| 95| (elf32_program_header_t*) ((uint8_t*) elf_header + yr_le32toh(elf_header->ph_offset)); ------------------ | | 89| 95|#define yr_le32toh(x) (x) ------------------ 198| | 199| 1.51k| for (i = 0; i < yr_le16toh(elf_header->ph_entry_count); i++) ------------------ | | 88| 1.51k|#define yr_le16toh(x) (x) ------------------ | Branch (199:17): [True: 1.45k, False: 56] ------------------ 200| 1.45k| { 201| 1.45k| if (rva >= yr_le32toh(program->virt_addr) && ------------------ | | 89| 2.90k|#define yr_le32toh(x) (x) ------------------ | Branch (201:11): [True: 1.03k, False: 420] ------------------ 202| 1.03k| rva < yr_le32toh(program->virt_addr) + yr_le32toh(program->mem_size)) ------------------ | | 89| 1.03k|#define yr_le32toh(x) (x) ------------------ rva < yr_le32toh(program->virt_addr) + yr_le32toh(program->mem_size)) ------------------ | | 89| 1.03k|#define yr_le32toh(x) (x) ------------------ | Branch (202:11): [True: 39, False: 995] ------------------ 203| 39| { 204| 39| return yr_le32toh(program->offset) + ------------------ | | 89| 39|#define yr_le32toh(x) (x) ------------------ 205| 39| (rva - yr_le32toh(program->virt_addr)); ------------------ | | 89| 39|#define yr_le32toh(x) (x) ------------------ 206| 39| } 207| | 208| 1.41k| program++; 209| 1.41k| } 210| 95| } 211| 251| else 212| 251| { 213| 251| int i; 214| 251| elf32_section_header_t* section; 215| | 216| 251| if (yr_le32toh(elf_header->sh_offset) == 0 || ------------------ | | 89| 251|#define yr_le32toh(x) (x) ------------------ | Branch (216:9): [True: 1, False: 250] ------------------ 217| 250| yr_le16toh(elf_header->sh_entry_count == 0)) ------------------ | | 88| 250|#define yr_le16toh(x) (x) | | ------------------ | | | Branch (88:23): [True: 11, False: 239] | | ------------------ ------------------ 218| 12| return 0; 219| | 220| | // check to prevent integer wraps 221| | 222| 239| if (ULONG_MAX - yr_le16toh(elf_header->sh_entry_count) < ------------------ | | 88| 239|#define yr_le16toh(x) (x) ------------------ | Branch (222:9): [True: 0, False: 239] ------------------ 223| 239| sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) ------------------ | | 88| 239|#define yr_le16toh(x) (x) ------------------ 224| 0| return 0; 225| | 226| | // check that 'sh_offset' doesn't wrap when added to the 227| | // size of entries. 228| | 229| 239| if (ULONG_MAX - yr_le32toh(elf_header->sh_offset) < ------------------ | | 89| 239|#define yr_le32toh(x) (x) ------------------ | Branch (229:9): [True: 0, False: 239] ------------------ 230| 239| sizeof(elf32_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) ------------------ | | 88| 239|#define yr_le16toh(x) (x) ------------------ 231| 0| return 0; 232| | 233| 239| if (yr_le32toh(elf_header->sh_offset) + ------------------ | | 89| 239|#define yr_le32toh(x) (x) ------------------ | Branch (233:9): [True: 84, False: 155] ------------------ 234| 239| sizeof(elf32_section_header_t) * 235| 239| yr_le16toh(elf_header->sh_entry_count) > ------------------ | | 88| 239|#define yr_le16toh(x) (x) ------------------ 236| 239| buffer_length) 237| 84| return 0; 238| | 239| 155| section = (elf32_section_header_t*) 240| 155| ((unsigned char*) elf_header + yr_le32toh(elf_header->sh_offset)); ------------------ | | 89| 155|#define yr_le32toh(x) (x) ------------------ 241| | 242| 2.07k| for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) ------------------ | | 88| 2.07k|#define yr_le16toh(x) (x) ------------------ | Branch (242:17): [True: 2.00k, False: 73] ------------------ 243| 2.00k| { 244| 2.00k| if (yr_le32toh(section->type) != ELF_SHT_NULL && ------------------ | | 89| 2.00k|#define yr_le32toh(x) (x) ------------------ if (yr_le32toh(section->type) != ELF_SHT_NULL && ------------------ | | 83| 4.00k|#define ELF_SHT_NULL 0 // Section header table entry unused ------------------ | Branch (244:11): [True: 1.63k, False: 365] ------------------ 245| 1.63k| yr_le32toh(section->type) != ELF_SHT_NOBITS && ------------------ | | 89| 1.63k|#define yr_le32toh(x) (x) ------------------ yr_le32toh(section->type) != ELF_SHT_NOBITS && ------------------ | | 91| 3.64k|#define ELF_SHT_NOBITS 8 // Program space with no data (bss) ------------------ | Branch (245:11): [True: 1.41k, False: 226] ------------------ 246| 1.41k| rva >= yr_le32toh(section->addr) && ------------------ | | 89| 3.41k|#define yr_le32toh(x) (x) ------------------ | Branch (246:11): [True: 1.04k, False: 368] ------------------ 247| 1.04k| rva < yr_le32toh(section->addr) + yr_le32toh(section->size)) ------------------ | | 89| 1.04k|#define yr_le32toh(x) (x) ------------------ rva < yr_le32toh(section->addr) + yr_le32toh(section->size)) ------------------ | | 89| 1.04k|#define yr_le32toh(x) (x) ------------------ | Branch (247:11): [True: 82, False: 962] ------------------ 248| 82| { 249| | // prevent integer wrapping with the return value 250| | 251| 82| if (ULONG_MAX - yr_le32toh(section->offset) < ------------------ | | 89| 82|#define yr_le32toh(x) (x) ------------------ | Branch (251:13): [True: 0, False: 82] ------------------ 252| 82| (rva - yr_le32toh(section->addr))) ------------------ | | 89| 82|#define yr_le32toh(x) (x) ------------------ 253| 0| return 0; 254| 82| else 255| 82| return yr_le32toh(section->offset) + ------------------ | | 89| 82|#define yr_le32toh(x) (x) ------------------ 256| 82| (rva - yr_le32toh(section->addr)); ------------------ | | 89| 82|#define yr_le32toh(x) (x) ------------------ 257| 82| } 258| | 259| 1.92k| section++; 260| 1.92k| } 261| 155| } 262| | 263| 129| return 0; 264| 437|} exefiles.c:yr_elf_rva_to_offset_64: 270| 740|{ 271| | // if the binary is an executable then prefer the program headers to resolve 272| | // the offset 273| 740| if (yr_le16toh(elf_header->type) == ELF_ET_EXEC) ------------------ | | 88| 740|#define yr_le16toh(x) (x) ------------------ if (yr_le16toh(elf_header->type) == ELF_ET_EXEC) ------------------ | | 54| 740|#define ELF_ET_EXEC 0x0002 // executable ------------------ | Branch (273:7): [True: 337, False: 403] ------------------ 274| 337| { 275| 337| int i; 276| 337| elf64_program_header_t* program; 277| 337| if (yr_le64toh(elf_header->ph_offset) == 0 || ------------------ | | 90| 337|#define yr_le64toh(x) (x) ------------------ | Branch (277:9): [True: 1, False: 336] ------------------ 278| 336| yr_le16toh(elf_header->ph_entry_count == 0)) ------------------ | | 88| 336|#define yr_le16toh(x) (x) | | ------------------ | | | Branch (88:23): [True: 5, False: 331] | | ------------------ ------------------ 279| 6| return 0; 280| | 281| | // check that 'ph_offset' doesn't wrap when added to the 282| | // size of entries. 283| 331| if (ULONG_MAX - yr_le64toh(elf_header->ph_offset) < ------------------ | | 90| 331|#define yr_le64toh(x) (x) ------------------ | Branch (283:9): [True: 19, False: 312] ------------------ 284| 331| sizeof(elf64_program_header_t) * yr_le16toh(elf_header->ph_entry_count)) ------------------ | | 88| 331|#define yr_le16toh(x) (x) ------------------ 285| 19| return 0; 286| | 287| | // ensure we don't exceed the buffer size 288| 312| if (yr_le64toh(elf_header->ph_offset) + ------------------ | | 90| 312|#define yr_le64toh(x) (x) ------------------ | Branch (288:9): [True: 151, False: 161] ------------------ 289| 312| sizeof(elf64_program_header_t) * 290| 312| yr_le16toh(elf_header->ph_entry_count) > ------------------ | | 88| 312|#define yr_le16toh(x) (x) ------------------ 291| 312| buffer_length) 292| 151| return 0; 293| | 294| 161| program = 295| 161| (elf64_program_header_t*) ((uint8_t*) elf_header + yr_le64toh(elf_header->ph_offset)); ------------------ | | 90| 161|#define yr_le64toh(x) (x) ------------------ 296| | 297| 966| for (i = 0; i < yr_le16toh(elf_header->ph_entry_count); i++) ------------------ | | 88| 966|#define yr_le16toh(x) (x) ------------------ | Branch (297:17): [True: 825, False: 141] ------------------ 298| 825| { 299| 825| if (rva >= yr_le64toh(program->virt_addr) && ------------------ | | 90| 1.65k|#define yr_le64toh(x) (x) ------------------ | Branch (299:11): [True: 579, False: 246] ------------------ 300| 579| rva < yr_le64toh(program->virt_addr) + yr_le64toh(program->mem_size)) ------------------ | | 90| 579|#define yr_le64toh(x) (x) ------------------ rva < yr_le64toh(program->virt_addr) + yr_le64toh(program->mem_size)) ------------------ | | 90| 579|#define yr_le64toh(x) (x) ------------------ | Branch (300:11): [True: 20, False: 559] ------------------ 301| 20| { 302| 20| return yr_le64toh(program->offset) + ------------------ | | 90| 20|#define yr_le64toh(x) (x) ------------------ 303| 20| (rva - yr_le64toh(program->virt_addr)); ------------------ | | 90| 20|#define yr_le64toh(x) (x) ------------------ 304| 20| } 305| | 306| 805| program++; 307| 805| } 308| 161| } 309| 403| else 310| 403| { 311| 403| int i; 312| 403| elf64_section_header_t* section; 313| | 314| 403| if (yr_le64toh(elf_header->sh_offset) == 0 || ------------------ | | 90| 403|#define yr_le64toh(x) (x) ------------------ | Branch (314:9): [True: 1, False: 402] ------------------ 315| 402| yr_le16toh(elf_header->sh_entry_count) == 0) ------------------ | | 88| 402|#define yr_le16toh(x) (x) ------------------ | Branch (315:9): [True: 13, False: 389] ------------------ 316| 14| return 0; 317| | 318| | // check that 'sh_offset' doesn't wrap when added to the 319| | // size of entries. 320| 389| if (ULONG_MAX - yr_le64toh(elf_header->sh_offset) < ------------------ | | 90| 389|#define yr_le64toh(x) (x) ------------------ | Branch (320:9): [True: 17, False: 372] ------------------ 321| 389| sizeof(elf64_section_header_t) * yr_le16toh(elf_header->sh_entry_count)) ------------------ | | 88| 389|#define yr_le16toh(x) (x) ------------------ 322| 17| return 0; 323| | 324| 372| if (yr_le64toh(elf_header->sh_offset) + ------------------ | | 90| 372|#define yr_le64toh(x) (x) ------------------ | Branch (324:9): [True: 162, False: 210] ------------------ 325| 372| sizeof(elf64_section_header_t) * 326| 372| yr_le16toh(elf_header->sh_entry_count) > ------------------ | | 88| 372|#define yr_le16toh(x) (x) ------------------ 327| 372| buffer_length) 328| 162| return 0; 329| | 330| 210| section = 331| 210| (elf64_section_header_t*) ((uint8_t*) elf_header + yr_le64toh(elf_header->sh_offset)); ------------------ | | 90| 210|#define yr_le64toh(x) (x) ------------------ 332| | 333| 3.30k| for (i = 0; i < yr_le16toh(elf_header->sh_entry_count); i++) ------------------ | | 88| 3.30k|#define yr_le16toh(x) (x) ------------------ | Branch (333:17): [True: 3.12k, False: 174] ------------------ 334| 3.12k| { 335| 3.12k| if (yr_le32toh(section->type) != ELF_SHT_NULL && ------------------ | | 89| 3.12k|#define yr_le32toh(x) (x) ------------------ if (yr_le32toh(section->type) != ELF_SHT_NULL && ------------------ | | 83| 6.25k|#define ELF_SHT_NULL 0 // Section header table entry unused ------------------ | Branch (335:11): [True: 2.80k, False: 325] ------------------ 336| 2.80k| yr_le32toh(section->type) != ELF_SHT_NOBITS && ------------------ | | 89| 2.80k|#define yr_le32toh(x) (x) ------------------ yr_le32toh(section->type) != ELF_SHT_NOBITS && ------------------ | | 91| 5.92k|#define ELF_SHT_NOBITS 8 // Program space with no data (bss) ------------------ | Branch (336:11): [True: 2.59k, False: 205] ------------------ 337| 2.59k| rva >= yr_le64toh(section->addr) && ------------------ | | 90| 5.72k|#define yr_le64toh(x) (x) ------------------ | Branch (337:11): [True: 2.27k, False: 321] ------------------ 338| 2.27k| rva < yr_le64toh(section->addr) + yr_le64toh(section->size)) ------------------ | | 90| 2.27k|#define yr_le64toh(x) (x) ------------------ rva < yr_le64toh(section->addr) + yr_le64toh(section->size)) ------------------ | | 90| 2.27k|#define yr_le64toh(x) (x) ------------------ | Branch (338:11): [True: 36, False: 2.23k] ------------------ 339| 36| { 340| 36| return yr_le64toh(section->offset) + (rva - yr_le64toh(section->addr)); ------------------ | | 90| 36|#define yr_le64toh(x) (x) ------------------ return yr_le64toh(section->offset) + (rva - yr_le64toh(section->addr)); ------------------ | | 90| 36|#define yr_le64toh(x) (x) ------------------ 341| 36| } 342| | 343| 3.09k| section++; 344| 3.09k| } 345| 210| } 346| | 347| 315| return 0; 348| 740|} yara_yyparse: 1902| 2|{ 1903| |/* Lookahead token kind. */ 1904| 2|int yychar; 1905| | 1906| | 1907| |/* The semantic value of the lookahead symbol. */ 1908| |/* Default value used for initialization, for pacifying older GCCs 1909| | or non-GCC compilers. */ 1910| 2|YY_INITIAL_VALUE (static YYSTYPE yyval_default;) ------------------ | | 727| 2|# define YY_INITIAL_VALUE(Value) Value ------------------ 1911| 2|YYSTYPE yylval YY_INITIAL_VALUE (= yyval_default); ------------------ | | 727| 2|# define YY_INITIAL_VALUE(Value) Value ------------------ 1912| | 1913| | /* Number of syntax errors so far. */ 1914| 2| int yynerrs = 0; 1915| | 1916| 2| yy_state_fast_t yystate = 0; 1917| | /* Number of tokens to shift before error messages enabled. */ 1918| 2| int yyerrstatus = 0; 1919| | 1920| | /* Refer to the stacks through separate pointers, to allow yyoverflow 1921| | to reallocate them elsewhere. */ 1922| | 1923| | /* Their size. */ 1924| 2| YYPTRDIFF_T yystacksize = YYINITDEPTH; ------------------ | | 634| 2|# define YYPTRDIFF_T __PTRDIFF_TYPE__ ------------------ YYPTRDIFF_T yystacksize = YYINITDEPTH; ------------------ | | 1473| 2|# define YYINITDEPTH 200 ------------------ 1925| | 1926| | /* The state stack: array, bottom, top. */ 1927| 2| yy_state_t yyssa[YYINITDEPTH]; 1928| 2| yy_state_t *yyss = yyssa; 1929| 2| yy_state_t *yyssp = yyss; 1930| | 1931| | /* The semantic value stack: array, bottom, top. */ 1932| 2| YYSTYPE yyvsa[YYINITDEPTH]; 1933| 2| YYSTYPE *yyvs = yyvsa; 1934| 2| YYSTYPE *yyvsp = yyvs; 1935| | 1936| 2| int yyn; 1937| | /* The return value of yyparse. */ 1938| 2| int yyresult; 1939| | /* Lookahead symbol kind. */ 1940| 2| yysymbol_kind_t yytoken = YYSYMBOL_YYEMPTY; 1941| | /* The variables used to return semantic value and location from the 1942| | action routines. */ 1943| 2| YYSTYPE yyval; 1944| | 1945| | /* Buffer for error messages, and its allocated size. */ 1946| 2| char yymsgbuf[128]; 1947| 2| char *yymsg = yymsgbuf; 1948| 2| YYPTRDIFF_T yymsg_alloc = sizeof yymsgbuf; ------------------ | | 634| 2|# define YYPTRDIFF_T __PTRDIFF_TYPE__ ------------------ 1949| | 1950| 2|#define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) 1951| | 1952| | /* The number of symbols on the RHS of the reduced rule. 1953| | Keep to zero when no symbol should be popped. */ 1954| 2| int yylen = 0; 1955| | 1956| 2| YYDPRINTF ((stderr, "Starting parse\n")); ------------------ | | 1464| 2|# define YYDPRINTF(Args) ((void) 0) ------------------ 1957| | 1958| 2| yychar = YYEMPTY; /* Cause a token to be read. */ ------------------ | | 51| 2|#define yychar yara_yychar ------------------ yychar = YYEMPTY; /* Cause a token to be read. */ ------------------ | | 312| 2|#define YYEMPTY -2 ------------------ 1959| | 1960| 2| goto yysetstate; 1961| | 1962| | 1963| |/*------------------------------------------------------------. 1964| || yynewstate -- push a new state, which is found in yystate. | 1965| |`------------------------------------------------------------*/ 1966| 568|yynewstate: 1967| | /* In all cases, when you get here, the value and location stacks 1968| | have just been pushed. So pushing a state here evens the stacks. */ 1969| 568| yyssp++; 1970| | 1971| | 1972| |/*--------------------------------------------------------------------. 1973| || yysetstate -- set current state (the top of the stack) to yystate. | 1974| |`--------------------------------------------------------------------*/ 1975| 570|yysetstate: 1976| 570| YYDPRINTF ((stderr, "Entering state %d\n", yystate)); ------------------ | | 1464| 570|# define YYDPRINTF(Args) ((void) 0) ------------------ 1977| 570| YY_ASSERT (0 <= yystate && yystate < YYNSTATES); ------------------ | | 750| 570|#define YY_ASSERT(E) ((void) (0 && (E))) | | ------------------ | | | Branch (750:31): [Folded, False: 570] | | | Branch (750:37): [True: 0, False: 0] | | | Branch (750:37): [True: 0, False: 0] | | ------------------ ------------------ 1978| 570| YY_IGNORE_USELESS_CAST_BEGIN 1979| 570| *yyssp = YY_CAST (yy_state_t, yystate); ------------------ | | 210| 570|# define YY_CAST(Type, Val) ((Type) (Val)) ------------------ 1980| 570| YY_IGNORE_USELESS_CAST_END 1981| 570| YY_STACK_PRINT (yyss, yyssp); 1982| | 1983| 570| if (yyss + yystacksize - 1 <= yyssp) ------------------ | Branch (1983:7): [True: 0, False: 570] ------------------ 1984| |#if !defined yyoverflow && !defined YYSTACK_RELOCATE 1985| | YYNOMEM; 1986| |#else 1987| 0| { 1988| | /* Get the current used size of the three stacks, in elements. */ 1989| 0| YYPTRDIFF_T yysize = yyssp - yyss + 1; ------------------ | | 634| 0|# define YYPTRDIFF_T __PTRDIFF_TYPE__ ------------------ 1990| | 1991| |# if defined yyoverflow 1992| | { 1993| | /* Give user a chance to reallocate the stack. Use copies of 1994| | these so that the &'s don't force the real ones into 1995| | memory. */ 1996| | yy_state_t *yyss1 = yyss; 1997| | YYSTYPE *yyvs1 = yyvs; 1998| | 1999| | /* Each stack pointer address is followed by the size of the 2000| | data in use in that stack, in bytes. This used to be a 2001| | conditional around just the two extra args, but that might 2002| | be undefined if yyoverflow is a macro. */ 2003| | yyoverflow (YY_("memory exhausted"), 2004| | &yyss1, yysize * YYSIZEOF (*yyssp), 2005| | &yyvs1, yysize * YYSIZEOF (*yyvsp), 2006| | &yystacksize); 2007| | yyss = yyss1; 2008| | yyvs = yyvs1; 2009| | } 2010| |# else /* defined YYSTACK_RELOCATE */ 2011| | /* Extend the stack our own way. */ 2012| 0| if (YYMAXDEPTH <= yystacksize) ------------------ | | 1484| 0|# define YYMAXDEPTH 10000 ------------------ | Branch (2012:11): [True: 0, False: 0] ------------------ 2013| 0| YYNOMEM; ------------------ | | 1315| 0|#define YYNOMEM goto yyexhaustedlab ------------------ 2014| 0| yystacksize *= 2; 2015| 0| if (YYMAXDEPTH < yystacksize) ------------------ | | 1484| 0|# define YYMAXDEPTH 10000 ------------------ | Branch (2015:11): [True: 0, False: 0] ------------------ 2016| 0| yystacksize = YYMAXDEPTH; ------------------ | | 1484| 0|# define YYMAXDEPTH 10000 ------------------ 2017| | 2018| 0| { 2019| 0| yy_state_t *yyss1 = yyss; 2020| 0| union yyalloc *yyptr = 2021| 0| YY_CAST (union yyalloc *, ------------------ | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) ------------------ 2022| 0| YYSTACK_ALLOC (YY_CAST (YYSIZE_T, YYSTACK_BYTES (yystacksize)))); 2023| 0| if (! yyptr) ------------------ | Branch (2023:13): [True: 0, False: 0] ------------------ 2024| 0| YYNOMEM; ------------------ | | 1315| 0|#define YYNOMEM goto yyexhaustedlab ------------------ 2025| 0| YYSTACK_RELOCATE (yyss_alloc, yyss); ------------------ | | 847| 0| do \ | | 848| 0| { \ | | 849| 0| YYPTRDIFF_T yynewbytes; \ | | ------------------ | | | | 634| 0|# define YYPTRDIFF_T __PTRDIFF_TYPE__ | | ------------------ | | 850| 0| YYCOPY (&yyptr->Stack_alloc, Stack, yysize); \ | | ------------------ | | | | 865| 0| __builtin_memcpy (Dst, Src, YY_CAST (YYSIZE_T, (Count)) * sizeof (*(Src))) | | | | ------------------ | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | ------------------ | | ------------------ | | 851| 0| Stack = &yyptr->Stack_alloc; \ | | 852| 0| yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \ | | ------------------ | | | | 667| 0|#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X)) | | | | ------------------ | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | ------------------ | | ------------------ | | yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \ | | ------------------ | | | | 831| 0|# define YYSTACK_GAP_MAXIMUM (YYSIZEOF (union yyalloc) - 1) | | | | ------------------ | | | | | | 667| 0|#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X)) | | | | | | ------------------ | | | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 853| 0| yyptr += yynewbytes / YYSIZEOF (*yyptr); \ | | ------------------ | | | | 667| 0|#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X)) | | | | ------------------ | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | ------------------ | | ------------------ | | 854| 0| } \ | | 855| 0| while (0) | | ------------------ | | | Branch (855:12): [Folded, False: 0] | | ------------------ ------------------ 2026| 0| YYSTACK_RELOCATE (yyvs_alloc, yyvs); ------------------ | | 847| 0| do \ | | 848| 0| { \ | | 849| 0| YYPTRDIFF_T yynewbytes; \ | | ------------------ | | | | 634| 0|# define YYPTRDIFF_T __PTRDIFF_TYPE__ | | ------------------ | | 850| 0| YYCOPY (&yyptr->Stack_alloc, Stack, yysize); \ | | ------------------ | | | | 865| 0| __builtin_memcpy (Dst, Src, YY_CAST (YYSIZE_T, (Count)) * sizeof (*(Src))) | | | | ------------------ | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | ------------------ | | ------------------ | | 851| 0| Stack = &yyptr->Stack_alloc; \ | | 852| 0| yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \ | | ------------------ | | | | 667| 0|#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X)) | | | | ------------------ | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | ------------------ | | ------------------ | | yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \ | | ------------------ | | | | 831| 0|# define YYSTACK_GAP_MAXIMUM (YYSIZEOF (union yyalloc) - 1) | | | | ------------------ | | | | | | 667| 0|#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X)) | | | | | | ------------------ | | | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 853| 0| yyptr += yynewbytes / YYSIZEOF (*yyptr); \ | | ------------------ | | | | 667| 0|#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X)) | | | | ------------------ | | | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | | | ------------------ | | ------------------ | | 854| 0| } \ | | 855| 0| while (0) | | ------------------ | | | Branch (855:12): [Folded, False: 0] | | ------------------ ------------------ 2027| 0|# undef YYSTACK_RELOCATE 2028| 0| if (yyss1 != yyssa) ------------------ | Branch (2028:13): [True: 0, False: 0] ------------------ 2029| 0| YYSTACK_FREE (yyss1); ------------------ | | 792| 0|# define YYSTACK_FREE YYFREE | | ------------------ | | | | 106| 0|#define YYFREE yr_free | | ------------------ ------------------ 2030| 0| } 2031| 0|# endif 2032| | 2033| 0| yyssp = yyss + yysize - 1; 2034| 0| yyvsp = yyvs + yysize - 1; 2035| | 2036| 0| YY_IGNORE_USELESS_CAST_BEGIN 2037| 0| YYDPRINTF ((stderr, "Stack size increased to %ld\n", ------------------ | | 1464| 0|# define YYDPRINTF(Args) ((void) 0) ------------------ 2038| 0| YY_CAST (long, yystacksize))); 2039| 0| YY_IGNORE_USELESS_CAST_END 2040| | 2041| 0| if (yyss + yystacksize - 1 <= yyssp) ------------------ | Branch (2041:11): [True: 0, False: 0] ------------------ 2042| 0| YYABORT; ------------------ | | 1313| 0|#define YYABORT goto yyabortlab ------------------ 2043| 0| } 2044| 570|#endif /* !defined yyoverflow && !defined YYSTACK_RELOCATE */ 2045| | 2046| | 2047| 570| if (yystate == YYFINAL) ------------------ | | 880| 570|#define YYFINAL 2 ------------------ | Branch (2047:7): [True: 2, False: 568] ------------------ 2048| 2| YYACCEPT; ------------------ | | 1312| 2|#define YYACCEPT goto yyacceptlab ------------------ 2049| | 2050| 568| goto yybackup; 2051| | 2052| | 2053| |/*-----------. 2054| || yybackup. | 2055| |`-----------*/ 2056| 568|yybackup: 2057| | /* Do appropriate processing given the current state. Read a 2058| | lookahead token if we need one and don't already have one. */ 2059| | 2060| | /* First try to decide what to do without reference to lookahead token. */ 2061| 568| yyn = yypact[yystate]; 2062| 568| if (yypact_value_is_default (yyn)) ------------------ | | 1021| 568| ((Yyn) == YYPACT_NINF) | | ------------------ | | | | 1018| 568|#define YYPACT_NINF (-170) | | ------------------ | | | Branch (1021:3): [True: 194, False: 374] | | ------------------ ------------------ 2063| 194| goto yydefault; 2064| | 2065| | /* Not known => get a lookahead token if don't already have one. */ 2066| | 2067| | /* YYCHAR is either empty, or end-of-input, or a valid lookahead. */ 2068| 374| if (yychar == YYEMPTY) ------------------ | | 51| 374|#define yychar yara_yychar ------------------ if (yychar == YYEMPTY) ------------------ | | 312| 374|#define YYEMPTY -2 ------------------ | Branch (2068:7): [True: 226, False: 148] ------------------ 2069| 226| { 2070| 226| YYDPRINTF ((stderr, "Reading a token\n")); ------------------ | | 1464| 226|# define YYDPRINTF(Args) ((void) 0) ------------------ 2071| 226| yychar = yylex (&yylval, yyscanner, compiler); ------------------ | | 51| 226|#define yychar yara_yychar ------------------ yychar = yylex (&yylval, yyscanner, compiler); ------------------ | | 47| 226|#define yylex yara_yylex ------------------ 2072| 226| } 2073| | 2074| 374| if (yychar <= _END_OF_FILE_) ------------------ | | 51| 374|#define yychar yara_yychar ------------------ if (yychar <= _END_OF_FILE_) ------------------ | | 313| 374|#define _END_OF_FILE_ 0 ------------------ | Branch (2074:7): [True: 2, False: 372] ------------------ 2075| 2| { 2076| 2| yychar = _END_OF_FILE_; ------------------ | | 51| 2|#define yychar yara_yychar ------------------ yychar = _END_OF_FILE_; ------------------ | | 313| 2|#define _END_OF_FILE_ 0 ------------------ 2077| 2| yytoken = YYSYMBOL_YYEOF; 2078| 2| YYDPRINTF ((stderr, "Now at end of input.\n")); ------------------ | | 1464| 2|# define YYDPRINTF(Args) ((void) 0) ------------------ 2079| 2| } 2080| 372| else if (yychar == YYerror) ------------------ | | 51| 372|#define yychar yara_yychar ------------------ else if (yychar == YYerror) ------------------ | | 314| 372|#define YYerror 256 ------------------ | Branch (2080:12): [True: 0, False: 372] ------------------ 2081| 0| { 2082| | /* The scanner already issued an error message, process directly 2083| | to error recovery. But do not keep the error token as 2084| | lookahead, it is too special and may lead us to an endless 2085| | loop in error recovery. */ 2086| 0| yychar = YYUNDEF; ------------------ | | 51| 0|#define yychar yara_yychar ------------------ yychar = YYUNDEF; ------------------ | | 315| 0|#define YYUNDEF 257 ------------------ 2087| 0| yytoken = YYSYMBOL_YYerror; 2088| 0| goto yyerrlab1; 2089| 0| } 2090| 372| else 2091| 372| { 2092| 372| yytoken = YYTRANSLATE (yychar); ------------------ | | 900| 372| (0 <= (YYX) && (YYX) <= YYMAXUTOK \ | | ------------------ | | | | 894| 372|#define YYMAXUTOK 319 | | ------------------ | | | Branch (900:4): [True: 372, False: 0] | | | Branch (900:18): [True: 372, False: 0] | | ------------------ | | 901| 372| ? YY_CAST (yysymbol_kind_t, yytranslate[YYX]) \ | | ------------------ | | | | 210| 372|# define YY_CAST(Type, Val) ((Type) (Val)) | | ------------------ | | 902| 372| : YYSYMBOL_YYUNDEF) ------------------ 2093| 372| YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc); 2094| 372| } 2095| | 2096| | /* If the proper action on seeing token YYTOKEN is to reduce or to 2097| | detect an error, take that action. */ 2098| 374| yyn += yytoken; 2099| 374| if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken) ------------------ | | 882| 374|#define YYLAST 480 ------------------ | Branch (2099:7): [True: 0, False: 374] | Branch (2099:18): [True: 0, False: 374] | Branch (2099:34): [True: 146, False: 228] ------------------ 2100| 146| goto yydefault; 2101| 228| yyn = yytable[yyn]; 2102| 228| if (yyn <= 0) ------------------ | Branch (2102:7): [True: 2, False: 226] ------------------ 2103| 2| { 2104| 2| if (yytable_value_is_error (yyn)) ------------------ | | 1026| 2| 0 | | ------------------ | | | Branch (1026:3): [Folded, False: 2] | | ------------------ ------------------ 2105| 0| goto yyerrlab; 2106| 2| yyn = -yyn; 2107| 2| goto yyreduce; 2108| 2| } 2109| | 2110| | /* Count tokens shifted since error; after three, turn off error 2111| | status. */ 2112| 226| if (yyerrstatus) ------------------ | Branch (2112:7): [True: 0, False: 226] ------------------ 2113| 0| yyerrstatus--; 2114| | 2115| | /* Shift the lookahead token. */ 2116| 226| YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc); 2117| 226| yystate = yyn; 2118| 226| YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN 2119| 226| *++yyvsp = yylval; 2120| 226| YY_IGNORE_MAYBE_UNINITIALIZED_END 2121| | 2122| | /* Discard the shifted token. */ 2123| 226| yychar = YYEMPTY; ------------------ | | 51| 226|#define yychar yara_yychar ------------------ yychar = YYEMPTY; ------------------ | | 312| 226|#define YYEMPTY -2 ------------------ 2124| 226| goto yynewstate; 2125| | 2126| | 2127| |/*-----------------------------------------------------------. 2128| || yydefault -- do the default action for the current state. | 2129| |`-----------------------------------------------------------*/ 2130| 340|yydefault: 2131| 340| yyn = yydefact[yystate]; 2132| 340| if (yyn == 0) ------------------ | Branch (2132:7): [True: 0, False: 340] ------------------ 2133| 0| goto yyerrlab; 2134| 340| goto yyreduce; 2135| | 2136| | 2137| |/*-----------------------------. 2138| || yyreduce -- do a reduction. | 2139| |`-----------------------------*/ 2140| 342|yyreduce: 2141| | /* yyn is the number of a rule to reduce with. */ 2142| 342| yylen = yyr2[yyn]; 2143| | 2144| | /* If YYLEN is nonzero, implement the default value of the action: 2145| | '$$ = $1'. 2146| | 2147| | Otherwise, the following line sets YYVAL to garbage. 2148| | This behavior is undocumented and Bison 2149| | users should not rely upon it. Assigning to YYVAL 2150| | unconditionally makes the parser a bit smaller, and it avoids a 2151| | GCC warning that YYVAL may be used uninitialized. */ 2152| 342| yyval = yyvsp[1-yylen]; 2153| | 2154| | 2155| 342| YY_REDUCE_PRINT (yyn); 2156| 342| switch (yyn) 2157| 342| { 2158| 0| case 8: /* rules: rules "end of included file" */ ------------------ | Branch (2158:3): [True: 0, False: 342] ------------------ 2159| 0|#line 373 "libyara/grammar.y" 2160| 0| { 2161| 0| _yr_compiler_pop_file_name(compiler); 2162| 0| } 2163| 0|#line 2164 "libyara/grammar.c" 2164| 0| break; 2165| | 2166| 0| case 9: /* rules: rules error "end of included file" */ ------------------ | Branch (2166:3): [True: 0, False: 342] ------------------ 2167| 0|#line 377 "libyara/grammar.y" 2168| 0| { 2169| 0| _yr_compiler_pop_file_name(compiler); 2170| 0| } 2171| 0|#line 2172 "libyara/grammar.c" 2172| 0| break; 2173| | 2174| 2| case 10: /* import: "" "text string" */ ------------------ | Branch (2174:3): [True: 2, False: 340] ------------------ 2175| 2|#line 385 "libyara/grammar.y" 2176| 2| { 2177| 2| int result = yr_parser_reduce_import(yyscanner, (yyvsp[0].sized_string)); 2178| | 2179| 2| yr_free((yyvsp[0].sized_string)); 2180| | 2181| 2| fail_if_error(result); ------------------ | | 135| 2| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 4|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 2|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 2] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 2| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2182| 2| } 2183| 0|#line 2184 "libyara/grammar.c" 2184| 0| break; 2185| | 2186| 2| case 11: /* @1: %empty */ ------------------ | Branch (2186:3): [True: 2, False: 340] ------------------ 2187| 2|#line 397 "libyara/grammar.y" 2188| 2| { 2189| 2| fail_if_error(yr_parser_reduce_rule_declaration_phase_1( ------------------ | | 135| 2| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 4|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 2|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 2] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 2| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2190| 2| yyscanner, (int32_t) (yyvsp[-2].integer), (yyvsp[0].c_string), &(yyval.rule))); 2191| 2| } 2192| 0|#line 2193 "libyara/grammar.c" 2193| 0| break; 2194| | 2195| 2| case 12: /* $@2: %empty */ ------------------ | Branch (2195:3): [True: 2, False: 340] ------------------ 2196| 2|#line 402 "libyara/grammar.y" 2197| 2| { 2198| 2| YR_RULE* rule = (YR_RULE*) yr_arena_ref_to_ptr( 2199| 2| compiler->arena, &(yyvsp[-4].rule)); 2200| | 2201| 2| rule->tags = (char*) yr_arena_ref_to_ptr( 2202| 2| compiler->arena, &(yyvsp[-3].tag)); 2203| | 2204| 2| rule->metas = (YR_META*) yr_arena_ref_to_ptr( 2205| 2| compiler->arena, &(yyvsp[-1].meta)); 2206| | 2207| 2| rule->strings = (YR_STRING*) yr_arena_ref_to_ptr( 2208| 2| compiler->arena, &(yyvsp[0].string)); 2209| 2| } 2210| 2|#line 2211 "libyara/grammar.c" 2211| 2| break; 2212| | 2213| 2| case 13: /* rule: rule_modifiers "" "identifier" @1 tags '{' meta strings $@2 condition '}' */ ------------------ | Branch (2213:3): [True: 2, False: 340] ------------------ 2214| 2|#line 416 "libyara/grammar.y" 2215| 2| { 2216| 2| YR_RULE* rule = (YR_RULE*) yr_arena_ref_to_ptr( 2217| 2| compiler->arena, &(yyvsp[-7].rule)); 2218| 2| rule->required_strings = (yyvsp[-1].expression).required_strings.count; 2219| | 2220| 2| int result = yr_parser_reduce_rule_declaration_phase_2( 2221| 2| yyscanner, &(yyvsp[-7].rule)); // rule created in phase 1 2222| | 2223| 2| yr_free((yyvsp[-8].c_string)); 2224| | 2225| 2| fail_if_error(result); ------------------ | | 135| 2| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 4|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 2|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 2] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 2| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2226| 2| } 2227| 0|#line 2228 "libyara/grammar.c" 2228| 0| break; 2229| | 2230| 2| case 14: /* meta: %empty */ ------------------ | Branch (2230:3): [True: 2, False: 340] ------------------ 2231| 2|#line 433 "libyara/grammar.y" 2232| 2| { 2233| 2| (yyval.meta) = YR_ARENA_NULL_REF; ------------------ | | 43| 2| (YR_ARENA_REF) \ | | 44| 2| { \ | | 45| 2| UINT32_MAX, UINT32_MAX \ | | 46| 2| } ------------------ 2234| 2| } 2235| 2|#line 2236 "libyara/grammar.c" 2236| 2| break; 2237| | 2238| 0| case 15: /* meta: "" ':' meta_declarations */ ------------------ | Branch (2238:3): [True: 0, False: 342] ------------------ 2239| 0|#line 437 "libyara/grammar.y" 2240| 0| { 2241| 0| YR_META* meta = yr_arena_get_ptr( 2242| 0| compiler->arena, 2243| 0| YR_METAS_TABLE, ------------------ | | 59| 0|#define YR_METAS_TABLE 2 ------------------ 2244| 0| (compiler->current_meta_idx - 1) * sizeof(YR_META)); 2245| | 2246| 0| meta->flags |= META_FLAGS_LAST_IN_RULE; ------------------ | | 140| 0|#define META_FLAGS_LAST_IN_RULE 1 ------------------ 2247| | 2248| 0| (yyval.meta) = (yyvsp[0].meta); 2249| 0| } 2250| 0|#line 2251 "libyara/grammar.c" 2251| 0| break; 2252| | 2253| 2| case 16: /* strings: %empty */ ------------------ | Branch (2253:3): [True: 2, False: 340] ------------------ 2254| 2|#line 452 "libyara/grammar.y" 2255| 2| { 2256| 2| (yyval.string) = YR_ARENA_NULL_REF; ------------------ | | 43| 2| (YR_ARENA_REF) \ | | 44| 2| { \ | | 45| 2| UINT32_MAX, UINT32_MAX \ | | 46| 2| } ------------------ 2257| 2| } 2258| 2|#line 2259 "libyara/grammar.c" 2259| 2| break; 2260| | 2261| 0| case 17: /* strings: "" ':' string_declarations */ ------------------ | Branch (2261:3): [True: 0, False: 342] ------------------ 2262| 0|#line 456 "libyara/grammar.y" 2263| 0| { 2264| 0| YR_STRING* string = (YR_STRING*) yr_arena_get_ptr( 2265| 0| compiler->arena, 2266| 0| YR_STRINGS_TABLE, ------------------ | | 60| 0|#define YR_STRINGS_TABLE 3 ------------------ 2267| 0| (compiler->current_string_idx - 1) * sizeof(YR_STRING)); 2268| | 2269| 0| string->flags |= STRING_FLAGS_LAST_IN_RULE; ------------------ | | 78| 0|#define STRING_FLAGS_LAST_IN_RULE 0x1000 ------------------ 2270| | 2271| 0| (yyval.string) = (yyvsp[0].string); 2272| 0| } 2273| 0|#line 2274 "libyara/grammar.c" 2274| 0| break; 2275| | 2276| 2| case 18: /* condition: "" ':' boolean_expression */ ------------------ | Branch (2276:3): [True: 2, False: 340] ------------------ 2277| 2|#line 471 "libyara/grammar.y" 2278| 2| { 2279| 2| (yyval.expression) = (yyvsp[0].expression); 2280| 2| } 2281| 2|#line 2282 "libyara/grammar.c" 2282| 2| break; 2283| | 2284| 2| case 19: /* rule_modifiers: %empty */ ------------------ | Branch (2284:3): [True: 2, False: 340] ------------------ 2285| 2|#line 478 "libyara/grammar.y" 2286| 2| { (yyval.integer) = 0; } 2287| 2|#line 2288 "libyara/grammar.c" 2288| 2| break; 2289| | 2290| 0| case 20: /* rule_modifiers: rule_modifiers rule_modifier */ ------------------ | Branch (2290:3): [True: 0, False: 342] ------------------ 2291| 0|#line 479 "libyara/grammar.y" 2292| 0| { (yyval.integer) = (yyvsp[-1].integer) | (yyvsp[0].integer); } 2293| 0|#line 2294 "libyara/grammar.c" 2294| 0| break; 2295| | 2296| 0| case 21: /* rule_modifier: "" */ ------------------ | Branch (2296:3): [True: 0, False: 342] ------------------ 2297| 0|#line 484 "libyara/grammar.y" 2298| 0| { (yyval.integer) = RULE_FLAGS_PRIVATE; } ------------------ | | 52| 0|#define RULE_FLAGS_PRIVATE 0x01 ------------------ 2299| 0|#line 2300 "libyara/grammar.c" 2300| 0| break; 2301| | 2302| 0| case 22: /* rule_modifier: "" */ ------------------ | Branch (2302:3): [True: 0, False: 342] ------------------ 2303| 0|#line 485 "libyara/grammar.y" 2304| 0| { (yyval.integer) = RULE_FLAGS_GLOBAL; } ------------------ | | 53| 0|#define RULE_FLAGS_GLOBAL 0x02 ------------------ 2305| 0|#line 2306 "libyara/grammar.c" 2306| 0| break; 2307| | 2308| 2| case 23: /* tags: %empty */ ------------------ | Branch (2308:3): [True: 2, False: 340] ------------------ 2309| 2|#line 491 "libyara/grammar.y" 2310| 2| { 2311| 2| (yyval.tag) = YR_ARENA_NULL_REF; ------------------ | | 43| 2| (YR_ARENA_REF) \ | | 44| 2| { \ | | 45| 2| UINT32_MAX, UINT32_MAX \ | | 46| 2| } ------------------ 2312| 2| } 2313| 2|#line 2314 "libyara/grammar.c" 2314| 2| break; 2315| | 2316| 0| case 24: /* tags: ':' tag_list */ ------------------ | Branch (2316:3): [True: 0, False: 342] ------------------ 2317| 0|#line 495 "libyara/grammar.y" 2318| 0| { 2319| | // Tags list is represented in the arena as a sequence 2320| | // of null-terminated strings, the sequence ends with an 2321| | // additional null character. Here we write the ending null 2322| | //character. Example: tag1\0tag2\0tag3\0\0 2323| | 2324| 0| fail_if_error(yr_arena_write_string( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2325| 0| yyget_extra(yyscanner)->arena, YR_SZ_POOL, "", NULL)); 2326| | 2327| 0| (yyval.tag) = (yyvsp[0].tag); 2328| 0| } 2329| 0|#line 2330 "libyara/grammar.c" 2330| 0| break; 2331| | 2332| 0| case 25: /* tag_list: "identifier" */ ------------------ | Branch (2332:3): [True: 0, False: 342] ------------------ 2333| 0|#line 511 "libyara/grammar.y" 2334| 0| { 2335| 0| int result = yr_arena_write_string( 2336| 0| yyget_extra(yyscanner)->arena, YR_SZ_POOL, (yyvsp[0].c_string), &(yyval.tag)); ------------------ | | 54| 0|#define yyget_extra yara_yyget_extra ------------------ yyget_extra(yyscanner)->arena, YR_SZ_POOL, (yyvsp[0].c_string), &(yyval.tag)); ------------------ | | 62| 0|#define YR_SZ_POOL 5 ------------------ 2337| | 2338| 0| yr_free((yyvsp[0].c_string)); 2339| | 2340| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2341| 0| } 2342| 0|#line 2343 "libyara/grammar.c" 2343| 0| break; 2344| | 2345| 0| case 26: /* tag_list: tag_list "identifier" */ ------------------ | Branch (2345:3): [True: 0, False: 342] ------------------ 2346| 0|#line 520 "libyara/grammar.y" 2347| 0| { 2348| 0| YR_ARENA_REF ref; 2349| | 2350| | // Write the new tag identifier. 2351| 0| int result = yr_arena_write_string( 2352| 0| yyget_extra(yyscanner)->arena, YR_SZ_POOL, (yyvsp[0].c_string), &ref); ------------------ | | 54| 0|#define yyget_extra yara_yyget_extra ------------------ yyget_extra(yyscanner)->arena, YR_SZ_POOL, (yyvsp[0].c_string), &ref); ------------------ | | 62| 0|#define YR_SZ_POOL 5 ------------------ 2353| | 2354| 0| yr_free((yyvsp[0].c_string)); 2355| | 2356| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2357| | 2358| | // Get the address for the tag identifier just written. 2359| 0| char* new_tag = (char*) yr_arena_ref_to_ptr( 2360| 0| compiler->arena, &ref); 2361| | 2362| | // Take the address of first tag's identifier in the list. 2363| 0| char* tag = (char*) yr_arena_ref_to_ptr( 2364| 0| compiler->arena, &(yyval.tag)); 2365| | 2366| | // Search for duplicated tags. Tags are written one after 2367| | // the other, with zeroes in between (i.e: tag1/0tag2/0tag3) 2368| | // that's why can use tag < new_tag as the condition for the 2369| | // loop. 2370| 0| while (tag < new_tag) ------------------ | Branch (2370:16): [True: 0, False: 0] ------------------ 2371| 0| { 2372| 0| if (strcmp(tag, new_tag) == 0) ------------------ | Branch (2372:15): [True: 0, False: 0] ------------------ 2373| 0| { 2374| 0| yr_compiler_set_error_extra_info(compiler, tag); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2375| 0| fail_with_error(ERROR_DUPLICATED_TAG_IDENTIFIER); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 2376| 0| } 2377| | 2378| 0| tag += strlen(tag) + 1; 2379| 0| } 2380| | 2381| 0| (yyval.tag) = (yyvsp[-1].tag); 2382| 0| } 2383| 0|#line 2384 "libyara/grammar.c" 2384| 0| break; 2385| | 2386| 0| case 27: /* meta_declarations: meta_declaration */ ------------------ | Branch (2386:3): [True: 0, False: 342] ------------------ 2387| 0|#line 561 "libyara/grammar.y" 2388| 0| { (yyval.meta) = (yyvsp[0].meta); } 2389| 0|#line 2390 "libyara/grammar.c" 2390| 0| break; 2391| | 2392| 0| case 28: /* meta_declarations: meta_declarations meta_declaration */ ------------------ | Branch (2392:3): [True: 0, False: 342] ------------------ 2393| 0|#line 562 "libyara/grammar.y" 2394| 0| { (yyval.meta) = (yyvsp[-1].meta); } 2395| 0|#line 2396 "libyara/grammar.c" 2396| 0| break; 2397| | 2398| 0| case 29: /* meta_declaration: "identifier" '=' "text string" */ ------------------ | Branch (2398:3): [True: 0, False: 342] ------------------ 2399| 0|#line 568 "libyara/grammar.y" 2400| 0| { 2401| 0| SIZED_STRING* sized_string = (yyvsp[0].sized_string); 2402| | 2403| 0| int result = yr_parser_reduce_meta_declaration( 2404| 0| yyscanner, 2405| 0| META_TYPE_STRING, ------------------ | | 137| 0|#define META_TYPE_STRING 2 ------------------ 2406| 0| (yyvsp[-2].c_string), 2407| 0| sized_string->c_string, 2408| 0| 0, 2409| 0| &(yyval.meta)); 2410| | 2411| 0| yr_free((yyvsp[-2].c_string)); 2412| 0| yr_free((yyvsp[0].sized_string)); 2413| | 2414| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2415| 0| } 2416| 0|#line 2417 "libyara/grammar.c" 2417| 0| break; 2418| | 2419| 0| case 30: /* meta_declaration: "identifier" '=' "integer number" */ ------------------ | Branch (2419:3): [True: 0, False: 342] ------------------ 2420| 0|#line 585 "libyara/grammar.y" 2421| 0| { 2422| 0| int result = yr_parser_reduce_meta_declaration( 2423| 0| yyscanner, 2424| 0| META_TYPE_INTEGER, ------------------ | | 136| 0|#define META_TYPE_INTEGER 1 ------------------ 2425| 0| (yyvsp[-2].c_string), 2426| 0| NULL, 2427| 0| (yyvsp[0].integer), 2428| 0| &(yyval.meta)); 2429| | 2430| 0| yr_free((yyvsp[-2].c_string)); 2431| | 2432| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2433| 0| } 2434| 0|#line 2435 "libyara/grammar.c" 2435| 0| break; 2436| | 2437| 0| case 31: /* meta_declaration: "identifier" '=' '-' "integer number" */ ------------------ | Branch (2437:3): [True: 0, False: 342] ------------------ 2438| 0|#line 599 "libyara/grammar.y" 2439| 0| { 2440| 0| int result = yr_parser_reduce_meta_declaration( 2441| 0| yyscanner, 2442| 0| META_TYPE_INTEGER, ------------------ | | 136| 0|#define META_TYPE_INTEGER 1 ------------------ 2443| 0| (yyvsp[-3].c_string), 2444| 0| NULL, 2445| 0| -(yyvsp[0].integer), 2446| 0| &(yyval.meta)); 2447| | 2448| 0| yr_free((yyvsp[-3].c_string)); 2449| | 2450| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2451| 0| } 2452| 0|#line 2453 "libyara/grammar.c" 2453| 0| break; 2454| | 2455| 0| case 32: /* meta_declaration: "identifier" '=' "" */ ------------------ | Branch (2455:3): [True: 0, False: 342] ------------------ 2456| 0|#line 613 "libyara/grammar.y" 2457| 0| { 2458| 0| int result = yr_parser_reduce_meta_declaration( 2459| 0| yyscanner, 2460| 0| META_TYPE_BOOLEAN, ------------------ | | 138| 0|#define META_TYPE_BOOLEAN 3 ------------------ 2461| 0| (yyvsp[-2].c_string), 2462| 0| NULL, 2463| 0| true, 2464| 0| &(yyval.meta)); 2465| | 2466| 0| yr_free((yyvsp[-2].c_string)); 2467| | 2468| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2469| 0| } 2470| 0|#line 2471 "libyara/grammar.c" 2471| 0| break; 2472| | 2473| 0| case 33: /* meta_declaration: "identifier" '=' "" */ ------------------ | Branch (2473:3): [True: 0, False: 342] ------------------ 2474| 0|#line 627 "libyara/grammar.y" 2475| 0| { 2476| 0| int result = yr_parser_reduce_meta_declaration( 2477| 0| yyscanner, 2478| 0| META_TYPE_BOOLEAN, ------------------ | | 138| 0|#define META_TYPE_BOOLEAN 3 ------------------ 2479| 0| (yyvsp[-2].c_string), 2480| 0| NULL, 2481| 0| false, 2482| 0| &(yyval.meta)); 2483| | 2484| 0| yr_free((yyvsp[-2].c_string)); 2485| | 2486| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2487| 0| } 2488| 0|#line 2489 "libyara/grammar.c" 2489| 0| break; 2490| | 2491| 0| case 34: /* string_declarations: string_declaration */ ------------------ | Branch (2491:3): [True: 0, False: 342] ------------------ 2492| 0|#line 644 "libyara/grammar.y" 2493| 0| { (yyval.string) = (yyvsp[0].string); } 2494| 0|#line 2495 "libyara/grammar.c" 2495| 0| break; 2496| | 2497| 0| case 35: /* string_declarations: string_declarations string_declaration */ ------------------ | Branch (2497:3): [True: 0, False: 342] ------------------ 2498| 0|#line 645 "libyara/grammar.y" 2499| 0| { (yyval.string) = (yyvsp[-1].string); } 2500| 0|#line 2501 "libyara/grammar.c" 2501| 0| break; 2502| | 2503| 0| case 36: /* $@3: %empty */ ------------------ | Branch (2503:3): [True: 0, False: 342] ------------------ 2504| 0|#line 651 "libyara/grammar.y" 2505| 0| { 2506| 0| compiler->current_line = yyget_lineno(yyscanner); ------------------ | | 55| 0|#define yyget_lineno yara_yyget_lineno ------------------ 2507| 0| } 2508| 0|#line 2509 "libyara/grammar.c" 2509| 0| break; 2510| | 2511| 0| case 37: /* string_declaration: "string identifier" '=' $@3 "text string" string_modifiers */ ------------------ | Branch (2511:3): [True: 0, False: 342] ------------------ 2512| 0|#line 655 "libyara/grammar.y" 2513| 0| { 2514| 0| int result = yr_parser_reduce_string_declaration( 2515| 0| yyscanner, (yyvsp[0].modifier), (yyvsp[-4].c_string), (yyvsp[-1].sized_string), &(yyval.string)); 2516| | 2517| 0| yr_free((yyvsp[-4].c_string)); 2518| 0| yr_free((yyvsp[-1].sized_string)); 2519| 0| yr_free((yyvsp[0].modifier).alphabet); 2520| | 2521| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2522| 0| compiler->current_line = 0; 2523| 0| } 2524| 0|#line 2525 "libyara/grammar.c" 2525| 0| break; 2526| | 2527| 0| case 38: /* $@4: %empty */ ------------------ | Branch (2527:3): [True: 0, False: 342] ------------------ 2528| 0|#line 667 "libyara/grammar.y" 2529| 0| { 2530| 0| compiler->current_line = yyget_lineno(yyscanner); ------------------ | | 55| 0|#define yyget_lineno yara_yyget_lineno ------------------ 2531| 0| } 2532| 0|#line 2533 "libyara/grammar.c" 2533| 0| break; 2534| | 2535| 0| case 39: /* string_declaration: "string identifier" '=' $@4 "regular expression" regexp_modifiers */ ------------------ | Branch (2535:3): [True: 0, False: 342] ------------------ 2536| 0|#line 671 "libyara/grammar.y" 2537| 0| { 2538| 0| int result; 2539| | 2540| 0| (yyvsp[0].modifier).flags |= STRING_FLAGS_REGEXP; ------------------ | | 71| 0|#define STRING_FLAGS_REGEXP 0x20 ------------------ 2541| | 2542| 0| result = yr_parser_reduce_string_declaration( 2543| 0| yyscanner, (yyvsp[0].modifier), (yyvsp[-4].c_string), (yyvsp[-1].sized_string), &(yyval.string)); 2544| | 2545| 0| yr_free((yyvsp[-4].c_string)); 2546| 0| yr_free((yyvsp[-1].sized_string)); 2547| | 2548| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2549| | 2550| 0| compiler->current_line = 0; 2551| 0| } 2552| 0|#line 2553 "libyara/grammar.c" 2553| 0| break; 2554| | 2555| 0| case 40: /* $@5: %empty */ ------------------ | Branch (2555:3): [True: 0, False: 342] ------------------ 2556| 0|#line 687 "libyara/grammar.y" 2557| 0| { 2558| 0| compiler->current_line = yyget_lineno(yyscanner); ------------------ | | 55| 0|#define yyget_lineno yara_yyget_lineno ------------------ 2559| 0| } 2560| 0|#line 2561 "libyara/grammar.c" 2561| 0| break; 2562| | 2563| 0| case 41: /* string_declaration: "string identifier" '=' $@5 "hex string" hex_modifiers */ ------------------ | Branch (2563:3): [True: 0, False: 342] ------------------ 2564| 0|#line 691 "libyara/grammar.y" 2565| 0| { 2566| 0| int result; 2567| | 2568| 0| (yyvsp[0].modifier).flags |= STRING_FLAGS_HEXADECIMAL; ------------------ | | 67| 0|#define STRING_FLAGS_HEXADECIMAL 0x02 ------------------ 2569| | 2570| 0| result = yr_parser_reduce_string_declaration( 2571| 0| yyscanner, (yyvsp[0].modifier), (yyvsp[-4].c_string), (yyvsp[-1].sized_string), &(yyval.string)); 2572| | 2573| 0| yr_free((yyvsp[-4].c_string)); 2574| 0| yr_free((yyvsp[-1].sized_string)); 2575| | 2576| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2577| | 2578| 0| compiler->current_line = 0; 2579| 0| } 2580| 0|#line 2581 "libyara/grammar.c" 2581| 0| break; 2582| | 2583| 0| case 42: /* string_modifiers: %empty */ ------------------ | Branch (2583:3): [True: 0, False: 342] ------------------ 2584| 0|#line 711 "libyara/grammar.y" 2585| 0| { 2586| 0| (yyval.modifier).flags = 0; 2587| 0| (yyval.modifier).xor_min = 0; 2588| 0| (yyval.modifier).xor_max = 0; 2589| 0| (yyval.modifier).alphabet = NULL; 2590| 0| } 2591| 0|#line 2592 "libyara/grammar.c" 2592| 0| break; 2593| | 2594| 0| case 43: /* string_modifiers: string_modifiers string_modifier */ ------------------ | Branch (2594:3): [True: 0, False: 342] ------------------ 2595| 0|#line 718 "libyara/grammar.y" 2596| 0| { 2597| 0| (yyval.modifier) = (yyvsp[-1].modifier); 2598| | 2599| | // Only set the xor minimum and maximum if we are dealing with the 2600| | // xor modifier. If we don't check for this then we can end up with 2601| | // "xor wide" resulting in whatever is on the stack for "wide" 2602| | // overwriting the values for xor. 2603| 0| if ((yyvsp[0].modifier).flags & STRING_FLAGS_XOR) ------------------ | | 85| 0|#define STRING_FLAGS_XOR 0x80000 ------------------ | Branch (2603:13): [True: 0, False: 0] ------------------ 2604| 0| { 2605| 0| (yyval.modifier).xor_min = (yyvsp[0].modifier).xor_min; 2606| 0| (yyval.modifier).xor_max = (yyvsp[0].modifier).xor_max; 2607| 0| } 2608| | 2609| | // Only set the base64 alphabet if we are dealing with the base64 2610| | // modifier. If we don't check for this then we can end up with 2611| | // "base64 ascii" resulting in whatever is on the stack for "ascii" 2612| | // overwriting the values for base64. 2613| 0| if (((yyvsp[0].modifier).flags & STRING_FLAGS_BASE64) || ------------------ | | 87| 0|#define STRING_FLAGS_BASE64 0x200000 ------------------ | Branch (2613:13): [True: 0, False: 0] ------------------ 2614| 0| ((yyvsp[0].modifier).flags & STRING_FLAGS_BASE64_WIDE)) ------------------ | | 88| 0|#define STRING_FLAGS_BASE64_WIDE 0x400000 ------------------ | Branch (2614:13): [True: 0, False: 0] ------------------ 2615| 0| { 2616| 0| if ((yyval.modifier).alphabet != NULL) ------------------ | Branch (2616:15): [True: 0, False: 0] ------------------ 2617| 0| { 2618| 0| if (ss_compare((yyval.modifier).alphabet, (yyvsp[0].modifier).alphabet) != 0) ------------------ | Branch (2618:17): [True: 0, False: 0] ------------------ 2619| 0| { 2620| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2621| 0| compiler, "can not specify multiple alphabets"); 2622| | 2623| 0| yr_free((yyvsp[0].modifier).alphabet); 2624| 0| yr_free((yyval.modifier).alphabet); 2625| | 2626| 0| fail_with_error(ERROR_INVALID_MODIFIER); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 2627| 0| } 2628| 0| else 2629| 0| { 2630| 0| yr_free((yyvsp[0].modifier).alphabet); 2631| 0| } 2632| 0| } 2633| 0| else 2634| 0| { 2635| 0| (yyval.modifier).alphabet = (yyvsp[0].modifier).alphabet; 2636| 0| } 2637| 0| } 2638| | 2639| 0| if ((yyval.modifier).flags & (yyvsp[0].modifier).flags) ------------------ | Branch (2639:13): [True: 0, False: 0] ------------------ 2640| 0| { 2641| 0| if ((yyval.modifier).alphabet != NULL) ------------------ | Branch (2641:15): [True: 0, False: 0] ------------------ 2642| 0| yr_free((yyval.modifier).alphabet); 2643| | 2644| 0| fail_with_error(ERROR_DUPLICATED_MODIFIER); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 2645| 0| } 2646| 0| else 2647| 0| { 2648| 0| (yyval.modifier).flags = (yyval.modifier).flags | (yyvsp[0].modifier).flags; 2649| 0| } 2650| 0| } 2651| 0|#line 2652 "libyara/grammar.c" 2652| 0| break; 2653| | 2654| 0| case 44: /* string_modifier: "" */ ------------------ | Branch (2654:3): [True: 0, False: 342] ------------------ 2655| 0|#line 777 "libyara/grammar.y" 2656| 0| { (yyval.modifier).flags = STRING_FLAGS_WIDE; } ------------------ | | 70| 0|#define STRING_FLAGS_WIDE 0x10 ------------------ 2657| 0|#line 2658 "libyara/grammar.c" 2658| 0| break; 2659| | 2660| 0| case 45: /* string_modifier: "" */ ------------------ | Branch (2660:3): [True: 0, False: 342] ------------------ 2661| 0|#line 778 "libyara/grammar.y" 2662| 0| { (yyval.modifier).flags = STRING_FLAGS_ASCII; } ------------------ | | 69| 0|#define STRING_FLAGS_ASCII 0x08 ------------------ 2663| 0|#line 2664 "libyara/grammar.c" 2664| 0| break; 2665| | 2666| 0| case 46: /* string_modifier: "" */ ------------------ | Branch (2666:3): [True: 0, False: 342] ------------------ 2667| 0|#line 779 "libyara/grammar.y" 2668| 0| { (yyval.modifier).flags = STRING_FLAGS_NO_CASE; } ------------------ | | 68| 0|#define STRING_FLAGS_NO_CASE 0x04 ------------------ 2669| 0|#line 2670 "libyara/grammar.c" 2670| 0| break; 2671| | 2672| 0| case 47: /* string_modifier: "" */ ------------------ | Branch (2672:3): [True: 0, False: 342] ------------------ 2673| 0|#line 780 "libyara/grammar.y" 2674| 0| { (yyval.modifier).flags = STRING_FLAGS_FULL_WORD; } ------------------ | | 73| 0|#define STRING_FLAGS_FULL_WORD 0x80 ------------------ 2675| 0|#line 2676 "libyara/grammar.c" 2676| 0| break; 2677| | 2678| 0| case 48: /* string_modifier: "" */ ------------------ | Branch (2678:3): [True: 0, False: 342] ------------------ 2679| 0|#line 781 "libyara/grammar.y" 2680| 0| { (yyval.modifier).flags = STRING_FLAGS_PRIVATE; } ------------------ | | 86| 0|#define STRING_FLAGS_PRIVATE 0x100000 ------------------ 2681| 0|#line 2682 "libyara/grammar.c" 2682| 0| break; 2683| | 2684| 0| case 49: /* string_modifier: "" */ ------------------ | Branch (2684:3): [True: 0, False: 342] ------------------ 2685| 0|#line 783 "libyara/grammar.y" 2686| 0| { 2687| 0| (yyval.modifier).flags = STRING_FLAGS_XOR; ------------------ | | 85| 0|#define STRING_FLAGS_XOR 0x80000 ------------------ 2688| 0| (yyval.modifier).xor_min = 0; 2689| 0| (yyval.modifier).xor_max = 255; 2690| 0| } 2691| 0|#line 2692 "libyara/grammar.c" 2692| 0| break; 2693| | 2694| 0| case 50: /* string_modifier: "" '(' "integer number" ')' */ ------------------ | Branch (2694:3): [True: 0, False: 342] ------------------ 2695| 0|#line 789 "libyara/grammar.y" 2696| 0| { 2697| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 2698| | 2699| 0| if ((yyvsp[-1].integer) < 0 || (yyvsp[-1].integer) > 255) ------------------ | Branch (2699:13): [True: 0, False: 0] | Branch (2699:40): [True: 0, False: 0] ------------------ 2700| 0| { 2701| 0| yr_compiler_set_error_extra_info(compiler, "invalid xor range"); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2702| 0| result = ERROR_INVALID_MODIFIER; ------------------ | | 106| 0|#define ERROR_INVALID_MODIFIER 59 ------------------ 2703| 0| } 2704| | 2705| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2706| | 2707| 0| (yyval.modifier).flags = STRING_FLAGS_XOR; ------------------ | | 85| 0|#define STRING_FLAGS_XOR 0x80000 ------------------ 2708| 0| (yyval.modifier).xor_min = (uint8_t) (yyvsp[-1].integer); 2709| 0| (yyval.modifier).xor_max = (uint8_t) (yyvsp[-1].integer); 2710| 0| } 2711| 0|#line 2712 "libyara/grammar.c" 2712| 0| break; 2713| | 2714| 0| case 51: /* string_modifier: "" '(' "integer number" '-' "integer number" ')' */ ------------------ | Branch (2714:3): [True: 0, False: 342] ------------------ 2715| 0|#line 810 "libyara/grammar.y" 2716| 0| { 2717| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 2718| | 2719| 0| if ((yyvsp[-3].integer) < 0) ------------------ | Branch (2719:13): [True: 0, False: 0] ------------------ 2720| 0| { 2721| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2722| 0| compiler, "lower bound for xor range exceeded (min: 0)"); 2723| 0| result = ERROR_INVALID_MODIFIER; ------------------ | | 106| 0|#define ERROR_INVALID_MODIFIER 59 ------------------ 2724| 0| } 2725| | 2726| 0| if ((yyvsp[-1].integer) > 255) ------------------ | Branch (2726:13): [True: 0, False: 0] ------------------ 2727| 0| { 2728| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2729| 0| compiler, "upper bound for xor range exceeded (max: 255)"); 2730| 0| result = ERROR_INVALID_MODIFIER; ------------------ | | 106| 0|#define ERROR_INVALID_MODIFIER 59 ------------------ 2731| 0| } 2732| | 2733| 0| if ((yyvsp[-3].integer) > (yyvsp[-1].integer)) ------------------ | Branch (2733:13): [True: 0, False: 0] ------------------ 2734| 0| { 2735| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2736| 0| compiler, "xor lower bound exceeds upper bound"); 2737| 0| result = ERROR_INVALID_MODIFIER; ------------------ | | 106| 0|#define ERROR_INVALID_MODIFIER 59 ------------------ 2738| 0| } 2739| | 2740| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2741| | 2742| 0| (yyval.modifier).flags = STRING_FLAGS_XOR; ------------------ | | 85| 0|#define STRING_FLAGS_XOR 0x80000 ------------------ 2743| 0| (yyval.modifier).xor_min = (uint8_t) (yyvsp[-3].integer); 2744| 0| (yyval.modifier).xor_max = (uint8_t) (yyvsp[-1].integer); 2745| 0| } 2746| 0|#line 2747 "libyara/grammar.c" 2747| 0| break; 2748| | 2749| 0| case 52: /* string_modifier: "" */ ------------------ | Branch (2749:3): [True: 0, False: 342] ------------------ 2750| 0|#line 841 "libyara/grammar.y" 2751| 0| { 2752| 0| (yyval.modifier).flags = STRING_FLAGS_BASE64; ------------------ | | 87| 0|#define STRING_FLAGS_BASE64 0x200000 ------------------ 2753| 0| (yyval.modifier).alphabet = ss_new(DEFAULT_BASE64_ALPHABET); ------------------ | | 200| 0| "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ------------------ 2754| 0| } 2755| 0|#line 2756 "libyara/grammar.c" 2756| 0| break; 2757| | 2758| 0| case 53: /* string_modifier: "" '(' "text string" ')' */ ------------------ | Branch (2758:3): [True: 0, False: 342] ------------------ 2759| 0|#line 846 "libyara/grammar.y" 2760| 0| { 2761| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 2762| | 2763| 0| if ((yyvsp[-1].sized_string)->length != 64) ------------------ | Branch (2763:13): [True: 0, False: 0] ------------------ 2764| 0| { 2765| 0| yr_free((yyvsp[-1].sized_string)); 2766| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2767| 0| compiler, "length of base64 alphabet must be 64"); 2768| 0| result = ERROR_INVALID_MODIFIER; ------------------ | | 106| 0|#define ERROR_INVALID_MODIFIER 59 ------------------ 2769| 0| } 2770| | 2771| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2772| | 2773| 0| (yyval.modifier).flags = STRING_FLAGS_BASE64; ------------------ | | 87| 0|#define STRING_FLAGS_BASE64 0x200000 ------------------ 2774| 0| (yyval.modifier).alphabet = (yyvsp[-1].sized_string); 2775| 0| } 2776| 0|#line 2777 "libyara/grammar.c" 2777| 0| break; 2778| | 2779| 0| case 54: /* string_modifier: "" */ ------------------ | Branch (2779:3): [True: 0, False: 342] ------------------ 2780| 0|#line 863 "libyara/grammar.y" 2781| 0| { 2782| 0| (yyval.modifier).flags = STRING_FLAGS_BASE64_WIDE; ------------------ | | 88| 0|#define STRING_FLAGS_BASE64_WIDE 0x400000 ------------------ 2783| 0| (yyval.modifier).alphabet = ss_new(DEFAULT_BASE64_ALPHABET); ------------------ | | 200| 0| "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ------------------ 2784| 0| } 2785| 0|#line 2786 "libyara/grammar.c" 2786| 0| break; 2787| | 2788| 0| case 55: /* string_modifier: "" '(' "text string" ')' */ ------------------ | Branch (2788:3): [True: 0, False: 342] ------------------ 2789| 0|#line 868 "libyara/grammar.y" 2790| 0| { 2791| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 2792| | 2793| 0| if ((yyvsp[-1].sized_string)->length != 64) ------------------ | Branch (2793:13): [True: 0, False: 0] ------------------ 2794| 0| { 2795| 0| yr_free((yyvsp[-1].sized_string)); 2796| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2797| 0| compiler, "length of base64 alphabet must be 64"); 2798| 0| result = ERROR_INVALID_MODIFIER; ------------------ | | 106| 0|#define ERROR_INVALID_MODIFIER 59 ------------------ 2799| 0| } 2800| | 2801| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2802| | 2803| 0| (yyval.modifier).flags = STRING_FLAGS_BASE64_WIDE; ------------------ | | 88| 0|#define STRING_FLAGS_BASE64_WIDE 0x400000 ------------------ 2804| 0| (yyval.modifier).alphabet = (yyvsp[-1].sized_string); 2805| 0| } 2806| 0|#line 2807 "libyara/grammar.c" 2807| 0| break; 2808| | 2809| 0| case 56: /* regexp_modifiers: %empty */ ------------------ | Branch (2809:3): [True: 0, False: 342] ------------------ 2810| 0|#line 887 "libyara/grammar.y" 2811| 0| { (yyval.modifier).flags = 0; } 2812| 0|#line 2813 "libyara/grammar.c" 2813| 0| break; 2814| | 2815| 0| case 57: /* regexp_modifiers: regexp_modifiers regexp_modifier */ ------------------ | Branch (2815:3): [True: 0, False: 342] ------------------ 2816| 0|#line 889 "libyara/grammar.y" 2817| 0| { 2818| 0| if ((yyvsp[-1].modifier).flags & (yyvsp[0].modifier).flags) ------------------ | Branch (2818:13): [True: 0, False: 0] ------------------ 2819| 0| { 2820| 0| fail_with_error(ERROR_DUPLICATED_MODIFIER); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 2821| 0| } 2822| 0| else 2823| 0| { 2824| 0| (yyval.modifier).flags = (yyvsp[-1].modifier).flags | (yyvsp[0].modifier).flags; 2825| 0| } 2826| 0| } 2827| 0|#line 2828 "libyara/grammar.c" 2828| 0| break; 2829| | 2830| 0| case 58: /* regexp_modifier: "" */ ------------------ | Branch (2830:3): [True: 0, False: 342] ------------------ 2831| 0|#line 902 "libyara/grammar.y" 2832| 0| { (yyval.modifier).flags = STRING_FLAGS_WIDE; } ------------------ | | 70| 0|#define STRING_FLAGS_WIDE 0x10 ------------------ 2833| 0|#line 2834 "libyara/grammar.c" 2834| 0| break; 2835| | 2836| 0| case 59: /* regexp_modifier: "" */ ------------------ | Branch (2836:3): [True: 0, False: 342] ------------------ 2837| 0|#line 903 "libyara/grammar.y" 2838| 0| { (yyval.modifier).flags = STRING_FLAGS_ASCII; } ------------------ | | 69| 0|#define STRING_FLAGS_ASCII 0x08 ------------------ 2839| 0|#line 2840 "libyara/grammar.c" 2840| 0| break; 2841| | 2842| 0| case 60: /* regexp_modifier: "" */ ------------------ | Branch (2842:3): [True: 0, False: 342] ------------------ 2843| 0|#line 904 "libyara/grammar.y" 2844| 0| { (yyval.modifier).flags = STRING_FLAGS_NO_CASE; } ------------------ | | 68| 0|#define STRING_FLAGS_NO_CASE 0x04 ------------------ 2845| 0|#line 2846 "libyara/grammar.c" 2846| 0| break; 2847| | 2848| 0| case 61: /* regexp_modifier: "" */ ------------------ | Branch (2848:3): [True: 0, False: 342] ------------------ 2849| 0|#line 905 "libyara/grammar.y" 2850| 0| { (yyval.modifier).flags = STRING_FLAGS_FULL_WORD; } ------------------ | | 73| 0|#define STRING_FLAGS_FULL_WORD 0x80 ------------------ 2851| 0|#line 2852 "libyara/grammar.c" 2852| 0| break; 2853| | 2854| 0| case 62: /* regexp_modifier: "" */ ------------------ | Branch (2854:3): [True: 0, False: 342] ------------------ 2855| 0|#line 906 "libyara/grammar.y" 2856| 0| { (yyval.modifier).flags = STRING_FLAGS_PRIVATE; } ------------------ | | 86| 0|#define STRING_FLAGS_PRIVATE 0x100000 ------------------ 2857| 0|#line 2858 "libyara/grammar.c" 2858| 0| break; 2859| | 2860| 0| case 63: /* hex_modifiers: %empty */ ------------------ | Branch (2860:3): [True: 0, False: 342] ------------------ 2861| 0|#line 910 "libyara/grammar.y" 2862| 0| { (yyval.modifier).flags = 0; } 2863| 0|#line 2864 "libyara/grammar.c" 2864| 0| break; 2865| | 2866| 0| case 64: /* hex_modifiers: hex_modifiers hex_modifier */ ------------------ | Branch (2866:3): [True: 0, False: 342] ------------------ 2867| 0|#line 912 "libyara/grammar.y" 2868| 0| { 2869| 0| if ((yyvsp[-1].modifier).flags & (yyvsp[0].modifier).flags) ------------------ | Branch (2869:13): [True: 0, False: 0] ------------------ 2870| 0| { 2871| 0| fail_with_error(ERROR_DUPLICATED_MODIFIER); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 2872| 0| } 2873| 0| else 2874| 0| { 2875| 0| (yyval.modifier).flags = (yyvsp[-1].modifier).flags | (yyvsp[0].modifier).flags; 2876| 0| } 2877| 0| } 2878| 0|#line 2879 "libyara/grammar.c" 2879| 0| break; 2880| | 2881| 0| case 65: /* hex_modifier: "" */ ------------------ | Branch (2881:3): [True: 0, False: 342] ------------------ 2882| 0|#line 925 "libyara/grammar.y" 2883| 0| { (yyval.modifier).flags = STRING_FLAGS_PRIVATE; } ------------------ | | 86| 0|#define STRING_FLAGS_PRIVATE 0x100000 ------------------ 2884| 0|#line 2885 "libyara/grammar.c" 2885| 0| break; 2886| | 2887| 18| case 66: /* identifier: "identifier" */ ------------------ | Branch (2887:3): [True: 18, False: 324] ------------------ 2888| 18|#line 930 "libyara/grammar.y" 2889| 18| { 2890| 18| YR_EXPRESSION expr; 2891| | 2892| 18| int result = ERROR_SUCCESS; ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ 2893| 18| int var_index = yr_parser_lookup_loop_variable(yyscanner, (yyvsp[0].c_string), &expr); 2894| | 2895| 18| if (var_index >= 0) ------------------ | Branch (2895:13): [True: 0, False: 18] ------------------ 2896| 0| { 2897| | // The identifier corresponds to a loop variable. 2898| 0| result = yr_parser_emit_with_arg( 2899| 0| yyscanner, 2900| 0| OP_PUSH_M, ------------------ | | 82| 0|#define OP_PUSH_M 34 ------------------ 2901| 0| var_index, 2902| 0| NULL, 2903| 0| NULL); 2904| | 2905| | // The expression associated to this identifier is the same one 2906| | // associated to the loop variable. 2907| 0| (yyval.expression) = expr; 2908| 0| } 2909| 18| else 2910| 18| { 2911| | // Search for identifier within the global namespace, where the 2912| | // externals variables reside. 2913| | 2914| 18| YR_OBJECT* object = (YR_OBJECT*) yr_hash_table_lookup( 2915| 18| compiler->objects_table, (yyvsp[0].c_string), NULL); 2916| | 2917| 18| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 2918| 18| compiler->arena, 2919| 18| YR_NAMESPACES_TABLE, ------------------ | | 57| 18|#define YR_NAMESPACES_TABLE 0 ------------------ 2920| 18| compiler->current_namespace_idx * sizeof(struct YR_NAMESPACE)); 2921| | 2922| 18| if (object == NULL) ------------------ | Branch (2922:15): [True: 18, False: 0] ------------------ 2923| 18| { 2924| | // If not found, search within the current namespace. 2925| 18| object = (YR_OBJECT*) yr_hash_table_lookup( 2926| 18| compiler->objects_table, (yyvsp[0].c_string), ns->name); 2927| 18| } 2928| | 2929| 18| if (object != NULL) ------------------ | Branch (2929:15): [True: 18, False: 0] ------------------ 2930| 18| { 2931| 18| YR_ARENA_REF ref; 2932| | 2933| 18| result = _yr_compiler_store_string( 2934| 18| compiler, (yyvsp[0].c_string), &ref); 2935| | 2936| 18| if (result == ERROR_SUCCESS) ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ | Branch (2936:17): [True: 18, False: 0] ------------------ 2937| 18| result = yr_parser_emit_with_arg_reloc( 2938| 18| yyscanner, 2939| 18| OP_OBJ_LOAD, ------------------ | | 64| 18|#define OP_OBJ_LOAD 16 ------------------ 2940| 18| yr_arena_ref_to_ptr(compiler->arena, &ref), 2941| 18| NULL, 2942| 18| NULL); 2943| | 2944| 18| (yyval.expression).type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 18|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 2945| 18| (yyval.expression).value.object = object; 2946| 18| (yyval.expression).identifier.ptr = NULL; 2947| 18| (yyval.expression).identifier.ref = ref; 2948| 18| } 2949| 0| else 2950| 0| { 2951| 0| uint32_t rule_idx = yr_hash_table_lookup_uint32( 2952| 0| compiler->rules_table, (yyvsp[0].c_string), ns->name); 2953| | 2954| 0| if (rule_idx != UINT32_MAX) ------------------ | Branch (2954:17): [True: 0, False: 0] ------------------ 2955| 0| { 2956| 0| result = yr_parser_emit_with_arg( 2957| 0| yyscanner, 2958| 0| OP_PUSH_RULE, ------------------ | | 75| 0|#define OP_PUSH_RULE 27 ------------------ 2959| 0| rule_idx, 2960| 0| NULL, 2961| 0| NULL); 2962| | 2963| 0| YR_RULE* rule = _yr_compiler_get_rule_by_idx(compiler, rule_idx); 2964| | 2965| 0| yr_arena_ptr_to_ref(compiler->arena, rule->identifier, &(yyval.expression).identifier.ref); 2966| | 2967| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 2968| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 2969| 0| (yyval.expression).identifier.ptr = NULL; 2970| 0| (yyval.expression).required_strings.count = 0; 2971| 0| } 2972| 0| else 2973| 0| { 2974| 0| yr_compiler_set_error_extra_info(compiler, (yyvsp[0].c_string)); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2975| 0| result = ERROR_UNDEFINED_IDENTIFIER; ------------------ | | 65| 0|#define ERROR_UNDEFINED_IDENTIFIER 20 ------------------ 2976| 0| } 2977| 0| } 2978| 18| } 2979| | 2980| 18| yr_free((yyvsp[0].c_string)); 2981| | 2982| 18| fail_if_error(result); ------------------ | | 135| 18| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 36|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 18|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 18] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 18| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 2983| 18| } 2984| 0|#line 2985 "libyara/grammar.c" 2985| 0| break; 2986| | 2987| 18| case 67: /* identifier: identifier '.' "identifier" */ ------------------ | Branch (2987:3): [True: 18, False: 324] ------------------ 2988| 18|#line 1026 "libyara/grammar.y" 2989| 18| { 2990| 18| int result = ERROR_SUCCESS; ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ 2991| 18| YR_OBJECT* field = NULL; 2992| | 2993| 18| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_OBJECT && ------------------ | | 50| 36|#define EXPRESSION_TYPE_OBJECT 16 ------------------ | Branch (2993:13): [True: 18, False: 0] ------------------ 2994| 18| (yyvsp[-2].expression).value.object->type == OBJECT_TYPE_STRUCTURE) ------------------ | | 60| 18|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (2994:13): [True: 18, False: 0] ------------------ 2995| 18| { 2996| 18| field = yr_object_lookup_field((yyvsp[-2].expression).value.object, (yyvsp[0].c_string)); 2997| | 2998| 18| if (field != NULL) ------------------ | Branch (2998:15): [True: 18, False: 0] ------------------ 2999| 18| { 3000| 18| YR_ARENA_REF ref; 3001| | 3002| 18| result = _yr_compiler_store_string( 3003| 18| compiler, (yyvsp[0].c_string), &ref); 3004| | 3005| 18| if (result == ERROR_SUCCESS) ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ | Branch (3005:17): [True: 18, False: 0] ------------------ 3006| 18| result = yr_parser_emit_with_arg_reloc( 3007| 18| yyscanner, 3008| 18| OP_OBJ_FIELD, ------------------ | | 66| 18|#define OP_OBJ_FIELD 18 ------------------ 3009| 18| yr_arena_ref_to_ptr(compiler->arena, &ref), 3010| 18| NULL, 3011| 18| NULL); 3012| | 3013| 18| (yyval.expression).type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 18|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 3014| 18| (yyval.expression).value.object = field; 3015| 18| (yyval.expression).identifier.ref = ref; 3016| 18| (yyval.expression).identifier.ptr = NULL; 3017| 18| } 3018| 0| else 3019| 0| { 3020| 0| yr_compiler_set_error_extra_info(compiler, (yyvsp[0].c_string)); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3021| 0| result = ERROR_INVALID_FIELD_NAME; ------------------ | | 80| 0|#define ERROR_INVALID_FIELD_NAME 33 ------------------ 3022| 0| } 3023| 18| } 3024| 0| else 3025| 0| { 3026| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | ------------------ | | | Branch (322:7): [True: 0, False: 0] | | ------------------ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3027| 0| compiler, expression_identifier((yyvsp[-2].expression))); 3028| | 3029| 0| result = ERROR_NOT_A_STRUCTURE; ------------------ | | 82| 0|#define ERROR_NOT_A_STRUCTURE 35 ------------------ 3030| 0| } 3031| | 3032| 18| yr_free((yyvsp[0].c_string)); 3033| | 3034| 18| fail_if_error(result); ------------------ | | 135| 18| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 36|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 18|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 18] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 18| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3035| 18| } 3036| 0|#line 3037 "libyara/grammar.c" 3037| 0| break; 3038| | 3039| 0| case 68: /* identifier: identifier '[' primary_expression ']' */ ------------------ | Branch (3039:3): [True: 0, False: 342] ------------------ 3040| 0|#line 1074 "libyara/grammar.y" 3041| 0| { 3042| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 3043| 0| YR_OBJECT_ARRAY* array; 3044| 0| YR_OBJECT_DICTIONARY* dict; 3045| | 3046| 0| if ((yyvsp[-3].expression).type == EXPRESSION_TYPE_OBJECT && ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ | Branch (3046:13): [True: 0, False: 0] ------------------ 3047| 0| (yyvsp[-3].expression).value.object->type == OBJECT_TYPE_ARRAY) ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (3047:13): [True: 0, False: 0] ------------------ 3048| 0| { 3049| 0| if ((yyvsp[-1].expression).type != EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3049:15): [True: 0, False: 0] ------------------ 3050| 0| { 3051| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3052| 0| compiler, "array indexes must be of integer type"); 3053| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 3054| 0| } 3055| | 3056| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3057| | 3058| 0| result = yr_parser_emit( 3059| 0| yyscanner, OP_INDEX_ARRAY, NULL); ------------------ | | 67| 0|#define OP_INDEX_ARRAY 19 ------------------ 3060| | 3061| 0| array = object_as_array((yyvsp[-3].expression).value.object); ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 3062| | 3063| 0| (yyval.expression).type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 3064| 0| (yyval.expression).value.object = array->prototype_item; 3065| 0| (yyval.expression).identifier.ptr = array->identifier; 3066| 0| (yyval.expression).identifier.ref = YR_ARENA_NULL_REF; ------------------ | | 43| 0| (YR_ARENA_REF) \ | | 44| 0| { \ | | 45| 0| UINT32_MAX, UINT32_MAX \ | | 46| 0| } ------------------ 3067| 0| } 3068| 0| else if ((yyvsp[-3].expression).type == EXPRESSION_TYPE_OBJECT && ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ | Branch (3068:18): [True: 0, False: 0] ------------------ 3069| 0| (yyvsp[-3].expression).value.object->type == OBJECT_TYPE_DICTIONARY) ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (3069:18): [True: 0, False: 0] ------------------ 3070| 0| { 3071| 0| if ((yyvsp[-1].expression).type != EXPRESSION_TYPE_STRING) ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (3071:15): [True: 0, False: 0] ------------------ 3072| 0| { 3073| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3074| 0| compiler, "dictionary keys must be of string type"); 3075| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 3076| 0| } 3077| | 3078| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3079| | 3080| 0| result = yr_parser_emit( 3081| 0| yyscanner, OP_LOOKUP_DICT, NULL); ------------------ | | 90| 0|#define OP_LOOKUP_DICT 42 ------------------ 3082| | 3083| 0| dict = object_as_dictionary((yyvsp[-3].expression).value.object); ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 3084| | 3085| 0| (yyval.expression).type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 3086| 0| (yyval.expression).value.object = dict->prototype_item; 3087| 0| (yyval.expression).identifier.ptr = dict->identifier; 3088| 0| (yyval.expression).identifier.ref = YR_ARENA_NULL_REF; ------------------ | | 43| 0| (YR_ARENA_REF) \ | | 44| 0| { \ | | 45| 0| UINT32_MAX, UINT32_MAX \ | | 46| 0| } ------------------ 3089| 0| } 3090| 0| else 3091| 0| { 3092| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | ------------------ | | | Branch (322:7): [True: 0, False: 0] | | ------------------ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3093| 0| compiler, expression_identifier((yyvsp[-3].expression))); 3094| | 3095| 0| result = ERROR_NOT_INDEXABLE; ------------------ | | 83| 0|#define ERROR_NOT_INDEXABLE 36 ------------------ 3096| 0| } 3097| | 3098| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3099| 0| } 3100| 0|#line 3101 "libyara/grammar.c" 3101| 0| break; 3102| | 3103| 18| case 69: /* identifier: identifier '(' arguments ')' */ ------------------ | Branch (3103:3): [True: 18, False: 324] ------------------ 3104| 18|#line 1135 "libyara/grammar.y" 3105| 18| { 3106| 18| YR_ARENA_REF ref = YR_ARENA_NULL_REF; ------------------ | | 43| 18| (YR_ARENA_REF) \ | | 44| 18| { \ | | 45| 18| UINT32_MAX, UINT32_MAX \ | | 46| 18| } ------------------ 3107| 18| int result = ERROR_SUCCESS; ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ 3108| | 3109| 18| if ((yyvsp[-3].expression).type == EXPRESSION_TYPE_OBJECT && ------------------ | | 50| 36|#define EXPRESSION_TYPE_OBJECT 16 ------------------ | Branch (3109:13): [True: 18, False: 0] ------------------ 3110| 18| (yyvsp[-3].expression).value.object->type == OBJECT_TYPE_FUNCTION) ------------------ | | 62| 18|#define OBJECT_TYPE_FUNCTION 5 ------------------ | Branch (3110:13): [True: 18, False: 0] ------------------ 3111| 18| { 3112| 18| YR_OBJECT_FUNCTION* function = object_as_function((yyvsp[-3].expression).value.object); ------------------ | | 912| 18|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 3113| | 3114| 18| result = yr_parser_check_types(compiler, function, (yyvsp[-1].c_string)); 3115| | 3116| 18| if (result == ERROR_SUCCESS) ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ | Branch (3116:15): [True: 18, False: 0] ------------------ 3117| 18| result = _yr_compiler_store_string( 3118| 18| compiler, (yyvsp[-1].c_string), &ref); 3119| | 3120| 18| if (result == ERROR_SUCCESS) ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ | Branch (3120:15): [True: 18, False: 0] ------------------ 3121| 18| result = yr_parser_emit_with_arg_reloc( 3122| 18| yyscanner, 3123| 18| OP_CALL, ------------------ | | 63| 18|#define OP_CALL 15 ------------------ 3124| 18| yr_arena_ref_to_ptr(compiler->arena, &ref), 3125| 18| NULL, 3126| 18| NULL); 3127| | 3128| 18| (yyval.expression).type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 18|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 3129| 18| (yyval.expression).value.object = function->return_obj; 3130| 18| (yyval.expression).identifier.ref = ref; 3131| 18| (yyval.expression).identifier.ptr = NULL; 3132| 18| } 3133| 0| else 3134| 0| { 3135| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | ------------------ | | | Branch (322:7): [True: 0, False: 0] | | ------------------ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3136| 0| compiler, expression_identifier((yyvsp[-3].expression))); 3137| | 3138| 0| result = ERROR_NOT_A_FUNCTION; ------------------ | | 84| 0|#define ERROR_NOT_A_FUNCTION 37 ------------------ 3139| 0| } 3140| | 3141| 18| yr_free((yyvsp[-1].c_string)); 3142| | 3143| 18| fail_if_error(result); ------------------ | | 135| 18| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 36|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 18|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 18] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 18| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3144| 18| } 3145| 0|#line 3146 "libyara/grammar.c" 3146| 0| break; 3147| | 3148| 0| case 70: /* arguments: %empty */ ------------------ | Branch (3148:3): [True: 0, False: 342] ------------------ 3149| 0|#line 1179 "libyara/grammar.y" 3150| 0| { (yyval.c_string) = yr_strdup(""); } 3151| 0|#line 3152 "libyara/grammar.c" 3152| 0| break; 3153| | 3154| 18| case 71: /* arguments: arguments_list */ ------------------ | Branch (3154:3): [True: 18, False: 324] ------------------ 3155| 18|#line 1180 "libyara/grammar.y" 3156| 18| { (yyval.c_string) = (yyvsp[0].c_string); } 3157| 18|#line 3158 "libyara/grammar.c" 3158| 18| break; 3159| | 3160| 18| case 72: /* arguments_list: expression */ ------------------ | Branch (3160:3): [True: 18, False: 324] ------------------ 3161| 18|#line 1185 "libyara/grammar.y" 3162| 18| { 3163| 18| (yyval.c_string) = (char*) yr_malloc(YR_MAX_FUNCTION_ARGS + 1); ------------------ | | 130| 18|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3164| | 3165| 18| if ((yyval.c_string) == NULL) ------------------ | Branch (3165:13): [True: 0, False: 18] ------------------ 3166| 18| fail_with_error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3167| | 3168| 18| switch((yyvsp[0].expression).type) 3169| 18| { 3170| 18| case EXPRESSION_TYPE_INTEGER: ------------------ | | 47| 18|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3170:11): [True: 18, False: 0] ------------------ 3171| 18| strlcpy((yyval.c_string), "i", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 18|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3172| 18| break; 3173| 0| case EXPRESSION_TYPE_FLOAT: ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (3173:11): [True: 0, False: 18] ------------------ 3174| 0| strlcpy((yyval.c_string), "f", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3175| 0| break; 3176| 0| case EXPRESSION_TYPE_BOOLEAN: ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ | Branch (3176:11): [True: 0, False: 18] ------------------ 3177| 0| strlcpy((yyval.c_string), "b", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3178| 0| break; 3179| 0| case EXPRESSION_TYPE_STRING: ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (3179:11): [True: 0, False: 18] ------------------ 3180| 0| strlcpy((yyval.c_string), "s", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3181| 0| break; 3182| 0| case EXPRESSION_TYPE_REGEXP: ------------------ | | 49| 0|#define EXPRESSION_TYPE_REGEXP 8 ------------------ | Branch (3182:11): [True: 0, False: 18] ------------------ 3183| 0| strlcpy((yyval.c_string), "r", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3184| 0| break; 3185| 0| case EXPRESSION_TYPE_UNKNOWN: ------------------ | | 45| 0|#define EXPRESSION_TYPE_UNKNOWN 0 ------------------ | Branch (3185:11): [True: 0, False: 18] ------------------ 3186| 0| yr_free((yyval.c_string)); 3187| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3188| 0| compiler, "unknown type for argument 1 in function call"); 3189| 0| fail_with_error(ERROR_WRONG_TYPE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3190| 0| break; 3191| 0| default: ------------------ | Branch (3191:11): [True: 0, False: 18] ------------------ 3192| | // An unknown expression type is OK iff an error ocurred. 3193| 0| assert(compiler->last_error != ERROR_SUCCESS); ------------------ | Branch (3193:13): [True: 0, False: 0] | Branch (3193:13): [True: 0, False: 0] ------------------ 3194| 18| } 3195| 18| } 3196| 18|#line 3197 "libyara/grammar.c" 3197| 18| break; 3198| | 3199| 24| case 73: /* arguments_list: arguments_list ',' expression */ ------------------ | Branch (3199:3): [True: 24, False: 318] ------------------ 3200| 24|#line 1220 "libyara/grammar.y" 3201| 24| { 3202| 24| int result = ERROR_SUCCESS; ------------------ | | 40| 24|#define ERROR_SUCCESS 0 ------------------ 3203| | 3204| 24| if (strlen((yyvsp[-2].c_string)) == YR_MAX_FUNCTION_ARGS) ------------------ | | 130| 24|#define YR_MAX_FUNCTION_ARGS 128 ------------------ | Branch (3204:13): [True: 0, False: 24] ------------------ 3205| 0| { 3206| 0| result = ERROR_TOO_MANY_ARGUMENTS; ------------------ | | 86| 0|#define ERROR_TOO_MANY_ARGUMENTS 39 ------------------ 3207| 0| } 3208| 24| else 3209| 24| { 3210| 24| switch((yyvsp[0].expression).type) 3211| 24| { 3212| 22| case EXPRESSION_TYPE_INTEGER: ------------------ | | 47| 22|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3212:13): [True: 22, False: 2] ------------------ 3213| 22| strlcat((yyvsp[-2].c_string), "i", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 22|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3214| 22| break; 3215| 2| case EXPRESSION_TYPE_FLOAT: ------------------ | | 51| 2|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (3215:13): [True: 2, False: 22] ------------------ 3216| 2| strlcat((yyvsp[-2].c_string), "f", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 2|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3217| 2| break; 3218| 0| case EXPRESSION_TYPE_BOOLEAN: ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ | Branch (3218:13): [True: 0, False: 24] ------------------ 3219| 0| strlcat((yyvsp[-2].c_string), "b", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3220| 0| break; 3221| 0| case EXPRESSION_TYPE_STRING: ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (3221:13): [True: 0, False: 24] ------------------ 3222| 0| strlcat((yyvsp[-2].c_string), "s", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3223| 0| break; 3224| 0| case EXPRESSION_TYPE_REGEXP: ------------------ | | 49| 0|#define EXPRESSION_TYPE_REGEXP 8 ------------------ | Branch (3224:13): [True: 0, False: 24] ------------------ 3225| 0| strlcat((yyvsp[-2].c_string), "r", YR_MAX_FUNCTION_ARGS); ------------------ | | 130| 0|#define YR_MAX_FUNCTION_ARGS 128 ------------------ 3226| 0| break; 3227| 0| case EXPRESSION_TYPE_UNKNOWN: ------------------ | | 45| 0|#define EXPRESSION_TYPE_UNKNOWN 0 ------------------ | Branch (3227:13): [True: 0, False: 24] ------------------ 3228| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 3229| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 3230| 0| compiler, "unknown type for argument %zu in function call", 3231| | // As we add one character per argument, the length of $1 is 3232| | // the number of arguments parsed so far, and the argument 3233| | // represented by is length of $1 plus one. 3234| 0| strlen((yyvsp[-2].c_string)) + 1); 3235| 0| break; 3236| 0| default: ------------------ | Branch (3236:13): [True: 0, False: 24] ------------------ 3237| | // An unknown expression type is OK iff an error ocurred. 3238| 0| assert(compiler->last_error != ERROR_SUCCESS); ------------------ | Branch (3238:15): [True: 0, False: 0] | Branch (3238:15): [True: 0, False: 0] ------------------ 3239| 24| } 3240| 24| } 3241| | 3242| 24| if (result != ERROR_SUCCESS) ------------------ | | 40| 24|#define ERROR_SUCCESS 0 ------------------ | Branch (3242:13): [True: 0, False: 24] ------------------ 3243| 0| yr_free((yyvsp[-2].c_string)); 3244| | 3245| 24| fail_if_error(result); ------------------ | | 135| 24| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 48|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 24|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 24] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 24| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3246| | 3247| 24| (yyval.c_string) = (yyvsp[-2].c_string); 3248| 24| } 3249| 0|#line 3250 "libyara/grammar.c" 3250| 0| break; 3251| | 3252| 0| case 74: /* regexp: "regular expression" */ ------------------ | Branch (3252:3): [True: 0, False: 342] ------------------ 3253| 0|#line 1273 "libyara/grammar.y" 3254| 0| { 3255| 0| YR_ARENA_REF re_ref; 3256| 0| RE_ERROR error; 3257| | 3258| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 3259| 0| int re_flags = 0; 3260| 0| int parser_flags = RE_PARSER_FLAG_NONE; 3261| | 3262| 0| if ((yyvsp[0].sized_string)->flags & SIZED_STRING_FLAGS_NO_CASE) ------------------ | | 39| 0|#define SIZED_STRING_FLAGS_NO_CASE 1 ------------------ | Branch (3262:13): [True: 0, False: 0] ------------------ 3263| 0| re_flags |= RE_FLAGS_NO_CASE; ------------------ | | 98| 0|#define RE_FLAGS_NO_CASE 0x20 ------------------ 3264| | 3265| 0| if ((yyvsp[0].sized_string)->flags & SIZED_STRING_FLAGS_DOT_ALL) ------------------ | | 43| 0|#define SIZED_STRING_FLAGS_DOT_ALL 2 ------------------ | Branch (3265:13): [True: 0, False: 0] ------------------ 3266| 0| re_flags |= RE_FLAGS_DOT_ALL; ------------------ | | 100| 0|#define RE_FLAGS_DOT_ALL 0x80 ------------------ 3267| | 3268| 0| if (compiler->strict_escape) ------------------ | Branch (3268:13): [True: 0, False: 0] ------------------ 3269| 0| parser_flags |= RE_PARSER_FLAG_ENABLE_STRICT_ESCAPE_SEQUENCES; 3270| | 3271| 0| result = yr_re_compile( 3272| 0| (yyvsp[0].sized_string)->c_string, 3273| 0| re_flags, 3274| 0| parser_flags, 3275| 0| compiler->arena, 3276| 0| &re_ref, 3277| 0| &error); 3278| | 3279| 0| yr_free((yyvsp[0].sized_string)); 3280| | 3281| 0| if (result == ERROR_INVALID_REGULAR_EXPRESSION) ------------------ | | 54| 0|#define ERROR_INVALID_REGULAR_EXPRESSION 9 ------------------ | Branch (3281:13): [True: 0, False: 0] ------------------ 3282| 0| yr_compiler_set_error_extra_info(compiler, error.message); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3283| | 3284| 0| if (result == ERROR_SUCCESS || result == ERROR_UNKNOWN_ESCAPE_SEQUENCE) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ if (result == ERROR_SUCCESS || result == ERROR_UNKNOWN_ESCAPE_SEQUENCE) ------------------ | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 ------------------ | Branch (3284:13): [True: 0, False: 0] | Branch (3284:40): [True: 0, False: 0] ------------------ 3285| 0| { 3286| 0| if (result == ERROR_UNKNOWN_ESCAPE_SEQUENCE) ------------------ | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 ------------------ | Branch (3286:15): [True: 0, False: 0] ------------------ 3287| 0| { 3288| 0| yywarning( ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3289| 0| yyscanner, 3290| 0| "unknown escape sequence"); 3291| 0| } 3292| 0| result = yr_parser_emit_with_arg_reloc( 3293| 0| yyscanner, 3294| 0| OP_PUSH, ------------------ | | 61| 0|#define OP_PUSH 13 ------------------ 3295| 0| yr_arena_ref_to_ptr(compiler->arena, &re_ref), 3296| 0| NULL, 3297| 0| NULL); 3298| 0| } 3299| | 3300| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3301| | 3302| 0| (yyval.expression).type = EXPRESSION_TYPE_REGEXP; ------------------ | | 49| 0|#define EXPRESSION_TYPE_REGEXP 8 ------------------ 3303| 0| } 3304| 0|#line 3305 "libyara/grammar.c" 3305| 0| break; 3306| | 3307| 34| case 75: /* boolean_expression: expression */ ------------------ | Branch (3307:3): [True: 34, False: 308] ------------------ 3308| 34|#line 1328 "libyara/grammar.y" 3309| 34| { 3310| 34| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_STRING) ------------------ | | 48| 34|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (3310:13): [True: 0, False: 34] ------------------ 3311| 0| { 3312| 0| if (!YR_ARENA_IS_NULL_REF((yyvsp[0].expression).value.sized_string_ref)) ------------------ | | 49| 0| (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | (memcmp(&(ref), &YR_ARENA_NULL_REF, sizeof(YR_ARENA_NULL_REF)) == 0) | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ ------------------ | Branch (3312:15): [True: 0, False: 0] ------------------ 3313| 0| { 3314| 0| SIZED_STRING* sized_string = yr_arena_ref_to_ptr( 3315| 0| compiler->arena, &(yyvsp[0].expression).value.sized_string_ref); 3316| | 3317| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3318| 0| "using literal string \"%s\" in a boolean operation.", 3319| 0| sized_string->c_string); 3320| 0| } 3321| | 3322| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3323| 0| yyscanner, OP_STR_TO_BOOL, NULL)); 3324| 0| } 3325| 34| if ((yyvsp[0].expression).type != EXPRESSION_TYPE_BOOLEAN) ------------------ | | 46| 34|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ | Branch (3325:13): [True: 0, False: 34] ------------------ 3326| 0| { 3327| 0| (yyval.expression).required_strings.count = 0; 3328| 0| } 3329| 34| else 3330| 34| { 3331| 34| (yyval.expression).required_strings.count = (yyvsp[0].expression).required_strings.count; 3332| 34| } 3333| | 3334| 34| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 34|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3335| 34| } 3336| 0|#line 3337 "libyara/grammar.c" 3337| 0| break; 3338| | 3339| 0| case 76: /* expression: "" */ ------------------ | Branch (3339:3): [True: 0, False: 342] ------------------ 3340| 0|#line 1359 "libyara/grammar.y" 3341| 0| { 3342| 0| fail_if_error(yr_parser_emit_push_const(yyscanner, 1)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3343| | 3344| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3345| 0| (yyval.expression).required_strings.count = 0; 3346| 0| } 3347| 0|#line 3348 "libyara/grammar.c" 3348| 0| break; 3349| | 3350| 0| case 77: /* expression: "" */ ------------------ | Branch (3350:3): [True: 0, False: 342] ------------------ 3351| 0|#line 1366 "libyara/grammar.y" 3352| 0| { 3353| 0| fail_if_error(yr_parser_emit_push_const(yyscanner, 0)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3354| | 3355| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3356| 0| (yyval.expression).required_strings.count = 0; 3357| 0| } 3358| 0|#line 3359 "libyara/grammar.c" 3359| 0| break; 3360| | 3361| 0| case 78: /* expression: primary_expression "" regexp */ ------------------ | Branch (3361:3): [True: 0, False: 342] ------------------ 3362| 0|#line 1373 "libyara/grammar.y" 3363| 0| { 3364| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "matches"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3365| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_REGEXP, "matches"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3366| | 3367| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3368| 0| yyscanner, 3369| 0| OP_MATCHES, 3370| 0| NULL)); 3371| | 3372| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3373| 0| (yyval.expression).required_strings.count = 0; 3374| 0| } 3375| 0|#line 3376 "libyara/grammar.c" 3376| 0| break; 3377| | 3378| 0| case 79: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3378:3): [True: 0, False: 342] ------------------ 3379| 0|#line 1386 "libyara/grammar.y" 3380| 0| { 3381| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "contains"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3382| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "contains"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3383| | 3384| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3385| 0| yyscanner, OP_CONTAINS, NULL)); 3386| | 3387| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3388| 0| (yyval.expression).required_strings.count = 0; 3389| 0| } 3390| 0|#line 3391 "libyara/grammar.c" 3391| 0| break; 3392| | 3393| 0| case 80: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3393:3): [True: 0, False: 342] ------------------ 3394| 0|#line 1397 "libyara/grammar.y" 3395| 0| { 3396| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "icontains"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3397| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "icontains"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3398| | 3399| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3400| 0| yyscanner, OP_ICONTAINS, NULL)); 3401| | 3402| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3403| 0| (yyval.expression).required_strings.count = 0; 3404| 0| } 3405| 0|#line 3406 "libyara/grammar.c" 3406| 0| break; 3407| | 3408| 0| case 81: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3408:3): [True: 0, False: 342] ------------------ 3409| 0|#line 1408 "libyara/grammar.y" 3410| 0| { 3411| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "startswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3412| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "startswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3413| | 3414| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3415| 0| yyscanner, OP_STARTSWITH, NULL)); 3416| | 3417| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3418| 0| (yyval.expression).required_strings.count = 0; 3419| 0| } 3420| 0|#line 3421 "libyara/grammar.c" 3421| 0| break; 3422| | 3423| 0| case 82: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3423:3): [True: 0, False: 342] ------------------ 3424| 0|#line 1419 "libyara/grammar.y" 3425| 0| { 3426| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "istartswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3427| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "istartswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3428| | 3429| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3430| 0| yyscanner, OP_ISTARTSWITH, NULL)); 3431| | 3432| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3433| 0| (yyval.expression).required_strings.count = 0; 3434| 0| } 3435| 0|#line 3436 "libyara/grammar.c" 3436| 0| break; 3437| | 3438| 0| case 83: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3438:3): [True: 0, False: 342] ------------------ 3439| 0|#line 1430 "libyara/grammar.y" 3440| 0| { 3441| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "endswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3442| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "endswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3443| | 3444| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3445| 0| yyscanner, OP_ENDSWITH, NULL)); 3446| | 3447| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3448| 0| (yyval.expression).required_strings.count = 0; 3449| 0| } 3450| 0|#line 3451 "libyara/grammar.c" 3451| 0| break; 3452| | 3453| 0| case 84: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3453:3): [True: 0, False: 342] ------------------ 3454| 0|#line 1441 "libyara/grammar.y" 3455| 0| { 3456| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "iendswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3457| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "iendswith"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3458| | 3459| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3460| 0| yyscanner, OP_IENDSWITH, NULL)); 3461| | 3462| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3463| 0| (yyval.expression).required_strings.count = 0; 3464| 0| } 3465| 0|#line 3466 "libyara/grammar.c" 3466| 0| break; 3467| | 3468| 0| case 85: /* expression: primary_expression "" primary_expression */ ------------------ | Branch (3468:3): [True: 0, False: 342] ------------------ 3469| 0|#line 1452 "libyara/grammar.y" 3470| 0| { 3471| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_STRING, "iequals"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3472| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_STRING, "iequals"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3473| | 3474| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3475| 0| yyscanner, OP_IEQUALS, NULL)); 3476| | 3477| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3478| 0| (yyval.expression).required_strings.count = 0; 3479| 0| } 3480| 0|#line 3481 "libyara/grammar.c" 3481| 0| break; 3482| | 3483| 0| case 86: /* expression: "string identifier" */ ------------------ | Branch (3483:3): [True: 0, False: 342] ------------------ 3484| 0|#line 1463 "libyara/grammar.y" 3485| 0| { 3486| 0| int result = yr_parser_reduce_string_identifier( 3487| 0| yyscanner, 3488| 0| (yyvsp[0].c_string), 3489| 0| OP_FOUND, ------------------ | | 70| 0|#define OP_FOUND 22 ------------------ 3490| 0| YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 3491| | 3492| 0| yr_free((yyvsp[0].c_string)); 3493| | 3494| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3495| | 3496| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3497| 0| (yyval.expression).required_strings.count = 1; 3498| 0| } 3499| 0|#line 3500 "libyara/grammar.c" 3500| 0| break; 3501| | 3502| 0| case 87: /* expression: "string identifier" "" primary_expression */ ------------------ | Branch (3502:3): [True: 0, False: 342] ------------------ 3503| 0|#line 1478 "libyara/grammar.y" 3504| 0| { 3505| 0| int result; 3506| | 3507| 0| check_type_with_cleanup((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "at", yr_free((yyvsp[-2].c_string))); ------------------ | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | ------------------ | | | Branch (145:9): [True: 0, False: 0] | | ------------------ | | 146| 0| { \ | | 147| 0| switch(expression.type) \ | | ------------------ | | | Branch (147:14): [True: 0, False: 0] | | ------------------ | | 148| 0| { \ | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | ------------------ | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | ------------------ | | | Branch (149:9): [True: 0, False: 0] | | ------------------ | | 150| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | 152| 0| break; \ | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | ------------------ | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | ------------------ | | | Branch (153:9): [True: 0, False: 0] | | ------------------ | | 154| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | 156| 0| break; \ | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | ------------------ | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | ------------------ | | | Branch (157:9): [True: 0, False: 0] | | ------------------ | | 158| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | 160| 0| break; \ | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | ------------------ | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | ------------------ | | | Branch (161:9): [True: 0, False: 0] | | ------------------ | | 162| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | 164| 0| break; \ | | 165| 0| } \ | | 166| 0| cleanup; \ | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | ------------------ | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | ------------------ | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 169| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 170| 0| } ------------------ 3508| | 3509| 0| result = yr_parser_reduce_string_identifier( 3510| 0| yyscanner, (yyvsp[-2].c_string), OP_FOUND_AT, (yyvsp[0].expression).value.integer); ------------------ | | 71| 0|#define OP_FOUND_AT 23 ------------------ 3511| | 3512| 0| yr_free((yyvsp[-2].c_string)); 3513| | 3514| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3515| | 3516| 0| (yyval.expression).required_strings.count = 1; 3517| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3518| 0| } 3519| 0|#line 3520 "libyara/grammar.c" 3520| 0| break; 3521| | 3522| 0| case 88: /* expression: "string identifier" "" range */ ------------------ | Branch (3522:3): [True: 0, False: 342] ------------------ 3523| 0|#line 1494 "libyara/grammar.y" 3524| 0| { 3525| 0| int result = yr_parser_reduce_string_identifier( 3526| 0| yyscanner, (yyvsp[-2].c_string), OP_FOUND_IN, YR_UNDEFINED); ------------------ | | 72| 0|#define OP_FOUND_IN 24 ------------------ yyscanner, (yyvsp[-2].c_string), OP_FOUND_IN, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 3527| | 3528| 0| yr_free((yyvsp[-2].c_string)); 3529| | 3530| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3531| | 3532| 0| (yyval.expression).required_strings.count = 1; 3533| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3534| 0| } 3535| 0|#line 3536 "libyara/grammar.c" 3536| 0| break; 3537| | 3538| 0| case 89: /* expression: "" for_expression error */ ------------------ | Branch (3538:3): [True: 0, False: 342] ------------------ 3539| 0|#line 1506 "libyara/grammar.y" 3540| 0| { 3541| | // Free all the loop variable identifiers, including the variables for 3542| | // the current loop (represented by loop_index), and set loop_index to 3543| | // -1. This is OK even if we have nested loops. If an error occurs while 3544| | // parsing the inner loop, it will be propagated to the outer loop 3545| | // anyways, so it's safe to do this cleanup while processing the error 3546| | // for the inner loop. 3547| | 3548| 0| for (int i = 0; i <= compiler->loop_index; i++) ------------------ | Branch (3548:25): [True: 0, False: 0] ------------------ 3549| 0| { 3550| 0| loop_vars_cleanup(i); ------------------ | | 179| 0| { \ | | 180| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[loop_index]; \ | | 181| 0| for (int i = 0; i < loop_ctx->vars_count; i++) \ | | ------------------ | | | Branch (181:23): [True: 0, False: 0] | | ------------------ | | 182| 0| { \ | | 183| 0| yr_free((void*) loop_ctx->vars[i].identifier.ptr); \ | | 184| 0| loop_ctx->vars[i].identifier.ptr = NULL; \ | | 185| 0| loop_ctx->vars[i].identifier.ref = YR_ARENA_NULL_REF; \ | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | 186| 0| } \ | | 187| 0| loop_ctx->vars_count = 0; \ | | 188| 0| } \ ------------------ 3551| 0| } 3552| | 3553| 0| compiler->loop_index = -1; 3554| 0| YYERROR; ------------------ | | 1314| 0|#define YYERROR goto yyerrorlab ------------------ 3555| 0| } 3556| 0|#line 3557 "libyara/grammar.c" 3557| 0| break; 3558| | 3559| 0| case 90: /* $@6: %empty */ ------------------ | Branch (3559:3): [True: 0, False: 342] ------------------ 3560| 0|#line 1580 "libyara/grammar.y" 3561| 0| { 3562| | // var_frame is used for accessing local variables used in this loop. 3563| | // All local variables are accessed using var_frame as a reference, 3564| | // like var_frame + 0, var_frame + 1, etc. Here we initialize var_frame 3565| | // with the correct value, which depends on the number of variables 3566| | // defined by any outer loops. 3567| | 3568| 0| int var_frame; 3569| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 3570| | 3571| 0| if (compiler->loop_index + 1 == YR_MAX_LOOP_NESTING) ------------------ | | 95| 0|#define YR_MAX_LOOP_NESTING 4 ------------------ | Branch (3571:13): [True: 0, False: 0] ------------------ 3572| 0| result = ERROR_LOOP_NESTING_LIMIT_EXCEEDED; ------------------ | | 57| 0|#define ERROR_LOOP_NESTING_LIMIT_EXCEEDED 12 ------------------ 3573| | 3574| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3575| | 3576| 0| compiler->loop_index++; 3577| | 3578| | // This loop uses internal variables besides the ones explicitly 3579| | // defined by the user. 3580| 0| compiler->loop[compiler->loop_index].vars_internal_count = \ 3581| 0| YR_INTERNAL_LOOP_VARS; ------------------ | | 76| 0|#define YR_INTERNAL_LOOP_VARS 3 ------------------ 3582| | 3583| | // Initialize the number of variables, this number will be incremented 3584| | // as variable declaration are processed by for_variables. 3585| 0| compiler->loop[compiler->loop_index].vars_count = 0; 3586| | 3587| 0| var_frame = _yr_compiler_get_var_frame(compiler); 3588| | 3589| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3590| 0| yyscanner, OP_CLEAR_M, var_frame + 0, NULL, NULL)); 3591| | 3592| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3593| 0| yyscanner, OP_CLEAR_M, var_frame + 1, NULL, NULL)); 3594| | 3595| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3596| 0| yyscanner, OP_POP_M, var_frame + 2, NULL, NULL)); 3597| 0| } 3598| 0|#line 3599 "libyara/grammar.c" 3599| 0| break; 3600| | 3601| 0| case 91: /* $@7: %empty */ ------------------ | Branch (3601:3): [True: 0, False: 342] ------------------ 3602| 0|#line 1618 "libyara/grammar.y" 3603| 0| { 3604| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[compiler->loop_index]; 3605| 0| YR_FIXUP* fixup; 3606| | 3607| 0| YR_ARENA_REF loop_start_ref; 3608| 0| YR_ARENA_REF jmp_offset_ref; 3609| | 3610| 0| int var_frame = _yr_compiler_get_var_frame(compiler); 3611| | 3612| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3613| 0| yyscanner, OP_ITER_NEXT, &loop_start_ref)); 3614| | 3615| | // For each variable generate an instruction that pops the value from 3616| | // the stack and store it into one memory slot starting at var_frame + 3617| | // YR_INTERNAL_LOOP_VARS because the first YR_INTERNAL_LOOP_VARS slots 3618| | // in the frame are for the internal variables. 3619| | 3620| 0| for (int i = 0; i < loop_ctx->vars_count; i++) ------------------ | Branch (3620:25): [True: 0, False: 0] ------------------ 3621| 0| { 3622| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3623| 0| yyscanner, 3624| 0| OP_POP_M, 3625| 0| var_frame + YR_INTERNAL_LOOP_VARS + i, 3626| 0| NULL, 3627| 0| NULL)); 3628| 0| } 3629| | 3630| 0| fail_if_error(yr_parser_emit_with_arg_int32( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3631| 0| yyscanner, 3632| 0| OP_JTRUE_P, 3633| 0| 0, // still don't know the jump offset, use 0 for now. 3634| 0| NULL, 3635| 0| &jmp_offset_ref)); 3636| | 3637| | // We still don't know the jump's target, so we push a fixup entry 3638| | // in the stack, so that the jump's offset can be set once we know it. 3639| | 3640| 0| fixup = (YR_FIXUP*) yr_malloc(sizeof(YR_FIXUP)); 3641| | 3642| 0| if (fixup == NULL) ------------------ | Branch (3642:13): [True: 0, False: 0] ------------------ 3643| 0| fail_with_error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3644| | 3645| 0| fixup->ref = jmp_offset_ref; 3646| 0| fixup->next = compiler->fixup_stack_head; 3647| 0| compiler->fixup_stack_head = fixup; 3648| | 3649| 0| loop_ctx->start_ref = loop_start_ref; 3650| 0| } 3651| 0|#line 3652 "libyara/grammar.c" 3652| 0| break; 3653| | 3654| 0| case 92: /* expression: "" for_expression $@6 for_iteration ':' $@7 '(' boolean_expression ')' */ ------------------ | Branch (3654:3): [True: 0, False: 342] ------------------ 3655| 0|#line 1667 "libyara/grammar.y" 3656| 0| { 3657| 0| int32_t jmp_offset; 3658| 0| YR_FIXUP* fixup; 3659| 0| YR_ARENA_REF pop_ref; 3660| | 3661| 0| int var_frame = _yr_compiler_get_var_frame(compiler); 3662| | 3663| 0| if ((yyvsp[-5].integer) == FOR_ITERATION_STRING_SET) ------------------ | | 113| 0|#define FOR_ITERATION_STRING_SET 2 ------------------ | Branch (3663:13): [True: 0, False: 0] ------------------ 3664| 0| { 3665| 0| compiler->loop_for_of_var_index = -1; 3666| 0| } 3667| | 3668| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3669| 0| yyscanner, OP_INCR_M, var_frame + 1, NULL, NULL)); 3670| | 3671| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3672| 0| yyscanner, OP_PUSH_M, var_frame + 0, NULL, NULL)); 3673| | 3674| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3675| 0| yyscanner, OP_PUSH_M, var_frame + 2, NULL, NULL)); 3676| | 3677| 0| fail_if_error(yr_parser_emit(yyscanner, OP_ITER_CONDITION, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3678| | 3679| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3680| 0| yyscanner, OP_ADD_M, var_frame + 0, NULL, NULL)); 3681| | 3682| 0| jmp_offset = \ 3683| 0| compiler->loop[compiler->loop_index].start_ref.offset - 3684| 0| yr_arena_get_current_offset(compiler->arena, YR_CODE_SECTION); ------------------ | | 63| 0|#define YR_CODE_SECTION 6 ------------------ 3685| | 3686| 0| fail_if_error(yr_parser_emit_with_arg_int32( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3687| 0| yyscanner, 3688| 0| OP_JTRUE_P, 3689| 0| jmp_offset, 3690| 0| NULL, 3691| 0| NULL)); 3692| | 3693| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3694| 0| yyscanner, OP_POP, &pop_ref)); 3695| | 3696| | // Pop from the stack the fixup entry containing the reference to 3697| | // the jump offset that needs to be fixed. 3698| | 3699| 0| fixup = compiler->fixup_stack_head; 3700| 0| compiler->fixup_stack_head = fixup->next; 3701| | 3702| | // The fixup entry has a reference to the jump offset that need 3703| | // to be fixed, convert the address into a pointer. 3704| 0| void* jmp_offset_addr = yr_arena_ref_to_ptr( 3705| 0| compiler->arena, &fixup->ref); 3706| | 3707| | // The reference in the fixup entry points to the jump's offset 3708| | // but the jump instruction is one byte before, that's why we add 3709| | // one to the offset. 3710| 0| jmp_offset = pop_ref.offset - fixup->ref.offset + 1; 3711| | 3712| | // Fix the jump's offset. 3713| 0| memcpy(jmp_offset_addr, &jmp_offset, sizeof(jmp_offset)); 3714| | 3715| 0| yr_free(fixup); 3716| | 3717| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3718| 0| yyscanner, OP_PUSH_M, var_frame + 1, NULL, NULL)); 3719| | 3720| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3721| 0| yyscanner, OP_PUSH_M, var_frame + 0, NULL, NULL)); 3722| | 3723| 0| fail_if_error(yr_parser_emit_with_arg( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3724| 0| yyscanner, OP_PUSH_M, var_frame + 2, NULL, NULL)); 3725| | 3726| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3727| 0| yyscanner, OP_ITER_END, NULL)); 3728| | 3729| 0| loop_vars_cleanup(compiler->loop_index); ------------------ | | 179| 0| { \ | | 180| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[loop_index]; \ | | 181| 0| for (int i = 0; i < loop_ctx->vars_count; i++) \ | | ------------------ | | | Branch (181:23): [True: 0, False: 0] | | ------------------ | | 182| 0| { \ | | 183| 0| yr_free((void*) loop_ctx->vars[i].identifier.ptr); \ | | 184| 0| loop_ctx->vars[i].identifier.ptr = NULL; \ | | 185| 0| loop_ctx->vars[i].identifier.ref = YR_ARENA_NULL_REF; \ | | ------------------ | | | | 43| 0| (YR_ARENA_REF) \ | | | | 44| 0| { \ | | | | 45| 0| UINT32_MAX, UINT32_MAX \ | | | | 46| 0| } | | ------------------ | | 186| 0| } \ | | 187| 0| loop_ctx->vars_count = 0; \ | | 188| 0| } \ ------------------ 3730| | 3731| 0| compiler->loop_index--; 3732| | 3733| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3734| 0| (yyval.expression).required_strings.count = 0; 3735| 0| } 3736| 0|#line 3737 "libyara/grammar.c" 3737| 0| break; 3738| | 3739| 0| case 93: /* expression: for_expression "" string_set */ ------------------ | Branch (3739:3): [True: 0, False: 342] ------------------ 3740| 0|#line 1748 "libyara/grammar.y" 3741| 0| { 3742| 0| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-2].expression).value.integer > (yyvsp[0].string_set).count) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3742:13): [True: 0, False: 0] | Branch (3742:71): [True: 0, False: 0] ------------------ 3743| 0| { 3744| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3745| 0| "expression always false - requesting %" PRId64 " of %" PRId64 ".", (yyvsp[-2].expression).value.integer, (yyvsp[0].string_set).count); 3746| 0| } 3747| | 3748| 0| if (((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-2].expression).value.integer > 0) || ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3748:14): [True: 0, False: 0] | Branch (3748:72): [True: 0, False: 0] ------------------ 3749| 0| ((yyvsp[-2].expression).type == EXPRESSION_TYPE_QUANTIFIER && ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ | Branch (3749:16): [True: 0, False: 0] ------------------ 3750| 0| ((yyvsp[-2].expression).value.integer == FOR_EXPRESSION_ALL || (yyvsp[-2].expression).value.integer == FOR_EXPRESSION_ANY))) ------------------ | | 108| 0|#define FOR_EXPRESSION_ALL 1 ------------------ ((yyvsp[-2].expression).value.integer == FOR_EXPRESSION_ALL || (yyvsp[-2].expression).value.integer == FOR_EXPRESSION_ANY))) ------------------ | | 109| 0|#define FOR_EXPRESSION_ANY 2 ------------------ | Branch (3750:20): [True: 0, False: 0] | Branch (3750:82): [True: 0, False: 0] ------------------ 3751| 0| { 3752| 0| (yyval.expression).required_strings.count = 1; 3753| 0| } 3754| 0| else 3755| 0| { 3756| 0| (yyval.expression).required_strings.count = 0; 3757| 0| } 3758| | 3759| 0| yr_parser_emit_with_arg(yyscanner, OP_OF, OF_STRING_SET, NULL, NULL); ------------------ | | 74| 0|#define OP_OF 26 ------------------ yr_parser_emit_with_arg(yyscanner, OP_OF, OF_STRING_SET, NULL, NULL); ------------------ | | 42| 0|#define OF_STRING_SET 0 ------------------ 3760| | 3761| 0| yr_string_set_destroy((yyvsp[0].string_set)); 3762| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3763| 0| } 3764| 0|#line 3765 "libyara/grammar.c" 3765| 0| break; 3766| | 3767| 0| case 94: /* expression: for_expression "" rule_set */ ------------------ | Branch (3767:3): [True: 0, False: 342] ------------------ 3768| 0|#line 1772 "libyara/grammar.y" 3769| 0| { 3770| 0| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-2].expression).value.integer > (yyvsp[0].integer)) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3770:13): [True: 0, False: 0] | Branch (3770:71): [True: 0, False: 0] ------------------ 3771| 0| { 3772| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3773| 0| "expression always false - requesting %" PRId64 " of %" PRId64 ".", (yyvsp[-2].expression).value.integer, (yyvsp[0].integer)); 3774| 0| } 3775| 0| yr_parser_emit_with_arg(yyscanner, OP_OF, OF_RULE_SET, NULL, NULL); ------------------ | | 74| 0|#define OP_OF 26 ------------------ yr_parser_emit_with_arg(yyscanner, OP_OF, OF_RULE_SET, NULL, NULL); ------------------ | | 43| 0|#define OF_RULE_SET 1 ------------------ 3776| | 3777| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3778| 0| (yyval.expression).required_strings.count = 0; 3779| 0| } 3780| 0|#line 3781 "libyara/grammar.c" 3781| 0| break; 3782| | 3783| 0| case 95: /* expression: primary_expression '%' "" string_set */ ------------------ | Branch (3783:3): [True: 0, False: 342] ------------------ 3784| 0|#line 1784 "libyara/grammar.y" 3785| 0| { 3786| 0| check_type_with_cleanup((yyvsp[-3].expression), EXPRESSION_TYPE_INTEGER, "%", yr_string_set_destroy((yyvsp[0].string_set))); ------------------ | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | ------------------ | | | Branch (145:9): [True: 0, False: 0] | | ------------------ | | 146| 0| { \ | | 147| 0| switch(expression.type) \ | | ------------------ | | | Branch (147:14): [True: 0, False: 0] | | ------------------ | | 148| 0| { \ | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | ------------------ | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | ------------------ | | | Branch (149:9): [True: 0, False: 0] | | ------------------ | | 150| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | 152| 0| break; \ | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | ------------------ | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | ------------------ | | | Branch (153:9): [True: 0, False: 0] | | ------------------ | | 154| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | 156| 0| break; \ | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | ------------------ | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | ------------------ | | | Branch (157:9): [True: 0, False: 0] | | ------------------ | | 158| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | 160| 0| break; \ | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | ------------------ | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | ------------------ | | | Branch (161:9): [True: 0, False: 0] | | ------------------ | | 162| 0| yr_compiler_set_error_extra_info( \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | 164| 0| break; \ | | 165| 0| } \ | | 166| 0| cleanup; \ | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | ------------------ | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | ------------------ | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 169| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 170| 0| } ------------------ 3787| | 3788| | // The value of primary_expression can be undefined because 3789| | // it could be a variable for which don't know the value during 3790| | // compiling time. However, if the value is defined it should be 3791| | // in the range [1,100]. 3792| 0| if (!IS_UNDEFINED((yyvsp[-3].expression).value.integer) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (3792:13): [True: 0, False: 0] ------------------ 3793| 0| ((yyvsp[-3].expression).value.integer < 1 || (yyvsp[-3].expression).value.integer > 100)) ------------------ | Branch (3793:14): [True: 0, False: 0] | Branch (3793:58): [True: 0, False: 0] ------------------ 3794| 0| { 3795| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3796| 0| compiler, "percentage must be between 1 and 100 (inclusive)"); 3797| | 3798| 0| yr_string_set_destroy((yyvsp[0].string_set)); 3799| 0| fail_with_error(ERROR_INVALID_PERCENTAGE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3800| 0| } 3801| | 3802| 0| if (!IS_UNDEFINED((yyvsp[-3].expression).value.integer)) ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (3802:13): [True: 0, False: 0] ------------------ 3803| 0| { 3804| 0| (yyval.expression).required_strings.count = 1; 3805| 0| } 3806| 0| else 3807| 0| { 3808| 0| (yyval.expression).required_strings.count = 0; 3809| 0| } 3810| | 3811| 0| yr_string_set_destroy((yyvsp[0].string_set)); 3812| 0| yr_parser_emit_with_arg(yyscanner, OP_OF_PERCENT, OF_STRING_SET, NULL, NULL); ------------------ | | 122| 0|#define OP_OF_PERCENT 74 ------------------ yr_parser_emit_with_arg(yyscanner, OP_OF_PERCENT, OF_STRING_SET, NULL, NULL); ------------------ | | 42| 0|#define OF_STRING_SET 0 ------------------ 3813| 0| } 3814| 0|#line 3815 "libyara/grammar.c" 3815| 0| break; 3816| | 3817| 0| case 96: /* expression: primary_expression '%' "" rule_set */ ------------------ | Branch (3817:3): [True: 0, False: 342] ------------------ 3818| 0|#line 1814 "libyara/grammar.y" 3819| 0| { 3820| 0| check_type((yyvsp[-3].expression), EXPRESSION_TYPE_INTEGER, "%"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 3821| | 3822| | // The value of primary_expression can be undefined because 3823| | // it could be a variable for which don't know the value during 3824| | // compiling time. However, if the value is defined it should be 3825| | // in the range [1,100]. 3826| 0| if (!IS_UNDEFINED((yyvsp[-3].expression).value.integer) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (3826:13): [True: 0, False: 0] ------------------ 3827| 0| ((yyvsp[-3].expression).value.integer < 1 || (yyvsp[-3].expression).value.integer > 100)) ------------------ | Branch (3827:14): [True: 0, False: 0] | Branch (3827:58): [True: 0, False: 0] ------------------ 3828| 0| { 3829| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3830| 0| compiler, "percentage must be between 1 and 100 (inclusive)"); 3831| | 3832| 0| fail_with_error(ERROR_INVALID_PERCENTAGE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3833| 0| } 3834| | 3835| 0| yr_parser_emit_with_arg(yyscanner, OP_OF_PERCENT, OF_RULE_SET, NULL, NULL); ------------------ | | 122| 0|#define OP_OF_PERCENT 74 ------------------ yr_parser_emit_with_arg(yyscanner, OP_OF_PERCENT, OF_RULE_SET, NULL, NULL); ------------------ | | 43| 0|#define OF_RULE_SET 1 ------------------ 3836| 0| } 3837| 0|#line 3838 "libyara/grammar.c" 3838| 0| break; 3839| | 3840| 0| case 97: /* expression: for_expression "" string_set "" range */ ------------------ | Branch (3840:3): [True: 0, False: 342] ------------------ 3841| 0|#line 1833 "libyara/grammar.y" 3842| 0| { 3843| 0| if ((yyvsp[-4].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-4].expression).value.integer > (yyvsp[-2].string_set).count) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3843:13): [True: 0, False: 0] | Branch (3843:71): [True: 0, False: 0] ------------------ 3844| 0| { 3845| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3846| 0| "expression always false - requesting %" PRId64 " of %" PRId64 ".", (yyvsp[-4].expression).value.integer, (yyvsp[-2].string_set).count); 3847| 0| } 3848| | 3849| 0| if (((yyvsp[-4].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-4].expression).value.integer > 0) || ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3849:14): [True: 0, False: 0] | Branch (3849:72): [True: 0, False: 0] ------------------ 3850| 0| ((yyvsp[-4].expression).type == EXPRESSION_TYPE_QUANTIFIER && ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ | Branch (3850:16): [True: 0, False: 0] ------------------ 3851| 0| ((yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ALL || (yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ANY))) ------------------ | | 108| 0|#define FOR_EXPRESSION_ALL 1 ------------------ ((yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ALL || (yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ANY))) ------------------ | | 109| 0|#define FOR_EXPRESSION_ANY 2 ------------------ | Branch (3851:20): [True: 0, False: 0] | Branch (3851:82): [True: 0, False: 0] ------------------ 3852| 0| { 3853| 0| (yyval.expression).required_strings.count = 1; 3854| 0| } 3855| 0| else 3856| 0| { 3857| 0| (yyval.expression).required_strings.count = 0; 3858| 0| } 3859| | 3860| 0| yr_parser_emit(yyscanner, OP_OF_FOUND_IN, NULL); ------------------ | | 123| 0|#define OP_OF_FOUND_IN 75 ------------------ 3861| | 3862| | // Mark strings as non-fast strings (since we need to check all matches whether they are in range) 3863| 0| yr_parser_mark_nonfast(yyscanner, (yyvsp[-2].string_set)); 3864| | 3865| 0| yr_string_set_destroy((yyvsp[-2].string_set)); 3866| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3867| 0| } 3868| 0|#line 3869 "libyara/grammar.c" 3869| 0| break; 3870| | 3871| 0| case 98: /* expression: for_expression "" string_set "" primary_expression */ ------------------ | Branch (3871:3): [True: 0, False: 342] ------------------ 3872| 0|#line 1860 "libyara/grammar.y" 3873| 0| { 3874| 0| if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3874:13): [True: 0, False: 0] ------------------ 3875| 0| { 3876| 0| yr_compiler_set_error_extra_info(compiler, ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 3877| 0| "at expression must be an integer"); 3878| | 3879| 0| yr_string_set_destroy((yyvsp[-2].string_set)); 3880| 0| fail_with_error(ERROR_INVALID_VALUE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3881| 0| } 3882| | 3883| 0| if ((yyvsp[-4].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-4].expression).value.integer > (yyvsp[-2].string_set).count) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3883:13): [True: 0, False: 0] | Branch (3883:71): [True: 0, False: 0] ------------------ 3884| 0| { 3885| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3886| 0| "expression always false - requesting %" PRId64 " of %" PRId64 ".", (yyvsp[-4].expression).value.integer, (yyvsp[-2].string_set).count); 3887| 0| } 3888| | 3889| | // Both of these are warnings: 3890| | // 3891| | // "N of them at 0" where N > 1 3892| | // 3893| | //"all of them at 0" where there is more than 1 in "them". 3894| | // 3895| | // This means you can do "all of them at 0" if you only have one string 3896| | // defined in the set. 3897| 0| if (((yyvsp[-4].expression).type == EXPRESSION_TYPE_INTEGER && ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3897:14): [True: 0, False: 0] ------------------ 3898| 0| !IS_UNDEFINED((yyvsp[-4].expression).value.integer) && (yyvsp[-4].expression).value.integer > 1) || ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (3898:15): [True: 0, False: 0] | Branch (3898:70): [True: 0, False: 0] ------------------ 3899| 0| ((yyvsp[-4].expression).type == EXPRESSION_TYPE_QUANTIFIER && ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ | Branch (3899:16): [True: 0, False: 0] ------------------ 3900| 0| (yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ALL && (yyvsp[-2].string_set).count > 1)) ------------------ | | 108| 0|#define FOR_EXPRESSION_ALL 1 ------------------ | Branch (3900:15): [True: 0, False: 0] | Branch (3900:77): [True: 0, False: 0] ------------------ 3901| 0| { 3902| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 3903| 0| "multiple strings at an offset is usually false."); 3904| 0| } 3905| | 3906| 0| if (((yyvsp[-4].expression).type == EXPRESSION_TYPE_INTEGER && (yyvsp[-4].expression).value.integer > 0) || ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (3906:14): [True: 0, False: 0] | Branch (3906:72): [True: 0, False: 0] ------------------ 3907| 0| ((yyvsp[-4].expression).type == EXPRESSION_TYPE_QUANTIFIER && ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ | Branch (3907:16): [True: 0, False: 0] ------------------ 3908| 0| ((yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ALL || (yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ANY))) ------------------ | | 108| 0|#define FOR_EXPRESSION_ALL 1 ------------------ ((yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ALL || (yyvsp[-4].expression).value.integer == FOR_EXPRESSION_ANY))) ------------------ | | 109| 0|#define FOR_EXPRESSION_ANY 2 ------------------ | Branch (3908:20): [True: 0, False: 0] | Branch (3908:82): [True: 0, False: 0] ------------------ 3909| 0| { 3910| 0| (yyval.expression).required_strings.count = 1; 3911| 0| } 3912| 0| else 3913| 0| { 3914| 0| (yyval.expression).required_strings.count = 0; 3915| 0| } 3916| | 3917| 0| yr_parser_emit(yyscanner, OP_OF_FOUND_AT, NULL); ------------------ | | 127| 0|#define OP_OF_FOUND_AT 79 ------------------ 3918| | 3919| | // Mark strings as non-fast strings (since we need to check all matches whether they are at location) 3920| 0| yr_parser_mark_nonfast(yyscanner, (yyvsp[-2].string_set)); 3921| | 3922| 0| yr_string_set_destroy((yyvsp[-2].string_set)); 3923| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3924| 0| } 3925| 0|#line 3926 "libyara/grammar.c" 3926| 0| break; 3927| | 3928| 0| case 99: /* expression: "" boolean_expression */ ------------------ | Branch (3928:3): [True: 0, False: 342] ------------------ 3929| 0|#line 1913 "libyara/grammar.y" 3930| 0| { 3931| 0| yr_parser_emit(yyscanner, OP_NOT, NULL); ------------------ | | 51| 0|#define OP_NOT 3 ------------------ 3932| | 3933| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3934| 0| (yyval.expression).required_strings.count = 0; 3935| 0| } 3936| 0|#line 3937 "libyara/grammar.c" 3937| 0| break; 3938| | 3939| 0| case 100: /* expression: "" boolean_expression */ ------------------ | Branch (3939:3): [True: 0, False: 342] ------------------ 3940| 0|#line 1920 "libyara/grammar.y" 3941| 0| { 3942| 0| yr_parser_emit(yyscanner, OP_DEFINED, NULL); ------------------ | | 125| 0|#define OP_DEFINED 77 ------------------ 3943| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3944| 0| (yyval.expression).required_strings.count = 0; 3945| 0| } 3946| 0|#line 3947 "libyara/grammar.c" 3947| 0| break; 3948| | 3949| 16| case 101: /* $@8: %empty */ ------------------ | Branch (3949:3): [True: 16, False: 326] ------------------ 3950| 16|#line 1926 "libyara/grammar.y" 3951| 16| { 3952| 16| YR_FIXUP* fixup; 3953| 16| YR_ARENA_REF jmp_offset_ref; 3954| | 3955| 16| fail_if_error(yr_parser_emit_with_arg_int32( ------------------ | | 135| 16| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 32|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 16|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 16] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 16| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3956| 16| yyscanner, 3957| 16| OP_JFALSE, 3958| 16| 0, // still don't know the jump offset, use 0 for now. 3959| 16| NULL, 3960| 16| &jmp_offset_ref)); 3961| | 3962| | // Create a fixup entry for the jump and push it in the stack. 3963| 16| fixup = (YR_FIXUP*) yr_malloc(sizeof(YR_FIXUP)); 3964| | 3965| 16| if (fixup == NULL) ------------------ | Branch (3965:13): [True: 0, False: 16] ------------------ 3966| 16| fail_with_error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 3967| | 3968| 16| fixup->ref = jmp_offset_ref; 3969| 16| fixup->next = compiler->fixup_stack_head; 3970| 16| compiler->fixup_stack_head = fixup; 3971| 16| } 3972| 0|#line 3973 "libyara/grammar.c" 3973| 0| break; 3974| | 3975| 16| case 102: /* expression: boolean_expression "" $@8 boolean_expression */ ------------------ | Branch (3975:3): [True: 16, False: 326] ------------------ 3976| 16|#line 1948 "libyara/grammar.y" 3977| 16| { 3978| 16| YR_FIXUP* fixup; 3979| | 3980| 16| fail_if_error(yr_parser_emit(yyscanner, OP_AND, NULL)); ------------------ | | 135| 16| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 32|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 16|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 16] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 16| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 3981| | 3982| 16| fixup = compiler->fixup_stack_head; 3983| | 3984| 16| void* jmp_offset_addr = yr_arena_ref_to_ptr( 3985| 16| compiler->arena, &fixup->ref); 3986| | 3987| 16| int32_t jmp_offset = \ 3988| 16| yr_arena_get_current_offset(compiler->arena, YR_CODE_SECTION) - ------------------ | | 63| 16|#define YR_CODE_SECTION 6 ------------------ 3989| 16| fixup->ref.offset + 1; 3990| | 3991| 16| memcpy(jmp_offset_addr, &jmp_offset, sizeof(jmp_offset)); 3992| | 3993| | // Remove fixup from the stack. 3994| 16| compiler->fixup_stack_head = fixup->next; 3995| 16| yr_free(fixup); 3996| | 3997| 16| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 16|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 3998| 16| (yyval.expression).required_strings.count = (yyvsp[0].expression).required_strings.count + (yyvsp[-3].expression).required_strings.count; 3999| 16| } 4000| 0|#line 4001 "libyara/grammar.c" 4001| 0| break; 4002| | 4003| 0| case 103: /* $@9: %empty */ ------------------ | Branch (4003:3): [True: 0, False: 342] ------------------ 4004| 0|#line 1972 "libyara/grammar.y" 4005| 0| { 4006| 0| YR_FIXUP* fixup; 4007| 0| YR_ARENA_REF jmp_offset_ref; 4008| | 4009| 0| fail_if_error(yr_parser_emit_with_arg_int32( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4010| 0| yyscanner, 4011| 0| OP_JTRUE, 4012| 0| 0, // still don't know the jump destination, use 0 for now. 4013| 0| NULL, 4014| 0| &jmp_offset_ref)); 4015| | 4016| 0| fixup = (YR_FIXUP*) yr_malloc(sizeof(YR_FIXUP)); 4017| | 4018| 0| if (fixup == NULL) ------------------ | Branch (4018:13): [True: 0, False: 0] ------------------ 4019| 0| fail_with_error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 4020| | 4021| 0| fixup->ref = jmp_offset_ref; 4022| 0| fixup->next = compiler->fixup_stack_head; 4023| 0| compiler->fixup_stack_head = fixup; 4024| 0| } 4025| 0|#line 4026 "libyara/grammar.c" 4026| 0| break; 4027| | 4028| 0| case 104: /* expression: boolean_expression "" $@9 boolean_expression */ ------------------ | Branch (4028:3): [True: 0, False: 342] ------------------ 4029| 0|#line 1993 "libyara/grammar.y" 4030| 0| { 4031| 0| YR_FIXUP* fixup; 4032| | 4033| 0| fail_if_error(yr_parser_emit(yyscanner, OP_OR, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4034| | 4035| 0| fixup = compiler->fixup_stack_head; 4036| | 4037| 0| int32_t jmp_offset = \ 4038| 0| yr_arena_get_current_offset(compiler->arena, YR_CODE_SECTION) - ------------------ | | 63| 0|#define YR_CODE_SECTION 6 ------------------ 4039| 0| fixup->ref.offset + 1; 4040| | 4041| 0| void* jmp_offset_addr = yr_arena_ref_to_ptr( 4042| 0| compiler->arena, &fixup->ref); 4043| | 4044| 0| memcpy(jmp_offset_addr, &jmp_offset, sizeof(jmp_offset)); 4045| | 4046| | // Remove fixup from the stack. 4047| 0| compiler->fixup_stack_head = fixup->next; 4048| 0| yr_free(fixup); 4049| | 4050| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4051| | 4052| | // Set required string count to minimum from both parts 4053| 0| if ((yyvsp[-3].expression).required_strings.count > (yyvsp[0].expression).required_strings.count) { ------------------ | Branch (4053:13): [True: 0, False: 0] ------------------ 4054| 0| (yyval.expression).required_strings.count = (yyvsp[0].expression).required_strings.count; 4055| 0| } else { 4056| 0| (yyval.expression).required_strings.count = (yyvsp[-3].expression).required_strings.count; 4057| 0| } 4058| 0| } 4059| 0|#line 4060 "libyara/grammar.c" 4060| 0| break; 4061| | 4062| 0| case 105: /* expression: primary_expression "<" primary_expression */ ------------------ | Branch (4062:3): [True: 0, False: 342] ------------------ 4063| 0|#line 2023 "libyara/grammar.y" 4064| 0| { 4065| 0| fail_if_error(yr_parser_reduce_operation( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4066| 0| yyscanner, "<", (yyvsp[-2].expression), (yyvsp[0].expression))); 4067| | 4068| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4069| 0| (yyval.expression).required_strings.count = 0; 4070| 0| } 4071| 0|#line 4072 "libyara/grammar.c" 4072| 0| break; 4073| | 4074| 0| case 106: /* expression: primary_expression ">" primary_expression */ ------------------ | Branch (4074:3): [True: 0, False: 342] ------------------ 4075| 0|#line 2031 "libyara/grammar.y" 4076| 0| { 4077| 0| fail_if_error(yr_parser_reduce_operation( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4078| 0| yyscanner, ">", (yyvsp[-2].expression), (yyvsp[0].expression))); 4079| | 4080| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4081| 0| (yyval.expression).required_strings.count = 0; 4082| 0| } 4083| 0|#line 4084 "libyara/grammar.c" 4084| 0| break; 4085| | 4086| 0| case 107: /* expression: primary_expression "<=" primary_expression */ ------------------ | Branch (4086:3): [True: 0, False: 342] ------------------ 4087| 0|#line 2039 "libyara/grammar.y" 4088| 0| { 4089| 0| fail_if_error(yr_parser_reduce_operation( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4090| 0| yyscanner, "<=", (yyvsp[-2].expression), (yyvsp[0].expression))); 4091| | 4092| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4093| 0| (yyval.expression).required_strings.count = 0; 4094| 0| } 4095| 0|#line 4096 "libyara/grammar.c" 4096| 0| break; 4097| | 4098| 18| case 108: /* expression: primary_expression ">=" primary_expression */ ------------------ | Branch (4098:3): [True: 18, False: 324] ------------------ 4099| 18|#line 2047 "libyara/grammar.y" 4100| 18| { 4101| 18| fail_if_error(yr_parser_reduce_operation( ------------------ | | 135| 18| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 36|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 18|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 18] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 18| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4102| 18| yyscanner, ">=", (yyvsp[-2].expression), (yyvsp[0].expression))); 4103| | 4104| 18| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 18|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4105| 18| (yyval.expression).required_strings.count = 0; 4106| 18| } 4107| 0|#line 4108 "libyara/grammar.c" 4108| 0| break; 4109| | 4110| 0| case 109: /* expression: primary_expression "==" primary_expression */ ------------------ | Branch (4110:3): [True: 0, False: 342] ------------------ 4111| 0|#line 2055 "libyara/grammar.y" 4112| 0| { 4113| 0| fail_if_error(yr_parser_reduce_operation( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4114| 0| yyscanner, "==", (yyvsp[-2].expression), (yyvsp[0].expression))); 4115| | 4116| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4117| 0| (yyval.expression).required_strings.count = 0; 4118| 0| } 4119| 0|#line 4120 "libyara/grammar.c" 4120| 0| break; 4121| | 4122| 0| case 110: /* expression: primary_expression "!=" primary_expression */ ------------------ | Branch (4122:3): [True: 0, False: 342] ------------------ 4123| 0|#line 2063 "libyara/grammar.y" 4124| 0| { 4125| 0| fail_if_error(yr_parser_reduce_operation( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4126| 0| yyscanner, "!=", (yyvsp[-2].expression), (yyvsp[0].expression))); 4127| | 4128| 0| (yyval.expression).type = EXPRESSION_TYPE_BOOLEAN; ------------------ | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 ------------------ 4129| 0| (yyval.expression).required_strings.count = 0; 4130| 0| } 4131| 0|#line 4132 "libyara/grammar.c" 4132| 0| break; 4133| | 4134| 42| case 111: /* expression: primary_expression */ ------------------ | Branch (4134:3): [True: 42, False: 300] ------------------ 4135| 42|#line 2071 "libyara/grammar.y" 4136| 42| { 4137| 42| (yyval.expression) = (yyvsp[0].expression); 4138| 42| } 4139| 42|#line 4140 "libyara/grammar.c" 4140| 42| break; 4141| | 4142| 0| case 112: /* expression: '(' expression ')' */ ------------------ | Branch (4142:3): [True: 0, False: 342] ------------------ 4143| 0|#line 2075 "libyara/grammar.y" 4144| 0| { 4145| 0| (yyval.expression) = (yyvsp[-1].expression); 4146| 0| } 4147| 0|#line 4148 "libyara/grammar.c" 4148| 0| break; 4149| | 4150| 0| case 113: /* for_iteration: for_variables "" iterator */ ------------------ | Branch (4150:3): [True: 0, False: 342] ------------------ 4151| 0|#line 2082 "libyara/grammar.y" 4152| 0| { (yyval.integer) = FOR_ITERATION_ITERATOR; } ------------------ | | 112| 0|#define FOR_ITERATION_ITERATOR 1 ------------------ 4153| 0|#line 4154 "libyara/grammar.c" 4154| 0| break; 4155| | 4156| 0| case 114: /* for_iteration: "" string_iterator */ ------------------ | Branch (4156:3): [True: 0, False: 342] ------------------ 4157| 0|#line 2084 "libyara/grammar.y" 4158| 0| { 4159| 0| int var_frame; 4160| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4161| | 4162| 0| if (compiler->loop_for_of_var_index != -1) ------------------ | Branch (4162:13): [True: 0, False: 0] ------------------ 4163| 0| result = ERROR_NESTED_FOR_OF_LOOP; ------------------ | | 79| 0|#define ERROR_NESTED_FOR_OF_LOOP 32 ------------------ 4164| | 4165| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4166| | 4167| | // Simulate that we have 1 variable with string loops 4168| 0| compiler->loop[compiler->loop_index].vars_count = 1; 4169| | 4170| | // Set where we can find our string in case $ is in 4171| | // the body of the loop 4172| 0| var_frame = _yr_compiler_get_var_frame(compiler); 4173| 0| compiler->loop_for_of_var_index = var_frame + 4174| 0| compiler->loop[compiler->loop_index].vars_internal_count; 4175| | 4176| 0| (yyval.integer) = FOR_ITERATION_STRING_SET; ------------------ | | 113| 0|#define FOR_ITERATION_STRING_SET 2 ------------------ 4177| 0| } 4178| 0|#line 4179 "libyara/grammar.c" 4179| 0| break; 4180| | 4181| 0| case 115: /* for_variables: "identifier" */ ------------------ | Branch (4181:3): [True: 0, False: 342] ------------------ 4182| 0|#line 2109 "libyara/grammar.y" 4183| 0| { 4184| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4185| | 4186| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[compiler->loop_index]; 4187| | 4188| 0| if (yr_parser_lookup_loop_variable(yyscanner, (yyvsp[0].c_string), NULL) >= 0) ------------------ | Branch (4188:13): [True: 0, False: 0] ------------------ 4189| 0| { 4190| 0| yr_compiler_set_error_extra_info(compiler, (yyvsp[0].c_string)); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4191| 0| yr_free((yyvsp[0].c_string)); 4192| | 4193| 0| result = ERROR_DUPLICATED_LOOP_IDENTIFIER; ------------------ | | 58| 0|#define ERROR_DUPLICATED_LOOP_IDENTIFIER 13 ------------------ 4194| 0| } 4195| | 4196| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4197| | 4198| 0| loop_ctx->vars[loop_ctx->vars_count++].identifier.ptr = (yyvsp[0].c_string); 4199| | 4200| 0| assert(loop_ctx->vars_count <= YR_MAX_LOOP_VARS); ------------------ | Branch (4200:9): [True: 0, False: 0] | Branch (4200:9): [True: 0, False: 0] ------------------ 4201| 0| } 4202| 0|#line 4203 "libyara/grammar.c" 4203| 0| break; 4204| | 4205| 0| case 116: /* for_variables: for_variables ',' "identifier" */ ------------------ | Branch (4205:3): [True: 0, False: 342] ------------------ 4206| 0|#line 2129 "libyara/grammar.y" 4207| 0| { 4208| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4209| | 4210| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[compiler->loop_index]; 4211| | 4212| 0| if (loop_ctx->vars_count == YR_MAX_LOOP_VARS) ------------------ | | 102| 0|#define YR_MAX_LOOP_VARS 2 ------------------ | Branch (4212:13): [True: 0, False: 0] ------------------ 4213| 0| { 4214| 0| yr_compiler_set_error_extra_info(compiler, "too many loop variables"); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4215| 0| yr_free((yyvsp[0].c_string)); 4216| | 4217| 0| result = ERROR_SYNTAX_ERROR; ------------------ | | 56| 0|#define ERROR_SYNTAX_ERROR 11 ------------------ 4218| 0| } 4219| 0| else if (yr_parser_lookup_loop_variable(yyscanner, (yyvsp[0].c_string), NULL) >= 0) ------------------ | Branch (4219:18): [True: 0, False: 0] ------------------ 4220| 0| { 4221| 0| yr_compiler_set_error_extra_info(compiler, (yyvsp[0].c_string)); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4222| 0| yr_free((yyvsp[0].c_string)); 4223| | 4224| 0| result = ERROR_DUPLICATED_LOOP_IDENTIFIER; ------------------ | | 58| 0|#define ERROR_DUPLICATED_LOOP_IDENTIFIER 13 ------------------ 4225| 0| } 4226| | 4227| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4228| | 4229| 0| loop_ctx->vars[loop_ctx->vars_count++].identifier.ptr = (yyvsp[0].c_string); 4230| 0| } 4231| 0|#line 4232 "libyara/grammar.c" 4232| 0| break; 4233| | 4234| 0| case 117: /* iterator: identifier */ ------------------ | Branch (4234:3): [True: 0, False: 342] ------------------ 4235| 0|#line 2157 "libyara/grammar.y" 4236| 0| { 4237| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[compiler->loop_index]; 4238| | 4239| | // Initially we assume that the identifier is from a non-iterable type, 4240| | // this will change later if it's iterable. 4241| 0| int result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 4242| | 4243| 0| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_OBJECT) ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ | Branch (4243:13): [True: 0, False: 0] ------------------ 4244| 0| { 4245| 0| switch((yyvsp[0].expression).value.object->type) ------------------ | Branch (4245:18): [True: 0, False: 0] ------------------ 4246| 0| { 4247| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (4247:13): [True: 0, False: 0] ------------------ 4248| | // If iterating an array the loop must define a single variable 4249| | // that will hold the current item. If a different number of 4250| | // variables were defined that's an error. 4251| 0| if (loop_ctx->vars_count == 1) ------------------ | Branch (4251:19): [True: 0, False: 0] ------------------ 4252| 0| { 4253| 0| loop_ctx->vars[0].type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 4254| 0| loop_ctx->vars[0].value.object = \ 4255| 0| object_as_array((yyvsp[0].expression).value.object)->prototype_item; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 4256| | 4257| 0| result = yr_parser_emit(yyscanner, OP_ITER_START_ARRAY, NULL); ------------------ | | 102| 0|#define OP_ITER_START_ARRAY 54 ------------------ 4258| 0| } 4259| 0| else 4260| 0| { 4261| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); | | ------------------ | | | Branch (330:7): [True: 0, False: 0] | | ------------------ ------------------ 4262| 0| compiler, 4263| 0| "iterator for \"%s\" yields a single item on each iteration" 4264| 0| ", but the loop expects %d", 4265| 0| expression_identifier((yyvsp[0].expression)), 4266| 0| loop_ctx->vars_count); 4267| | 4268| 0| result = ERROR_SYNTAX_ERROR; ------------------ | | 56| 0|#define ERROR_SYNTAX_ERROR 11 ------------------ 4269| 0| } 4270| 0| break; 4271| | 4272| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (4272:13): [True: 0, False: 0] ------------------ 4273| | // If iterating a dictionary the loop must define exactly two 4274| | // variables, one for the key and another for the value . If a 4275| | // different number of variables were defined that's an error. 4276| 0| if (loop_ctx->vars_count == 2) ------------------ | Branch (4276:19): [True: 0, False: 0] ------------------ 4277| 0| { 4278| 0| loop_ctx->vars[0].type = EXPRESSION_TYPE_STRING; ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ 4279| 0| loop_ctx->vars[0].value.sized_string_ref = YR_ARENA_NULL_REF; ------------------ | | 43| 0| (YR_ARENA_REF) \ | | 44| 0| { \ | | 45| 0| UINT32_MAX, UINT32_MAX \ | | 46| 0| } ------------------ 4280| 0| loop_ctx->vars[1].type = EXPRESSION_TYPE_OBJECT; ------------------ | | 50| 0|#define EXPRESSION_TYPE_OBJECT 16 ------------------ 4281| 0| loop_ctx->vars[1].value.object = \ 4282| 0| object_as_array((yyvsp[0].expression).value.object)->prototype_item; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 4283| | 4284| 0| result = yr_parser_emit(yyscanner, OP_ITER_START_DICT, NULL); ------------------ | | 103| 0|#define OP_ITER_START_DICT 55 ------------------ 4285| 0| } 4286| 0| else 4287| 0| { 4288| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); | | ------------------ | | | Branch (330:7): [True: 0, False: 0] | | ------------------ ------------------ 4289| 0| compiler, 4290| 0| "iterator for \"%s\" yields a key,value pair item on each iteration", 4291| 0| expression_identifier((yyvsp[0].expression))); 4292| | 4293| 0| result = ERROR_SYNTAX_ERROR; ------------------ | | 56| 0|#define ERROR_SYNTAX_ERROR 11 ------------------ 4294| 0| } 4295| 0| break; 4296| 0| } 4297| 0| } 4298| | 4299| 0| if (result == ERROR_WRONG_TYPE) ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ | Branch (4299:13): [True: 0, False: 0] ------------------ 4300| 0| { 4301| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); | | ------------------ | | | Branch (330:7): [True: 0, False: 0] | | ------------------ ------------------ 4302| 0| compiler, 4303| 0| "identifier \"%s\" is not iterable", 4304| 0| expression_identifier((yyvsp[0].expression))); 4305| 0| } 4306| | 4307| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4308| 0| } 4309| 0|#line 4310 "libyara/grammar.c" 4310| 0| break; 4311| | 4312| 0| case 118: /* iterator: set */ ------------------ | Branch (4312:3): [True: 0, False: 342] ------------------ 4313| 0|#line 2231 "libyara/grammar.y" 4314| 0| { 4315| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4316| | 4317| 0| YR_LOOP_CONTEXT* loop_ctx = &compiler->loop[compiler->loop_index]; 4318| | 4319| 0| if (loop_ctx->vars_count == 1) ------------------ | Branch (4319:13): [True: 0, False: 0] ------------------ 4320| 0| { 4321| 0| loop_ctx->vars[0].type = (yyvsp[0].enumeration).type; 4322| | 4323| 0| if ((yyvsp[0].enumeration).type == EXPRESSION_TYPE_STRING) ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (4323:15): [True: 0, False: 0] ------------------ 4324| 0| loop_ctx->vars[0].value.sized_string_ref = YR_ARENA_NULL_REF; ------------------ | | 43| 0| (YR_ARENA_REF) \ | | 44| 0| { \ | | 45| 0| UINT32_MAX, UINT32_MAX \ | | 46| 0| } ------------------ 4325| 0| else 4326| 0| loop_ctx->vars[0].value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4327| 0| } 4328| 0| else 4329| 0| { 4330| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 4331| 0| compiler, 4332| 0| "iterator yields one value on each iteration " 4333| 0| ", but the loop expects %d", 4334| 0| loop_ctx->vars_count); 4335| | 4336| 0| result = ERROR_SYNTAX_ERROR; ------------------ | | 56| 0|#define ERROR_SYNTAX_ERROR 11 ------------------ 4337| 0| } 4338| | 4339| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4340| 0| } 4341| 0|#line 4342 "libyara/grammar.c" 4342| 0| break; 4343| | 4344| 0| case 119: /* set: '(' enumeration ')' */ ------------------ | Branch (4344:3): [True: 0, False: 342] ------------------ 4345| 0|#line 2263 "libyara/grammar.y" 4346| 0| { 4347| | // $2.count contains the number of items in the enumeration 4348| 0| fail_if_error(yr_parser_emit_push_const(yyscanner, (yyvsp[-1].enumeration).count)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4349| | 4350| 0| if ((yyvsp[-1].enumeration).type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (4350:13): [True: 0, False: 0] ------------------ 4351| 0| { 4352| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4353| 0| yyscanner, OP_ITER_START_INT_ENUM, NULL)); 4354| 0| } 4355| 0| else 4356| 0| { 4357| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4358| 0| yyscanner, OP_ITER_START_TEXT_STRING_SET, NULL)); 4359| 0| } 4360| | 4361| 0| (yyval.enumeration).type = (yyvsp[-1].enumeration).type; 4362| 0| } 4363| 0|#line 4364 "libyara/grammar.c" 4364| 0| break; 4365| | 4366| 0| case 120: /* set: range */ ------------------ | Branch (4366:3): [True: 0, False: 342] ------------------ 4367| 0|#line 2281 "libyara/grammar.y" 4368| 0| { 4369| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4370| 0| yyscanner, OP_ITER_START_INT_RANGE, NULL)); 4371| | 4372| 0| (yyval.enumeration).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4373| 0| } 4374| 0|#line 4375 "libyara/grammar.c" 4375| 0| break; 4376| | 4377| 0| case 121: /* range: '(' primary_expression ".." primary_expression ')' */ ------------------ | Branch (4377:3): [True: 0, False: 342] ------------------ 4378| 0|#line 2292 "libyara/grammar.y" 4379| 0| { 4380| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4381| | 4382| 0| if ((yyvsp[-3].expression).type != EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (4382:13): [True: 0, False: 0] ------------------ 4383| 0| { 4384| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4385| 0| compiler, "wrong type for range's lower bound"); 4386| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 4387| 0| } 4388| | 4389| 0| if ((yyvsp[-1].expression).type != EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (4389:13): [True: 0, False: 0] ------------------ 4390| 0| { 4391| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4392| 0| compiler, "wrong type for range's upper bound"); 4393| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 4394| 0| } 4395| | 4396| | // If we can statically determine lower and upper bounds, ensure 4397| | // lower < upper. Check for upper bound here because some things (like 4398| | // string count) are EXPRESSION_TYPE_INTEGER. 4399| 0| if ((yyvsp[-3].expression).value.integer != YR_UNDEFINED && (yyvsp[-1].expression).value.integer != YR_UNDEFINED) ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ if ((yyvsp[-3].expression).value.integer != YR_UNDEFINED && (yyvsp[-1].expression).value.integer != YR_UNDEFINED) ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ | Branch (4399:13): [True: 0, False: 0] | Branch (4399:69): [True: 0, False: 0] ------------------ 4400| 0| { 4401| 0| if ((yyvsp[-3].expression).value.integer > (yyvsp[-1].expression).value.integer) ------------------ | Branch (4401:15): [True: 0, False: 0] ------------------ 4402| 0| { 4403| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4404| 0| compiler, "range lower bound must be less than upper bound"); 4405| 0| result = ERROR_INVALID_VALUE; ------------------ | | 111| 0|#define ERROR_INVALID_VALUE 64 ------------------ 4406| 0| } 4407| 0| else if ((yyvsp[-3].expression).value.integer < 0) ------------------ | Branch (4407:20): [True: 0, False: 0] ------------------ 4408| 0| { 4409| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4410| 0| compiler, "range lower bound can not be negative"); 4411| 0| result = ERROR_INVALID_VALUE; ------------------ | | 111| 0|#define ERROR_INVALID_VALUE 64 ------------------ 4412| 0| } 4413| 0| } 4414| | 4415| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4416| 0| } 4417| 0|#line 4418 "libyara/grammar.c" 4418| 0| break; 4419| | 4420| 0| case 122: /* enumeration: primary_expression */ ------------------ | Branch (4420:3): [True: 0, False: 342] ------------------ 4421| 0|#line 2335 "libyara/grammar.y" 4422| 0| { 4423| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4424| | 4425| 0| if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER && (yyvsp[0].expression).type != EXPRESSION_TYPE_STRING) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ if ((yyvsp[0].expression).type != EXPRESSION_TYPE_INTEGER && (yyvsp[0].expression).type != EXPRESSION_TYPE_STRING) ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (4425:13): [True: 0, False: 0] | Branch (4425:70): [True: 0, False: 0] ------------------ 4426| 0| { 4427| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4428| 0| compiler, "wrong type for enumeration item"); 4429| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 4430| 0| } 4431| | 4432| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4433| | 4434| 0| (yyval.enumeration).type = (yyvsp[0].expression).type; 4435| 0| (yyval.enumeration).count = 1; 4436| 0| } 4437| 0|#line 4438 "libyara/grammar.c" 4438| 0| break; 4439| | 4440| 0| case 123: /* enumeration: enumeration ',' primary_expression */ ------------------ | Branch (4440:3): [True: 0, False: 342] ------------------ 4441| 0|#line 2351 "libyara/grammar.y" 4442| 0| { 4443| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4444| | 4445| 0| if ((yyvsp[0].expression).type != (yyvsp[-2].enumeration).type) ------------------ | Branch (4445:13): [True: 0, False: 0] ------------------ 4446| 0| { 4447| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4448| 0| compiler, "enumerations must be all the same type"); 4449| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 4450| 0| } 4451| | 4452| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4453| | 4454| 0| (yyval.enumeration).type = (yyvsp[-2].enumeration).type; 4455| 0| (yyval.enumeration).count = (yyvsp[-2].enumeration).count + 1; 4456| 0| } 4457| 0|#line 4458 "libyara/grammar.c" 4458| 0| break; 4459| | 4460| 0| case 124: /* string_iterator: string_set */ ------------------ | Branch (4460:3): [True: 0, False: 342] ------------------ 4461| 0|#line 2371 "libyara/grammar.y" 4462| 0| { 4463| 0| fail_if_error(yr_parser_emit_push_const(yyscanner, (yyvsp[0].string_set).count)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4464| 0| fail_if_error(yr_parser_emit(yyscanner, OP_ITER_START_STRING_SET, ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4465| 0| NULL)); 4466| 0| fail_if_error(yr_string_set_destroy((yyvsp[0].string_set))); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4467| 0| } 4468| 0|#line 4469 "libyara/grammar.c" 4469| 0| break; 4470| | 4471| 0| case 125: /* $@10: %empty */ ------------------ | Branch (4471:3): [True: 0, False: 342] ------------------ 4472| 0|#line 2381 "libyara/grammar.y" 4473| 0| { 4474| | // Push end-of-list marker 4475| 0| yr_parser_emit_push_const(yyscanner, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4476| 0| } 4477| 0|#line 4478 "libyara/grammar.c" 4478| 0| break; 4479| | 4480| 0| case 126: /* string_set: '(' $@10 string_enumeration ')' */ ------------------ | Branch (4480:3): [True: 0, False: 342] ------------------ 4481| 0|#line 2386 "libyara/grammar.y" 4482| 0| { 4483| 0| (yyval.string_set) = (yyvsp[-1].string_set); 4484| 0| } 4485| 0|#line 4486 "libyara/grammar.c" 4486| 0| break; 4487| | 4488| 0| case 127: /* string_set: "" */ ------------------ | Branch (4488:3): [True: 0, False: 342] ------------------ 4489| 0|#line 2390 "libyara/grammar.y" 4490| 0| { 4491| 0| fail_if_error(yr_parser_emit_push_const(yyscanner, YR_UNDEFINED)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4492| | 4493| 0| YR_STRING_SET strings; 4494| 0| fail_if_error(yr_parser_emit_pushes_for_strings( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4495| 0| yyscanner, "$*", &strings)); 4496| | 4497| 0| (yyval.string_set) = strings; 4498| 0| } 4499| 0|#line 4500 "libyara/grammar.c" 4500| 0| break; 4501| | 4502| 0| case 128: /* string_enumeration: string_enumeration_item */ ------------------ | Branch (4502:3): [True: 0, False: 342] ------------------ 4503| 0|#line 2403 "libyara/grammar.y" 4504| 0| { (yyval.string_set) = (yyvsp[0].string_set); } 4505| 0|#line 4506 "libyara/grammar.c" 4506| 0| break; 4507| | 4508| 0| case 129: /* string_enumeration: string_enumeration ',' string_enumeration_item */ ------------------ | Branch (4508:3): [True: 0, False: 342] ------------------ 4509| 0|#line 2405 "libyara/grammar.y" 4510| 0| { 4511| 0| YR_STRING_SET_ELEMENT* tail = (yyvsp[-2].string_set).head; 4512| 0| while (tail->next != NULL) { ------------------ | Branch (4512:14): [True: 0, False: 0] ------------------ 4513| 0| tail = tail->next; 4514| 0| } 4515| | // Combine the linked lists by linking the tail of $1 to the head of $3 4516| 0| tail->next = (yyvsp[0].string_set).head; 4517| 0| (yyvsp[-2].string_set).count += (yyvsp[0].string_set).count; 4518| 0| (yyval.string_set) = (yyvsp[-2].string_set); 4519| 0| } 4520| 0|#line 4521 "libyara/grammar.c" 4521| 0| break; 4522| | 4523| 0| case 130: /* string_enumeration_item: "string identifier" */ ------------------ | Branch (4523:3): [True: 0, False: 342] ------------------ 4524| 0|#line 2420 "libyara/grammar.y" 4525| 0| { 4526| 0| YR_STRING_SET strings; 4527| 0| int result = yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string), &strings); 4528| 0| yr_free((yyvsp[0].c_string)); 4529| | 4530| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4531| | 4532| 0| (yyval.string_set) = strings; 4533| 0| } 4534| 0|#line 4535 "libyara/grammar.c" 4535| 0| break; 4536| | 4537| 0| case 131: /* string_enumeration_item: "string identifier with wildcard" */ ------------------ | Branch (4537:3): [True: 0, False: 342] ------------------ 4538| 0|#line 2430 "libyara/grammar.y" 4539| 0| { 4540| 0| YR_STRING_SET strings; 4541| 0| int result = yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[0].c_string), &strings); 4542| 0| yr_free((yyvsp[0].c_string)); 4543| | 4544| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4545| | 4546| 0| (yyval.string_set) = strings; 4547| 0| } 4548| 0|#line 4549 "libyara/grammar.c" 4549| 0| break; 4550| | 4551| 0| case 132: /* $@11: %empty */ ------------------ | Branch (4551:3): [True: 0, False: 342] ------------------ 4552| 0|#line 2444 "libyara/grammar.y" 4553| 0| { 4554| | // Push end-of-list marker 4555| 0| yr_parser_emit_push_const(yyscanner, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4556| 0| } 4557| 0|#line 4558 "libyara/grammar.c" 4558| 0| break; 4559| | 4560| 0| case 133: /* rule_set: '(' $@11 rule_enumeration ')' */ ------------------ | Branch (4560:3): [True: 0, False: 342] ------------------ 4561| 0|#line 2449 "libyara/grammar.y" 4562| 0| { 4563| 0| (yyval.integer) = (yyvsp[-1].integer); 4564| 0| } 4565| 0|#line 4566 "libyara/grammar.c" 4566| 0| break; 4567| | 4568| 0| case 134: /* rule_enumeration: rule_enumeration_item */ ------------------ | Branch (4568:3): [True: 0, False: 342] ------------------ 4569| 0|#line 2456 "libyara/grammar.y" 4570| 0| { (yyval.integer) = (yyvsp[0].integer); } 4571| 0|#line 4572 "libyara/grammar.c" 4572| 0| break; 4573| | 4574| 0| case 135: /* rule_enumeration: rule_enumeration ',' rule_enumeration_item */ ------------------ | Branch (4574:3): [True: 0, False: 342] ------------------ 4575| 0|#line 2457 "libyara/grammar.y" 4576| 0| { (yyval.integer) = (yyvsp[-2].integer) + (yyvsp[0].integer); } 4577| 0|#line 4578 "libyara/grammar.c" 4578| 0| break; 4579| | 4580| 0| case 136: /* rule_enumeration_item: "identifier" */ ------------------ | Branch (4580:3): [True: 0, False: 342] ------------------ 4581| 0|#line 2463 "libyara/grammar.y" 4582| 0| { 4583| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4584| | 4585| 0| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 4586| 0| compiler->arena, 4587| 0| YR_NAMESPACES_TABLE, ------------------ | | 57| 0|#define YR_NAMESPACES_TABLE 0 ------------------ 4588| 0| compiler->current_namespace_idx * sizeof(struct YR_NAMESPACE)); 4589| | 4590| 0| uint32_t rule_idx = yr_hash_table_lookup_uint32( 4591| 0| compiler->rules_table, (yyvsp[0].c_string), ns->name); 4592| | 4593| 0| if (rule_idx != UINT32_MAX) ------------------ | Branch (4593:13): [True: 0, False: 0] ------------------ 4594| 0| { 4595| 0| result = yr_parser_emit_with_arg( 4596| 0| yyscanner, 4597| 0| OP_PUSH_RULE, ------------------ | | 75| 0|#define OP_PUSH_RULE 27 ------------------ 4598| 0| rule_idx, 4599| 0| NULL, 4600| 0| NULL); 4601| 0| } 4602| 0| else 4603| 0| { 4604| 0| yr_compiler_set_error_extra_info(compiler, (yyvsp[0].c_string)); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4605| 0| result = ERROR_UNDEFINED_IDENTIFIER; ------------------ | | 65| 0|#define ERROR_UNDEFINED_IDENTIFIER 20 ------------------ 4606| 0| } 4607| | 4608| 0| yr_free((yyvsp[0].c_string)); 4609| | 4610| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4611| | 4612| 0| (yyval.integer) = 1; 4613| 0| } 4614| 0|#line 4615 "libyara/grammar.c" 4615| 0| break; 4616| | 4617| 0| case 137: /* rule_enumeration_item: "identifier" '*' */ ------------------ | Branch (4617:3): [True: 0, False: 342] ------------------ 4618| 0|#line 2496 "libyara/grammar.y" 4619| 0| { 4620| 0| int count = 0; 4621| 0| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 4622| 0| compiler->arena, 4623| 0| YR_NAMESPACES_TABLE, ------------------ | | 57| 0|#define YR_NAMESPACES_TABLE 0 ------------------ 4624| 0| compiler->current_namespace_idx * sizeof(struct YR_NAMESPACE)); 4625| | 4626| 0| yr_hash_table_add_uint32( 4627| 0| compiler->wildcard_identifiers_table, 4628| 0| (yyvsp[-1].c_string), 4629| 0| ns->name, 4630| 0| 1); 4631| | 4632| 0| int result = yr_parser_emit_pushes_for_rules(yyscanner, (yyvsp[-1].c_string), &count); 4633| 0| yr_free((yyvsp[-1].c_string)); 4634| | 4635| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4636| | 4637| 0| (yyval.integer) = count; 4638| 0| } 4639| 0|#line 4640 "libyara/grammar.c" 4640| 0| break; 4641| | 4642| 0| case 138: /* for_expression: primary_expression */ ------------------ | Branch (4642:3): [True: 0, False: 342] ------------------ 4643| 0|#line 2521 "libyara/grammar.y" 4644| 0| { 4645| 0| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER && !IS_UNDEFINED((yyvsp[0].expression).value.integer)) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER && !IS_UNDEFINED((yyvsp[0].expression).value.integer)) ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (4645:13): [True: 0, False: 0] | Branch (4645:70): [True: 0, False: 0] ------------------ 4646| 0| { 4647| 0| if ((yyvsp[0].expression).value.integer == 0) ------------------ | Branch (4647:15): [True: 0, False: 0] ------------------ 4648| 0| { 4649| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 4650| 0| "consider using \"none\" keyword, it is less ambiguous."); 4651| 0| } 4652| | 4653| 0| if ((yyvsp[0].expression).value.integer < 0) ------------------ | Branch (4653:15): [True: 0, False: 0] ------------------ 4654| 0| { 4655| 0| yr_compiler_set_error_extra_info_fmt(compiler, ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 4656| 0| "%" PRId64, (yyvsp[0].expression).value.integer); 4657| | 4658| 0| fail_with_error(ERROR_INVALID_VALUE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 4659| 0| } 4660| 0| } 4661| | 4662| 0| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_FLOAT) ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (4662:13): [True: 0, False: 0] ------------------ 4663| 0| { 4664| 0| yr_compiler_set_error_extra_info_fmt(compiler, ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 4665| 0| "%a", (yyvsp[0].expression).value.double_); 4666| | 4667| 0| fail_with_error(ERROR_INVALID_VALUE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 4668| 0| } 4669| | 4670| 0| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_STRING) ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (4670:13): [True: 0, False: 0] ------------------ 4671| 0| { 4672| 0| SIZED_STRING* ss = yr_arena_ref_to_ptr(compiler->arena, 4673| 0| &(yyvsp[0].expression).value.sized_string_ref); 4674| | // If the expression is an external string variable we need to get 4675| | // it some other way. 4676| 0| if (ss != NULL) ------------------ | Branch (4676:15): [True: 0, False: 0] ------------------ 4677| 0| { 4678| 0| yr_compiler_set_error_extra_info_fmt(compiler, "%s", ss->c_string); ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 4679| 0| } 4680| 0| else 4681| 0| { 4682| 0| yr_compiler_set_error_extra_info(compiler, ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4683| 0| "string in for_expression is invalid"); 4684| 0| } 4685| | 4686| 0| fail_with_error(ERROR_INVALID_VALUE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 4687| 0| } 4688| | 4689| 0| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_REGEXP) ------------------ | | 49| 0|#define EXPRESSION_TYPE_REGEXP 8 ------------------ | Branch (4689:13): [True: 0, False: 0] ------------------ 4690| 0| { 4691| 0| yr_compiler_set_error_extra_info(compiler, ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 4692| 0| "regexp in for_expression is invalid"); 4693| | 4694| 0| fail_with_error(ERROR_INVALID_VALUE); ------------------ | | 120| 0| { \ | | 121| 0| compiler->last_error = e; \ | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 123| 0| switch (e) \ | | 124| 0| { \ | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | ------------------ | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | ------------------ | | | Branch (125:7): [True: 0, False: 0] | | ------------------ | | 126| 0| YYABORT; \ | | ------------------ | | | | 1313| 0|#define YYABORT goto yyabortlab | | ------------------ | | 127| 0| default: \ | | ------------------ | | | Branch (127:7): [True: 0, False: 0] | | ------------------ | | 128| 0| YYERROR; \ | | ------------------ | | | | 1314| 0|#define YYERROR goto yyerrorlab | | ------------------ | | 129| 0| } \ | | 130| 0| } ------------------ 4695| 0| } 4696| | 4697| 0| (yyval.expression).value.integer = (yyvsp[0].expression).value.integer; 4698| 0| } 4699| 0|#line 4700 "libyara/grammar.c" 4700| 0| break; 4701| | 4702| 0| case 139: /* for_expression: for_quantifier */ ------------------ | Branch (4702:3): [True: 0, False: 342] ------------------ 4703| 0|#line 2577 "libyara/grammar.y" 4704| 0| { 4705| 0| (yyval.expression).value.integer = (yyvsp[0].expression).value.integer; 4706| 0| } 4707| 0|#line 4708 "libyara/grammar.c" 4708| 0| break; 4709| | 4710| 0| case 140: /* for_quantifier: "" */ ------------------ | Branch (4710:3): [True: 0, False: 342] ------------------ 4711| 0|#line 2584 "libyara/grammar.y" 4712| 0| { 4713| 0| yr_parser_emit_push_const(yyscanner, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4714| 0| (yyval.expression).type = EXPRESSION_TYPE_QUANTIFIER; ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ 4715| 0| (yyval.expression).value.integer = FOR_EXPRESSION_ALL; ------------------ | | 108| 0|#define FOR_EXPRESSION_ALL 1 ------------------ 4716| 0| } 4717| 0|#line 4718 "libyara/grammar.c" 4718| 0| break; 4719| | 4720| 0| case 141: /* for_quantifier: "" */ ------------------ | Branch (4720:3): [True: 0, False: 342] ------------------ 4721| 0|#line 2590 "libyara/grammar.y" 4722| 0| { 4723| 0| yr_parser_emit_push_const(yyscanner, 1); 4724| 0| (yyval.expression).type = EXPRESSION_TYPE_QUANTIFIER; ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ 4725| 0| (yyval.expression).value.integer = FOR_EXPRESSION_ANY; ------------------ | | 109| 0|#define FOR_EXPRESSION_ANY 2 ------------------ 4726| 0| } 4727| 0|#line 4728 "libyara/grammar.c" 4728| 0| break; 4729| | 4730| 0| case 142: /* for_quantifier: "" */ ------------------ | Branch (4730:3): [True: 0, False: 342] ------------------ 4731| 0|#line 2596 "libyara/grammar.y" 4732| 0| { 4733| 0| yr_parser_emit_push_const(yyscanner, 0); 4734| 0| (yyval.expression).type = EXPRESSION_TYPE_QUANTIFIER; ------------------ | | 52| 0|#define EXPRESSION_TYPE_QUANTIFIER 64 ------------------ 4735| 0| (yyval.expression).value.integer = FOR_EXPRESSION_NONE; ------------------ | | 110| 0|#define FOR_EXPRESSION_NONE 3 ------------------ 4736| 0| } 4737| 0|#line 4738 "libyara/grammar.c" 4738| 0| break; 4739| | 4740| 0| case 143: /* primary_expression: '(' primary_expression ')' */ ------------------ | Branch (4740:3): [True: 0, False: 342] ------------------ 4741| 0|#line 2606 "libyara/grammar.y" 4742| 0| { 4743| 0| (yyval.expression) = (yyvsp[-1].expression); 4744| 0| } 4745| 0|#line 4746 "libyara/grammar.c" 4746| 0| break; 4747| | 4748| 18| case 144: /* primary_expression: "" */ ------------------ | Branch (4748:3): [True: 18, False: 324] ------------------ 4749| 18|#line 2610 "libyara/grammar.y" 4750| 18| { 4751| 18| fail_if_error(yr_parser_emit( ------------------ | | 135| 18| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 36|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 18|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 18] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 18| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4752| 18| yyscanner, OP_FILESIZE, NULL)); 4753| | 4754| 18| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 18|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4755| 18| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 18|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4756| 18| } 4757| 0|#line 4758 "libyara/grammar.c" 4758| 0| break; 4759| | 4760| 0| case 145: /* primary_expression: "" */ ------------------ | Branch (4760:3): [True: 0, False: 342] ------------------ 4761| 0|#line 2618 "libyara/grammar.y" 4762| 0| { 4763| 0| yywarning(yyscanner, ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 4764| 0| "using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " 4765| 0| "function from PE module instead."); 4766| | 4767| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4768| 0| yyscanner, OP_ENTRYPOINT, NULL)); 4769| | 4770| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4771| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4772| 0| } 4773| 0|#line 4774 "libyara/grammar.c" 4774| 0| break; 4775| | 4776| 0| case 146: /* primary_expression: "integer function" '(' primary_expression ')' */ ------------------ | Branch (4776:3): [True: 0, False: 342] ------------------ 4777| 0|#line 2630 "libyara/grammar.y" 4778| 0| { 4779| 0| check_type((yyvsp[-1].expression), EXPRESSION_TYPE_INTEGER, "intXXXX or uintXXXX"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 4780| | 4781| | // _INTEGER_FUNCTION_ could be any of int8, int16, int32, uint8, 4782| | // uint32, etc. $1 contains an index that added to OP_READ_INT results 4783| | // in the proper OP_INTXX opcode. 4784| | 4785| 0| fail_if_error(yr_parser_emit( ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4786| 0| yyscanner, (uint8_t) (OP_READ_INT + (yyvsp[-3].integer)), NULL)); 4787| | 4788| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4789| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4790| 0| } 4791| 0|#line 4792 "libyara/grammar.c" 4792| 0| break; 4793| | 4794| 40| case 147: /* primary_expression: "integer number" */ ------------------ | Branch (4794:3): [True: 40, False: 302] ------------------ 4795| 40|#line 2644 "libyara/grammar.y" 4796| 40| { 4797| 40| fail_if_error(yr_parser_emit_push_const(yyscanner, (yyvsp[0].integer))); ------------------ | | 135| 40| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 80|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 40|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 40] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 40| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4798| | 4799| 40| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 40|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4800| 40| (yyval.expression).value.integer = (yyvsp[0].integer); 4801| 40| } 4802| 0|#line 4803 "libyara/grammar.c" 4803| 0| break; 4804| | 4805| 2| case 148: /* primary_expression: "floating point number" */ ------------------ | Branch (4805:3): [True: 2, False: 340] ------------------ 4806| 2|#line 2651 "libyara/grammar.y" 4807| 2| { 4808| 2| fail_if_error(yr_parser_emit_with_arg_double( ------------------ | | 135| 2| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 4|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 2|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 2] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 2| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4809| 2| yyscanner, OP_PUSH, (yyvsp[0].double_), NULL, NULL)); 4810| | 4811| 2| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 2|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 4812| 2| } 4813| 0|#line 4814 "libyara/grammar.c" 4814| 0| break; 4815| | 4816| 0| case 149: /* primary_expression: "text string" */ ------------------ | Branch (4816:3): [True: 0, False: 342] ------------------ 4817| 0|#line 2658 "libyara/grammar.y" 4818| 0| { 4819| 0| YR_ARENA_REF ref; 4820| | 4821| 0| int result = _yr_compiler_store_data( 4822| 0| compiler, 4823| 0| (yyvsp[0].sized_string), 4824| 0| (yyvsp[0].sized_string)->length + sizeof(SIZED_STRING), 4825| 0| &ref); 4826| | 4827| 0| yr_free((yyvsp[0].sized_string)); 4828| | 4829| 0| if (result == ERROR_SUCCESS) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ | Branch (4829:13): [True: 0, False: 0] ------------------ 4830| 0| result = yr_parser_emit_with_arg_reloc( 4831| 0| yyscanner, 4832| 0| OP_PUSH, ------------------ | | 61| 0|#define OP_PUSH 13 ------------------ 4833| 0| yr_arena_ref_to_ptr(compiler->arena, &ref), 4834| 0| NULL, 4835| 0| NULL); 4836| | 4837| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4838| | 4839| 0| (yyval.expression).type = EXPRESSION_TYPE_STRING; ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ 4840| 0| (yyval.expression).value.sized_string_ref = ref; 4841| 0| } 4842| 0|#line 4843 "libyara/grammar.c" 4843| 0| break; 4844| | 4845| 0| case 150: /* primary_expression: "string count" "" range */ ------------------ | Branch (4845:3): [True: 0, False: 342] ------------------ 4846| 0|#line 2683 "libyara/grammar.y" 4847| 0| { 4848| 0| int result = yr_parser_reduce_string_identifier( 4849| 0| yyscanner, (yyvsp[-2].c_string), OP_COUNT_IN, YR_UNDEFINED); ------------------ | | 124| 0|#define OP_COUNT_IN 76 ------------------ yyscanner, (yyvsp[-2].c_string), OP_COUNT_IN, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4850| | 4851| 0| yr_free((yyvsp[-2].c_string)); 4852| | 4853| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4854| | 4855| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4856| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4857| 0| } 4858| 0|#line 4859 "libyara/grammar.c" 4859| 0| break; 4860| | 4861| 0| case 151: /* primary_expression: "string count" */ ------------------ | Branch (4861:3): [True: 0, False: 342] ------------------ 4862| 0|#line 2695 "libyara/grammar.y" 4863| 0| { 4864| 0| int result = yr_parser_reduce_string_identifier( 4865| 0| yyscanner, (yyvsp[0].c_string), OP_COUNT, YR_UNDEFINED); ------------------ | | 68| 0|#define OP_COUNT 20 ------------------ yyscanner, (yyvsp[0].c_string), OP_COUNT, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4866| | 4867| 0| yr_free((yyvsp[0].c_string)); 4868| | 4869| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4870| | 4871| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4872| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4873| 0| } 4874| 0|#line 4875 "libyara/grammar.c" 4875| 0| break; 4876| | 4877| 0| case 152: /* primary_expression: "string offset" '[' primary_expression ']' */ ------------------ | Branch (4877:3): [True: 0, False: 342] ------------------ 4878| 0|#line 2707 "libyara/grammar.y" 4879| 0| { 4880| 0| int result = yr_parser_reduce_string_identifier( 4881| 0| yyscanner, (yyvsp[-3].c_string), OP_OFFSET, YR_UNDEFINED); ------------------ | | 73| 0|#define OP_OFFSET 25 ------------------ yyscanner, (yyvsp[-3].c_string), OP_OFFSET, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4882| | 4883| 0| yr_free((yyvsp[-3].c_string)); 4884| | 4885| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4886| | 4887| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4888| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4889| 0| } 4890| 0|#line 4891 "libyara/grammar.c" 4891| 0| break; 4892| | 4893| 0| case 153: /* primary_expression: "string offset" */ ------------------ | Branch (4893:3): [True: 0, False: 342] ------------------ 4894| 0|#line 2719 "libyara/grammar.y" 4895| 0| { 4896| 0| int result = yr_parser_emit_push_const(yyscanner, 1); 4897| | 4898| 0| if (result == ERROR_SUCCESS) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ | Branch (4898:13): [True: 0, False: 0] ------------------ 4899| 0| result = yr_parser_reduce_string_identifier( 4900| 0| yyscanner, (yyvsp[0].c_string), OP_OFFSET, YR_UNDEFINED); ------------------ | | 73| 0|#define OP_OFFSET 25 ------------------ yyscanner, (yyvsp[0].c_string), OP_OFFSET, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4901| | 4902| 0| yr_free((yyvsp[0].c_string)); 4903| | 4904| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4905| | 4906| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4907| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4908| 0| } 4909| 0|#line 4910 "libyara/grammar.c" 4910| 0| break; 4911| | 4912| 0| case 154: /* primary_expression: "string length" '[' primary_expression ']' */ ------------------ | Branch (4912:3): [True: 0, False: 342] ------------------ 4913| 0|#line 2734 "libyara/grammar.y" 4914| 0| { 4915| 0| int result = yr_parser_reduce_string_identifier( 4916| 0| yyscanner, (yyvsp[-3].c_string), OP_LENGTH, YR_UNDEFINED); ------------------ | | 69| 0|#define OP_LENGTH 21 ------------------ yyscanner, (yyvsp[-3].c_string), OP_LENGTH, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4917| | 4918| 0| yr_free((yyvsp[-3].c_string)); 4919| | 4920| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4921| | 4922| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4923| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4924| 0| } 4925| 0|#line 4926 "libyara/grammar.c" 4926| 0| break; 4927| | 4928| 0| case 155: /* primary_expression: "string length" */ ------------------ | Branch (4928:3): [True: 0, False: 342] ------------------ 4929| 0|#line 2746 "libyara/grammar.y" 4930| 0| { 4931| 0| int result = yr_parser_emit_push_const(yyscanner, 1); 4932| | 4933| 0| if (result == ERROR_SUCCESS) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ | Branch (4933:13): [True: 0, False: 0] ------------------ 4934| 0| result = yr_parser_reduce_string_identifier( 4935| 0| yyscanner, (yyvsp[0].c_string), OP_LENGTH, YR_UNDEFINED); ------------------ | | 69| 0|#define OP_LENGTH 21 ------------------ yyscanner, (yyvsp[0].c_string), OP_LENGTH, YR_UNDEFINED); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4936| | 4937| 0| yr_free((yyvsp[0].c_string)); 4938| | 4939| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4940| | 4941| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4942| 0| (yyval.expression).value.integer = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 4943| 0| } 4944| 0|#line 4945 "libyara/grammar.c" 4945| 0| break; 4946| | 4947| 18| case 156: /* primary_expression: identifier */ ------------------ | Branch (4947:3): [True: 18, False: 324] ------------------ 4948| 18|#line 2761 "libyara/grammar.y" 4949| 18| { 4950| 18| int result = ERROR_SUCCESS; ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ 4951| | 4952| 18| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_OBJECT) ------------------ | | 50| 18|#define EXPRESSION_TYPE_OBJECT 16 ------------------ | Branch (4952:13): [True: 18, False: 0] ------------------ 4953| 18| { 4954| 18| result = yr_parser_emit( 4955| 18| yyscanner, OP_OBJ_VALUE, NULL); ------------------ | | 65| 18|#define OP_OBJ_VALUE 17 ------------------ 4956| | 4957| 18| switch((yyvsp[0].expression).value.object->type) 4958| 18| { 4959| 6| case OBJECT_TYPE_INTEGER: ------------------ | | 58| 6|#define OBJECT_TYPE_INTEGER 1 ------------------ | Branch (4959:13): [True: 6, False: 12] ------------------ 4960| 6| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 6|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 4961| 6| (yyval.expression).value.integer = (yyvsp[0].expression).value.object->value.i; 4962| 6| break; 4963| 12| case OBJECT_TYPE_FLOAT: ------------------ | | 64| 12|#define OBJECT_TYPE_FLOAT 7 ------------------ | Branch (4963:13): [True: 12, False: 6] ------------------ 4964| 12| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 12|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 4965| 12| break; 4966| 0| case OBJECT_TYPE_STRING: ------------------ | | 59| 0|#define OBJECT_TYPE_STRING 2 ------------------ | Branch (4966:13): [True: 0, False: 18] ------------------ 4967| 0| (yyval.expression).type = EXPRESSION_TYPE_STRING; ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ 4968| 0| (yyval.expression).value.sized_string_ref = YR_ARENA_NULL_REF; ------------------ | | 43| 0| (YR_ARENA_REF) \ | | 44| 0| { \ | | 45| 0| UINT32_MAX, UINT32_MAX \ | | 46| 0| } ------------------ 4969| 0| break; 4970| 0| default: ------------------ | Branch (4970:13): [True: 0, False: 18] ------------------ 4971| | // In a primary expression any identifier that corresponds to an 4972| | // object must be of type integer, float or string. If "foobar" is 4973| | // either a function, structure, dictionary or array you can not 4974| | // use it as: 4975| | // condition: foobar 4976| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); | | ------------------ | | | Branch (330:7): [True: 0, False: 0] | | ------------------ ------------------ 4977| 0| compiler, 4978| 0| "wrong usage of identifier \"%s\"", 4979| 0| expression_identifier((yyvsp[0].expression))); 4980| | 4981| 0| result = ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 4982| 18| } 4983| 18| } 4984| 0| else 4985| 0| { 4986| 0| (yyval.expression) = (yyvsp[0].expression); 4987| 0| } 4988| | 4989| 18| fail_if_error(result); ------------------ | | 135| 18| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 36|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 18|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 18] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 18| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 4990| 18| } 4991| 0|#line 4992 "libyara/grammar.c" 4992| 0| break; 4993| | 4994| 0| case 157: /* primary_expression: '-' primary_expression */ ------------------ | Branch (4994:3): [True: 0, False: 342] ------------------ 4995| 0|#line 2804 "libyara/grammar.y" 4996| 0| { 4997| 0| int result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 4998| | 4999| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT, "-"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5000| | 5001| 0| if ((yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5001:13): [True: 0, False: 0] ------------------ 5002| 0| { 5003| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5004| 0| (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == YR_UNDEFINED) ? ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ | Branch (5004:46): [True: 0, False: 0] ------------------ 5005| 0| YR_UNDEFINED : (int64_t) (0 - (uint64_t) (yyvsp[0].expression).value.integer); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 5006| 0| result = yr_parser_emit(yyscanner, OP_INT_MINUS, NULL); ------------------ | | 152| 0|#define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS) | | ------------------ | | | | 141| 0|#define OP_INT_BEGIN 100 | | ------------------ | | #define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS) | | ------------------ | | | | 139| 0|#define _OP_MINUS 10 | | ------------------ ------------------ 5007| 0| } 5008| 0| else if ((yyvsp[0].expression).type == EXPRESSION_TYPE_FLOAT) ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (5008:18): [True: 0, False: 0] ------------------ 5009| 0| { 5010| 0| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 5011| 0| result = yr_parser_emit(yyscanner, OP_DBL_MINUS, NULL); ------------------ | | 166| 0|#define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS) | | ------------------ | | | | 155| 0|#define OP_DBL_BEGIN 120 | | ------------------ | | #define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS) | | ------------------ | | | | 139| 0|#define _OP_MINUS 10 | | ------------------ ------------------ 5012| 0| } 5013| | 5014| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5015| 0| } 5016| 0|#line 5017 "libyara/grammar.c" 5017| 0| break; 5018| | 5019| 0| case 158: /* primary_expression: primary_expression '+' primary_expression */ ------------------ | Branch (5019:3): [True: 0, False: 342] ------------------ 5020| 0|#line 2825 "libyara/grammar.y" 5021| 0| { 5022| 0| int result = yr_parser_reduce_operation( 5023| 0| yyscanner, "+", (yyvsp[-2].expression), (yyvsp[0].expression)); 5024| | 5025| 0| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5025:13): [True: 0, False: 0] ------------------ 5026| 0| (yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5026:13): [True: 0, False: 0] ------------------ 5027| 0| { 5028| 0| int64_t i1 = (yyvsp[-2].expression).value.integer; 5029| 0| int64_t i2 = (yyvsp[0].expression).value.integer; 5030| | 5031| 0| if (!IS_UNDEFINED(i1) && !IS_UNDEFINED(i2) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ if (!IS_UNDEFINED(i1) && !IS_UNDEFINED(i2) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5031:15): [True: 0, False: 0] | Branch (5031:36): [True: 0, False: 0] ------------------ 5032| 0| ( 5033| 0| (i2 > 0 && i1 > INT64_MAX - i2) || ------------------ | Branch (5033:18): [True: 0, False: 0] | Branch (5033:28): [True: 0, False: 0] ------------------ 5034| 0| (i2 < 0 && i1 < INT64_MIN - i2) ------------------ | Branch (5034:18): [True: 0, False: 0] | Branch (5034:28): [True: 0, False: 0] ------------------ 5035| 0| )) 5036| 0| { 5037| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 5038| 0| compiler, "%" PRId64 " + %" PRId64, i1, i2); 5039| | 5040| 0| result = ERROR_INTEGER_OVERFLOW; ------------------ | | 99| 0|#define ERROR_INTEGER_OVERFLOW 52 ------------------ 5041| 0| } 5042| 0| else 5043| 0| { 5044| 0| (yyval.expression).value.integer = OPERATION(+, i1, i2); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5045| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5046| 0| } 5047| 0| } 5048| 0| else 5049| 0| { 5050| 0| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 5051| 0| } 5052| | 5053| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5054| 0| } 5055| 0|#line 5056 "libyara/grammar.c" 5056| 0| break; 5057| | 5058| 0| case 159: /* primary_expression: primary_expression '-' primary_expression */ ------------------ | Branch (5058:3): [True: 0, False: 342] ------------------ 5059| 0|#line 2860 "libyara/grammar.y" 5060| 0| { 5061| 0| int result = yr_parser_reduce_operation( 5062| 0| yyscanner, "-", (yyvsp[-2].expression), (yyvsp[0].expression)); 5063| | 5064| 0| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5064:13): [True: 0, False: 0] ------------------ 5065| 0| (yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5065:13): [True: 0, False: 0] ------------------ 5066| 0| { 5067| 0| int64_t i1 = (yyvsp[-2].expression).value.integer; 5068| 0| int64_t i2 = (yyvsp[0].expression).value.integer; 5069| | 5070| 0| if (!IS_UNDEFINED(i1) && !IS_UNDEFINED(i2) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ if (!IS_UNDEFINED(i1) && !IS_UNDEFINED(i2) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5070:15): [True: 0, False: 0] | Branch (5070:36): [True: 0, False: 0] ------------------ 5071| 0| ( 5072| 0| (i2 < 0 && i1 > INT64_MAX + i2) || ------------------ | Branch (5072:18): [True: 0, False: 0] | Branch (5072:28): [True: 0, False: 0] ------------------ 5073| 0| (i2 > 0 && i1 < INT64_MIN + i2) ------------------ | Branch (5073:18): [True: 0, False: 0] | Branch (5073:28): [True: 0, False: 0] ------------------ 5074| 0| )) 5075| 0| { 5076| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 5077| 0| compiler, "%" PRId64 " - %" PRId64, i1, i2); 5078| | 5079| 0| result = ERROR_INTEGER_OVERFLOW; ------------------ | | 99| 0|#define ERROR_INTEGER_OVERFLOW 52 ------------------ 5080| 0| } 5081| 0| else 5082| 0| { 5083| 0| (yyval.expression).value.integer = OPERATION(-, i1, i2); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5084| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5085| 0| } 5086| 0| } 5087| 0| else 5088| 0| { 5089| 0| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 5090| 0| } 5091| | 5092| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5093| 0| } 5094| 0|#line 5095 "libyara/grammar.c" 5095| 0| break; 5096| | 5097| 0| case 160: /* primary_expression: primary_expression '*' primary_expression */ ------------------ | Branch (5097:3): [True: 0, False: 342] ------------------ 5098| 0|#line 2895 "libyara/grammar.y" 5099| 0| { 5100| 0| int result = yr_parser_reduce_operation( 5101| 0| yyscanner, "*", (yyvsp[-2].expression), (yyvsp[0].expression)); 5102| | 5103| 0| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5103:13): [True: 0, False: 0] ------------------ 5104| 0| (yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5104:13): [True: 0, False: 0] ------------------ 5105| 0| { 5106| 0| int64_t i1 = (yyvsp[-2].expression).value.integer; 5107| 0| int64_t i2 = (yyvsp[0].expression).value.integer; 5108| | 5109| 0| uint64_t m1 = (i1 < 0) ? 0 - (uint64_t) i1 : (uint64_t) i1; ------------------ | Branch (5109:25): [True: 0, False: 0] ------------------ 5110| 0| uint64_t m2 = (i2 < 0) ? 0 - (uint64_t) i2 : (uint64_t) i2; ------------------ | Branch (5110:25): [True: 0, False: 0] ------------------ 5111| | 5112| 0| if (!IS_UNDEFINED(i1) && !IS_UNDEFINED(i2) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ if (!IS_UNDEFINED(i1) && !IS_UNDEFINED(i2) && ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5112:15): [True: 0, False: 0] | Branch (5112:36): [True: 0, False: 0] ------------------ 5113| 0| i2 != 0 && m1 > (uint64_t) INT64_MAX / m2) ------------------ | Branch (5113:15): [True: 0, False: 0] | Branch (5113:26): [True: 0, False: 0] ------------------ 5114| 0| { 5115| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 5116| 0| compiler, "%" PRId64 " * %" PRId64, i1, i2); 5117| | 5118| 0| result = ERROR_INTEGER_OVERFLOW; ------------------ | | 99| 0|#define ERROR_INTEGER_OVERFLOW 52 ------------------ 5119| 0| } 5120| 0| else 5121| 0| { 5122| 0| (yyval.expression).value.integer = OPERATION(*, i1, i2); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5123| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5124| 0| } 5125| 0| } 5126| 0| else 5127| 0| { 5128| 0| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 5129| 0| } 5130| | 5131| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5132| 0| } 5133| 0|#line 5134 "libyara/grammar.c" 5134| 0| break; 5135| | 5136| 0| case 161: /* primary_expression: primary_expression '\\' primary_expression */ ------------------ | Branch (5136:3): [True: 0, False: 342] ------------------ 5137| 0|#line 2930 "libyara/grammar.y" 5138| 0| { 5139| 0| int result = yr_parser_reduce_operation( 5140| 0| yyscanner, "\\", (yyvsp[-2].expression), (yyvsp[0].expression)); 5141| | 5142| 0| if ((yyvsp[-2].expression).type == EXPRESSION_TYPE_INTEGER && ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5142:13): [True: 0, False: 0] ------------------ 5143| 0| (yyvsp[0].expression).type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (5143:13): [True: 0, False: 0] ------------------ 5144| 0| { 5145| 0| int64_t i1 = (yyvsp[-2].expression).value.integer; 5146| 0| int64_t i2 = (yyvsp[0].expression).value.integer; 5147| | 5148| 0| if (i2 == 0) ------------------ | Branch (5148:15): [True: 0, False: 0] ------------------ 5149| 0| { 5150| 0| result = ERROR_DIVISION_BY_ZERO; ------------------ | | 91| 0|#define ERROR_DIVISION_BY_ZERO 44 ------------------ 5151| 0| } 5152| 0| else if (i1 == INT64_MIN && i2 == -1) ------------------ | Branch (5152:20): [True: 0, False: 0] | Branch (5152:39): [True: 0, False: 0] ------------------ 5153| 0| { 5154| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 5155| 0| compiler, "%" PRId64 " \\ %" PRId64, i1, i2); 5156| | 5157| 0| result = ERROR_INTEGER_OVERFLOW; ------------------ | | 99| 0|#define ERROR_INTEGER_OVERFLOW 52 ------------------ 5158| 0| } 5159| 0| else 5160| 0| { 5161| 0| (yyval.expression).value.integer = OPERATION(/, i1, i2); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5162| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5163| 0| } 5164| 0| } 5165| 0| else 5166| 0| { 5167| 0| (yyval.expression).type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 5168| 0| } 5169| | 5170| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5171| 0| } 5172| 0|#line 5173 "libyara/grammar.c" 5173| 0| break; 5174| | 5175| 0| case 162: /* primary_expression: primary_expression '%' primary_expression */ ------------------ | Branch (5175:3): [True: 0, False: 342] ------------------ 5176| 0|#line 2965 "libyara/grammar.y" 5177| 0| { 5178| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "%"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5179| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "%"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5180| | 5181| 0| fail_if_error(yr_parser_emit(yyscanner, OP_MOD, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5182| | 5183| 0| if ((yyvsp[0].expression).value.integer != 0) ------------------ | Branch (5183:13): [True: 0, False: 0] ------------------ 5184| 0| { 5185| 0| (yyval.expression).value.integer = OPERATION(%, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5186| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5187| 0| } 5188| 0| else 5189| 0| { 5190| 0| fail_if_error(ERROR_DIVISION_BY_ZERO); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, Folded] | | | Branch (135:31): [True: 0, Folded] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5191| 0| } 5192| 0| } 5193| 0|#line 5194 "libyara/grammar.c" 5194| 0| break; 5195| | 5196| 0| case 163: /* primary_expression: primary_expression '^' primary_expression */ ------------------ | Branch (5196:3): [True: 0, False: 342] ------------------ 5197| 0|#line 2982 "libyara/grammar.y" 5198| 0| { 5199| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5200| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5201| | 5202| 0| fail_if_error(yr_parser_emit(yyscanner, OP_BITWISE_XOR, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5203| | 5204| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5205| 0| (yyval.expression).value.integer = OPERATION(^, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5206| 0| } 5207| 0|#line 5208 "libyara/grammar.c" 5208| 0| break; 5209| | 5210| 0| case 164: /* primary_expression: primary_expression '&' primary_expression */ ------------------ | Branch (5210:3): [True: 0, False: 342] ------------------ 5211| 0|#line 2992 "libyara/grammar.y" 5212| 0| { 5213| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "^"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5214| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "^"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5215| | 5216| 0| fail_if_error(yr_parser_emit(yyscanner, OP_BITWISE_AND, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5217| | 5218| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5219| 0| (yyval.expression).value.integer = OPERATION(&, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5220| 0| } 5221| 0|#line 5222 "libyara/grammar.c" 5222| 0| break; 5223| | 5224| 0| case 165: /* primary_expression: primary_expression '|' primary_expression */ ------------------ | Branch (5224:3): [True: 0, False: 342] ------------------ 5225| 0|#line 3002 "libyara/grammar.y" 5226| 0| { 5227| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "|"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5228| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "|"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5229| | 5230| 0| fail_if_error(yr_parser_emit(yyscanner, OP_BITWISE_OR, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5231| | 5232| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5233| 0| (yyval.expression).value.integer = OPERATION(|, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5234| 0| } 5235| 0|#line 5236 "libyara/grammar.c" 5236| 0| break; 5237| | 5238| 0| case 166: /* primary_expression: '~' primary_expression */ ------------------ | Branch (5238:3): [True: 0, False: 342] ------------------ 5239| 0|#line 3012 "libyara/grammar.y" 5240| 0| { 5241| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "~"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5242| | 5243| 0| fail_if_error(yr_parser_emit(yyscanner, OP_BITWISE_NOT, NULL)); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5244| | 5245| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5246| 0| (yyval.expression).value.integer = ((yyvsp[0].expression).value.integer == YR_UNDEFINED) ? ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ | Branch (5246:44): [True: 0, False: 0] ------------------ 5247| 0| YR_UNDEFINED : ~((yyvsp[0].expression).value.integer); ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 5248| 0| } 5249| 0|#line 5250 "libyara/grammar.c" 5250| 0| break; 5251| | 5252| 0| case 167: /* primary_expression: primary_expression "<<" primary_expression */ ------------------ | Branch (5252:3): [True: 0, False: 342] ------------------ 5253| 0|#line 3022 "libyara/grammar.y" 5254| 0| { 5255| 0| int result; 5256| | 5257| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, "<<"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5258| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, "<<"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5259| | 5260| 0| result = yr_parser_emit(yyscanner, OP_SHL, NULL); ------------------ | | 56| 0|#define OP_SHL 8 ------------------ 5261| | 5262| 0| if (!IS_UNDEFINED((yyvsp[0].expression).value.integer) && (yyvsp[0].expression).value.integer < 0) ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5262:13): [True: 0, False: 0] | Branch (5262:67): [True: 0, False: 0] ------------------ 5263| 0| result = ERROR_INVALID_OPERAND; ------------------ | | 101| 0|#define ERROR_INVALID_OPERAND 54 ------------------ 5264| 0| else if (!IS_UNDEFINED((yyvsp[0].expression).value.integer) && (yyvsp[0].expression).value.integer >= 64) ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5264:18): [True: 0, False: 0] | Branch (5264:72): [True: 0, False: 0] ------------------ 5265| 0| (yyval.expression).value.integer = 0; 5266| 0| else 5267| 0| (yyval.expression).value.integer = OPERATION(<<, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5268| | 5269| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5270| | 5271| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5272| 0| } 5273| 0|#line 5274 "libyara/grammar.c" 5274| 0| break; 5275| | 5276| 0| case 168: /* primary_expression: primary_expression ">>" primary_expression */ ------------------ | Branch (5276:3): [True: 0, False: 342] ------------------ 5277| 0|#line 3042 "libyara/grammar.y" 5278| 0| { 5279| 0| int result; 5280| | 5281| 0| check_type((yyvsp[-2].expression), EXPRESSION_TYPE_INTEGER, ">>"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5282| 0| check_type((yyvsp[0].expression), EXPRESSION_TYPE_INTEGER, ">>"); ------------------ | | 175| 0| check_type_with_cleanup(expression, expected_type, op, ) | | ------------------ | | | | 145| 0| if (((expression.type) & (expected_type)) == 0) \ | | | | ------------------ | | | | | Branch (145:9): [True: 0, False: 0] | | | | ------------------ | | | | 146| 0| { \ | | | | 147| 0| switch(expression.type) \ | | | | ------------------ | | | | | Branch (147:14): [True: 0, False: 0] | | | | ------------------ | | | | 148| 0| { \ | | | | 149| 0| case EXPRESSION_TYPE_INTEGER: \ | | | | ------------------ | | | | | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 | | | | ------------------ | | | | | Branch (149:9): [True: 0, False: 0] | | | | ------------------ | | | | 150| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 151| 0| compiler, "wrong type \"integer\" for " op " operator"); \ | | | | 152| 0| break; \ | | | | 153| 0| case EXPRESSION_TYPE_FLOAT: \ | | | | ------------------ | | | | | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 | | | | ------------------ | | | | | Branch (153:9): [True: 0, False: 0] | | | | ------------------ | | | | 154| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 155| 0| compiler, "wrong type \"float\" for " op " operator"); \ | | | | 156| 0| break; \ | | | | 157| 0| case EXPRESSION_TYPE_STRING: \ | | | | ------------------ | | | | | | 48| 0|#define EXPRESSION_TYPE_STRING 4 | | | | ------------------ | | | | | Branch (157:9): [True: 0, False: 0] | | | | ------------------ | | | | 158| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 159| 0| compiler, "wrong type \"string\" for " op " operator"); \ | | | | 160| 0| break; \ | | | | 161| 0| case EXPRESSION_TYPE_BOOLEAN: \ | | | | ------------------ | | | | | | 46| 0|#define EXPRESSION_TYPE_BOOLEAN 1 | | | | ------------------ | | | | | Branch (161:9): [True: 0, False: 0] | | | | ------------------ | | | | 162| 0| yr_compiler_set_error_extra_info( \ | | | | ------------------ | | | | | | 320| 0| strlcpy( \ | | | | | | 321| 0| compiler->last_error_extra_info, \ | | | | | | 322| 0| info, \ | | | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | | | ------------------ | | | | 163| 0| compiler, "wrong type \"boolean\" for " op " operator"); \ | | | | 164| 0| break; \ | | | | 165| 0| } \ | | | | 166| 0| cleanup; \ | | | | 167| 0| compiler->last_error = ERROR_WRONG_TYPE; \ | | | | ------------------ | | | | | | 69| 0|#define ERROR_WRONG_TYPE 24 | | | | ------------------ | | | | 168| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 169| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 170| 0| } | | ------------------ ------------------ 5283| | 5284| 0| result = yr_parser_emit(yyscanner, OP_SHR, NULL); ------------------ | | 57| 0|#define OP_SHR 9 ------------------ 5285| | 5286| 0| if (!IS_UNDEFINED((yyvsp[0].expression).value.integer) && (yyvsp[0].expression).value.integer < 0) ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5286:13): [True: 0, False: 0] | Branch (5286:67): [True: 0, False: 0] ------------------ 5287| 0| result = ERROR_INVALID_OPERAND; ------------------ | | 101| 0|#define ERROR_INVALID_OPERAND 54 ------------------ 5288| 0| else if (!IS_UNDEFINED((yyvsp[0].expression).value.integer) && (yyvsp[0].expression).value.integer >= 64) ------------------ | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ | Branch (5288:18): [True: 0, False: 0] | Branch (5288:72): [True: 0, False: 0] ------------------ 5289| 0| (yyval.expression).value.integer = 0; 5290| 0| else 5291| 0| (yyval.expression).value.integer = OPERATION(<<, (yyvsp[-2].expression).value.integer, (yyvsp[0].expression).value.integer); ------------------ | | 197| 0| (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 39| 0|#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) YR_UNDEFINED) | | | | ------------------ | | | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | | | ------------------ | | | | | Branch (39:25): [True: 0, False: 0] | | | | ------------------ | | ------------------ | | (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (YR_UNDEFINED) : (op1 operator op2) | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ ------------------ 5292| | 5293| 0| (yyval.expression).type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 0|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 5294| | 5295| 0| fail_if_error(result); ------------------ | | 135| 0| if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | if (e != ERROR_SUCCESS && e != ERROR_UNKNOWN_ESCAPE_SEQUENCE) \ | | ------------------ | | | | 113| 0|#define ERROR_UNKNOWN_ESCAPE_SEQUENCE 66 | | ------------------ | | | Branch (135:9): [True: 0, False: 0] | | | Branch (135:31): [True: 0, False: 0] | | ------------------ | | 136| 0| { \ | | 137| 0| fail_with_error(e); \ | | ------------------ | | | | 120| 0| { \ | | | | 121| 0| compiler->last_error = e; \ | | | | 122| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 123| 0| switch (e) \ | | | | 124| 0| { \ | | | | 125| 0| case ERROR_INSUFFICIENT_MEMORY: \ | | | | ------------------ | | | | | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 | | | | ------------------ | | | | | Branch (125:7): [True: 0, False: 0] | | | | ------------------ | | | | 126| 0| YYABORT; \ | | | | ------------------ | | | | | | 1313| 0|#define YYABORT goto yyabortlab | | | | ------------------ | | | | 127| 0| default: \ | | | | ------------------ | | | | | Branch (127:7): [True: 0, False: 0] | | | | ------------------ | | | | 128| 0| YYERROR; \ | | | | ------------------ | | | | | | 1314| 0|#define YYERROR goto yyerrorlab | | | | ------------------ | | | | 129| 0| } \ | | | | 130| 0| } | | ------------------ | | 138| 0| } ------------------ 5296| 0| } 5297| 0|#line 5298 "libyara/grammar.c" 5298| 0| break; 5299| | 5300| 0| case 169: /* primary_expression: regexp */ ------------------ | Branch (5300:3): [True: 0, False: 342] ------------------ 5301| 0|#line 3062 "libyara/grammar.y" 5302| 0| { 5303| 0| (yyval.expression) = (yyvsp[0].expression); 5304| 0| } 5305| 0|#line 5306 "libyara/grammar.c" 5306| 0| break; 5307| | 5308| | 5309| 0|#line 5310 "libyara/grammar.c" 5310| | 5311| 6| default: break; ------------------ | Branch (5311:7): [True: 6, False: 336] ------------------ 5312| 342| } 5313| | /* User semantic actions sometimes alter yychar, and that requires 5314| | that yytoken be updated with the new translation. We take the 5315| | approach of translating immediately before every use of yytoken. 5316| | One alternative is translating here after every semantic action, 5317| | but that translation would be missed if the semantic action invokes 5318| | YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or 5319| | if it invokes YYBACKUP. In the case of YYABORT or YYACCEPT, an 5320| | incorrect destructor might then be invoked immediately. In the 5321| | case of YYERROR or YYBACKUP, subsequent parser actions might lead 5322| | to an incorrect destructor call or verbose syntax error message 5323| | before the lookahead is translated. */ 5324| 342| YY_SYMBOL_PRINT ("-> $$ =", YY_CAST (yysymbol_kind_t, yyr1[yyn]), &yyval, &yyloc); 5325| | 5326| 342| YYPOPSTACK (yylen); ------------------ | | 1950| 342|#define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) ------------------ 5327| 342| yylen = 0; 5328| | 5329| 342| *++yyvsp = yyval; 5330| | 5331| | /* Now 'shift' the result of the reduction. Determine what state 5332| | that goes to, based on the state we popped back to and the rule 5333| | number reduced by. */ 5334| 342| { 5335| 342| const int yylhs = yyr1[yyn] - YYNTOKENS; ------------------ | | 885| 342|#define YYNTOKENS 84 ------------------ 5336| 342| const int yyi = yypgoto[yylhs] + *yyssp; 5337| 342| yystate = (0 <= yyi && yyi <= YYLAST && yycheck[yyi] == *yyssp ------------------ | | 882| 568|#define YYLAST 480 ------------------ | Branch (5337:16): [True: 226, False: 116] | Branch (5337:28): [True: 226, False: 0] | Branch (5337:45): [True: 94, False: 132] ------------------ 5338| 342| ? yytable[yyi] 5339| 342| : yydefgoto[yylhs]); 5340| 342| } 5341| | 5342| 342| goto yynewstate; 5343| | 5344| | 5345| |/*--------------------------------------. 5346| || yyerrlab -- here on detecting error. | 5347| |`--------------------------------------*/ 5348| 0|yyerrlab: 5349| | /* Make sure we have latest lookahead translation. See comments at 5350| | user semantic actions for why this is necessary. */ 5351| 0| yytoken = yychar == YYEMPTY ? YYSYMBOL_YYEMPTY : YYTRANSLATE (yychar); ------------------ | | 51| 0|#define yychar yara_yychar ------------------ yytoken = yychar == YYEMPTY ? YYSYMBOL_YYEMPTY : YYTRANSLATE (yychar); ------------------ | | 312| 0|#define YYEMPTY -2 ------------------ yytoken = yychar == YYEMPTY ? YYSYMBOL_YYEMPTY : YYTRANSLATE (yychar); ------------------ | | 900| 0| (0 <= (YYX) && (YYX) <= YYMAXUTOK \ | | ------------------ | | | | 894| 0|#define YYMAXUTOK 319 | | ------------------ | | | Branch (900:4): [True: 0, False: 0] | | | Branch (900:18): [True: 0, False: 0] | | ------------------ | | 901| 0| ? YY_CAST (yysymbol_kind_t, yytranslate[YYX]) \ | | ------------------ | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | ------------------ | | 902| 0| : YYSYMBOL_YYUNDEF) ------------------ | Branch (5351:13): [True: 0, False: 0] ------------------ 5352| | /* If not already recovering from an error, report this error. */ 5353| 0| if (!yyerrstatus) ------------------ | Branch (5353:7): [True: 0, False: 0] ------------------ 5354| 0| { 5355| 0| ++yynerrs; ------------------ | | 53| 0|#define yynerrs yara_yynerrs ------------------ 5356| 0| { 5357| 0| yypcontext_t yyctx 5358| 0| = {yyssp, yytoken}; 5359| 0| char const *yymsgp = YY_("syntax error"); ------------------ | | 684| 0|# define YY_(Msgid) Msgid ------------------ 5360| 0| int yysyntax_error_status; 5361| 0| yysyntax_error_status = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx); 5362| 0| if (yysyntax_error_status == 0) ------------------ | Branch (5362:13): [True: 0, False: 0] ------------------ 5363| 0| yymsgp = yymsg; 5364| 0| else if (yysyntax_error_status == -1) ------------------ | Branch (5364:18): [True: 0, False: 0] ------------------ 5365| 0| { 5366| 0| if (yymsg != yymsgbuf) ------------------ | Branch (5366:17): [True: 0, False: 0] ------------------ 5367| 0| YYSTACK_FREE (yymsg); ------------------ | | 792| 0|# define YYSTACK_FREE YYFREE | | ------------------ | | | | 106| 0|#define YYFREE yr_free | | ------------------ ------------------ 5368| 0| yymsg = YY_CAST (char *, ------------------ | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) ------------------ 5369| 0| YYSTACK_ALLOC (YY_CAST (YYSIZE_T, yymsg_alloc))); 5370| 0| if (yymsg) ------------------ | Branch (5370:17): [True: 0, False: 0] ------------------ 5371| 0| { 5372| 0| yysyntax_error_status 5373| 0| = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx); 5374| 0| yymsgp = yymsg; 5375| 0| } 5376| 0| else 5377| 0| { 5378| 0| yymsg = yymsgbuf; 5379| 0| yymsg_alloc = sizeof yymsgbuf; 5380| 0| yysyntax_error_status = YYENOMEM; 5381| 0| } 5382| 0| } 5383| 0| yyerror (yyscanner, compiler, yymsgp); ------------------ | | 48| 0|#define yyerror yara_yyerror ------------------ 5384| 0| if (yysyntax_error_status == YYENOMEM) ------------------ | Branch (5384:13): [True: 0, False: 0] ------------------ 5385| 0| YYNOMEM; ------------------ | | 1315| 0|#define YYNOMEM goto yyexhaustedlab ------------------ 5386| 0| } 5387| 0| } 5388| | 5389| 0| if (yyerrstatus == 3) ------------------ | Branch (5389:7): [True: 0, False: 0] ------------------ 5390| 0| { 5391| | /* If just tried and failed to reuse lookahead token after an 5392| | error, discard it. */ 5393| | 5394| 0| if (yychar <= _END_OF_FILE_) ------------------ | | 51| 0|#define yychar yara_yychar ------------------ if (yychar <= _END_OF_FILE_) ------------------ | | 313| 0|#define _END_OF_FILE_ 0 ------------------ | Branch (5394:11): [True: 0, False: 0] ------------------ 5395| 0| { 5396| | /* Return failure if at end of input. */ 5397| 0| if (yychar == _END_OF_FILE_) ------------------ | | 51| 0|#define yychar yara_yychar ------------------ if (yychar == _END_OF_FILE_) ------------------ | | 313| 0|#define _END_OF_FILE_ 0 ------------------ | Branch (5397:15): [True: 0, False: 0] ------------------ 5398| 0| YYABORT; ------------------ | | 1313| 0|#define YYABORT goto yyabortlab ------------------ 5399| 0| } 5400| 0| else 5401| 0| { 5402| 0| yydestruct ("Error: discarding", 5403| 0| yytoken, &yylval, yyscanner, compiler); 5404| 0| yychar = YYEMPTY; ------------------ | | 51| 0|#define yychar yara_yychar ------------------ yychar = YYEMPTY; ------------------ | | 312| 0|#define YYEMPTY -2 ------------------ 5405| 0| } 5406| 0| } 5407| | 5408| | /* Else will try to reuse lookahead token after shifting the error 5409| | token. */ 5410| 0| goto yyerrlab1; 5411| | 5412| | 5413| |/*---------------------------------------------------. 5414| || yyerrorlab -- error raised explicitly by YYERROR. | 5415| |`---------------------------------------------------*/ 5416| 0|yyerrorlab: 5417| | /* Pacify compilers when the user code never invokes YYERROR and the 5418| | label yyerrorlab therefore never appears in user code. */ 5419| 0| if (0) ------------------ | Branch (5419:7): [Folded, False: 0] ------------------ 5420| 0| YYERROR; ------------------ | | 1314| 0|#define YYERROR goto yyerrorlab ------------------ 5421| 0| ++yynerrs; ------------------ | | 53| 0|#define yynerrs yara_yynerrs ------------------ 5422| | 5423| | /* Do not reclaim the symbols of the rule whose action triggered 5424| | this YYERROR. */ 5425| 0| YYPOPSTACK (yylen); ------------------ | | 1950| 0|#define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) ------------------ 5426| 0| yylen = 0; 5427| 0| YY_STACK_PRINT (yyss, yyssp); 5428| 0| yystate = *yyssp; 5429| 0| goto yyerrlab1; 5430| | 5431| | 5432| |/*-------------------------------------------------------------. 5433| || yyerrlab1 -- common code for both syntax error and YYERROR. | 5434| |`-------------------------------------------------------------*/ 5435| 0|yyerrlab1: 5436| 0| yyerrstatus = 3; /* Each real token shifted decrements this. */ 5437| | 5438| | /* Pop stack until we find a state that shifts the error token. */ 5439| 0| for (;;) 5440| 0| { 5441| 0| yyn = yypact[yystate]; 5442| 0| if (!yypact_value_is_default (yyn)) ------------------ | | 1021| 0| ((Yyn) == YYPACT_NINF) | | ------------------ | | | | 1018| 0|#define YYPACT_NINF (-170) | | ------------------ ------------------ | Branch (5442:11): [True: 0, False: 0] ------------------ 5443| 0| { 5444| 0| yyn += YYSYMBOL_YYerror; 5445| 0| if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYSYMBOL_YYerror) ------------------ | | 882| 0|#define YYLAST 480 ------------------ | Branch (5445:15): [True: 0, False: 0] | Branch (5445:27): [True: 0, False: 0] | Branch (5445:44): [True: 0, False: 0] ------------------ 5446| 0| { 5447| 0| yyn = yytable[yyn]; 5448| 0| if (0 < yyn) ------------------ | Branch (5448:19): [True: 0, False: 0] ------------------ 5449| 0| break; 5450| 0| } 5451| 0| } 5452| | 5453| | /* Pop the current state because it cannot handle the error token. */ 5454| 0| if (yyssp == yyss) ------------------ | Branch (5454:11): [True: 0, False: 0] ------------------ 5455| 0| YYABORT; ------------------ | | 1313| 0|#define YYABORT goto yyabortlab ------------------ 5456| | 5457| | 5458| 0| yydestruct ("Error: popping", 5459| 0| YY_ACCESSING_SYMBOL (yystate), yyvsp, yyscanner, compiler); ------------------ | | 967| 0|#define YY_ACCESSING_SYMBOL(State) YY_CAST (yysymbol_kind_t, yystos[State]) | | ------------------ | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | ------------------ ------------------ 5460| 0| YYPOPSTACK (1); ------------------ | | 1950| 0|#define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) ------------------ 5461| 0| yystate = *yyssp; 5462| 0| YY_STACK_PRINT (yyss, yyssp); 5463| 0| } 5464| | 5465| 0| YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN 5466| 0| *++yyvsp = yylval; 5467| 0| YY_IGNORE_MAYBE_UNINITIALIZED_END 5468| | 5469| | 5470| | /* Shift the error token. */ 5471| 0| YY_SYMBOL_PRINT ("Shifting", YY_ACCESSING_SYMBOL (yyn), yyvsp, yylsp); 5472| | 5473| 0| yystate = yyn; 5474| 0| goto yynewstate; 5475| | 5476| | 5477| |/*-------------------------------------. 5478| || yyacceptlab -- YYACCEPT comes here. | 5479| |`-------------------------------------*/ 5480| 2|yyacceptlab: 5481| 2| yyresult = 0; 5482| 2| goto yyreturnlab; 5483| | 5484| | 5485| |/*-----------------------------------. 5486| || yyabortlab -- YYABORT comes here. | 5487| |`-----------------------------------*/ 5488| 0|yyabortlab: 5489| 0| yyresult = 1; 5490| 0| goto yyreturnlab; 5491| | 5492| | 5493| |/*-----------------------------------------------------------. 5494| || yyexhaustedlab -- YYNOMEM (memory exhaustion) comes here. | 5495| |`-----------------------------------------------------------*/ 5496| 0|yyexhaustedlab: 5497| 0| yyerror (yyscanner, compiler, YY_("memory exhausted")); ------------------ | | 48| 0|#define yyerror yara_yyerror ------------------ yyerror (yyscanner, compiler, YY_("memory exhausted")); ------------------ | | 684| 0|# define YY_(Msgid) Msgid ------------------ 5498| 0| yyresult = 2; 5499| 0| goto yyreturnlab; 5500| | 5501| | 5502| |/*----------------------------------------------------------. 5503| || yyreturnlab -- parsing is finished, clean up and return. | 5504| |`----------------------------------------------------------*/ 5505| 2|yyreturnlab: 5506| 2| if (yychar != YYEMPTY) ------------------ | | 51| 2|#define yychar yara_yychar ------------------ if (yychar != YYEMPTY) ------------------ | | 312| 2|#define YYEMPTY -2 ------------------ | Branch (5506:7): [True: 0, False: 2] ------------------ 5507| 0| { 5508| | /* Make sure we have latest lookahead translation. See comments at 5509| | user semantic actions for why this is necessary. */ 5510| 0| yytoken = YYTRANSLATE (yychar); ------------------ | | 900| 0| (0 <= (YYX) && (YYX) <= YYMAXUTOK \ | | ------------------ | | | | 894| 0|#define YYMAXUTOK 319 | | ------------------ | | | Branch (900:4): [True: 0, False: 0] | | | Branch (900:18): [True: 0, False: 0] | | ------------------ | | 901| 0| ? YY_CAST (yysymbol_kind_t, yytranslate[YYX]) \ | | ------------------ | | | | 210| 0|# define YY_CAST(Type, Val) ((Type) (Val)) | | ------------------ | | 902| 0| : YYSYMBOL_YYUNDEF) ------------------ 5511| 0| yydestruct ("Cleanup: discarding lookahead", 5512| 0| yytoken, &yylval, yyscanner, compiler); 5513| 0| } 5514| | /* Do not reclaim the symbols of the rule whose action triggered 5515| | this YYABORT or YYACCEPT. */ 5516| 2| YYPOPSTACK (yylen); ------------------ | | 1950| 2|#define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) ------------------ 5517| 2| YY_STACK_PRINT (yyss, yyssp); 5518| 6| while (yyssp != yyss) ------------------ | Branch (5518:10): [True: 4, False: 2] ------------------ 5519| 4| { 5520| 4| yydestruct ("Cleanup: popping", 5521| 4| YY_ACCESSING_SYMBOL (+*yyssp), yyvsp, yyscanner, compiler); ------------------ | | 967| 4|#define YY_ACCESSING_SYMBOL(State) YY_CAST (yysymbol_kind_t, yystos[State]) | | ------------------ | | | | 210| 4|# define YY_CAST(Type, Val) ((Type) (Val)) | | ------------------ ------------------ 5522| 4| YYPOPSTACK (1); ------------------ | | 1950| 4|#define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) ------------------ 5523| 4| } 5524| 2|#ifndef yyoverflow 5525| 2| if (yyss != yyssa) ------------------ | Branch (5525:7): [True: 0, False: 2] ------------------ 5526| 0| YYSTACK_FREE (yyss); ------------------ | | 792| 0|# define YYSTACK_FREE YYFREE | | ------------------ | | | | 106| 0|#define YYFREE yr_free | | ------------------ ------------------ 5527| 2|#endif 5528| 2| if (yymsg != yymsgbuf) ------------------ | Branch (5528:7): [True: 0, False: 2] ------------------ 5529| 0| YYSTACK_FREE (yymsg); ------------------ | | 792| 0|# define YYSTACK_FREE YYFREE | | ------------------ | | | | 106| 0|#define YYFREE yr_free | | ------------------ ------------------ 5530| 2| return yyresult; 5531| 0|} grammar.c:yydestruct: 1766| 4|{ 1767| 4| YY_USE (yyvaluep); ------------------ | | 707| 4|# define YY_USE(E) ((void) (E)) ------------------ 1768| 4| YY_USE (yyscanner); ------------------ | | 707| 4|# define YY_USE(E) ((void) (E)) ------------------ 1769| 4| YY_USE (compiler); ------------------ | | 707| 4|# define YY_USE(E) ((void) (E)) ------------------ 1770| 4| if (!yymsg) ------------------ | Branch (1770:7): [True: 0, False: 4] ------------------ 1771| 0| yymsg = "Deleting"; 1772| 4| YY_SYMBOL_PRINT (yymsg, yykind, yyvaluep, yylocationp); 1773| | 1774| 4| YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN 1775| 4| switch (yykind) 1776| 4| { 1777| 0| case YYSYMBOL__IDENTIFIER_: /* "identifier" */ ------------------ | Branch (1777:5): [True: 0, False: 4] ------------------ 1778| 0|#line 313 "libyara/grammar.y" 1779| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1780| 0|#line 1781 "libyara/grammar.c" 1781| 0| break; 1782| | 1783| 0| case YYSYMBOL__STRING_IDENTIFIER_: /* "string identifier" */ ------------------ | Branch (1783:5): [True: 0, False: 4] ------------------ 1784| 0|#line 317 "libyara/grammar.y" 1785| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1786| 0|#line 1787 "libyara/grammar.c" 1787| 0| break; 1788| | 1789| 0| case YYSYMBOL__STRING_COUNT_: /* "string count" */ ------------------ | Branch (1789:5): [True: 0, False: 4] ------------------ 1790| 0|#line 314 "libyara/grammar.y" 1791| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1792| 0|#line 1793 "libyara/grammar.c" 1793| 0| break; 1794| | 1795| 0| case YYSYMBOL__STRING_OFFSET_: /* "string offset" */ ------------------ | Branch (1795:5): [True: 0, False: 4] ------------------ 1796| 0|#line 315 "libyara/grammar.y" 1797| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1798| 0|#line 1799 "libyara/grammar.c" 1799| 0| break; 1800| | 1801| 0| case YYSYMBOL__STRING_LENGTH_: /* "string length" */ ------------------ | Branch (1801:5): [True: 0, False: 4] ------------------ 1802| 0|#line 316 "libyara/grammar.y" 1803| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1804| 0|#line 1805 "libyara/grammar.c" 1805| 0| break; 1806| | 1807| 0| case YYSYMBOL__STRING_IDENTIFIER_WITH_WILDCARD_: /* "string identifier with wildcard" */ ------------------ | Branch (1807:5): [True: 0, False: 4] ------------------ 1808| 0|#line 318 "libyara/grammar.y" 1809| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1810| 0|#line 1811 "libyara/grammar.c" 1811| 0| break; 1812| | 1813| 0| case YYSYMBOL__TEXT_STRING_: /* "text string" */ ------------------ | Branch (1813:5): [True: 0, False: 4] ------------------ 1814| 0|#line 319 "libyara/grammar.y" 1815| 0| { yr_free(((*yyvaluep).sized_string)); ((*yyvaluep).sized_string) = NULL; } 1816| 0|#line 1817 "libyara/grammar.c" 1817| 0| break; 1818| | 1819| 0| case YYSYMBOL__HEX_STRING_: /* "hex string" */ ------------------ | Branch (1819:5): [True: 0, False: 4] ------------------ 1820| 0|#line 320 "libyara/grammar.y" 1821| 0| { yr_free(((*yyvaluep).sized_string)); ((*yyvaluep).sized_string) = NULL; } 1822| 0|#line 1823 "libyara/grammar.c" 1823| 0| break; 1824| | 1825| 0| case YYSYMBOL__REGEXP_: /* "regular expression" */ ------------------ | Branch (1825:5): [True: 0, False: 4] ------------------ 1826| 0|#line 321 "libyara/grammar.y" 1827| 0| { yr_free(((*yyvaluep).sized_string)); ((*yyvaluep).sized_string) = NULL; } 1828| 0|#line 1829 "libyara/grammar.c" 1829| 0| break; 1830| | 1831| 0| case YYSYMBOL_string_modifiers: /* string_modifiers */ ------------------ | Branch (1831:5): [True: 0, False: 4] ------------------ 1832| 0|#line 337 "libyara/grammar.y" 1833| 0| { 1834| 0| if (((*yyvaluep).modifier).alphabet != NULL) ------------------ | Branch (1834:7): [True: 0, False: 0] ------------------ 1835| 0| { 1836| 0| yr_free(((*yyvaluep).modifier).alphabet); 1837| 0| ((*yyvaluep).modifier).alphabet = NULL; 1838| 0| } 1839| 0|} 1840| 0|#line 1841 "libyara/grammar.c" 1841| 0| break; 1842| | 1843| 0| case YYSYMBOL_string_modifier: /* string_modifier */ ------------------ | Branch (1843:5): [True: 0, False: 4] ------------------ 1844| 0|#line 329 "libyara/grammar.y" 1845| 0| { 1846| 0| if (((*yyvaluep).modifier).alphabet != NULL) ------------------ | Branch (1846:7): [True: 0, False: 0] ------------------ 1847| 0| { 1848| 0| yr_free(((*yyvaluep).modifier).alphabet); 1849| 0| ((*yyvaluep).modifier).alphabet = NULL; 1850| 0| } 1851| 0|} 1852| 0|#line 1853 "libyara/grammar.c" 1853| 0| break; 1854| | 1855| 0| case YYSYMBOL_arguments: /* arguments */ ------------------ | Branch (1855:5): [True: 0, False: 4] ------------------ 1856| 0|#line 326 "libyara/grammar.y" 1857| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1858| 0|#line 1859 "libyara/grammar.c" 1859| 0| break; 1860| | 1861| 0| case YYSYMBOL_arguments_list: /* arguments_list */ ------------------ | Branch (1861:5): [True: 0, False: 4] ------------------ 1862| 0|#line 327 "libyara/grammar.y" 1863| 0| { yr_free(((*yyvaluep).c_string)); ((*yyvaluep).c_string) = NULL; } 1864| 0|#line 1865 "libyara/grammar.c" 1865| 0| break; 1866| | 1867| 0| case YYSYMBOL_string_set: /* string_set */ ------------------ | Branch (1867:5): [True: 0, False: 4] ------------------ 1868| 0|#line 325 "libyara/grammar.y" 1869| 0| { yr_string_set_destroy(((*yyvaluep).string_set)); ((*yyvaluep).string_set).head = NULL; } 1870| 0|#line 1871 "libyara/grammar.c" 1871| 0| break; 1872| | 1873| 0| case YYSYMBOL_string_enumeration: /* string_enumeration */ ------------------ | Branch (1873:5): [True: 0, False: 4] ------------------ 1874| 0|#line 323 "libyara/grammar.y" 1875| 0| { yr_string_set_destroy(((*yyvaluep).string_set)); ((*yyvaluep).string_set).head = NULL; } 1876| 0|#line 1877 "libyara/grammar.c" 1877| 0| break; 1878| | 1879| 0| case YYSYMBOL_string_enumeration_item: /* string_enumeration_item */ ------------------ | Branch (1879:5): [True: 0, False: 4] ------------------ 1880| 0|#line 324 "libyara/grammar.y" 1881| 0| { yr_string_set_destroy(((*yyvaluep).string_set)); ((*yyvaluep).string_set).head = NULL; } 1882| 0|#line 1883 "libyara/grammar.c" 1883| 0| break; 1884| | 1885| 4| default: ------------------ | Branch (1885:7): [True: 4, False: 0] ------------------ 1886| 4| break; 1887| 4| } 1888| 4| YY_IGNORE_MAYBE_UNINITIALIZED_END 1889| 4|} yr_hash: 94| 35.4k|{ 95| 35.4k| const uint8_t* b = (uint8_t*) buffer; 96| | 97| 35.4k| uint32_t result = seed; 98| 35.4k| size_t i; 99| | 100| 35.4k| if (len == 0) ------------------ | Branch (100:7): [True: 0, False: 35.4k] ------------------ 101| 0| return result; 102| | 103| 150k| for (i = len - 1; i > 0; i--) ------------------ | Branch (103:21): [True: 115k, False: 35.4k] ------------------ 104| 115k| { 105| 115k| result ^= ROTATE_INT32(byte_to_int32[*b], i); ------------------ | | 46| 115k|#define ROTATE_INT32(x, shift) rotl32(x, shift % 32) ------------------ 106| 115k| b++; 107| 115k| } 108| | 109| 35.4k| result ^= byte_to_int32[*b]; 110| 35.4k| return result; 111| 35.4k|} yr_hash_table_create: 178| 1.71k|{ 179| 1.71k| YR_HASH_TABLE* new_table; 180| 1.71k| int i; 181| | 182| 1.71k| new_table = (YR_HASH_TABLE*) yr_malloc( 183| 1.71k| sizeof(YR_HASH_TABLE) + size * sizeof(YR_HASH_TABLE_ENTRY*)); 184| | 185| 1.71k| if (new_table == NULL) ------------------ | Branch (185:7): [True: 0, False: 1.71k] ------------------ 186| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 187| | 188| 1.71k| new_table->size = size; 189| | 190| 164k| for (i = 0; i < size; i++) new_table->buckets[i] = NULL; ------------------ | Branch (190:15): [True: 163k, False: 1.71k] ------------------ 191| | 192| 1.71k| *table = new_table; 193| | 194| 1.71k| return ERROR_SUCCESS; ------------------ | | 40| 1.71k|#define ERROR_SUCCESS 0 ------------------ 195| 1.71k|} yr_hash_table_clean: 200| 1.71k|{ 201| 1.71k| YR_HASH_TABLE_ENTRY* entry; 202| 1.71k| YR_HASH_TABLE_ENTRY* next_entry; 203| | 204| 1.71k| int i; 205| | 206| 1.71k| if (table == NULL) ------------------ | Branch (206:7): [True: 0, False: 1.71k] ------------------ 207| 0| return; 208| | 209| 184k| for (i = 0; i < table->size; i++) ------------------ | Branch (209:15): [True: 183k, False: 1.71k] ------------------ 210| 183k| { 211| 183k| entry = table->buckets[i]; 212| | 213| 183k| while (entry != NULL) ------------------ | Branch (213:12): [True: 34, False: 183k] ------------------ 214| 34| { 215| 34| next_entry = entry->next; 216| | 217| 34| if (free_value != NULL) ------------------ | Branch (217:11): [True: 2, False: 32] ------------------ 218| 2| free_value(entry->value); 219| | 220| 34| if (entry->ns != NULL) ------------------ | Branch (220:11): [True: 4, False: 30] ------------------ 221| 4| yr_free(entry->ns); 222| | 223| 34| yr_free(entry->key); 224| 34| yr_free(entry); 225| | 226| 34| entry = next_entry; 227| 34| } 228| | 229| | table->buckets[i] = NULL; 230| 183k| } 231| 1.71k|} yr_hash_table_destroy: 236| 1.71k|{ 237| 1.71k| yr_hash_table_clean(table, free_value); 238| 1.71k| yr_free(table); 239| 1.71k|} yr_hash_table_iterate: 246| 2|{ 247| 2| int result; 248| 2| YR_HASH_TABLE_ENTRY* entry; 249| | 250| 2| if (table == NULL) ------------------ | Branch (250:7): [True: 0, False: 2] ------------------ 251| 0| return ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 252| | 253| 2.00k| for (int i = 0; i < table->size; i++) ------------------ | Branch (253:19): [True: 2.00k, False: 2] ------------------ 254| 2.00k| { 255| 2.00k| entry = table->buckets[i]; 256| 2.00k| while (entry != NULL) ------------------ | Branch (256:12): [True: 0, False: 2.00k] ------------------ 257| 0| { 258| 0| if ((entry->ns == NULL && ns == NULL) ------------------ | Branch (258:12): [True: 0, False: 0] | Branch (258:33): [True: 0, False: 0] ------------------ 259| 0| || (entry->ns != NULL && ns != NULL && !strcmp(entry->ns, ns))) ------------------ | Branch (259:15): [True: 0, False: 0] | Branch (259:36): [True: 0, False: 0] | Branch (259:50): [True: 0, False: 0] ------------------ 260| 0| { 261| 0| result = iterate_func( 262| 0| entry->key, entry->key_length, entry->value, data); 263| | 264| 0| if (result != ERROR_SUCCESS) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ | Branch (264:13): [True: 0, False: 0] ------------------ 265| 0| return result; 266| 0| } 267| 0| entry = entry->next; 268| 0| } 269| 2.00k| } 270| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 271| 2|} yr_hash_table_lookup_raw_key: 278| 16.6k|{ 279| | return _yr_hash_table_lookup(table, key, key_length, ns, false); 280| 16.6k|} yr_hash_table_remove_raw_key: 287| 17.0k|{ 288| | return _yr_hash_table_lookup(table, key, key_length, ns, true); 289| 17.0k|} yr_hash_table_add_raw_key: 297| 1.74k|{ 298| 1.74k| YR_HASH_TABLE_ENTRY* entry; 299| 1.74k| uint32_t bucket_index; 300| | 301| 1.74k| entry = (YR_HASH_TABLE_ENTRY*) yr_malloc(sizeof(YR_HASH_TABLE_ENTRY)); 302| | 303| 1.74k| if (entry == NULL) ------------------ | Branch (303:7): [True: 0, False: 1.74k] ------------------ 304| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 305| | 306| 1.74k| entry->key = yr_malloc(key_length); 307| | 308| 1.74k| if (entry->key == NULL) ------------------ | Branch (308:7): [True: 0, False: 1.74k] ------------------ 309| 0| { 310| 0| yr_free(entry); 311| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 312| 0| } 313| | 314| 1.74k| if (ns != NULL) ------------------ | Branch (314:7): [True: 4, False: 1.73k] ------------------ 315| 4| { 316| 4| entry->ns = yr_strdup(ns); 317| | 318| 4| if (entry->ns == NULL) ------------------ | Branch (318:9): [True: 0, False: 4] ------------------ 319| 0| { 320| 0| yr_free(entry->key); 321| 0| yr_free(entry); 322| | 323| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 324| 0| } 325| 4| } 326| 1.73k| else 327| 1.73k| { 328| 1.73k| entry->ns = NULL; 329| 1.73k| } 330| | 331| 1.74k| entry->key_length = key_length; 332| 1.74k| entry->value = value; 333| | 334| 1.74k| memcpy(entry->key, key, key_length); 335| | 336| 1.74k| bucket_index = yr_hash(0, key, key_length); 337| | 338| 1.74k| if (ns != NULL) ------------------ | Branch (338:7): [True: 4, False: 1.73k] ------------------ 339| 4| bucket_index = yr_hash(bucket_index, (uint8_t*) ns, strlen(ns)); 340| | 341| 1.74k| bucket_index = bucket_index % table->size; 342| | 343| 1.74k| entry->next = table->buckets[bucket_index]; 344| 1.74k| table->buckets[bucket_index] = entry; 345| | 346| 1.74k| return ERROR_SUCCESS; ------------------ | | 40| 1.74k|#define ERROR_SUCCESS 0 ------------------ 347| 1.74k|} yr_hash_table_lookup: 353| 16.5k|{ 354| 16.5k| return yr_hash_table_lookup_raw_key(table, (void*) key, strlen(key), ns); 355| 16.5k|} yr_hash_table_remove: 361| 17.0k|{ 362| 17.0k| return yr_hash_table_remove_raw_key(table, (void*) key, strlen(key), ns); 363| 17.0k|} yr_hash_table_add: 370| 1.70k|{ 371| 1.70k| return yr_hash_table_add_raw_key(table, (void*) key, strlen(key), ns, value); 372| 1.70k|} yr_hash_table_add_uint32: 379| 2|{ 380| 2| return yr_hash_table_add_uint32_raw_key( 381| 2| table, (void*) key, strlen(key), ns, value); 382| 2|} yr_hash_table_lookup_uint32: 388| 2|{ 389| 2| return yr_hash_table_lookup_uint32_raw_key( 390| 2| table, (void*) key, strlen(key), ns); 391| 2|} yr_hash_table_add_uint32_raw_key: 399| 32|{ 400| | // Don't allow values equal to UINT32_MAX or UINT32_MAX - 1. 401| 32| if (value >= UINT32_MAX - 1) ------------------ | Branch (401:7): [True: 0, False: 32] ------------------ 402| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 403| | 404| | // Add +1 to the value in order to avoid putting a NULL pointer in the 405| | // hash table once the integer is casted to a pointer. This is undone 406| | // by yr_hash_table_lookup_uint32. 407| 32| return yr_hash_table_add_raw_key( 408| 32| table, key, key_length, ns, (void*) (size_t) (value + 1)); 409| 32|} yr_hash_table_lookup_uint32_raw_key: 416| 62|{ 417| 62| void* ptr = yr_hash_table_lookup_raw_key(table, key, key_length, ns); 418| | 419| 62| if (ptr == NULL) ------------------ | Branch (419:7): [True: 32, False: 30] ------------------ 420| 32| return UINT32_MAX; 421| | 422| | // Remove one from the pointe in order to get the original value. 423| | // See comment in yr_hash_table_add_uint32_raw_key. 424| 30| return ((uint32_t) (size_t) (uint8_t*) ptr) - 1; 425| 62|} hash.c:rotl32: 41| 115k|{ 42| 115k| assert(shift < 32); ------------------ | Branch (42:3): [True: 0, False: 115k] | Branch (42:3): [True: 115k, False: 0] ------------------ 43| 115k| return (x << shift) | (x >> (-shift & 31)); 44| 115k|} hash.c:_yr_hash_table_lookup: 124| 33.6k|{ 125| 33.6k| YR_HASH_TABLE_ENTRY* entry; 126| 33.6k| YR_HASH_TABLE_ENTRY* prev_entry; 127| | 128| 33.6k| void* result; 129| | 130| 33.6k| uint32_t bucket_index = yr_hash(0, key, key_length); 131| | 132| 33.6k| if (ns != NULL) ------------------ | Branch (132:7): [True: 22, False: 33.6k] ------------------ 133| 22| bucket_index = yr_hash(bucket_index, (uint8_t*) ns, strlen(ns)); 134| | 135| 33.6k| bucket_index = bucket_index % table->size; 136| 33.6k| prev_entry = NULL; 137| 33.6k| entry = table->buckets[bucket_index]; 138| | 139| 33.6k| while (entry != NULL) ------------------ | Branch (139:10): [True: 16.5k, False: 17.1k] ------------------ 140| 16.5k| { 141| 16.5k| int key_match = 142| 16.5k| ((entry->key_length == key_length) && ------------------ | Branch (142:10): [True: 16.5k, False: 0] ------------------ 143| 16.5k| (memcmp(entry->key, key, key_length) == 0)); ------------------ | Branch (143:10): [True: 16.5k, False: 0] ------------------ 144| | 145| 16.5k| int ns_match = 146| 16.5k| ((entry->ns == ns) || ------------------ | Branch (146:10): [True: 16.5k, False: 18] ------------------ 147| 18| (entry->ns != NULL && ns != NULL && strcmp(entry->ns, ns) == 0)); ------------------ | Branch (147:11): [True: 18, False: 0] | Branch (147:32): [True: 18, False: 0] | Branch (147:46): [True: 18, False: 0] ------------------ 148| | 149| 16.5k| if (key_match && ns_match) ------------------ | Branch (149:9): [True: 16.5k, False: 0] | Branch (149:22): [True: 16.5k, False: 0] ------------------ 150| 16.5k| { 151| 16.5k| result = entry->value; 152| | 153| 16.5k| if (remove) ------------------ | Branch (153:11): [True: 1.70k, False: 14.8k] ------------------ 154| 1.70k| { 155| 1.70k| if (prev_entry == NULL) ------------------ | Branch (155:13): [True: 1.70k, False: 0] ------------------ 156| 1.70k| table->buckets[bucket_index] = entry->next; 157| 0| else 158| 0| prev_entry->next = entry->next; 159| | 160| 1.70k| if (entry->ns != NULL) ------------------ | Branch (160:13): [True: 0, False: 1.70k] ------------------ 161| 0| yr_free(entry->ns); 162| | 163| 1.70k| yr_free(entry->key); 164| 1.70k| yr_free(entry); 165| 1.70k| } 166| | 167| 16.5k| return result; 168| 16.5k| } 169| | 170| 0| prev_entry = entry; 171| 0| entry = entry->next; 172| 0| } 173| | 174| 17.1k| return NULL; 175| 33.6k|} exec.c:yr_unaligned_u64: 88| 15.1k|{ 89| 15.1k| const uint64_una_t *tmp = (const uint64_una_t *) ptr; 90| 15.1k| return tmp->val; 91| 15.1k|} exec.c:yr_unaligned_u32: 82| 2.27k|{ 83| 2.27k| const uint32_una_t *tmp = (const uint32_una_t *) ptr; 84| 2.27k| return tmp->val; 85| 2.27k|} exec.c:yr_unaligned_char_ptr: 112| 44.3k|{ 113| 44.3k| const charp_una_t *tmp = (const charp_una_t *) ptr; 114| 44.3k| return tmp->val; 115| 44.3k|} yara_yylex: 1278| 226|{ 1279| 226| yy_state_type yy_current_state; 1280| 226| char *yy_cp, *yy_bp; 1281| 226| int yy_act; 1282| 226| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 1283| | 1284| 226| yylval = yylval_param; ------------------ | | 1097| 226| # define yylval yyg->yylval_r ------------------ 1285| | 1286| 226| if ( !yyg->yy_init ) ------------------ | Branch (1286:7): [True: 2, False: 224] ------------------ 1287| 2| { 1288| 2| yyg->yy_init = 1; 1289| | 1290| |#ifdef YY_USER_INIT 1291| | YY_USER_INIT; 1292| |#endif 1293| | 1294| 2| if ( ! yyg->yy_start ) ------------------ | Branch (1294:8): [True: 2, False: 0] ------------------ 1295| 2| yyg->yy_start = 1; /* first start state */ 1296| | 1297| 2| if ( ! yyin ) ------------------ | | 344| 2|#define yyin yyg->yyin_r ------------------ | Branch (1297:8): [True: 2, False: 0] ------------------ 1298| 2| yyin = stdin; ------------------ | | 344| 2|#define yyin yyg->yyin_r ------------------ 1299| | 1300| 2| if ( ! yyout ) ------------------ | | 345| 2|#define yyout yyg->yyout_r ------------------ | Branch (1300:8): [True: 2, False: 0] ------------------ 1301| 2| yyout = stdout; ------------------ | | 345| 2|#define yyout yyg->yyout_r ------------------ 1302| | 1303| 2| if ( ! YY_CURRENT_BUFFER ) { ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ | Branch (1303:8): [True: 0, False: 2] ------------------ 1304| 0| yyensure_buffer_stack (yyscanner); ------------------ | | 86| 0|#define yyensure_buffer_stack yara_yyensure_buffer_stack ------------------ 1305| 0| YY_CURRENT_BUFFER_LVALUE = ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 1306| 0| yy_create_buffer( yyin, YY_BUF_SIZE , yyscanner); ------------------ | | 20| 0|#define yy_create_buffer yara_yy_create_buffer ------------------ yy_create_buffer( yyin, YY_BUF_SIZE , yyscanner); ------------------ | | 344| 0|#define yyin yyg->yyin_r ------------------ yy_create_buffer( yyin, YY_BUF_SIZE , yyscanner); ------------------ | | 379| 0|#define YY_BUF_SIZE 16384 ------------------ 1307| 0| } 1308| | 1309| 2| yy_load_buffer_state( yyscanner ); ------------------ | | 62| 2|#define yy_load_buffer_state yara_yy_load_buffer_state ------------------ 1310| 2| } 1311| | 1312| 226| { 1313| 226|#line 163 "libyara/lexer.l" 1314| | 1315| | 1316| 226|#line 1316 "libyara/lexer.c" 1317| | 1318| 384| while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */ ------------------ | Branch (1318:23): [True: 384, Folded] ------------------ 1319| 384| { 1320| 384| yy_cp = yyg->yy_c_buf_p; 1321| | 1322| | /* Support of yytext. */ 1323| 384| *yy_cp = yyg->yy_hold_char; 1324| | 1325| | /* yy_bp points to the position in yy_ch_buf of the start of 1326| | * the current run. 1327| | */ 1328| 384| yy_bp = yy_cp; 1329| | 1330| 384| yy_current_state = yyg->yy_start; 1331| 384|yy_match: 1332| 384| do 1333| 1.19k| { 1334| 1.19k| YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)] ; ------------------ | | 334| 1.19k|#define YY_SC_TO_UI(c) ((YY_CHAR) (c)) ------------------ 1335| 1.19k| if ( yy_accept[yy_current_state] ) ------------------ | Branch (1335:9): [True: 798, False: 394] ------------------ 1336| 798| { 1337| 798| yyg->yy_last_accepting_state = yy_current_state; 1338| 798| yyg->yy_last_accepting_cpos = yy_cp; 1339| 798| } 1340| 1.86k| while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) ------------------ | Branch (1340:12): [True: 668, False: 1.19k] ------------------ 1341| 668| { 1342| 668| yy_current_state = (int) yy_def[yy_current_state]; 1343| 668| if ( yy_current_state >= 295 ) ------------------ | Branch (1343:10): [True: 284, False: 384] ------------------ 1344| 284| yy_c = yy_meta[yy_c]; 1345| 668| } 1346| 1.19k| yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c]; 1347| 1.19k| ++yy_cp; 1348| 1.19k| } 1349| 1.19k| while ( yy_current_state != 294 ); ------------------ | Branch (1349:11): [True: 808, False: 384] ------------------ 1350| 384| yy_cp = yyg->yy_last_accepting_cpos; 1351| 384| yy_current_state = yyg->yy_last_accepting_state; 1352| | 1353| 386|yy_find_action: 1354| 386| yy_act = yy_accept[yy_current_state]; 1355| | 1356| 386| YY_DO_BEFORE_ACTION; ------------------ | | 578| 386| yyg->yytext_ptr = yy_bp; \ | | ------------------ | | | | 567| 386|#define yytext_ptr yytext_r | | ------------------ | | 579| 386| yyleng = (int) (yy_cp - yy_bp); \ | | ------------------ | | | | 347| 386|#define yyleng yyg->yyleng_r | | ------------------ | | 580| 386| yyg->yy_hold_char = *yy_cp; \ | | 581| 386| *yy_cp = '\0'; \ | | 582| 386| yyg->yy_c_buf_p = yy_cp; ------------------ 1357| | 1358| 386| if ( yy_act != YY_END_OF_BUFFER && yy_rule_can_match_eol[yy_act] ) ------------------ | | 584| 772|#define YY_END_OF_BUFFER 87 ------------------ | Branch (1358:8): [True: 382, False: 4] | Branch (1358:38): [True: 154, False: 228] ------------------ 1359| 154| { 1360| 154| int yyl; 1361| 308| for ( yyl = 0; yyl < yyleng; ++yyl ) ------------------ | | 347| 308|#define yyleng yyg->yyleng_r ------------------ | Branch (1361:19): [True: 154, False: 154] ------------------ 1362| 154| if ( yytext[yyl] == '\n' ) ------------------ | | 348| 154|#define yytext yyg->yytext_r ------------------ | Branch (1362:10): [True: 0, False: 154] ------------------ 1363| | 1364| 0| do{ yylineno++; ------------------ | | 349| 0|#define yylineno (YY_CURRENT_BUFFER_LVALUE->yy_bs_lineno) | | ------------------ | | | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] | | ------------------ ------------------ 1365| 0| yycolumn=0; ------------------ | | 350| 0|#define yycolumn (YY_CURRENT_BUFFER_LVALUE->yy_bs_column) | | ------------------ | | | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] | | ------------------ ------------------ 1366| 0| }while(0) ------------------ | Branch (1366:12): [Folded, False: 0] ------------------ 1367| 154|; 1368| 154| } 1369| | 1370| 388|do_action: /* This label is used only to access EOF actions. */ 1371| | 1372| 388| switch ( yy_act ) 1373| 388| { /* beginning of action switch */ 1374| 0| case 0: /* must back up */ ------------------ | Branch (1374:4): [True: 0, False: 388] ------------------ 1375| | /* undo the effects of YY_DO_BEFORE_ACTION */ 1376| 0| *yy_cp = yyg->yy_hold_char; 1377| 0| yy_cp = yyg->yy_last_accepting_cpos; 1378| 0| yy_current_state = yyg->yy_last_accepting_state; 1379| 0| goto yy_find_action; 1380| | 1381| 0|case 1: ------------------ | Branch (1381:1): [True: 0, False: 388] ------------------ 1382| 0|YY_RULE_SETUP 1383| 0|#line 165 "libyara/lexer.l" 1384| 0|{ return _DOT_DOT_; } ------------------ | | 127| 0|#define _DOT_DOT_ 259 ------------------ 1385| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1386| 0|case 2: ------------------ | Branch (1386:1): [True: 0, False: 388] ------------------ 1387| 0|YY_RULE_SETUP 1388| 0|#line 166 "libyara/lexer.l" 1389| 0|{ return _LT_; } ------------------ | | 180| 0|#define _LT_ 312 ------------------ 1390| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1391| 0|case 3: ------------------ | Branch (1391:1): [True: 0, False: 388] ------------------ 1392| 0|YY_RULE_SETUP 1393| 0|#line 167 "libyara/lexer.l" 1394| 0|{ return _GT_; } ------------------ | | 182| 0|#define _GT_ 314 ------------------ 1395| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1396| 0|case 4: ------------------ | Branch (1396:1): [True: 0, False: 388] ------------------ 1397| 0|YY_RULE_SETUP 1398| 0|#line 168 "libyara/lexer.l" 1399| 0|{ return _LE_; } ------------------ | | 181| 0|#define _LE_ 313 ------------------ 1400| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1401| 18|case 5: ------------------ | Branch (1401:1): [True: 18, False: 370] ------------------ 1402| 18|YY_RULE_SETUP 1403| 18|#line 169 "libyara/lexer.l" 1404| 18|{ return _GE_; } ------------------ | | 183| 18|#define _GE_ 315 ------------------ 1405| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1406| 0|case 6: ------------------ | Branch (1406:1): [True: 0, False: 388] ------------------ 1407| 0|YY_RULE_SETUP 1408| 0|#line 170 "libyara/lexer.l" 1409| 0|{ return _EQ_; } ------------------ | | 178| 0|#define _EQ_ 310 ------------------ 1410| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1411| 0|case 7: ------------------ | Branch (1411:1): [True: 0, False: 388] ------------------ 1412| 0|YY_RULE_SETUP 1413| 0|#line 171 "libyara/lexer.l" 1414| 0|{ return _NEQ_; } ------------------ | | 179| 0|#define _NEQ_ 311 ------------------ 1415| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1416| 0|case 8: ------------------ | Branch (1416:1): [True: 0, False: 388] ------------------ 1417| 0|YY_RULE_SETUP 1418| 0|#line 172 "libyara/lexer.l" 1419| 0|{ return _SHIFT_LEFT_; } ------------------ | | 184| 0|#define _SHIFT_LEFT_ 316 ------------------ 1420| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1421| 0|case 9: ------------------ | Branch (1421:1): [True: 0, False: 388] ------------------ 1422| 0|YY_RULE_SETUP 1423| 0|#line 173 "libyara/lexer.l" 1424| 0|{ return _SHIFT_RIGHT_; } ------------------ | | 185| 0|#define _SHIFT_RIGHT_ 317 ------------------ 1425| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1426| 0|case 10: ------------------ | Branch (1426:1): [True: 0, False: 388] ------------------ 1427| 0|YY_RULE_SETUP 1428| 0|#line 174 "libyara/lexer.l" 1429| 0|{ return _PRIVATE_; } ------------------ | | 129| 0|#define _PRIVATE_ 261 ------------------ 1430| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1431| 0|case 11: ------------------ | Branch (1431:1): [True: 0, False: 388] ------------------ 1432| 0|YY_RULE_SETUP 1433| 0|#line 175 "libyara/lexer.l" 1434| 0|{ return _GLOBAL_; } ------------------ | | 130| 0|#define _GLOBAL_ 262 ------------------ 1435| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1436| 2|case 12: ------------------ | Branch (1436:1): [True: 2, False: 386] ------------------ 1437| 2|YY_RULE_SETUP 1438| 2|#line 176 "libyara/lexer.l" 1439| 2|{ return _RULE_; } ------------------ | | 128| 2|#define _RULE_ 260 ------------------ 1440| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1441| 0|case 13: ------------------ | Branch (1441:1): [True: 0, False: 388] ------------------ 1442| 0|YY_RULE_SETUP 1443| 0|#line 177 "libyara/lexer.l" 1444| 0|{ return _META_; } ------------------ | | 131| 0|#define _META_ 263 ------------------ 1445| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1446| 0|case 14: ------------------ | Branch (1446:1): [True: 0, False: 388] ------------------ 1447| 0|YY_RULE_SETUP 1448| 0|#line 178 "libyara/lexer.l" 1449| 0|{ return _STRINGS_; } ------------------ | | 132| 0|#define _STRINGS_ 264 ------------------ 1450| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1451| 0|case 15: ------------------ | Branch (1451:1): [True: 0, False: 388] ------------------ 1452| 0|YY_RULE_SETUP 1453| 0|#line 179 "libyara/lexer.l" 1454| 0|{ return _ASCII_; } ------------------ | | 146| 0|#define _ASCII_ 278 ------------------ 1455| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1456| 0|case 16: ------------------ | Branch (1456:1): [True: 0, False: 388] ------------------ 1457| 0|YY_RULE_SETUP 1458| 0|#line 180 "libyara/lexer.l" 1459| 0|{ return _WIDE_; } ------------------ | | 147| 0|#define _WIDE_ 279 ------------------ 1460| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1461| 0|case 17: ------------------ | Branch (1461:1): [True: 0, False: 388] ------------------ 1462| 0|YY_RULE_SETUP 1463| 0|#line 181 "libyara/lexer.l" 1464| 0|{ return _XOR_; } ------------------ | | 148| 0|#define _XOR_ 280 ------------------ 1465| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1466| 0|case 18: ------------------ | Branch (1466:1): [True: 0, False: 388] ------------------ 1467| 0|YY_RULE_SETUP 1468| 0|#line 182 "libyara/lexer.l" 1469| 0|{ return _BASE64_; } ------------------ | | 149| 0|#define _BASE64_ 281 ------------------ 1470| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1471| 0|case 19: ------------------ | Branch (1471:1): [True: 0, False: 388] ------------------ 1472| 0|YY_RULE_SETUP 1473| 0|#line 183 "libyara/lexer.l" 1474| 0|{ return _BASE64_WIDE_; } ------------------ | | 150| 0|#define _BASE64_WIDE_ 282 ------------------ 1475| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1476| 0|case 20: ------------------ | Branch (1476:1): [True: 0, False: 388] ------------------ 1477| 0|YY_RULE_SETUP 1478| 0|#line 184 "libyara/lexer.l" 1479| 0|{ return _FULLWORD_; } ------------------ | | 152| 0|#define _FULLWORD_ 284 ------------------ 1480| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1481| 0|case 21: ------------------ | Branch (1481:1): [True: 0, False: 388] ------------------ 1482| 0|YY_RULE_SETUP 1483| 0|#line 185 "libyara/lexer.l" 1484| 0|{ return _NOCASE_; } ------------------ | | 151| 0|#define _NOCASE_ 283 ------------------ 1485| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1486| 2|case 22: ------------------ | Branch (1486:1): [True: 2, False: 386] ------------------ 1487| 2|YY_RULE_SETUP 1488| 2|#line 186 "libyara/lexer.l" 1489| 2|{ return _CONDITION_; } ------------------ | | 133| 2|#define _CONDITION_ 265 ------------------ 1490| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1491| 0|case 23: ------------------ | Branch (1491:1): [True: 0, False: 388] ------------------ 1492| 0|YY_RULE_SETUP 1493| 0|#line 187 "libyara/lexer.l" 1494| 0|{ return _TRUE_; } ------------------ | | 172| 0|#define _TRUE_ 304 ------------------ 1495| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1496| 0|case 24: ------------------ | Branch (1496:1): [True: 0, False: 388] ------------------ 1497| 0|YY_RULE_SETUP 1498| 0|#line 188 "libyara/lexer.l" 1499| 0|{ return _FALSE_; } ------------------ | | 173| 0|#define _FALSE_ 305 ------------------ 1500| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1501| 0|case 25: ------------------ | Branch (1501:1): [True: 0, False: 388] ------------------ 1502| 0|YY_RULE_SETUP 1503| 0|#line 189 "libyara/lexer.l" 1504| 0|{ return _NOT_; } ------------------ | | 176| 0|#define _NOT_ 308 ------------------ 1505| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1506| 16|case 26: ------------------ | Branch (1506:1): [True: 16, False: 372] ------------------ 1507| 16|YY_RULE_SETUP 1508| 16|#line 190 "libyara/lexer.l" 1509| 16|{ return _AND_; } ------------------ | | 175| 16|#define _AND_ 307 ------------------ 1510| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1511| 0|case 27: ------------------ | Branch (1511:1): [True: 0, False: 388] ------------------ 1512| 0|YY_RULE_SETUP 1513| 0|#line 191 "libyara/lexer.l" 1514| 0|{ return _OR_; } ------------------ | | 174| 0|#define _OR_ 306 ------------------ 1515| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1516| 0|case 28: ------------------ | Branch (1516:1): [True: 0, False: 388] ------------------ 1517| 0|YY_RULE_SETUP 1518| 0|#line 192 "libyara/lexer.l" 1519| 0|{ return _AT_; } ------------------ | | 153| 0|#define _AT_ 285 ------------------ 1520| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1521| 0|case 29: ------------------ | Branch (1521:1): [True: 0, False: 388] ------------------ 1522| 0|YY_RULE_SETUP 1523| 0|#line 193 "libyara/lexer.l" 1524| 0|{ return _IN_; } ------------------ | | 159| 0|#define _IN_ 291 ------------------ 1525| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1526| 0|case 30: ------------------ | Branch (1526:1): [True: 0, False: 388] ------------------ 1527| 0|YY_RULE_SETUP 1528| 0|#line 194 "libyara/lexer.l" 1529| 0|{ return _OF_; } ------------------ | | 160| 0|#define _OF_ 292 ------------------ 1530| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1531| 0|case 31: ------------------ | Branch (1531:1): [True: 0, False: 388] ------------------ 1532| 0|YY_RULE_SETUP 1533| 0|#line 195 "libyara/lexer.l" 1534| 0|{ return _THEM_; } ------------------ | | 162| 0|#define _THEM_ 294 ------------------ 1535| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1536| 0|case 32: ------------------ | Branch (1536:1): [True: 0, False: 388] ------------------ 1537| 0|YY_RULE_SETUP 1538| 0|#line 196 "libyara/lexer.l" 1539| 0|{ return _FOR_; } ------------------ | | 161| 0|#define _FOR_ 293 ------------------ 1540| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1541| 0|case 33: ------------------ | Branch (1541:1): [True: 0, False: 388] ------------------ 1542| 0|YY_RULE_SETUP 1543| 0|#line 197 "libyara/lexer.l" 1544| 0|{ return _ALL_; } ------------------ | | 156| 0|#define _ALL_ 288 ------------------ 1545| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1546| 0|case 34: ------------------ | Branch (1546:1): [True: 0, False: 388] ------------------ 1547| 0|YY_RULE_SETUP 1548| 0|#line 198 "libyara/lexer.l" 1549| 0|{ return _ANY_; } ------------------ | | 157| 0|#define _ANY_ 289 ------------------ 1550| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1551| 0|case 35: ------------------ | Branch (1551:1): [True: 0, False: 388] ------------------ 1552| 0|YY_RULE_SETUP 1553| 0|#line 199 "libyara/lexer.l" 1554| 0|{ return _NONE_; } ------------------ | | 158| 0|#define _NONE_ 290 ------------------ 1555| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1556| 0|case 36: ------------------ | Branch (1556:1): [True: 0, False: 388] ------------------ 1557| 0|YY_RULE_SETUP 1558| 0|#line 200 "libyara/lexer.l" 1559| 0|{ return _ENTRYPOINT_; } ------------------ | | 155| 0|#define _ENTRYPOINT_ 287 ------------------ 1560| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1561| 18|case 37: ------------------ | Branch (1561:1): [True: 18, False: 370] ------------------ 1562| 18|YY_RULE_SETUP 1563| 18|#line 201 "libyara/lexer.l" 1564| 18|{ return _FILESIZE_; } ------------------ | | 154| 18|#define _FILESIZE_ 286 ------------------ 1565| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1566| 0|case 38: ------------------ | Branch (1566:1): [True: 0, False: 388] ------------------ 1567| 0|YY_RULE_SETUP 1568| 0|#line 202 "libyara/lexer.l" 1569| 0|{ return _MATCHES_; } ------------------ | | 163| 0|#define _MATCHES_ 295 ------------------ 1570| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1571| 0|case 39: ------------------ | Branch (1571:1): [True: 0, False: 388] ------------------ 1572| 0|YY_RULE_SETUP 1573| 0|#line 203 "libyara/lexer.l" 1574| 0|{ return _CONTAINS_; } ------------------ | | 164| 0|#define _CONTAINS_ 296 ------------------ 1575| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1576| 0|case 40: ------------------ | Branch (1576:1): [True: 0, False: 388] ------------------ 1577| 0|YY_RULE_SETUP 1578| 0|#line 204 "libyara/lexer.l" 1579| 0|{ return _STARTSWITH_; } ------------------ | | 165| 0|#define _STARTSWITH_ 297 ------------------ 1580| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1581| 0|case 41: ------------------ | Branch (1581:1): [True: 0, False: 388] ------------------ 1582| 0|YY_RULE_SETUP 1583| 0|#line 205 "libyara/lexer.l" 1584| 0|{ return _ENDSWITH_; } ------------------ | | 166| 0|#define _ENDSWITH_ 298 ------------------ 1585| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1586| 0|case 42: ------------------ | Branch (1586:1): [True: 0, False: 388] ------------------ 1587| 0|YY_RULE_SETUP 1588| 0|#line 206 "libyara/lexer.l" 1589| 0|{ return _ICONTAINS_; } ------------------ | | 167| 0|#define _ICONTAINS_ 299 ------------------ 1590| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1591| 0|case 43: ------------------ | Branch (1591:1): [True: 0, False: 388] ------------------ 1592| 0|YY_RULE_SETUP 1593| 0|#line 207 "libyara/lexer.l" 1594| 0|{ return _ISTARTSWITH_; } ------------------ | | 168| 0|#define _ISTARTSWITH_ 300 ------------------ 1595| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1596| 0|case 44: ------------------ | Branch (1596:1): [True: 0, False: 388] ------------------ 1597| 0|YY_RULE_SETUP 1598| 0|#line 208 "libyara/lexer.l" 1599| 0|{ return _IENDSWITH_; } ------------------ | | 169| 0|#define _IENDSWITH_ 301 ------------------ 1600| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1601| 0|case 45: ------------------ | Branch (1601:1): [True: 0, False: 388] ------------------ 1602| 0|YY_RULE_SETUP 1603| 0|#line 209 "libyara/lexer.l" 1604| 0|{ return _IEQUALS_; } ------------------ | | 170| 0|#define _IEQUALS_ 302 ------------------ 1605| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1606| 2|case 46: ------------------ | Branch (1606:1): [True: 2, False: 386] ------------------ 1607| 2|YY_RULE_SETUP 1608| 2|#line 210 "libyara/lexer.l" 1609| 2|{ return _IMPORT_; } ------------------ | | 171| 2|#define _IMPORT_ 303 ------------------ 1610| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1611| 0|case 47: ------------------ | Branch (1611:1): [True: 0, False: 388] ------------------ 1612| 0|YY_RULE_SETUP 1613| 0|#line 211 "libyara/lexer.l" 1614| 0|{ return _DEFINED_; } ------------------ | | 177| 0|#define _DEFINED_ 309 ------------------ 1615| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1616| 0|case 48: ------------------ | Branch (1616:1): [True: 0, False: 388] ------------------ 1617| 0|YY_RULE_SETUP 1618| 0|#line 214 "libyara/lexer.l" 1619| 0|{ BEGIN(comment); } ------------------ | | 357| 0|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ { BEGIN(comment); } ------------------ | | 1043| 0|#define comment 4 ------------------ 1620| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1621| 0|case 49: ------------------ | Branch (1621:1): [True: 0, False: 388] ------------------ 1622| 0|YY_RULE_SETUP 1623| 0|#line 215 "libyara/lexer.l" 1624| 0|{ BEGIN(INITIAL); } ------------------ | | 357| 0|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ { BEGIN(INITIAL); } ------------------ | | 1039| 0|#define INITIAL 0 ------------------ 1625| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1626| 0|case 50: ------------------ | Branch (1626:1): [True: 0, False: 388] ------------------ 1627| |/* rule 50 can match eol */ 1628| 0|YY_RULE_SETUP 1629| 0|#line 216 "libyara/lexer.l" 1630| 0|{ /* skip comments */ } 1631| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1632| 0|case 51: ------------------ | Branch (1632:1): [True: 0, False: 388] ------------------ 1633| 0|YY_RULE_SETUP 1634| 0|#line 219 "libyara/lexer.l" 1635| 0|{ /* skip single-line comments */ } 1636| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1637| 0|case 52: ------------------ | Branch (1637:1): [True: 0, False: 388] ------------------ 1638| 0|YY_RULE_SETUP 1639| 0|#line 222 "libyara/lexer.l" 1640| 0|{ 1641| 0| yyextra->lex_buf_ptr = yyextra->lex_buf; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ yyextra->lex_buf_ptr = yyextra->lex_buf; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1642| 0| yyextra->lex_buf_len = 0; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1643| 0| BEGIN(include); ------------------ | | 357| 0|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ BEGIN(include); ------------------ | | 1042| 0|#define include 3 ------------------ 1644| 0| } 1645| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1646| 0|case 53: ------------------ | Branch (1646:1): [True: 0, False: 388] ------------------ 1647| |/* rule 53 can match eol */ 1648| 0|YY_RULE_SETUP 1649| 0|#line 229 "libyara/lexer.l" 1650| 0|{ yytext_to_buffer; } ------------------ | | 991| 0| { \ | | 992| 0| char *yptr = yytext; \ | | ------------------ | | | | 348| 0|#define yytext yyg->yytext_r | | ------------------ | | 993| 0| lex_check_space_ok(yptr, yyextra->lex_buf_len, YR_LEX_BUF_SIZE); \ | | ------------------ | | | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | | | ------------------ | | | | | Branch (984:9): [True: 0, False: 0] | | | | ------------------ | | | | 985| 0| { \ | | | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 987| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 988| 0| } | | ------------------ | | 994| 0| while(*yptr) \ | | ------------------ | | | Branch (994:13): [True: 0, False: 0] | | ------------------ | | 995| 0| { \ | | 996| 0| *yyextra->lex_buf_ptr++ = *yptr++; \ | | ------------------ | | | | 346| 0|#define yyextra yyg->yyextra_r | | ------------------ | | 997| 0| yyextra->lex_buf_len++; \ | | ------------------ | | | | 346| 0|#define yyextra yyg->yyextra_r | | ------------------ | | 998| 0| } \ | | 999| 0| } ------------------ 1651| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1652| 0|case 54: ------------------ | Branch (1652:1): [True: 0, False: 388] ------------------ 1653| 0|YY_RULE_SETUP 1654| 0|#line 232 "libyara/lexer.l" 1655| 0|{ 1656| | 1657| 0| if (compiler->include_callback != NULL) ------------------ | Branch (1657:7): [True: 0, False: 0] ------------------ 1658| 0| { 1659| | #ifdef _MSC_VER 1660| | char* b = NULL; 1661| | #endif 1662| 0| char* s = NULL; 1663| 0| char* f; 1664| | 1665| 0| char buffer[1024]; 1666| 0| const char* included_rules; 1667| 0| char* current_file_name; 1668| 0| char* include_path; 1669| | 1670| 0| *yyextra->lex_buf_ptr = '\0'; // null-terminate included file path ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1671| | 1672| 0| current_file_name = yr_compiler_get_current_file_name(compiler); 1673| | 1674| 0| if (current_file_name == NULL || ------------------ | Branch (1674:9): [True: 0, False: 0] ------------------ 1675| 0| compiler->include_callback != _yr_compiler_default_include_callback || ------------------ | Branch (1675:9): [True: 0, False: 0] ------------------ 1676| 0| is_absolute_path(yyextra->lex_buf)) ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ | Branch (1676:9): [True: 0, False: 0] ------------------ 1677| 0| { 1678| 0| include_path = yyextra->lex_buf; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1679| 0| } 1680| 0| else 1681| 0| { 1682| 0| strlcpy(buffer, current_file_name, sizeof(buffer)); 1683| 0| s = strrchr(buffer, '/'); 1684| | 1685| | #ifdef _MSC_VER 1686| | b = strrchr(buffer, '\\'); // in Windows both path delimiters are accepted 1687| | #endif 1688| | 1689| | #ifdef _MSC_VER 1690| | if (s != NULL || b != NULL) 1691| | #else 1692| 0| if (s != NULL) ------------------ | Branch (1692:11): [True: 0, False: 0] ------------------ 1693| 0| #endif 1694| 0| { 1695| | #ifdef _MSC_VER 1696| | f = (b > s) ? (b + 1) : (s + 1); 1697| | #else 1698| 0| f = s + 1; 1699| 0| #endif 1700| | 1701| 0| strlcpy(f, yyextra->lex_buf, sizeof(buffer) - (f - buffer)); ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1702| 0| include_path = buffer; 1703| 0| } 1704| 0| else 1705| 0| { 1706| 0| include_path = yyextra->lex_buf; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1707| 0| } 1708| 0| } 1709| | 1710| 0| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 1711| 0| compiler->arena, 1712| 0| YR_NAMESPACES_TABLE, ------------------ | | 57| 0|#define YR_NAMESPACES_TABLE 0 ------------------ 1713| 0| compiler->current_namespace_idx * sizeof(struct YR_NAMESPACE)); 1714| | 1715| 0| included_rules = compiler->include_callback( 1716| 0| include_path, 1717| 0| current_file_name, 1718| 0| ns->name, 1719| 0| compiler->incl_clbk_user_data); 1720| | 1721| 0| if (included_rules != NULL) ------------------ | Branch (1721:9): [True: 0, False: 0] ------------------ 1722| 0| { 1723| 0| int error_code = _yr_compiler_push_file_name(compiler, include_path); 1724| | 1725| 0| if (error_code != ERROR_SUCCESS) ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ | Branch (1725:11): [True: 0, False: 0] ------------------ 1726| 0| { 1727| 0| if (error_code == ERROR_INCLUDES_CIRCULAR_REFERENCE) ------------------ | | 67| 0|#define ERROR_INCLUDES_CIRCULAR_REFERENCE 22 ------------------ | Branch (1727:13): [True: 0, False: 0] ------------------ 1728| 0| { 1729| 0| yyerror(yyscanner, compiler, "includes circular reference"); ------------------ | | 48| 0|#define yyerror yara_yyerror ------------------ 1730| 0| } 1731| 0| else if (error_code == ERROR_INCLUDE_DEPTH_EXCEEDED) ------------------ | | 68| 0|#define ERROR_INCLUDE_DEPTH_EXCEEDED 23 ------------------ | Branch (1731:18): [True: 0, False: 0] ------------------ 1732| 0| { 1733| 0| yyerror(yyscanner, compiler, "includes depth exceeded"); ------------------ | | 48| 0|#define yyerror yara_yyerror ------------------ 1734| 0| } 1735| | 1736| 0| if (compiler->include_free != NULL) ------------------ | Branch (1736:13): [True: 0, False: 0] ------------------ 1737| 0| { 1738| 0| compiler->include_free(included_rules, compiler->incl_clbk_user_data); 1739| 0| } 1740| | 1741| 0| yyterminate(); ------------------ | | 1232| 0|#define yyterminate() return YY_NULL | | ------------------ | | | | 329| 0|#define YY_NULL 0 | | ------------------ ------------------ 1742| 0| } 1743| | 1744| | // Workaround for flex issue: https://github.com/westes/flex/issues/58 1745| 0| yypush_buffer_state(YY_CURRENT_BUFFER, yyscanner); ------------------ | | 74| 0|#define yypush_buffer_state yara_yypush_buffer_state ------------------ yypush_buffer_state(YY_CURRENT_BUFFER, yyscanner); ------------------ | | 509| 0|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 0, False: 0] | | ------------------ | | 510| 0| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 0| : NULL) ------------------ 1746| 0| yy_scan_string(included_rules, yyscanner); ------------------ | | 38| 0|#define yy_scan_string yara_yy_scan_string ------------------ 1747| 0| yyset_lineno(1, yyscanner); ------------------ | | 188| 0|#define yyset_lineno yara_yyset_lineno ------------------ 1748| | 1749| 0| if (compiler->include_free != NULL) ------------------ | Branch (1749:11): [True: 0, False: 0] ------------------ 1750| 0| { 1751| 0| compiler->include_free(included_rules, compiler->incl_clbk_user_data); 1752| 0| } 1753| 0| } 1754| 0| else 1755| 0| { 1756| 0| char* err_msg_fmt; 1757| 0| char err_msg[512]; 1758| | 1759| 0| if (compiler->include_callback == _yr_compiler_default_include_callback) ------------------ | Branch (1759:11): [True: 0, False: 0] ------------------ 1760| 0| { 1761| 0| err_msg_fmt = "can't open include file: %s"; 1762| 0| } 1763| 0| else 1764| 0| { 1765| 0| err_msg_fmt = "callback failed to provide include resource: %s"; 1766| 0| } 1767| | 1768| 0| snprintf( 1769| 0| err_msg, 1770| 0| sizeof(err_msg), 1771| 0| err_msg_fmt, 1772| 0| yyextra->lex_buf); ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 1773| | 1774| 0| yyerror(yyscanner, compiler, err_msg); ------------------ | | 48| 0|#define yyerror yara_yyerror ------------------ 1775| 0| } 1776| | 1777| 0| } 1778| 0| else // not allowing includes 1779| 0| { 1780| 0| yyerror(yyscanner, compiler, "includes are disabled"); ------------------ | | 48| 0|#define yyerror yara_yyerror ------------------ 1781| 0| } 1782| | 1783| 0| BEGIN(INITIAL); ------------------ | | 357| 0|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ BEGIN(INITIAL); ------------------ | | 1039| 0|#define INITIAL 0 ------------------ 1784| 0|} 1785| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1786| 2|case YY_STATE_EOF(INITIAL): ------------------ | | 365| 2|#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) | | ------------------ | | | | 584| 2|#define YY_END_OF_BUFFER 87 | | ------------------ ------------------ | Branch (1786:1): [True: 2, False: 386] ------------------ 1787| 2|case YY_STATE_EOF(str): ------------------ | | 365| 2|#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) | | ------------------ | | | | 584| 2|#define YY_END_OF_BUFFER 87 | | ------------------ ------------------ | Branch (1787:1): [True: 0, False: 388] ------------------ 1788| 2|case YY_STATE_EOF(regexp): ------------------ | | 365| 2|#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) | | ------------------ | | | | 584| 2|#define YY_END_OF_BUFFER 87 | | ------------------ ------------------ | Branch (1788:1): [True: 0, False: 388] ------------------ 1789| 2|case YY_STATE_EOF(include): ------------------ | | 365| 2|#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) | | ------------------ | | | | 584| 2|#define YY_END_OF_BUFFER 87 | | ------------------ ------------------ | Branch (1789:1): [True: 0, False: 388] ------------------ 1790| 2|case YY_STATE_EOF(comment): ------------------ | | 365| 2|#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) | | ------------------ | | | | 584| 2|#define YY_END_OF_BUFFER 87 | | ------------------ ------------------ | Branch (1790:1): [True: 0, False: 388] ------------------ 1791| 2|#line 364 "libyara/lexer.l" 1792| 2|{ 1793| | 1794| 2| yypop_buffer_state(yyscanner); ------------------ | | 80| 2|#define yypop_buffer_state yara_yypop_buffer_state ------------------ 1795| | 1796| 2| if (!YY_CURRENT_BUFFER) ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ | Branch (1796:7): [True: 2, False: 0] ------------------ 1797| 2| yyterminate(); ------------------ | | 1232| 2|#define yyterminate() return YY_NULL | | ------------------ | | | | 329| 2|#define YY_NULL 0 | | ------------------ ------------------ 1798| | 1799| 0| return _END_OF_INCLUDED_FILE_; ------------------ | | 126| 0|#define _END_OF_INCLUDED_FILE_ 258 ------------------ 1800| 2|} 1801| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1802| 0|case 55: ------------------ | Branch (1802:1): [True: 0, False: 388] ------------------ 1803| 0|YY_RULE_SETUP 1804| 0|#line 375 "libyara/lexer.l" 1805| 0|{ 1806| | 1807| 0| yylval->c_string = yr_strdup(yytext); ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ yylval->c_string = yr_strdup(yytext); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 1808| | 1809| 0| if (yylval->c_string == NULL) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1809:7): [True: 0, False: 0] ------------------ 1810| 0| error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1811| | 1812| 0| return _STRING_IDENTIFIER_WITH_WILDCARD_; ------------------ | | 139| 0|#define _STRING_IDENTIFIER_WITH_WILDCARD_ 271 ------------------ 1813| 0|} 1814| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1815| 0|case 56: ------------------ | Branch (1815:1): [True: 0, False: 388] ------------------ 1816| 0|YY_RULE_SETUP 1817| 0|#line 386 "libyara/lexer.l" 1818| 0|{ 1819| | 1820| 0| yylval->c_string = yr_strdup(yytext); ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ yylval->c_string = yr_strdup(yytext); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 1821| | 1822| 0| if (yylval->c_string == NULL) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1822:7): [True: 0, False: 0] ------------------ 1823| 0| error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1824| | 1825| 0| return _STRING_IDENTIFIER_; ------------------ | | 135| 0|#define _STRING_IDENTIFIER_ 267 ------------------ 1826| 0|} 1827| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1828| 0|case 57: ------------------ | Branch (1828:1): [True: 0, False: 388] ------------------ 1829| 0|YY_RULE_SETUP 1830| 0|#line 397 "libyara/lexer.l" 1831| 0|{ 1832| | 1833| 0| yylval->c_string = yr_strdup(yytext); ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ yylval->c_string = yr_strdup(yytext); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 1834| | 1835| 0| if (yylval->c_string == NULL) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1835:7): [True: 0, False: 0] ------------------ 1836| 0| { 1837| 0| error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1838| 0| } 1839| 0| else 1840| 0| { 1841| 0| yylval->c_string[0] = '$'; /* replace # by $*/ ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1842| 0| } 1843| | 1844| 0| return _STRING_COUNT_; ------------------ | | 136| 0|#define _STRING_COUNT_ 268 ------------------ 1845| 0|} 1846| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1847| 0|case 58: ------------------ | Branch (1847:1): [True: 0, False: 388] ------------------ 1848| 0|YY_RULE_SETUP 1849| 0|#line 414 "libyara/lexer.l" 1850| 0|{ 1851| | 1852| 0| yylval->c_string = yr_strdup(yytext); ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ yylval->c_string = yr_strdup(yytext); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 1853| | 1854| 0| if (yylval->c_string == NULL) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1854:7): [True: 0, False: 0] ------------------ 1855| 0| { 1856| 0| error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1857| 0| } 1858| 0| else 1859| 0| { 1860| 0| yylval->c_string[0] = '$'; /* replace @ by $*/ ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1861| 0| } 1862| | 1863| 0| return _STRING_OFFSET_; ------------------ | | 137| 0|#define _STRING_OFFSET_ 269 ------------------ 1864| 0|} 1865| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1866| 0|case 59: ------------------ | Branch (1866:1): [True: 0, False: 388] ------------------ 1867| 0|YY_RULE_SETUP 1868| 0|#line 431 "libyara/lexer.l" 1869| 0|{ 1870| | 1871| 0| yylval->c_string = yr_strdup(yytext); ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ yylval->c_string = yr_strdup(yytext); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 1872| | 1873| 0| if (yylval->c_string == NULL) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1873:7): [True: 0, False: 0] ------------------ 1874| 0| { 1875| 0| error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1876| 0| } 1877| 0| else 1878| 0| { 1879| 0| yylval->c_string[0] = '$'; /* replace ! by $*/ ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1880| 0| } 1881| | 1882| 0| return _STRING_LENGTH_; ------------------ | | 138| 0|#define _STRING_LENGTH_ 270 ------------------ 1883| 0|} 1884| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1885| 0|case 60: ------------------ | Branch (1885:1): [True: 0, False: 388] ------------------ 1886| 0|YY_RULE_SETUP 1887| 0|#line 448 "libyara/lexer.l" 1888| 0|{ 1889| | 1890| 0| char* text = yytext; ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 1891| | 1892| 0| if (*text == 'u') ------------------ | Branch (1892:7): [True: 0, False: 0] ------------------ 1893| 0| { 1894| 0| yylval->integer = 3; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1895| 0| text++; 1896| 0| } 1897| 0| else 1898| 0| { 1899| 0| yylval->integer = 0; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1900| 0| } 1901| | 1902| 0| if (strstr(text, "int8") == text) ------------------ | Branch (1902:7): [True: 0, False: 0] ------------------ 1903| 0| { 1904| 0| yylval->integer += 0; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1905| 0| text += 4; 1906| 0| } 1907| 0| else if (strstr(text, "int16") == text) ------------------ | Branch (1907:12): [True: 0, False: 0] ------------------ 1908| 0| { 1909| 0| yylval->integer += 1; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1910| 0| text += 5; 1911| 0| } 1912| 0| else if (strstr(text, "int32") == text) ------------------ | Branch (1912:12): [True: 0, False: 0] ------------------ 1913| 0| { 1914| 0| yylval->integer += 2; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1915| 0| text += 5; 1916| 0| } 1917| | 1918| 0| if (strcmp(text, "be") == 0) ------------------ | Branch (1918:7): [True: 0, False: 0] ------------------ 1919| 0| { 1920| 0| yylval->integer += 6; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1921| 0| } 1922| | 1923| 0| return _INTEGER_FUNCTION_; ------------------ | | 142| 0|#define _INTEGER_FUNCTION_ 274 ------------------ 1924| 0|} 1925| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1926| 38|case 61: ------------------ | Branch (1926:1): [True: 38, False: 350] ------------------ 1927| 38|YY_RULE_SETUP 1928| 38|#line 487 "libyara/lexer.l" 1929| 38|{ 1930| | 1931| 38| if (strlen(yytext) > 128) ------------------ | | 348| 38|#define yytext yyg->yytext_r ------------------ | Branch (1931:7): [True: 0, False: 38] ------------------ 1932| 38| syntax_error("identifier too long"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 1933| | 1934| 38| yylval->c_string = yr_strdup(yytext); ------------------ | | 1097| 38| # define yylval yyg->yylval_r ------------------ yylval->c_string = yr_strdup(yytext); ------------------ | | 348| 38|#define yytext yyg->yytext_r ------------------ 1935| | 1936| 38| if (yylval->c_string == NULL) ------------------ | | 1097| 38| # define yylval yyg->yylval_r ------------------ | Branch (1936:7): [True: 0, False: 38] ------------------ 1937| 38| error(ERROR_INSUFFICIENT_MEMORY); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1938| | 1939| 38| return _IDENTIFIER_; ------------------ | | 134| 38|#define _IDENTIFIER_ 266 ------------------ 1940| 38|} 1941| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1942| 36|case 62: ------------------ | Branch (1942:1): [True: 36, False: 352] ------------------ 1943| 36|YY_RULE_SETUP 1944| 36|#line 501 "libyara/lexer.l" 1945| 36|{ 1946| | 1947| 36| char *endptr; 1948| | 1949| 36| errno = 0; 1950| 36| yylval->integer = strtoll(yytext, &endptr, 10); ------------------ | | 1097| 36| # define yylval yyg->yylval_r ------------------ yylval->integer = strtoll(yytext, &endptr, 10); ------------------ | | 348| 36|#define yytext yyg->yytext_r ------------------ 1951| | 1952| 36| if (yylval->integer == LLONG_MAX && errno == ERANGE) ------------------ | | 1097| 36| # define yylval yyg->yylval_r ------------------ | Branch (1952:7): [True: 0, False: 36] | Branch (1952:39): [True: 0, False: 0] ------------------ 1953| 0| { 1954| 0| yr_compiler_set_error_extra_info(compiler, yytext); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1955| 0| error(ERROR_INTEGER_OVERFLOW); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1956| 0| } 1957| 36| else if (strstr(yytext, "KB") != NULL) ------------------ | | 348| 36|#define yytext yyg->yytext_r ------------------ | Branch (1957:12): [True: 0, False: 36] ------------------ 1958| 0| { 1959| 0| if (yylval->integer > LLONG_MAX / 1024) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1959:9): [True: 0, False: 0] ------------------ 1960| 0| { 1961| 0| yr_compiler_set_error_extra_info(compiler, yytext); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1962| 0| error(ERROR_INTEGER_OVERFLOW); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1963| 0| } 1964| 0| else 1965| 0| { 1966| 0| yylval->integer *= 1024; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1967| 0| } 1968| 0| } 1969| 36| else if (strstr(yytext, "MB") != NULL) ------------------ | | 348| 36|#define yytext yyg->yytext_r ------------------ | Branch (1969:12): [True: 0, False: 36] ------------------ 1970| 0| { 1971| 0| if (yylval->integer > LLONG_MAX / 1048576) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (1971:9): [True: 0, False: 0] ------------------ 1972| 0| { 1973| 0| yr_compiler_set_error_extra_info(compiler, yytext); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1974| 0| error(ERROR_INTEGER_OVERFLOW); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 1975| 0| } 1976| 0| else 1977| 0| { 1978| 0| yylval->integer *= 1048576; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 1979| 0| } 1980| 0| } 1981| | 1982| 36| return _NUMBER_; ------------------ | | 140| 36|#define _NUMBER_ 272 ------------------ 1983| 36|} 1984| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1985| 2|case 63: ------------------ | Branch (1985:1): [True: 2, False: 386] ------------------ 1986| 2|YY_RULE_SETUP 1987| 2|#line 541 "libyara/lexer.l" 1988| 2|{ 1989| 2| yylval->double_ = atof(yytext); ------------------ | | 1097| 2| # define yylval yyg->yylval_r ------------------ yylval->double_ = atof(yytext); ------------------ | | 348| 2|#define yytext yyg->yytext_r ------------------ 1990| 2| return _DOUBLE_; ------------------ | | 141| 2|#define _DOUBLE_ 273 ------------------ 1991| 36|} 1992| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 1993| 4|case 64: ------------------ | Branch (1993:1): [True: 4, False: 384] ------------------ 1994| 4|YY_RULE_SETUP 1995| 4|#line 546 "libyara/lexer.l" 1996| 4|{ 1997| | 1998| 4| char *endptr; 1999| | 2000| 4| errno = 0; 2001| 4| yylval->integer = strtoll(yytext, &endptr, 16); ------------------ | | 1097| 4| # define yylval yyg->yylval_r ------------------ yylval->integer = strtoll(yytext, &endptr, 16); ------------------ | | 348| 4|#define yytext yyg->yytext_r ------------------ 2002| | 2003| 4| if (yylval->integer == LLONG_MAX && errno == ERANGE) ------------------ | | 1097| 4| # define yylval yyg->yylval_r ------------------ | Branch (2003:7): [True: 0, False: 4] | Branch (2003:39): [True: 0, False: 0] ------------------ 2004| 0| { 2005| 0| yr_compiler_set_error_extra_info(compiler, yytext); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2006| 0| error(ERROR_INTEGER_OVERFLOW); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 2007| 0| } 2008| | 2009| 4| return _NUMBER_; ------------------ | | 140| 4|#define _NUMBER_ 272 ------------------ 2010| 4|} 2011| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2012| 0|case 65: ------------------ | Branch (2012:1): [True: 0, False: 388] ------------------ 2013| 0|YY_RULE_SETUP 2014| 0|#line 562 "libyara/lexer.l" 2015| 0|{ 2016| | 2017| 0| char *endptr; 2018| | 2019| 0| errno = 0; 2020| 0| yylval->integer = strtoll(yytext + 2, &endptr, 8); ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ yylval->integer = strtoll(yytext + 2, &endptr, 8); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 2021| | 2022| 0| if (yylval->integer == LLONG_MAX && errno == ERANGE) ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ | Branch (2022:7): [True: 0, False: 0] | Branch (2022:39): [True: 0, False: 0] ------------------ 2023| 0| { 2024| 0| yr_compiler_set_error_extra_info(compiler, yytext); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 2025| 0| error(ERROR_INTEGER_OVERFLOW); ------------------ | | 971| 0| { \ | | 972| 0| compiler->last_error = error_code; \ | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 974| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 975| 0| } ------------------ 2026| 0| } 2027| | 2028| 0| return _NUMBER_; ------------------ | | 140| 0|#define _NUMBER_ 272 ------------------ 2029| 0|} 2030| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2031| 2|case 66: ------------------ | Branch (2031:1): [True: 2, False: 386] ------------------ 2032| 2|YY_RULE_SETUP 2033| 2|#line 579 "libyara/lexer.l" 2034| 2|{ /* saw closing quote - all done */ 2035| | 2036| 2| alloc_sized_string(s, yyextra->lex_buf_len); ------------------ | | 1002| 2| SIZED_STRING* str = (SIZED_STRING*) yr_malloc( \ | | 1003| 2| str_len + sizeof(SIZED_STRING)); \ | | 1004| 2| if (str == NULL) \ | | ------------------ | | | Branch (1004:7): [True: 0, False: 2] | | ------------------ | | 1005| 2| { \ | | 1006| 0| yyerror(yyscanner, compiler, "not enough memory"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 1007| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 1008| 0| } \ | | 1009| 2| else \ | | 1010| 2| { \ | | 1011| 2| str->length = (uint32_t) (str_len); \ | | 1012| 2| str->flags = 0; \ | | 1013| 2| } \ ------------------ 2037| | 2038| 2| *yyextra->lex_buf_ptr = '\0'; ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ 2039| 2| memcpy(s->c_string, yyextra->lex_buf, yyextra->lex_buf_len + 1); ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ memcpy(s->c_string, yyextra->lex_buf, yyextra->lex_buf_len + 1); ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ 2040| | 2041| 2| yylval->sized_string = s; ------------------ | | 1097| 2| # define yylval yyg->yylval_r ------------------ 2042| | 2043| 2| BEGIN(INITIAL); ------------------ | | 357| 2|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ BEGIN(INITIAL); ------------------ | | 1039| 2|#define INITIAL 0 ------------------ 2044| | 2045| 2| return _TEXT_STRING_; ------------------ | | 143| 2|#define _TEXT_STRING_ 275 ------------------ 2046| 2|} 2047| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2048| 0|case 67: ------------------ | Branch (2048:1): [True: 0, False: 388] ------------------ 2049| 0|YY_RULE_SETUP 2050| 0|#line 594 "libyara/lexer.l" 2051| 0|{ 2052| | 2053| 0| lex_check_space_ok("\t", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2054| 0| *yyextra->lex_buf_ptr++ = '\t'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2055| 0| yyextra->lex_buf_len++; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2056| 0|} 2057| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2058| 0|case 68: ------------------ | Branch (2058:1): [True: 0, False: 388] ------------------ 2059| 0|YY_RULE_SETUP 2060| 0|#line 602 "libyara/lexer.l" 2061| 0|{ 2062| | 2063| 0| lex_check_space_ok("\r", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2064| 0| *yyextra->lex_buf_ptr++ = '\r'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2065| 0| yyextra->lex_buf_len++; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2066| 0|} 2067| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2068| 0|case 69: ------------------ | Branch (2068:1): [True: 0, False: 388] ------------------ 2069| 0|YY_RULE_SETUP 2070| 0|#line 610 "libyara/lexer.l" 2071| 0|{ 2072| | 2073| 0| lex_check_space_ok("\n", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2074| 0| *yyextra->lex_buf_ptr++ = '\n'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2075| 0| yyextra->lex_buf_len++; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2076| 0|} 2077| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2078| 0|case 70: ------------------ | Branch (2078:1): [True: 0, False: 388] ------------------ 2079| 0|YY_RULE_SETUP 2080| 0|#line 618 "libyara/lexer.l" 2081| 0|{ 2082| | 2083| 0| lex_check_space_ok("\"", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2084| 0| *yyextra->lex_buf_ptr++ = '\"'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2085| 0| yyextra->lex_buf_len++; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2086| 0|} 2087| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2088| 0|case 71: ------------------ | Branch (2088:1): [True: 0, False: 388] ------------------ 2089| 0|YY_RULE_SETUP 2090| 0|#line 626 "libyara/lexer.l" 2091| 0|{ 2092| | 2093| 0| lex_check_space_ok("\\", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2094| 0| *yyextra->lex_buf_ptr++ = '\\'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2095| 0| yyextra->lex_buf_len++; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2096| 0|} 2097| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2098| 0|case 72: ------------------ | Branch (2098:1): [True: 0, False: 388] ------------------ 2099| 0|YY_RULE_SETUP 2100| 0|#line 634 "libyara/lexer.l" 2101| 0|{ 2102| | 2103| 0| int result; 2104| | 2105| 0| sscanf(yytext + 2, "%x", &result); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 2106| 0| lex_check_space_ok("X", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2107| 0| *yyextra->lex_buf_ptr++ = result; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2108| 0| yyextra->lex_buf_len++; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2109| 0|} 2110| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2111| 2|case 73: ------------------ | Branch (2111:1): [True: 2, False: 386] ------------------ 2112| 2|YY_RULE_SETUP 2113| 2|#line 645 "libyara/lexer.l" 2114| 2|{ yytext_to_buffer; } ------------------ | | 991| 2| { \ | | 992| 2| char *yptr = yytext; \ | | ------------------ | | | | 348| 2|#define yytext yyg->yytext_r | | ------------------ | | 993| 2| lex_check_space_ok(yptr, yyextra->lex_buf_len, YR_LEX_BUF_SIZE); \ | | ------------------ | | | | 984| 2| if (strlen(data) + current_size >= max_length - 1) \ | | | | ------------------ | | | | | Branch (984:9): [True: 0, False: 2] | | | | ------------------ | | | | 985| 2| { \ | | | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 987| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 988| 0| } | | ------------------ | | 994| 10| while(*yptr) \ | | ------------------ | | | Branch (994:13): [True: 8, False: 2] | | ------------------ | | 995| 8| { \ | | 996| 8| *yyextra->lex_buf_ptr++ = *yptr++; \ | | ------------------ | | | | 346| 8|#define yyextra yyg->yyextra_r | | ------------------ | | 997| 8| yyextra->lex_buf_len++; \ | | ------------------ | | | | 346| 8|#define yyextra yyg->yyextra_r | | ------------------ | | 998| 8| } \ | | 999| 2| } ------------------ 2115| 2| YY_BREAK ------------------ | | 1269| 2|#define YY_BREAK /*LINTED*/break; ------------------ 2116| 0|case 74: ------------------ | Branch (2116:1): [True: 0, False: 388] ------------------ 2117| |/* rule 74 can match eol */ 2118| 0|YY_RULE_SETUP 2119| 0|#line 648 "libyara/lexer.l" 2120| 0|{ 2121| 0| syntax_error("unterminated string"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 2122| 0|} 2123| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2124| 0|case 75: ------------------ | Branch (2124:1): [True: 0, False: 388] ------------------ 2125| |/* rule 75 can match eol */ 2126| 0|YY_RULE_SETUP 2127| 0|#line 653 "libyara/lexer.l" 2128| 0|{ 2129| 0| syntax_error("illegal escape sequence"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 2130| 0|} 2131| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2132| 0|case 76: ------------------ | Branch (2132:1): [True: 0, False: 388] ------------------ 2133| 0|YY_RULE_SETUP 2134| 0|#line 658 "libyara/lexer.l" 2135| 0|{ 2136| | 2137| 0| if (yyextra->lex_buf_len > 0) ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ | Branch (2137:7): [True: 0, False: 0] ------------------ 2138| 0| { 2139| 0| alloc_sized_string(s, yyextra->lex_buf_len); ------------------ | | 1002| 0| SIZED_STRING* str = (SIZED_STRING*) yr_malloc( \ | | 1003| 0| str_len + sizeof(SIZED_STRING)); \ | | 1004| 0| if (str == NULL) \ | | ------------------ | | | Branch (1004:7): [True: 0, False: 0] | | ------------------ | | 1005| 0| { \ | | 1006| 0| yyerror(yyscanner, compiler, "not enough memory"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 1007| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 1008| 0| } \ | | 1009| 0| else \ | | 1010| 0| { \ | | 1011| 0| str->length = (uint32_t) (str_len); \ | | 1012| 0| str->flags = 0; \ | | 1013| 0| } \ ------------------ 2140| | 2141| 0| if (yytext[1] == 'i') ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ | Branch (2141:9): [True: 0, False: 0] ------------------ 2142| 0| s->flags |= SIZED_STRING_FLAGS_NO_CASE; ------------------ | | 39| 0|#define SIZED_STRING_FLAGS_NO_CASE 1 ------------------ 2143| | 2144| 0| if (yytext[1] == 's' || yytext[2] == 's') ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ if (yytext[1] == 's' || yytext[2] == 's') ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ | Branch (2144:9): [True: 0, False: 0] | Branch (2144:29): [True: 0, False: 0] ------------------ 2145| 0| s->flags |= SIZED_STRING_FLAGS_DOT_ALL; ------------------ | | 43| 0|#define SIZED_STRING_FLAGS_DOT_ALL 2 ------------------ 2146| | 2147| 0| *yyextra->lex_buf_ptr = '\0'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2148| 0| strlcpy(s->c_string, yyextra->lex_buf, s->length + 1); ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2149| | 2150| 0| yylval->sized_string = s; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 2151| 0| } 2152| 0| else 2153| 0| { 2154| 0| syntax_error("empty regular expression"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 2155| 0| } 2156| | 2157| 0| BEGIN(INITIAL); ------------------ | | 357| 0|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ BEGIN(INITIAL); ------------------ | | 1039| 0|#define INITIAL 0 ------------------ 2158| 0| return _REGEXP_; ------------------ | | 145| 0|#define _REGEXP_ 277 ------------------ 2159| 0|} 2160| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2161| 0|case 77: ------------------ | Branch (2161:1): [True: 0, False: 388] ------------------ 2162| 0|YY_RULE_SETUP 2163| 0|#line 685 "libyara/lexer.l" 2164| 0|{ 2165| | 2166| 0| lex_check_space_ok("/", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2167| 0| *yyextra->lex_buf_ptr++ = '/'; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2168| 0| yyextra->lex_buf_len++ ; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2169| 0|} 2170| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2171| 0|case 78: ------------------ | Branch (2171:1): [True: 0, False: 388] ------------------ 2172| 0|YY_RULE_SETUP 2173| 0|#line 693 "libyara/lexer.l" 2174| 0|{ 2175| | 2176| 0| lex_check_space_ok("\\.", yyextra->lex_buf_len, YR_LEX_BUF_SIZE); ------------------ | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | ------------------ | | | Branch (984:9): [True: 0, False: 0] | | ------------------ | | 985| 0| { \ | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 987| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 988| 0| } ------------------ 2177| | 2178| 0| if (yytext[1] == 0) ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ | Branch (2178:7): [True: 0, False: 0] ------------------ 2179| 0| syntax_error("malformed regular expression"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 2180| | 2181| 0| *yyextra->lex_buf_ptr++ = yytext[0]; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ *yyextra->lex_buf_ptr++ = yytext[0]; ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 2182| 0| *yyextra->lex_buf_ptr++ = yytext[1]; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ *yyextra->lex_buf_ptr++ = yytext[1]; ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 2183| 0| yyextra->lex_buf_len += 2; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2184| 0|} 2185| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2186| 0|case 79: ------------------ | Branch (2186:1): [True: 0, False: 388] ------------------ 2187| 0|YY_RULE_SETUP 2188| 0|#line 706 "libyara/lexer.l" 2189| 0|{ yytext_to_buffer; } ------------------ | | 991| 0| { \ | | 992| 0| char *yptr = yytext; \ | | ------------------ | | | | 348| 0|#define yytext yyg->yytext_r | | ------------------ | | 993| 0| lex_check_space_ok(yptr, yyextra->lex_buf_len, YR_LEX_BUF_SIZE); \ | | ------------------ | | | | 984| 0| if (strlen(data) + current_size >= max_length - 1) \ | | | | ------------------ | | | | | Branch (984:9): [True: 0, False: 0] | | | | ------------------ | | | | 985| 0| { \ | | | | 986| 0| yyerror(yyscanner, compiler, "out of space in lex_buf"); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 987| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 988| 0| } | | ------------------ | | 994| 0| while(*yptr) \ | | ------------------ | | | Branch (994:13): [True: 0, False: 0] | | ------------------ | | 995| 0| { \ | | 996| 0| *yyextra->lex_buf_ptr++ = *yptr++; \ | | ------------------ | | | | 346| 0|#define yyextra yyg->yyextra_r | | ------------------ | | 997| 0| yyextra->lex_buf_len++; \ | | ------------------ | | | | 346| 0|#define yyextra yyg->yyextra_r | | ------------------ | | 998| 0| } \ | | 999| 0| } ------------------ 2190| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2191| 0|case 80: ------------------ | Branch (2191:1): [True: 0, False: 388] ------------------ 2192| |/* rule 80 can match eol */ 2193| 0|YY_RULE_SETUP 2194| 0|#line 709 "libyara/lexer.l" 2195| 0|{ 2196| 0| syntax_error("unterminated regular expression"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 2197| 0|} 2198| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2199| 2|case 81: ------------------ | Branch (2199:1): [True: 2, False: 386] ------------------ 2200| 2|YY_RULE_SETUP 2201| 2|#line 714 "libyara/lexer.l" 2202| 2|{ 2203| | 2204| 2| yylval->sized_string = NULL; ------------------ | | 1097| 2| # define yylval yyg->yylval_r ------------------ 2205| 2| yyextra->lex_buf_ptr = yyextra->lex_buf; ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ yyextra->lex_buf_ptr = yyextra->lex_buf; ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ 2206| 2| yyextra->lex_buf_len = 0; ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ 2207| 2| BEGIN(str); ------------------ | | 357| 2|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ BEGIN(str); ------------------ | | 1040| 2|#define str 1 ------------------ 2208| 2|} 2209| 2| YY_BREAK ------------------ | | 1269| 2|#define YY_BREAK /*LINTED*/break; ------------------ 2210| 0|case 82: ------------------ | Branch (2210:1): [True: 0, False: 388] ------------------ 2211| 0|YY_RULE_SETUP 2212| 0|#line 723 "libyara/lexer.l" 2213| 0|{ 2214| | 2215| 0| yylval->sized_string = NULL; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 2216| 0| yyextra->lex_buf_ptr = yyextra->lex_buf; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ yyextra->lex_buf_ptr = yyextra->lex_buf; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2217| 0| yyextra->lex_buf_len = 0; ------------------ | | 346| 0|#define yyextra yyg->yyextra_r ------------------ 2218| 0| BEGIN(regexp); ------------------ | | 357| 0|#define BEGIN yyg->yy_start = 1 + 2 * ------------------ BEGIN(regexp); ------------------ | | 1041| 0|#define regexp 2 ------------------ 2219| 0|} 2220| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2221| 0|case 83: ------------------ | Branch (2221:1): [True: 0, False: 388] ------------------ 2222| |/* rule 83 can match eol */ 2223| 0|YY_RULE_SETUP 2224| 0|#line 732 "libyara/lexer.l" 2225| 0|{ 2226| | // Match hex-digits with whitespace or comments. The latter are stripped 2227| | // out by hex_lexer.l 2228| | // TODO(vmalvarez): Integrate the hex string lexer and parser into this one, 2229| | // by having a single lexer/parser instead of two different ones we can avoid 2230| | // complex regular expressions like the one above, which is actually trying to 2231| | // do some parsing in the lexer. 2232| | 2233| 0| alloc_sized_string(s, strlen(yytext)); ------------------ | | 1002| 0| SIZED_STRING* str = (SIZED_STRING*) yr_malloc( \ | | 1003| 0| str_len + sizeof(SIZED_STRING)); \ | | 1004| 0| if (str == NULL) \ | | ------------------ | | | Branch (1004:7): [True: 0, False: 0] | | ------------------ | | 1005| 0| { \ | | 1006| 0| yyerror(yyscanner, compiler, "not enough memory"); \ | | ------------------ | | | | 48| 0|#define yyerror yara_yyerror | | ------------------ | | 1007| 0| yyterminate(); \ | | ------------------ | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | ------------------ | | | | | | 329| 0|#define YY_NULL 0 | | | | ------------------ | | ------------------ | | 1008| 0| } \ | | 1009| 0| else \ | | 1010| 0| { \ | | 1011| 0| str->length = (uint32_t) (str_len); \ | | 1012| 0| str->flags = 0; \ | | 1013| 0| } \ ------------------ 2234| | 2235| 0| strlcpy(s->c_string, yytext, s->length + 1); ------------------ | | 348| 0|#define yytext yyg->yytext_r ------------------ 2236| 0| yylval->sized_string = s; ------------------ | | 1097| 0| # define yylval yyg->yylval_r ------------------ 2237| | 2238| 0| return _HEX_STRING_; ------------------ | | 144| 0|#define _HEX_STRING_ 276 ------------------ 2239| 0|} 2240| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2241| 154|case 84: ------------------ | Branch (2241:1): [True: 154, False: 234] ------------------ 2242| |/* rule 84 can match eol */ 2243| 154|YY_RULE_SETUP 2244| 154|#line 749 "libyara/lexer.l" 2245| |/* skip whitespace */ 2246| 154| YY_BREAK ------------------ | | 1269| 154|#define YY_BREAK /*LINTED*/break; ------------------ 2247| 84|case 85: ------------------ | Branch (2247:1): [True: 84, False: 304] ------------------ 2248| 84|YY_RULE_SETUP 2249| 84|#line 751 "libyara/lexer.l" 2250| 84|{ 2251| | 2252| 84| if (yytext[0] >= 32 && yytext[0] < 127) ------------------ | | 348| 84|#define yytext yyg->yytext_r ------------------ if (yytext[0] >= 32 && yytext[0] < 127) ------------------ | | 348| 84|#define yytext yyg->yytext_r ------------------ | Branch (2252:7): [True: 84, False: 0] | Branch (2252:26): [True: 84, False: 0] ------------------ 2253| 84| { 2254| 84| return yytext[0]; ------------------ | | 348| 84|#define yytext yyg->yytext_r ------------------ 2255| 84| } 2256| 0| else 2257| 0| { 2258| 0| syntax_error("non-ascii character"); ------------------ | | 978| 0| { \ | | 979| 0| yr_compiler_set_error_extra_info(compiler, error_msg); \ | | ------------------ | | | | 320| 0| strlcpy( \ | | | | 321| 0| compiler->last_error_extra_info, \ | | | | 322| 0| info, \ | | | | 323| 0| sizeof(compiler->last_error_extra_info)); | | ------------------ | | 980| 0| error(ERROR_SYNTAX_ERROR); \ | | ------------------ | | | | 971| 0| { \ | | | | 972| 0| compiler->last_error = error_code; \ | | | | 973| 0| yyerror(yyscanner, compiler, NULL); \ | | | | ------------------ | | | | | | 48| 0|#define yyerror yara_yyerror | | | | ------------------ | | | | 974| 0| yyterminate(); \ | | | | ------------------ | | | | | | 1232| 0|#define yyterminate() return YY_NULL | | | | | | ------------------ | | | | | | | | 329| 0|#define YY_NULL 0 | | | | | | ------------------ | | | | ------------------ | | | | 975| 0| } | | ------------------ | | 981| 0| } ------------------ 2259| 0| } 2260| 84|} 2261| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2262| 0|case 86: ------------------ | Branch (2262:1): [True: 0, False: 388] ------------------ 2263| 0|YY_RULE_SETUP 2264| 0|#line 763 "libyara/lexer.l" 2265| 0|ECHO; 2266| 0| YY_BREAK ------------------ | | 1269| 0|#define YY_BREAK /*LINTED*/break; ------------------ 2267| 0|#line 2267 "libyara/lexer.c" 2268| | 2269| 4| case YY_END_OF_BUFFER: ------------------ | | 584| 4|#define YY_END_OF_BUFFER 87 ------------------ | Branch (2269:2): [True: 4, False: 384] ------------------ 2270| 4| { 2271| | /* Amount of text matched not including the EOB char. */ 2272| 4| int yy_amount_of_matched_text = (int) (yy_cp - yyg->yytext_ptr) - 1; ------------------ | | 567| 4|#define yytext_ptr yytext_r ------------------ 2273| | 2274| | /* Undo the effects of YY_DO_BEFORE_ACTION. */ 2275| 4| *yy_cp = yyg->yy_hold_char; 2276| 4| YY_RESTORE_YY_MORE_OFFSET 2277| | 2278| 4| if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW ) ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW ) ------------------ | | 486| 4|#define YY_BUFFER_NEW 0 ------------------ | Branch (2278:8): [True: 2, False: 2] ------------------ 2279| 2| { 2280| | /* We're scanning a new file or input source. It's 2281| | * possible that this happened because the user 2282| | * just pointed yyin at a new source and called 2283| | * yylex(). If so, then we have to assure 2284| | * consistency between YY_CURRENT_BUFFER and our 2285| | * globals. Here is the right place to do so, because 2286| | * this is the first action (other than possibly a 2287| | * back-up) that will match for the new input source. 2288| | */ 2289| 2| yyg->yy_n_chars = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2290| 2| YY_CURRENT_BUFFER_LVALUE->yy_input_file = yyin; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ YY_CURRENT_BUFFER_LVALUE->yy_input_file = yyin; ------------------ | | 344| 2|#define yyin yyg->yyin_r ------------------ 2291| 2| YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL; ------------------ | | 487| 2|#define YY_BUFFER_NORMAL 1 ------------------ 2292| 2| } 2293| | 2294| | /* Note that here we test for yy_c_buf_p "<=" to the position 2295| | * of the first EOB in the buffer, since yy_c_buf_p will 2296| | * already have been incremented past the NUL character 2297| | * (since all states make transitions on EOB to the 2298| | * end-of-buffer state). Contrast this with the test 2299| | * in input(). 2300| | */ 2301| 4| if ( yyg->yy_c_buf_p <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars] ) ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ | Branch (2301:8): [True: 0, False: 4] ------------------ 2302| 0| { /* This was really a NUL. */ 2303| 0| yy_state_type yy_next_state; 2304| | 2305| 0| yyg->yy_c_buf_p = yyg->yytext_ptr + yy_amount_of_matched_text; ------------------ | | 567| 0|#define yytext_ptr yytext_r ------------------ 2306| | 2307| 0| yy_current_state = yy_get_previous_state( yyscanner ); 2308| | 2309| | /* Okay, we're now positioned to make the NUL 2310| | * transition. We couldn't have 2311| | * yy_get_previous_state() go ahead and do it 2312| | * for us because it doesn't know how to deal 2313| | * with the possibility of jamming (and we don't 2314| | * want to build jamming into it because then it 2315| | * will run more slowly). 2316| | */ 2317| | 2318| 0| yy_next_state = yy_try_NUL_trans( yy_current_state , yyscanner); 2319| | 2320| 0| yy_bp = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 567| 0|#define yytext_ptr yytext_r ------------------ yy_bp = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 895| 0|#define YY_MORE_ADJ 0 ------------------ 2321| | 2322| 0| if ( yy_next_state ) ------------------ | Branch (2322:9): [True: 0, False: 0] ------------------ 2323| 0| { 2324| | /* Consume the NUL. */ 2325| 0| yy_cp = ++yyg->yy_c_buf_p; 2326| 0| yy_current_state = yy_next_state; 2327| 0| goto yy_match; 2328| 0| } 2329| | 2330| 0| else 2331| 0| { 2332| 0| yy_cp = yyg->yy_last_accepting_cpos; 2333| 0| yy_current_state = yyg->yy_last_accepting_state; 2334| 0| goto yy_find_action; 2335| 0| } 2336| 0| } 2337| | 2338| 4| else switch ( yy_get_next_buffer( yyscanner ) ) ------------------ | Branch (2338:17): [True: 4, False: 0] ------------------ 2339| 4| { 2340| 2| case EOB_ACT_END_OF_FILE: ------------------ | | 398| 2|#define EOB_ACT_END_OF_FILE 1 ------------------ | Branch (2340:4): [True: 2, False: 2] ------------------ 2341| 2| { 2342| 2| yyg->yy_did_buffer_switch_on_eof = 0; 2343| | 2344| 2| if ( yywrap( yyscanner ) ) ------------------ | | 206| 2|#define yywrap yara_yywrap | | ------------------ | | | | 561| 2|#define yara_yywrap(yyscanner) (/*CONSTCOND*/1) | | | | ------------------ | | | | | Branch (561:32): [True: 2, Folded] | | | | ------------------ | | ------------------ ------------------ 2345| 2| { 2346| | /* Note: because we've taken care in 2347| | * yy_get_next_buffer() to have set up 2348| | * yytext, we can now set up 2349| | * yy_c_buf_p so that if some total 2350| | * hoser (like flex itself) wants to 2351| | * call the scanner after we return the 2352| | * YY_NULL, it'll still work - another 2353| | * YY_NULL will get returned. 2354| | */ 2355| 2| yyg->yy_c_buf_p = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 567| 2|#define yytext_ptr yytext_r ------------------ yyg->yy_c_buf_p = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 895| 2|#define YY_MORE_ADJ 0 ------------------ 2356| | 2357| 2| yy_act = YY_STATE_EOF(YY_START); ------------------ | | 365| 2|#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) | | ------------------ | | | | 584| 2|#define YY_END_OF_BUFFER 87 | | ------------------ ------------------ 2358| 2| goto do_action; 2359| 2| } 2360| | 2361| 0| else 2362| 0| { 2363| 0| if ( ! yyg->yy_did_buffer_switch_on_eof ) ------------------ | Branch (2363:11): [True: 0, False: 0] ------------------ 2364| 0| YY_NEW_FILE; ------------------ | | 367| 0|#define YY_NEW_FILE yyrestart( yyin , yyscanner ) | | ------------------ | | | | 98| 0|#define yyrestart yara_yyrestart | | ------------------ | | #define YY_NEW_FILE yyrestart( yyin , yyscanner ) | | ------------------ | | | | 344| 0|#define yyin yyg->yyin_r | | ------------------ ------------------ 2365| 0| } 2366| 0| break; 2367| 2| } 2368| | 2369| 0| case EOB_ACT_CONTINUE_SCAN: ------------------ | | 397| 0|#define EOB_ACT_CONTINUE_SCAN 0 ------------------ | Branch (2369:4): [True: 0, False: 4] ------------------ 2370| 0| yyg->yy_c_buf_p = 2371| 0| yyg->yytext_ptr + yy_amount_of_matched_text; ------------------ | | 567| 0|#define yytext_ptr yytext_r ------------------ 2372| | 2373| 0| yy_current_state = yy_get_previous_state( yyscanner ); 2374| | 2375| 0| yy_cp = yyg->yy_c_buf_p; 2376| 0| yy_bp = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 567| 0|#define yytext_ptr yytext_r ------------------ yy_bp = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 895| 0|#define YY_MORE_ADJ 0 ------------------ 2377| 0| goto yy_match; 2378| | 2379| 2| case EOB_ACT_LAST_MATCH: ------------------ | | 399| 2|#define EOB_ACT_LAST_MATCH 2 ------------------ | Branch (2379:4): [True: 2, False: 2] ------------------ 2380| 2| yyg->yy_c_buf_p = 2381| 2| &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars]; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2382| | 2383| 2| yy_current_state = yy_get_previous_state( yyscanner ); 2384| | 2385| 2| yy_cp = yyg->yy_c_buf_p; 2386| 2| yy_bp = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 567| 2|#define yytext_ptr yytext_r ------------------ yy_bp = yyg->yytext_ptr + YY_MORE_ADJ; ------------------ | | 895| 2|#define YY_MORE_ADJ 0 ------------------ 2387| 2| goto yy_find_action; 2388| 4| } 2389| 0| break; 2390| 4| } 2391| | 2392| 0| default: ------------------ | Branch (2392:2): [True: 0, False: 388] ------------------ 2393| 0| YY_FATAL_ERROR( ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2394| 388| "fatal flex scanner internal error--no action found" ); 2395| 388| } /* end of action switch */ 2396| 388| } /* end of scanning one token */ 2397| 226| } /* end of user's declarations */ 2398| 226|} /* end of yylex */ yara_yy_switch_to_buffer: 2714| 2|{ 2715| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2716| | 2717| | /* TODO. We should be able to replace this entire function body 2718| | * with 2719| | * yypop_buffer_state(); 2720| | * yypush_buffer_state(new_buffer); 2721| | */ 2722| 2| yyensure_buffer_stack (yyscanner); ------------------ | | 86| 2|#define yyensure_buffer_stack yara_yyensure_buffer_stack ------------------ 2723| 2| if ( YY_CURRENT_BUFFER == new_buffer ) ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ | Branch (2723:7): [True: 0, False: 2] ------------------ 2724| 0| return; 2725| | 2726| 2| if ( YY_CURRENT_BUFFER ) ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:27): [True: 0, False: 2] | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ 2727| 0| { 2728| | /* Flush out information for old buffer. */ 2729| 0| *yyg->yy_c_buf_p = yyg->yy_hold_char; 2730| 0| YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = yyg->yy_c_buf_p; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2731| 0| YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2732| 0| } 2733| | 2734| 2| YY_CURRENT_BUFFER_LVALUE = new_buffer; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2735| 2| yy_load_buffer_state( yyscanner ); ------------------ | | 62| 2|#define yy_load_buffer_state yara_yy_load_buffer_state ------------------ 2736| | 2737| | /* We don't actually know whether we did this switch during 2738| | * EOF (yywrap()) processing, but the only time this flag 2739| | * is looked at is after yywrap() is called, so it's safe 2740| | * to go ahead and always set it. 2741| | */ 2742| 2| yyg->yy_did_buffer_switch_on_eof = 1; 2743| 2|} yara_yy_delete_buffer: 2789| 2|{ 2790| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2791| | 2792| 2| if ( ! b ) ------------------ | Branch (2792:7): [True: 0, False: 2] ------------------ 2793| 0| return; 2794| | 2795| 2| if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */ ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ | Branch (2795:7): [True: 2, False: 0] ------------------ 2796| 2| YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2797| | 2798| 2| if ( b->yy_is_our_buffer ) ------------------ | Branch (2798:7): [True: 2, False: 0] ------------------ 2799| 2| yyfree( (void *) b->yy_ch_buf , yyscanner ); ------------------ | | 236| 2|#define yyfree yara_yyfree ------------------ 2800| | 2801| 2| yyfree( (void *) b , yyscanner ); ------------------ | | 236| 2|#define yyfree yara_yyfree ------------------ 2802| 2|} yara_yypop_buffer_state: 2899| 2|{ 2900| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2901| 2| if (!YY_CURRENT_BUFFER) ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ | Branch (2901:6): [True: 0, False: 2] ------------------ 2902| 0| return; 2903| | 2904| 2| yy_delete_buffer(YY_CURRENT_BUFFER , yyscanner); ------------------ | | 26| 2|#define yy_delete_buffer yara_yy_delete_buffer ------------------ yy_delete_buffer(YY_CURRENT_BUFFER , yyscanner); ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ 2905| 2| YY_CURRENT_BUFFER_LVALUE = NULL; ------------------ | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2906| 2| if (yyg->yy_buffer_stack_top > 0) ------------------ | Branch (2906:6): [True: 0, False: 2] ------------------ 2907| 0| --yyg->yy_buffer_stack_top; 2908| | 2909| 2| if (YY_CURRENT_BUFFER) { ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:27): [True: 0, False: 2] | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ 2910| 0| yy_load_buffer_state( yyscanner ); ------------------ | | 62| 0|#define yy_load_buffer_state yara_yy_load_buffer_state ------------------ 2911| 0| yyg->yy_did_buffer_switch_on_eof = 1; 2912| 0| } 2913| 2|} yara_yy_scan_buffer: 2969| 2|{ 2970| 2| YY_BUFFER_STATE b; 2971| | 2972| 2| if ( size < 2 || ------------------ | Branch (2972:7): [True: 0, False: 2] ------------------ 2973| 2| base[size-2] != YY_END_OF_BUFFER_CHAR || ------------------ | | 368| 4|#define YY_END_OF_BUFFER_CHAR 0 ------------------ | Branch (2973:7): [True: 0, False: 2] ------------------ 2974| 2| base[size-1] != YY_END_OF_BUFFER_CHAR ) ------------------ | | 368| 2|#define YY_END_OF_BUFFER_CHAR 0 ------------------ | Branch (2974:7): [True: 0, False: 2] ------------------ 2975| | /* They forgot to leave room for the EOB's. */ 2976| 0| return NULL; 2977| | 2978| 2| b = (YY_BUFFER_STATE) yyalloc( sizeof( struct yy_buffer_state ) , yyscanner ); ------------------ | | 224| 2|#define yyalloc yara_yyalloc ------------------ 2979| 2| if ( ! b ) ------------------ | Branch (2979:7): [True: 0, False: 2] ------------------ 2980| 0| YY_FATAL_ERROR( "out of dynamic memory in yy_scan_buffer()" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2981| | 2982| 2| b->yy_buf_size = (int) (size - 2); /* "- 2" to take care of EOB's */ 2983| 2| b->yy_buf_pos = b->yy_ch_buf = base; 2984| 2| b->yy_is_our_buffer = 0; 2985| 2| b->yy_input_file = NULL; 2986| 2| b->yy_n_chars = b->yy_buf_size; 2987| 2| b->yy_is_interactive = 0; 2988| 2| b->yy_at_bol = 1; 2989| 2| b->yy_fill_buffer = 0; 2990| 2| b->yy_buffer_status = YY_BUFFER_NEW; ------------------ | | 486| 2|#define YY_BUFFER_NEW 0 ------------------ 2991| | 2992| 2| yy_switch_to_buffer( b , yyscanner ); ------------------ | | 68| 2|#define yy_switch_to_buffer yara_yy_switch_to_buffer ------------------ 2993| | 2994| 2| return b; 2995| 2|} yara_yy_scan_string: 3006| 2|{ 3007| | 3008| 2| return yy_scan_bytes( yystr, (int) strlen(yystr) , yyscanner); ------------------ | | 44| 2|#define yy_scan_bytes yara_yy_scan_bytes ------------------ 3009| 2|} yara_yy_scan_bytes: 3019| 2|{ 3020| 2| YY_BUFFER_STATE b; 3021| 2| char *buf; 3022| 2| yy_size_t n; 3023| 2| int i; 3024| | 3025| | /* Get memory for full buffer, including space for trailing EOB's. */ 3026| 2| n = (yy_size_t) (_yybytes_len + 2); 3027| 2| buf = (char *) yyalloc( n , yyscanner ); ------------------ | | 224| 2|#define yyalloc yara_yyalloc ------------------ 3028| 2| if ( ! buf ) ------------------ | Branch (3028:7): [True: 0, False: 2] ------------------ 3029| 0| YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 3030| | 3031| 802| for ( i = 0; i < _yybytes_len; ++i ) ------------------ | Branch (3031:15): [True: 800, False: 2] ------------------ 3032| 800| buf[i] = yybytes[i]; 3033| | 3034| 2| buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR; ------------------ | | 368| 2|#define YY_END_OF_BUFFER_CHAR 0 ------------------ 3035| | 3036| 2| b = yy_scan_buffer( buf, n , yyscanner); ------------------ | | 32| 2|#define yy_scan_buffer yara_yy_scan_buffer ------------------ 3037| 2| if ( ! b ) ------------------ | Branch (3037:7): [True: 0, False: 2] ------------------ 3038| 0| YY_FATAL_ERROR( "bad buffer in yy_scan_bytes()" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 3039| | 3040| | /* It's okay to grow etc. this buffer, and we should throw it 3041| | * away when we're done. 3042| | */ 3043| 2| b->yy_is_our_buffer = 1; 3044| | 3045| 2| return b; 3046| 2|} yara_yyget_extra: 3083| 388|{ 3084| 388| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3085| 388| return yyextra; ------------------ | | 346| 388|#define yyextra yyg->yyextra_r ------------------ 3086| 388|} yara_yyset_extra: 3156| 2|{ 3157| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3158| 2| yyextra = user_defined ; ------------------ | | 346| 2|#define yyextra yyg->yyextra_r ------------------ 3159| 2|} yara_yyset_lineno: 3166| 2|{ 3167| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3168| | 3169| | /* lineno is only valid if an input buffer exists. */ 3170| 2| if (! YY_CURRENT_BUFFER ) ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ | Branch (3170:13): [True: 0, False: 2] ------------------ 3171| 0| YY_FATAL_ERROR( "yyset_lineno called with no buffer" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 3172| | 3173| 2| yylineno = _line_number; ------------------ | | 349| 2|#define yylineno (YY_CURRENT_BUFFER_LVALUE->yy_bs_lineno) | | ------------------ | | | | 515| 2|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] | | ------------------ ------------------ 3174| 2|} yara_yylex_init: 3242| 2|{ 3243| 2| if (ptr_yy_globals == NULL){ ------------------ | Branch (3243:9): [True: 0, False: 2] ------------------ 3244| 0| errno = EINVAL; 3245| 0| return 1; 3246| 0| } 3247| | 3248| 2| *ptr_yy_globals = (yyscan_t) yyalloc ( sizeof( struct yyguts_t ), NULL ); ------------------ | | 224| 2|#define yyalloc yara_yyalloc ------------------ 3249| | 3250| 2| if (*ptr_yy_globals == NULL){ ------------------ | Branch (3250:9): [True: 0, False: 2] ------------------ 3251| 0| errno = ENOMEM; 3252| 0| return 1; 3253| 0| } 3254| | 3255| | /* By setting to 0xAA, we expose bugs in yy_init_globals. Leave at 0x00 for releases. */ 3256| 2| memset(*ptr_yy_globals,0x00,sizeof(struct yyguts_t)); 3257| | 3258| 2| return yy_init_globals ( *ptr_yy_globals ); 3259| 2|} yara_yylex_destroy: 3330| 2|{ 3331| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3332| | 3333| | /* Pop the buffer stack, destroying each element. */ 3334| 2| while(YY_CURRENT_BUFFER){ ------------------ | | 509| 2|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:27): [True: 0, False: 2] | | | Branch (509:29): [True: 2, False: 0] | | ------------------ | | 510| 2| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 2| : NULL) ------------------ 3335| 0| yy_delete_buffer( YY_CURRENT_BUFFER , yyscanner ); ------------------ | | 26| 0|#define yy_delete_buffer yara_yy_delete_buffer ------------------ yy_delete_buffer( YY_CURRENT_BUFFER , yyscanner ); ------------------ | | 509| 0|#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \ | | ------------------ | | | Branch (509:29): [True: 0, False: 0] | | ------------------ | | 510| 0| ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \ | | 511| 0| : NULL) ------------------ 3336| 0| YY_CURRENT_BUFFER_LVALUE = NULL; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 3337| 0| yypop_buffer_state(yyscanner); ------------------ | | 80| 0|#define yypop_buffer_state yara_yypop_buffer_state ------------------ 3338| 0| } 3339| | 3340| | /* Destroy the stack itself. */ 3341| 2| yyfree(yyg->yy_buffer_stack , yyscanner); ------------------ | | 236| 2|#define yyfree yara_yyfree ------------------ 3342| 2| yyg->yy_buffer_stack = NULL; 3343| | 3344| | /* Destroy the start condition stack. */ 3345| 2| yyfree( yyg->yy_start_stack , yyscanner ); ------------------ | | 236| 2|#define yyfree yara_yyfree ------------------ 3346| 2| yyg->yy_start_stack = NULL; 3347| | 3348| | /* Reset the globals. This is important in a non-reentrant scanner so the next time 3349| | * yylex() is called, initialization will occur. */ 3350| 2| yy_init_globals( yyscanner); 3351| | 3352| | /* Destroy the main struct (reentrant only). */ 3353| 2| yyfree ( yyscanner , yyscanner ); ------------------ | | 236| 2|#define yyfree yara_yyfree ------------------ 3354| | yyscanner = NULL; 3355| 2| return 0; 3356| 2|} yara_yyalloc: 3386| 8|{ 3387| 8| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3388| 8| (void)yyg; 3389| 8| return malloc(size); 3390| 8|} yara_yyfree: 3408| 10|{ 3409| 10| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3410| 10| (void)yyg; 3411| 10| free( (char *) ptr ); /* see yyrealloc() for (char *) cast */ 3412| 10|} yr_lex_parse_rules_string: 3582| 2|{ 3583| 2| yyscan_t yyscanner; 3584| | 3585| 2| compiler->errors = 0; 3586| | 3587| 2| if (rules_string == NULL) ------------------ | Branch (3587:7): [True: 0, False: 2] ------------------ 3588| 0| return 0; 3589| | 3590| 2| if (yylex_init(&yyscanner) != 0) ------------------ | | 104| 2|#define yylex_init yara_yylex_init ------------------ | Branch (3590:7): [True: 0, False: 2] ------------------ 3591| 0| { 3592| 0| compiler->errors = 1; 3593| 0| compiler->last_error = ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 3594| 0| return compiler->errors; 3595| 0| } 3596| | 3597| 2| if (setjmp(compiler->error_recovery) != 0) ------------------ | Branch (3597:7): [True: 0, False: 2] ------------------ 3598| 0| return compiler->errors; 3599| | 3600| | #if YYDEBUG 3601| | yydebug = 1; 3602| | #endif 3603| | 3604| 2| yyset_extra(compiler, yyscanner); ------------------ | | 140| 2|#define yyset_extra yara_yyset_extra ------------------ 3605| 2| yy_scan_string(rules_string, yyscanner); ------------------ | | 38| 2|#define yy_scan_string yara_yy_scan_string ------------------ 3606| 2| yyset_lineno(1, yyscanner); ------------------ | | 188| 2|#define yyset_lineno yara_yyset_lineno ------------------ 3607| 2| yyparse(yyscanner, compiler); ------------------ | | 46| 2|#define yyparse yara_yyparse ------------------ 3608| 2| yylex_destroy(yyscanner); ------------------ | | 116| 2|#define yylex_destroy yara_yylex_destroy ------------------ 3609| | 3610| 2| return compiler->errors; 3611| 2|} lexer.c:yy_get_next_buffer: 2408| 4|{ 2409| 4| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2410| 4| char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2411| 4| char *source = yyg->yytext_ptr; ------------------ | | 567| 4|#define yytext_ptr yytext_r ------------------ 2412| 4| int number_to_move, i; 2413| 4| int ret_val; 2414| | 2415| 4| if ( yyg->yy_c_buf_p > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars + 1] ) ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ | Branch (2415:7): [True: 0, False: 4] ------------------ 2416| 0| YY_FATAL_ERROR( ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2417| 4| "fatal flex scanner internal error--end of buffer missed" ); 2418| | 2419| 4| if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 ) ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ | Branch (2419:7): [True: 4, False: 0] ------------------ 2420| 4| { /* Don't try to fill the buffer, so this is an EOF. */ 2421| 4| if ( yyg->yy_c_buf_p - yyg->yytext_ptr - YY_MORE_ADJ == 1 ) ------------------ | | 567| 4|#define yytext_ptr yytext_r ------------------ if ( yyg->yy_c_buf_p - yyg->yytext_ptr - YY_MORE_ADJ == 1 ) ------------------ | | 895| 4|#define YY_MORE_ADJ 0 ------------------ | Branch (2421:8): [True: 2, False: 2] ------------------ 2422| 2| { 2423| | /* We matched a single character, the EOB, so 2424| | * treat this as a final EOF. 2425| | */ 2426| 2| return EOB_ACT_END_OF_FILE; ------------------ | | 398| 2|#define EOB_ACT_END_OF_FILE 1 ------------------ 2427| 2| } 2428| | 2429| 2| else 2430| 2| { 2431| | /* We matched some text prior to the EOB, first 2432| | * process it. 2433| | */ 2434| 2| return EOB_ACT_LAST_MATCH; ------------------ | | 399| 2|#define EOB_ACT_LAST_MATCH 2 ------------------ 2435| 2| } 2436| 4| } 2437| | 2438| | /* Try to read more data. */ 2439| | 2440| | /* First move last chars to start of buffer. */ 2441| 0| number_to_move = (int) (yyg->yy_c_buf_p - yyg->yytext_ptr - 1); ------------------ | | 567| 0|#define yytext_ptr yytext_r ------------------ 2442| | 2443| 0| for ( i = 0; i < number_to_move; ++i ) ------------------ | Branch (2443:15): [True: 0, False: 0] ------------------ 2444| 0| *(dest++) = *(source++); 2445| | 2446| 0| if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING ) ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING ) ------------------ | | 498| 0|#define YY_BUFFER_EOF_PENDING 2 ------------------ | Branch (2446:7): [True: 0, False: 0] ------------------ 2447| | /* don't do the read, it's not guaranteed to return an EOF, 2448| | * just force an EOF 2449| | */ 2450| 0| YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars = 0; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2451| | 2452| 0| else 2453| 0| { 2454| 0| int num_to_read = 2455| 0| YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2456| | 2457| 0| while ( num_to_read <= 0 ) ------------------ | Branch (2457:11): [True: 0, False: 0] ------------------ 2458| 0| { /* Not enough room in the buffer - grow it. */ 2459| | 2460| | /* just a shorter name for the current buffer */ 2461| 0| YY_BUFFER_STATE b = YY_CURRENT_BUFFER_LVALUE; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2462| | 2463| 0| int yy_c_buf_p_offset = 2464| 0| (int) (yyg->yy_c_buf_p - b->yy_ch_buf); 2465| | 2466| 0| if ( b->yy_is_our_buffer ) ------------------ | Branch (2466:9): [True: 0, False: 0] ------------------ 2467| 0| { 2468| 0| int new_size = b->yy_buf_size * 2; 2469| | 2470| 0| if ( new_size <= 0 ) ------------------ | Branch (2470:10): [True: 0, False: 0] ------------------ 2471| 0| b->yy_buf_size += b->yy_buf_size / 8; 2472| 0| else 2473| 0| b->yy_buf_size *= 2; 2474| | 2475| 0| b->yy_ch_buf = (char *) 2476| | /* Include room in for 2 EOB chars. */ 2477| 0| yyrealloc( (void *) b->yy_ch_buf, ------------------ | | 230| 0|#define yyrealloc yara_yyrealloc ------------------ 2478| 0| (yy_size_t) (b->yy_buf_size + 2) , yyscanner ); 2479| 0| } 2480| 0| else 2481| | /* Can't grow it, we don't own it. */ 2482| 0| b->yy_ch_buf = NULL; 2483| | 2484| 0| if ( ! b->yy_ch_buf ) ------------------ | Branch (2484:9): [True: 0, False: 0] ------------------ 2485| 0| YY_FATAL_ERROR( ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2486| 0| "fatal error - scanner input buffer overflow" ); 2487| | 2488| 0| yyg->yy_c_buf_p = &b->yy_ch_buf[yy_c_buf_p_offset]; 2489| | 2490| 0| num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2491| 0| number_to_move - 1; 2492| | 2493| 0| } 2494| | 2495| 0| if ( num_to_read > YY_READ_BUF_SIZE ) ------------------ | | 1179| 0|#define YY_READ_BUF_SIZE 8192 ------------------ | Branch (2495:8): [True: 0, False: 0] ------------------ 2496| 0| num_to_read = YY_READ_BUF_SIZE; ------------------ | | 1179| 0|#define YY_READ_BUF_SIZE 8192 ------------------ 2497| | 2498| | /* Read in more data. */ 2499| 0| YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), ------------------ | | 1196| 0| if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \ | | ------------------ | | | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] | | ------------------ | | | Branch (1196:7): [True: 0, False: 0] | | ------------------ | | 1197| 0| { \ | | 1198| 0| int c = '*'; \ | | 1199| 0| int n; \ | | 1200| 0| for ( n = 0; n < max_size && \ | | ------------------ | | | Branch (1200:16): [True: 0, False: 0] | | ------------------ | | 1201| 0| (c = getc( yyin )) != EOF && c != '\n'; ++n ) \ | | ------------------ | | | | 344| 0|#define yyin yyg->yyin_r | | ------------------ | | | Branch (1201:9): [True: 0, False: 0] | | | Branch (1201:38): [True: 0, False: 0] | | ------------------ | | 1202| 0| buf[n] = (char) c; \ | | 1203| 0| if ( c == '\n' ) \ | | ------------------ | | | Branch (1203:8): [True: 0, False: 0] | | ------------------ | | 1204| 0| buf[n++] = (char) c; \ | | 1205| 0| if ( c == EOF && ferror( yyin ) ) \ | | ------------------ | | | | 344| 0|#define yyin yyg->yyin_r | | ------------------ | | | Branch (1205:8): [True: 0, False: 0] | | | Branch (1205:20): [True: 0, False: 0] | | ------------------ | | 1206| 0| YY_FATAL_ERROR( "input in flex scanner failed" ); \ | | ------------------ | | | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) | | ------------------ | | 1207| 0| result = n; \ | | 1208| 0| } \ | | 1209| 0| else \ | | 1210| 0| { \ | | 1211| 0| errno=0; \ | | 1212| 0| while ( (result = (int) fread(buf, 1, (yy_size_t) max_size, yyin)) == 0 && ferror(yyin)) \ | | ------------------ | | | | 344| 0|#define yyin yyg->yyin_r | | ------------------ | | while ( (result = (int) fread(buf, 1, (yy_size_t) max_size, yyin)) == 0 && ferror(yyin)) \ | | ------------------ | | | | 344| 0|#define yyin yyg->yyin_r | | ------------------ | | | Branch (1212:11): [True: 0, False: 0] | | | Branch (1212:78): [True: 0, False: 0] | | ------------------ | | 1213| 0| { \ | | 1214| 0| if( errno != EINTR) \ | | ------------------ | | | Branch (1214:8): [True: 0, False: 0] | | ------------------ | | 1215| 0| { \ | | 1216| 0| YY_FATAL_ERROR( "input in flex scanner failed" ); \ | | ------------------ | | | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) | | ------------------ | | 1217| 0| break; \ | | 1218| 0| } \ | | 1219| 0| errno=0; \ | | 1220| 0| clearerr(yyin); \ | | ------------------ | | | | 344| 0|#define yyin yyg->yyin_r | | ------------------ | | 1221| 0| } \ | | 1222| 0| }\ ------------------ 2500| 0| yyg->yy_n_chars, num_to_read ); 2501| | 2502| 0| YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2503| 0| } 2504| | 2505| 0| if ( yyg->yy_n_chars == 0 ) ------------------ | Branch (2505:7): [True: 0, False: 0] ------------------ 2506| 0| { 2507| 0| if ( number_to_move == YY_MORE_ADJ ) ------------------ | | 895| 0|#define YY_MORE_ADJ 0 ------------------ | Branch (2507:8): [True: 0, False: 0] ------------------ 2508| 0| { 2509| 0| ret_val = EOB_ACT_END_OF_FILE; ------------------ | | 398| 0|#define EOB_ACT_END_OF_FILE 1 ------------------ 2510| 0| yyrestart( yyin , yyscanner); ------------------ | | 98| 0|#define yyrestart yara_yyrestart ------------------ yyrestart( yyin , yyscanner); ------------------ | | 344| 0|#define yyin yyg->yyin_r ------------------ 2511| 0| } 2512| | 2513| 0| else 2514| 0| { 2515| 0| ret_val = EOB_ACT_LAST_MATCH; ------------------ | | 399| 0|#define EOB_ACT_LAST_MATCH 2 ------------------ 2516| 0| YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2517| 0| YY_BUFFER_EOF_PENDING; ------------------ | | 498| 0|#define YY_BUFFER_EOF_PENDING 2 ------------------ 2518| 0| } 2519| 0| } 2520| | 2521| 0| else 2522| 0| ret_val = EOB_ACT_CONTINUE_SCAN; ------------------ | | 397| 0|#define EOB_ACT_CONTINUE_SCAN 0 ------------------ 2523| | 2524| 0| if ((yyg->yy_n_chars + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ | Branch (2524:6): [True: 0, False: 0] ------------------ 2525| | /* Extend the array by 50%, plus the number we really need. */ 2526| 0| int new_size = yyg->yy_n_chars + number_to_move + (yyg->yy_n_chars >> 1); 2527| 0| YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc( ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc( ------------------ | | 230| 0|#define yyrealloc yara_yyrealloc ------------------ 2528| 0| (void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf, (yy_size_t) new_size , yyscanner ); ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2529| 0| if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ | Branch (2529:8): [True: 0, False: 0] ------------------ 2530| 0| YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2531| | /* "- 2" to take care of EOB's */ 2532| 0| YY_CURRENT_BUFFER_LVALUE->yy_buf_size = (int) (new_size - 2); ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2533| 0| } 2534| | 2535| 0| yyg->yy_n_chars += number_to_move; 2536| 0| YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars] = YY_END_OF_BUFFER_CHAR; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars] = YY_END_OF_BUFFER_CHAR; ------------------ | | 368| 0|#define YY_END_OF_BUFFER_CHAR 0 ------------------ 2537| 0| YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars + 1] = YY_END_OF_BUFFER_CHAR; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars + 1] = YY_END_OF_BUFFER_CHAR; ------------------ | | 368| 0|#define YY_END_OF_BUFFER_CHAR 0 ------------------ 2538| | 2539| 0| yyg->yytext_ptr = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0]; ------------------ | | 567| 0|#define yytext_ptr yytext_r ------------------ yyg->yytext_ptr = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0]; ------------------ | | 515| 0|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2540| | 2541| 0| return ret_val; 2542| 4|} lexer.c:yy_get_previous_state: 2547| 2|{ 2548| 2| yy_state_type yy_current_state; 2549| 2| char *yy_cp; 2550| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2551| | 2552| 2| yy_current_state = yyg->yy_start; 2553| | 2554| 4| for ( yy_cp = yyg->yytext_ptr + YY_MORE_ADJ; yy_cp < yyg->yy_c_buf_p; ++yy_cp ) ------------------ | | 567| 2|#define yytext_ptr yytext_r ------------------ for ( yy_cp = yyg->yytext_ptr + YY_MORE_ADJ; yy_cp < yyg->yy_c_buf_p; ++yy_cp ) ------------------ | | 895| 2|#define YY_MORE_ADJ 0 ------------------ | Branch (2554:47): [True: 2, False: 2] ------------------ 2555| 2| { 2556| 2| YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1); ------------------ | | 334| 2|#define YY_SC_TO_UI(c) ((YY_CHAR) (c)) ------------------ | Branch (2556:19): [True: 2, False: 0] ------------------ 2557| 2| if ( yy_accept[yy_current_state] ) ------------------ | Branch (2557:8): [True: 0, False: 2] ------------------ 2558| 0| { 2559| 0| yyg->yy_last_accepting_state = yy_current_state; 2560| 0| yyg->yy_last_accepting_cpos = yy_cp; 2561| 0| } 2562| 2| while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) ------------------ | Branch (2562:11): [True: 0, False: 2] ------------------ 2563| 0| { 2564| 0| yy_current_state = (int) yy_def[yy_current_state]; 2565| 0| if ( yy_current_state >= 295 ) ------------------ | Branch (2565:9): [True: 0, False: 0] ------------------ 2566| 0| yy_c = yy_meta[yy_c]; 2567| 0| } 2568| 2| yy_current_state = yy_nxt[yy_base[yy_current_state] + yy_c]; 2569| 2| } 2570| | 2571| 2| return yy_current_state; 2572| 2|} lexer.c:yara_yy_load_buffer_state: 2746| 4|{ 2747| 4| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2748| 4| yyg->yy_n_chars = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2749| 4| yyg->yytext_ptr = yyg->yy_c_buf_p = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos; ------------------ | | 567| 4|#define yytext_ptr yytext_r ------------------ yyg->yytext_ptr = yyg->yy_c_buf_p = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos; ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2750| 4| yyin = YY_CURRENT_BUFFER_LVALUE->yy_input_file; ------------------ | | 344| 4|#define yyin yyg->yyin_r ------------------ yyin = YY_CURRENT_BUFFER_LVALUE->yy_input_file; ------------------ | | 515| 4|#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] ------------------ 2751| 4| yyg->yy_hold_char = *yyg->yy_c_buf_p; 2752| 4|} lexer.c:yara_yyensure_buffer_stack: 2919| 2|{ 2920| 2| yy_size_t num_to_alloc; 2921| 2| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 2922| | 2923| 2| if (!yyg->yy_buffer_stack) { ------------------ | Branch (2923:6): [True: 2, False: 0] ------------------ 2924| | 2925| | /* First allocation is just for 2 elements, since we don't know if this 2926| | * scanner will even need a stack. We use 2 instead of 1 to avoid an 2927| | * immediate realloc on the next call. 2928| | */ 2929| 2| num_to_alloc = 1; /* After all that talk, this was set to 1 anyways... */ 2930| 2| yyg->yy_buffer_stack = (struct yy_buffer_state**)yyalloc ------------------ | | 224| 2|#define yyalloc yara_yyalloc ------------------ 2931| 2| (num_to_alloc * sizeof(struct yy_buffer_state*) 2932| 2| , yyscanner); 2933| 2| if ( ! yyg->yy_buffer_stack ) ------------------ | Branch (2933:8): [True: 0, False: 2] ------------------ 2934| 0| YY_FATAL_ERROR( "out of dynamic memory in yyensure_buffer_stack()" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2935| | 2936| 2| memset(yyg->yy_buffer_stack, 0, num_to_alloc * sizeof(struct yy_buffer_state*)); 2937| | 2938| 2| yyg->yy_buffer_stack_max = num_to_alloc; 2939| 2| yyg->yy_buffer_stack_top = 0; 2940| 2| return; 2941| 2| } 2942| | 2943| 0| if (yyg->yy_buffer_stack_top >= (yyg->yy_buffer_stack_max) - 1){ ------------------ | Branch (2943:6): [True: 0, False: 0] ------------------ 2944| | 2945| | /* Increase the buffer to prepare for a possible push. */ 2946| 0| yy_size_t grow_size = 8 /* arbitrary grow size */; 2947| | 2948| 0| num_to_alloc = yyg->yy_buffer_stack_max + grow_size; 2949| 0| yyg->yy_buffer_stack = (struct yy_buffer_state**)yyrealloc ------------------ | | 230| 0|#define yyrealloc yara_yyrealloc ------------------ 2950| 0| (yyg->yy_buffer_stack, 2951| 0| num_to_alloc * sizeof(struct yy_buffer_state*) 2952| 0| , yyscanner); 2953| 0| if ( ! yyg->yy_buffer_stack ) ------------------ | Branch (2953:8): [True: 0, False: 0] ------------------ 2954| 0| YY_FATAL_ERROR( "out of dynamic memory in yyensure_buffer_stack()" ); ------------------ | | 80| 0|#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg) ------------------ 2955| | 2956| | /* zero only the new slots.*/ 2957| 0| memset(yyg->yy_buffer_stack + yyg->yy_buffer_stack_max, 0, grow_size * sizeof(struct yy_buffer_state*)); 2958| 0| yyg->yy_buffer_stack_max = num_to_alloc; 2959| 0| } 2960| 0|} lexer.c:yy_init_globals: 3296| 4|{ 3297| 4| struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; 3298| | /* Initialization is the same as for the non-reentrant scanner. 3299| | * This function is called from yylex_destroy(), so don't allocate here. 3300| | */ 3301| | 3302| 4| yyg->yy_buffer_stack = NULL; 3303| 4| yyg->yy_buffer_stack_top = 0; 3304| 4| yyg->yy_buffer_stack_max = 0; 3305| 4| yyg->yy_c_buf_p = NULL; 3306| 4| yyg->yy_init = 0; 3307| 4| yyg->yy_start = 0; 3308| | 3309| 4| yyg->yy_start_stack_ptr = 0; 3310| 4| yyg->yy_start_stack_depth = 0; 3311| 4| yyg->yy_start_stack = NULL; 3312| | 3313| |/* Defined in main.c */ 3314| |#ifdef YY_STDINIT 3315| | yyin = stdin; 3316| | yyout = stdout; 3317| |#else 3318| 4| yyin = NULL; ------------------ | | 344| 4|#define yyin yyg->yyin_r ------------------ 3319| 4| yyout = NULL; ------------------ | | 345| 4|#define yyout yyg->yyout_r ------------------ 3320| 4|#endif 3321| | 3322| | /* For future reference: Set errno on error, since we are called by 3323| | * yylex_init() 3324| | */ 3325| 4| return 0; 3326| 4|} yr_initialize: 242| 2|{ 243| 2| YR_DEBUG_FPRINTF(2, stderr, "+ %s() {\n", __FUNCTION__); 244| | 245| 2| uint32_t def_stack_size = DEFAULT_STACK_SIZE; ------------------ | | 81| 2|#define DEFAULT_STACK_SIZE 16384 ------------------ 246| 2| uint32_t def_max_strings_per_rule = DEFAULT_MAX_STRINGS_PER_RULE; ------------------ | | 82| 2|#define DEFAULT_MAX_STRINGS_PER_RULE 10000 ------------------ 247| 2| uint32_t def_max_match_data = DEFAULT_MAX_MATCH_DATA; ------------------ | | 83| 2|#define DEFAULT_MAX_MATCH_DATA 512 ------------------ 248| 2| uint64_t def_max_process_memory_chunk = DEFAULT_MAX_PROCESS_MEMORY_CHUNK; ------------------ | | 84| 2|#define DEFAULT_MAX_PROCESS_MEMORY_CHUNK 1073741824 ------------------ 249| | 250| 2| init_count++; 251| | 252| 2| if (init_count > 1) ------------------ | Branch (252:7): [True: 0, False: 2] ------------------ 253| 0| return ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 254| | 255| | // Initialize random number generator, as it is used for generating object 256| | // canaries. 257| 2| srand((unsigned) time(NULL)); 258| | 259| 514| for (int i = 0; i < 256; i++) ------------------ | Branch (259:19): [True: 512, False: 2] ------------------ 260| 512| { 261| 512| if (i >= 'a' && i <= 'z') ------------------ | Branch (261:9): [True: 318, False: 194] | Branch (261:21): [True: 52, False: 266] ------------------ 262| 52| yr_altercase[i] = i - 32; 263| 460| else if (i >= 'A' && i <= 'Z') ------------------ | Branch (263:14): [True: 330, False: 130] | Branch (263:26): [True: 52, False: 278] ------------------ 264| 52| yr_altercase[i] = i + 32; 265| 408| else 266| 408| yr_altercase[i] = i; 267| | 268| 512| yr_lowercase[i] = tolower(i); ------------------ | Branch (268:23): [True: 0, False: 0] | Branch (268:23): [True: 0, False: 512] | Branch (268:23): [True: 512, Folded] ------------------ 269| 512| } 270| | 271| 2| FAIL_ON_ERROR(yr_heap_alloc()); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 272| 2| FAIL_ON_ERROR(yr_thread_storage_create(&yr_yyfatal_trampoline_tls)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 273| 2| FAIL_ON_ERROR(yr_thread_storage_create(&yr_trycatch_trampoline_tls)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 274| | 275| |#if defined HAVE_LIBCRYPTO && OPENSSL_VERSION_NUMBER < 0x10100000L 276| | 277| | openssl_locks = (YR_MUTEX *) OPENSSL_malloc( 278| | CRYPTO_num_locks() * sizeof(YR_MUTEX)); 279| | 280| | for (int i = 0; i < CRYPTO_num_locks(); i++) 281| | yr_mutex_create(&openssl_locks[i]); 282| | 283| | CRYPTO_THREADID_set_callback(_thread_id); 284| | CRYPTO_set_locking_callback(_locking_function); 285| | 286| |#elif defined(HAVE_WINCRYPT_H) 287| | 288| | if (!CryptAcquireContext( 289| | &yr_cryptprov, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) 290| | { 291| | return ERROR_INTERNAL_FATAL_ERROR; 292| | } 293| | 294| |#elif defined(HAVE_COMMON_CRYPTO) 295| | 296| | ... 297| | 298| |#endif 299| | 300| 2| FAIL_ON_ERROR(yr_modules_initialize()); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 301| | 302| | // Initialize default configuration options 303| | 304| 2| FAIL_ON_ERROR(yr_set_configuration(YR_CONFIG_STACK_SIZE, &def_stack_size)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 305| | 306| 2| FAIL_ON_ERROR(yr_set_configuration( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 307| 2| YR_CONFIG_MAX_STRINGS_PER_RULE, &def_max_strings_per_rule)); 308| | 309| 2| FAIL_ON_ERROR(yr_set_configuration( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 310| 2| YR_CONFIG_MAX_PROCESS_MEMORY_CHUNK, &def_max_process_memory_chunk)); 311| | 312| 2| FAIL_ON_ERROR( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 313| 2| yr_set_configuration(YR_CONFIG_MAX_MATCH_DATA, &def_max_match_data)); 314| | 315| 2| YR_DEBUG_FPRINTF(2, stderr, "} // %s()\n", __FUNCTION__); 316| | 317| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 318| 2|} yr_set_configuration: 396| 8|{ 397| 8| if (src == NULL) ------------------ | Branch (397:7): [True: 0, False: 8] ------------------ 398| 0| return ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 399| | 400| 8| switch (name) 401| 8| { // lump all the cases using same types together in one cascade 402| 2| case YR_CONFIG_STACK_SIZE: ------------------ | Branch (402:3): [True: 2, False: 6] ------------------ 403| 4| case YR_CONFIG_MAX_STRINGS_PER_RULE: ------------------ | Branch (403:3): [True: 2, False: 6] ------------------ 404| 6| case YR_CONFIG_MAX_MATCH_DATA: ------------------ | Branch (404:3): [True: 2, False: 6] ------------------ 405| 6| yr_cfgs[name].ui32 = *(uint32_t *) src; 406| 6| break; 407| | 408| 2| case YR_CONFIG_MAX_PROCESS_MEMORY_CHUNK: ------------------ | Branch (408:3): [True: 2, False: 6] ------------------ 409| 2| yr_cfgs[name].ui64 = *(uint64_t *) src; 410| 2| break; 411| | 412| 0| default: ------------------ | Branch (412:3): [True: 0, False: 8] ------------------ 413| 0| return ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 414| 8| } 415| | 416| 8| return ERROR_SUCCESS; ------------------ | | 40| 8|#define ERROR_SUCCESS 0 ------------------ 417| 8|} yr_get_configuration: 486| 3.41k|{ 487| 3.41k| if (dest == NULL) ------------------ | Branch (487:7): [True: 0, False: 3.41k] ------------------ 488| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 489| | 490| 3.41k| switch (name) 491| 3.41k| { // lump all the cases using same types together in one cascade 492| 1.70k| case YR_CONFIG_STACK_SIZE: ------------------ | Branch (492:3): [True: 1.70k, False: 1.70k] ------------------ 493| 1.70k| case YR_CONFIG_MAX_STRINGS_PER_RULE: ------------------ | Branch (493:3): [True: 2, False: 3.41k] ------------------ 494| 3.41k| case YR_CONFIG_MAX_MATCH_DATA: ------------------ | Branch (494:3): [True: 1.70k, False: 1.70k] ------------------ 495| 3.41k| *(uint32_t *) dest = yr_cfgs[name].ui32; 496| 3.41k| break; 497| | 498| 0| case YR_CONFIG_MAX_PROCESS_MEMORY_CHUNK: ------------------ | Branch (498:3): [True: 0, False: 3.41k] ------------------ 499| 0| *(uint64_t *) dest = yr_cfgs[name].ui64; 500| 0| break; 501| | 502| 0| default: ------------------ | Branch (502:3): [True: 0, False: 3.41k] ------------------ 503| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 504| 3.41k| } 505| | 506| 3.41k| return ERROR_SUCCESS; ------------------ | | 40| 3.41k|#define ERROR_SUCCESS 0 ------------------ 507| 3.41k|} yr_get_configuration_uint32: 522| 3.41k|{ 523| 3.41k| switch (name) 524| 3.41k| { 525| | // Accept only the configuration options that are of type uint32_t. 526| 1.70k| case YR_CONFIG_STACK_SIZE: ------------------ | Branch (526:3): [True: 1.70k, False: 1.70k] ------------------ 527| 1.70k| case YR_CONFIG_MAX_STRINGS_PER_RULE: ------------------ | Branch (527:3): [True: 2, False: 3.41k] ------------------ 528| 3.41k| case YR_CONFIG_MAX_MATCH_DATA: ------------------ | Branch (528:3): [True: 1.70k, False: 1.70k] ------------------ 529| 3.41k| return yr_get_configuration(name, (void *) dest); 530| 0| default: ------------------ | Branch (530:3): [True: 0, False: 3.41k] ------------------ 531| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 532| 3.41k| } 533| 3.41k|} yr_heap_alloc: 120| 2|{ 121| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 122| 2|} yr_calloc: 130| 21.9k|{ 131| 21.9k| return calloc(count, size); 132| 21.9k|} yr_malloc: 135| 105k|{ 136| 105k| return malloc(size); 137| 105k|} yr_realloc: 140| 1.72k|{ 141| 1.72k| return realloc(ptr, size); 142| 1.72k|} yr_strdup: 145| 66.1k|{ 146| 66.1k| return strdup(str); 147| 66.1k|} yr_free: 155| 195k|{ 156| 195k| free(ptr); 157| 195k|} yr_modules_initialize: 64| 2|{ 65| 22| for (YR_MODULE* module = yr_modules_table; module->initialize != NULL; ------------------ | Branch (65:46): [True: 20, False: 2] ------------------ 66| 20| module++) 67| 20| { 68| 20| int result = module->initialize(module); 69| | 70| 20| if (result != ERROR_SUCCESS) ------------------ | | 40| 20|#define ERROR_SUCCESS 0 ------------------ | Branch (70:9): [True: 0, False: 20] ------------------ 71| 0| return result; 72| 20| } 73| | 74| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 75| 2|} yr_modules_do_declarations: 93| 1.70k|{ 94| 1.70k| for (YR_MODULE* module = yr_modules_table; 95| 6.83k| module->name != NULL && module->declarations != NULL; ------------------ | Branch (95:8): [True: 6.83k, False: 0] | Branch (95:32): [True: 6.83k, False: 0] ------------------ 96| 5.12k| module++) 97| 6.83k| { 98| 6.83k| if (strcmp(module->name, module_name) == 0) ------------------ | Branch (98:9): [True: 1.70k, False: 5.12k] ------------------ 99| 1.70k| return module->declarations(main_structure); 100| 6.83k| } 101| | 102| 0| return ERROR_UNKNOWN_MODULE; ------------------ | | 81| 0|#define ERROR_UNKNOWN_MODULE 34 ------------------ 103| 1.70k|} yr_modules_load: 106| 1.70k|{ 107| 1.70k| int result; 108| | 109| 1.70k| YR_MODULE_IMPORT mi; 110| | 111| 1.70k| YR_OBJECT* module_structure = (YR_OBJECT*) yr_hash_table_lookup( 112| 1.70k| context->objects_table, module_name, NULL); 113| | 114| | // if module_structure != NULL, the module was already 115| | // loaded, return successfully without doing nothing. 116| | 117| 1.70k| if (module_structure != NULL) ------------------ | Branch (117:7): [True: 0, False: 1.70k] ------------------ 118| 0| return ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 119| | 120| | // not loaded yet 121| | 122| 1.70k| FAIL_ON_ERROR(yr_object_create( ------------------ | | 134| 1.70k| { \ | | 135| 1.70k| int __error = (x); \ | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 1.70k] | | ------------------ | | 137| 1.70k| return __error; \ | | 138| 1.70k| } ------------------ 123| 1.70k| OBJECT_TYPE_STRUCTURE, module_name, NULL, &module_structure)); 124| | 125| | // initialize canary for module's top-level structure, every other object 126| | // within the module inherits the same canary. 127| 1.70k| yr_object_set_canary(module_structure, context->canary); 128| | 129| 1.70k| mi.module_name = module_name; 130| 1.70k| mi.module_data = NULL; 131| 1.70k| mi.module_data_size = 0; 132| | 133| 1.70k| result = context->callback( 134| 1.70k| context, CALLBACK_MSG_IMPORT_MODULE, &mi, context->user_data); ------------------ | | 41| 1.70k|#define CALLBACK_MSG_IMPORT_MODULE 4 ------------------ 135| | 136| 1.70k| if (result == CALLBACK_ERROR) ------------------ | | 49| 1.70k|#define CALLBACK_ERROR 2 ------------------ | Branch (136:7): [True: 0, False: 1.70k] ------------------ 137| 0| { 138| 0| yr_object_destroy(module_structure); 139| 0| return ERROR_CALLBACK_ERROR; ------------------ | | 75| 0|#define ERROR_CALLBACK_ERROR 28 ------------------ 140| 0| } 141| | 142| 1.70k| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 1.70k| { \ | | 143| 1.70k| int __error = (x); \ | | 144| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 1.70k] | | ------------------ | | 145| 1.70k| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 1.70k| } ------------------ 143| 1.70k| yr_modules_do_declarations(module_name, module_structure), 144| 1.70k| yr_object_destroy(module_structure)); 145| | 146| 1.70k| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 1.70k| { \ | | 143| 1.70k| int __error = (x); \ | | 144| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 1.70k] | | ------------------ | | 145| 1.70k| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 1.70k| } ------------------ 147| 1.70k| yr_hash_table_add( 148| 1.70k| context->objects_table, module_name, NULL, module_structure), 149| 1.70k| yr_object_destroy(module_structure)); 150| | 151| 1.70k| for (YR_MODULE* module = yr_modules_table; 152| 18.7k| module->name != NULL && module->load != NULL; ------------------ | Branch (152:8): [True: 17.0k, False: 1.70k] | Branch (152:32): [True: 17.0k, False: 0] ------------------ 153| 17.0k| module++) 154| 17.0k| { 155| 17.0k| if (strcmp(module->name, module_name) == 0) ------------------ | Branch (155:9): [True: 1.70k, False: 15.3k] ------------------ 156| 1.70k| { 157| 1.70k| result = module->load( 158| 1.70k| context, module_structure, mi.module_data, mi.module_data_size); 159| | 160| 1.70k| if (result != ERROR_SUCCESS) ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ | Branch (160:11): [True: 0, False: 1.70k] ------------------ 161| 0| return result; 162| 1.70k| } 163| 17.0k| } 164| | 165| 1.70k| result = context->callback( 166| 1.70k| context, 167| 1.70k| CALLBACK_MSG_MODULE_IMPORTED, ------------------ | | 42| 1.70k|#define CALLBACK_MSG_MODULE_IMPORTED 5 ------------------ 168| 1.70k| module_structure, 169| 1.70k| context->user_data); 170| | 171| 1.70k| if (result == CALLBACK_ERROR) ------------------ | | 49| 1.70k|#define CALLBACK_ERROR 2 ------------------ | Branch (171:7): [True: 0, False: 1.70k] ------------------ 172| 0| return ERROR_CALLBACK_ERROR; ------------------ | | 75| 0|#define ERROR_CALLBACK_ERROR 28 ------------------ 173| | 174| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 175| 1.70k|} yr_modules_unload_all: 178| 1.70k|{ 179| 1.70k| for (YR_MODULE* module = yr_modules_table; 180| 18.7k| module->name != NULL && module->unload != NULL; ------------------ | Branch (180:8): [True: 17.0k, False: 1.70k] | Branch (180:32): [True: 17.0k, False: 0] ------------------ 181| 17.0k| module++) 182| 17.0k| { 183| 17.0k| YR_OBJECT* module_structure = (YR_OBJECT*) yr_hash_table_remove( 184| 17.0k| context->objects_table, module->name, NULL); 185| | 186| 17.0k| if (module_structure != NULL) ------------------ | Branch (186:9): [True: 1.70k, False: 15.3k] ------------------ 187| 1.70k| { 188| 1.70k| module->unload(module_structure); 189| 1.70k| yr_object_destroy(module_structure); 190| 1.70k| } 191| 17.0k| } 192| | 193| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 194| 1.70k|} console__initialize: 260| 2|{ 261| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 262| 2|} dex__initialize: 1451| 2|{ 1452| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 1453| 2|} dotnet__initialize: 3487| 2|{ 3488| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 3489| 2|} elf__initialize: 1005| 2|{ 1006| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 1007| 2|} macho__initialize: 1363| 2|{ 1364| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 1365| 2|} get_distribution: 57| 8.30k|{ 58| 8.30k| bool past_first_block = false; 59| | 60| 8.30k| size_t i; 61| | 62| 8.30k| uint32_t* data = (uint32_t*) yr_calloc(256, sizeof(uint32_t)); 63| | 64| 8.30k| if (data == NULL) ------------------ | Branch (64:7): [True: 0, False: 8.30k] ------------------ 65| 0| return NULL; 66| | 67| 8.30k| YR_MEMORY_BLOCK* block = first_memory_block(context); ------------------ | | 222| 8.30k| (context)->iterator->first((context)->iterator) ------------------ 68| 8.30k| YR_MEMORY_BLOCK_ITERATOR* iterator = context->iterator; 69| | 70| 8.30k| if (block == NULL || offset < 0 || length < 0 || offset < block->base) ------------------ | Branch (70:7): [True: 0, False: 8.30k] | Branch (70:24): [True: 0, False: 8.30k] | Branch (70:38): [True: 0, False: 8.30k] | Branch (70:52): [True: 0, False: 8.30k] ------------------ 71| 0| { 72| 0| yr_free(data); 73| 0| return NULL; 74| 0| } 75| | 76| 8.30k| foreach_memory_block(iterator, block) ------------------ | | 218| 8.30k| for (block = iterator->first(iterator); block != NULL; \ | | ------------------ | | | Branch (218:43): [True: 8.30k, False: 0] | | ------------------ | | 219| 8.30k| block = iterator->next(iterator)) ------------------ 77| 8.30k| { 78| 8.30k| if (offset >= block->base && offset < block->base + block->size) ------------------ | Branch (78:9): [True: 8.30k, False: 0] | Branch (78:34): [True: 8.30k, False: 0] ------------------ 79| 8.30k| { 80| 8.30k| size_t data_offset = (size_t) (offset - block->base); 81| 8.30k| size_t data_len = (size_t) yr_min( ------------------ | | 112| 8.30k|#define yr_min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (112:23): [True: 0, False: 8.30k] | | ------------------ ------------------ 82| 8.30k| length, (size_t) (block->size - data_offset)); 83| | 84| 8.30k| const uint8_t* block_data = yr_fetch_block_data(block); 85| | 86| 8.30k| if (block_data == NULL) ------------------ | Branch (86:11): [True: 0, False: 8.30k] ------------------ 87| 0| { 88| 0| yr_free(data); 89| 0| return NULL; 90| 0| } 91| | 92| 8.30k| offset += data_len; 93| 8.30k| length -= data_len; 94| | 95| 157M| for (i = 0; i < data_len; i++) ------------------ | Branch (95:19): [True: 157M, False: 8.30k] ------------------ 96| 157M| { 97| 157M| uint8_t c = *(block_data + data_offset + i); 98| 157M| data[c]++; 99| 157M| } 100| | 101| 8.30k| past_first_block = true; 102| 8.30k| } 103| 0| else if (past_first_block) ------------------ | Branch (103:14): [True: 0, False: 0] ------------------ 104| 0| { 105| | // If offset is not within current block and we already 106| | // past the first block then the we are trying to compute 107| | // the distribution over a range of non contiguous blocks. As 108| | // range contains gaps of undefined data the distribution is 109| | // undefined. 110| | 111| 0| yr_free(data); 112| 0| return NULL; 113| 0| } 114| | 115| 8.30k| if (block->base + block->size >= offset + length) ------------------ | Branch (115:9): [True: 8.30k, False: 0] ------------------ 116| 8.30k| break; 117| 8.30k| } 118| | 119| 8.30k| if (!past_first_block) ------------------ | Branch (119:7): [True: 0, False: 8.30k] ------------------ 120| 0| { 121| 0| yr_free(data); 122| 0| return NULL; 123| 0| } 124| 8.30k| return data; 125| 8.30k|} data_entropy: 201| 1.70k|{ 202| 1.70k| double entropy = 0.0; 203| | 204| 1.70k| int64_t offset = integer_argument(1); // offset where to start ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 205| 1.70k| int64_t length = integer_argument(2); // length of bytes we want entropy on ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 206| | 207| 1.70k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.70k|#define yr_scan_context() (__context) ------------------ 208| | 209| 1.70k| size_t i; 210| | 211| 1.70k| size_t total_len = 0; 212| | 213| 1.70k| uint32_t* data = get_distribution(offset, length, context); 214| | 215| 1.70k| if (data == NULL) ------------------ | Branch (215:7): [True: 0, False: 1.70k] ------------------ 216| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 217| | 218| 438k| for (i = 0; i < 256; i++) ------------------ | Branch (218:15): [True: 436k, False: 1.70k] ------------------ 219| 436k| { 220| 436k| total_len += data[i]; 221| 436k| } 222| | 223| 438k| for (i = 0; i < 256; i++) ------------------ | Branch (223:15): [True: 436k, False: 1.70k] ------------------ 224| 436k| { 225| 436k| if (data[i] != 0) ------------------ | Branch (225:9): [True: 61.2k, False: 375k] ------------------ 226| 61.2k| { 227| 61.2k| double x = (double) (data[i]) / total_len; 228| 61.2k| entropy -= x * log2(x); 229| 61.2k| } 230| 436k| } 231| | 232| 1.70k| yr_free(data); 233| 1.70k| return_float(entropy); ------------------ | | 257| 1.70k| { \ | | 258| 1.70k| double d = (double) (double_); \ | | 259| 1.70k| assertf( \ | | ------------------ | | | | 164| 1.70k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.70k] | | | | ------------------ | | | | 165| 1.70k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 1.70k| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 1.70k| "return type differs from function declaration"); \ | | 262| 1.70k| return yr_object_set_float( \ | | 263| 1.70k| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 1.70k, False: 0] | | ------------------ | | 264| 1.70k| __function_obj->return_obj, \ | | 265| 1.70k| NULL); \ | | 266| 1.70k| } ------------------ 234| 0|} data_deviation: 251| 1.70k|{ 252| 1.70k| int64_t offset = integer_argument(1); ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 253| 1.70k| int64_t length = integer_argument(2); ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 254| | 255| 1.70k| double mean = float_argument(3); ------------------ | | 209| 1.70k|#define float_argument(n) (__args[n - 1].d) ------------------ 256| 1.70k| double sum = 0.0; 257| | 258| 1.70k| size_t total_len = 0; 259| 1.70k| size_t i; 260| | 261| 1.70k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.70k|#define yr_scan_context() (__context) ------------------ 262| | 263| 1.70k| uint32_t* data = get_distribution(offset, length, context); 264| | 265| 1.70k| if (data == NULL) ------------------ | Branch (265:7): [True: 0, False: 1.70k] ------------------ 266| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 267| | 268| 438k| for (i = 0; i < 256; i++) ------------------ | Branch (268:15): [True: 436k, False: 1.70k] ------------------ 269| 436k| { 270| 436k| total_len += data[i]; 271| 436k| sum += fabs(((double) i) - mean) * data[i]; 272| 436k| } 273| | 274| 1.70k| yr_free(data); 275| 1.70k| return_float(sum / total_len); ------------------ | | 257| 1.70k| { \ | | 258| 1.70k| double d = (double) (double_); \ | | 259| 1.70k| assertf( \ | | ------------------ | | | | 164| 1.70k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.70k] | | | | ------------------ | | | | 165| 1.70k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 1.70k| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 1.70k| "return type differs from function declaration"); \ | | 262| 1.70k| return yr_object_set_float( \ | | 263| 1.70k| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 1.70k, False: 0] | | ------------------ | | 264| 1.70k| __function_obj->return_obj, \ | | 265| 1.70k| NULL); \ | | 266| 1.70k| } ------------------ 276| 0|} data_mean: 291| 1.70k|{ 292| 1.70k| double sum = 0.0; 293| | 294| 1.70k| int64_t offset = integer_argument(1); ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 295| 1.70k| int64_t length = integer_argument(2); ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 296| | 297| 1.70k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.70k|#define yr_scan_context() (__context) ------------------ 298| | 299| 1.70k| size_t total_len = 0; 300| 1.70k| size_t i; 301| | 302| 1.70k| uint32_t* data = get_distribution(offset, length, context); 303| | 304| 1.70k| if (data == NULL) ------------------ | Branch (304:7): [True: 0, False: 1.70k] ------------------ 305| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 306| | 307| 438k| for (i = 0; i < 256; i++) ------------------ | Branch (307:15): [True: 436k, False: 1.70k] ------------------ 308| 436k| { 309| 436k| total_len += data[i]; 310| 436k| sum += ((double) i) * data[i]; 311| 436k| } 312| | 313| 1.70k| yr_free(data); 314| 1.70k| return_float(sum / total_len); ------------------ | | 257| 1.70k| { \ | | 258| 1.70k| double d = (double) (double_); \ | | 259| 1.70k| assertf( \ | | ------------------ | | | | 164| 1.70k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.70k] | | | | ------------------ | | | | 165| 1.70k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 1.70k| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 1.70k| "return type differs from function declaration"); \ | | 262| 1.70k| return yr_object_set_float( \ | | 263| 1.70k| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 1.70k, False: 0] | | ------------------ | | 264| 1.70k| __function_obj->return_obj, \ | | 265| 1.70k| NULL); \ | | 266| 1.70k| } ------------------ 315| 0|} data_serial_correlation: 318| 1.70k|{ 319| 1.70k| int past_first_block = false; 320| | 321| 1.70k| size_t total_len = 0; 322| 1.70k| size_t i; 323| | 324| 1.70k| int64_t offset = integer_argument(1); ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 325| 1.70k| int64_t length = integer_argument(2); ------------------ | | 207| 1.70k|#define integer_argument(n) (__args[n - 1].i) ------------------ 326| | 327| 1.70k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.70k|#define yr_scan_context() (__context) ------------------ 328| 1.70k| YR_MEMORY_BLOCK* block = first_memory_block(context); ------------------ | | 222| 1.70k| (context)->iterator->first((context)->iterator) ------------------ 329| 1.70k| YR_MEMORY_BLOCK_ITERATOR* iterator = context->iterator; 330| | 331| 1.70k| if (block == NULL) ------------------ | Branch (331:7): [True: 0, False: 1.70k] ------------------ 332| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 333| | 334| 1.70k| double sccun = 0; 335| 1.70k| double sccfirst = 0; 336| 1.70k| double scclast = 0; 337| 1.70k| double scct1 = 0; 338| 1.70k| double scct2 = 0; 339| 1.70k| double scct3 = 0; 340| 1.70k| double scc = 0; 341| | 342| 1.70k| if (offset < 0 || length < 0 || offset < block->base) ------------------ | Branch (342:7): [True: 0, False: 1.70k] | Branch (342:21): [True: 0, False: 1.70k] | Branch (342:35): [True: 0, False: 1.70k] ------------------ 343| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 344| | 345| 1.70k| foreach_memory_block(iterator, block) ------------------ | | 218| 1.70k| for (block = iterator->first(iterator); block != NULL; \ | | ------------------ | | | Branch (218:43): [True: 1.70k, False: 0] | | ------------------ | | 219| 1.70k| block = iterator->next(iterator)) ------------------ 346| 1.70k| { 347| 1.70k| if (offset >= block->base && offset < block->base + block->size) ------------------ | Branch (347:9): [True: 1.70k, False: 0] | Branch (347:34): [True: 1.70k, False: 0] ------------------ 348| 1.70k| { 349| 1.70k| size_t data_offset = (size_t) (offset - block->base); 350| 1.70k| size_t data_len = (size_t) yr_min( ------------------ | | 112| 1.70k|#define yr_min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (112:23): [True: 0, False: 1.70k] | | ------------------ ------------------ 351| 1.70k| length, (size_t) (block->size - data_offset)); 352| | 353| 1.70k| const uint8_t* block_data = yr_fetch_block_data(block); 354| | 355| 1.70k| if (block_data == NULL) ------------------ | Branch (355:11): [True: 0, False: 1.70k] ------------------ 356| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 357| | 358| 1.70k| total_len += data_len; 359| 1.70k| offset += data_len; 360| 1.70k| length -= data_len; 361| | 362| 33.0M| for (i = 0; i < data_len; i++) ------------------ | Branch (362:19): [True: 33.0M, False: 1.70k] ------------------ 363| 33.0M| { 364| 33.0M| sccun = (double) *(block_data + data_offset + i); 365| 33.0M| if (i == 0) ------------------ | Branch (365:13): [True: 1.70k, False: 33.0M] ------------------ 366| 1.70k| { 367| 1.70k| sccfirst = sccun; 368| 1.70k| } 369| 33.0M| scct1 += scclast * sccun; 370| 33.0M| scct2 += sccun; 371| 33.0M| scct3 += sccun * sccun; 372| 33.0M| scclast = sccun; 373| 33.0M| } 374| | 375| 1.70k| past_first_block = true; 376| 1.70k| } 377| 0| else if (past_first_block) ------------------ | Branch (377:14): [True: 0, False: 0] ------------------ 378| 0| { 379| | // If offset is not within current block and we already 380| | // past the first block then the we are trying to compute 381| | // the checksum over a range of non contiguous blocks. As 382| | // range contains gaps of undefined data the checksum is 383| | // undefined. 384| 0| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 385| 0| } 386| | 387| 1.70k| if (block->base + block->size >= offset + length) ------------------ | Branch (387:9): [True: 1.70k, False: 0] ------------------ 388| 1.70k| break; 389| 1.70k| } 390| | 391| 1.70k| if (!past_first_block) ------------------ | Branch (391:7): [True: 0, False: 1.70k] ------------------ 392| 1.70k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 393| | 394| 1.70k| scct1 += scclast * sccfirst; 395| 1.70k| scct2 *= scct2; 396| | 397| 1.70k| scc = total_len * scct3 - scct2; 398| | 399| 1.70k| if (scc == 0) ------------------ | Branch (399:7): [True: 25, False: 1.68k] ------------------ 400| 25| scc = -100000; 401| 1.68k| else 402| 1.68k| scc = (total_len * scct1 - scct2) / scc; 403| | 404| 1.70k| return_float(scc); ------------------ | | 257| 1.70k| { \ | | 258| 1.70k| double d = (double) (double_); \ | | 259| 1.70k| assertf( \ | | ------------------ | | | | 164| 1.70k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.70k] | | | | ------------------ | | | | 165| 1.70k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 1.70k| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 1.70k| "return type differs from function declaration"); \ | | 262| 1.70k| return yr_object_set_float( \ | | 263| 1.70k| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 1.70k, False: 0] | | ------------------ | | 264| 1.70k| __function_obj->return_obj, \ | | 265| 1.70k| NULL); \ | | 266| 1.70k| } ------------------ 405| 0|} data_monte_carlo_pi: 446| 1.59k|{ 447| 1.59k| int past_first_block = false; 448| 1.59k| int mcount = 0; 449| 1.59k| int inmont = 0; 450| | 451| 1.59k| double INCIRC = pow(pow(256.0, 3.0) - 1, 2.0); 452| 1.59k| double mpi = 0; 453| | 454| 1.59k| size_t i; 455| | 456| 1.59k| int64_t offset = integer_argument(1); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 457| 1.59k| int64_t length = integer_argument(2); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 458| | 459| 1.59k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.59k|#define yr_scan_context() (__context) ------------------ 460| 1.59k| YR_MEMORY_BLOCK* block = first_memory_block(context); ------------------ | | 222| 1.59k| (context)->iterator->first((context)->iterator) ------------------ 461| 1.59k| YR_MEMORY_BLOCK_ITERATOR* iterator = context->iterator; 462| | 463| 1.59k| if (block == NULL) ------------------ | Branch (463:7): [True: 0, False: 1.59k] ------------------ 464| 1.59k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 465| | 466| 1.59k| if (offset < 0 || length < 0 || offset < block->base) ------------------ | Branch (466:7): [True: 0, False: 1.59k] | Branch (466:21): [True: 0, False: 1.59k] | Branch (466:35): [True: 0, False: 1.59k] ------------------ 467| 1.59k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 468| | 469| 1.59k| foreach_memory_block(iterator, block) ------------------ | | 218| 1.59k| for (block = iterator->first(iterator); block != NULL; \ | | ------------------ | | | Branch (218:43): [True: 1.59k, False: 0] | | ------------------ | | 219| 1.59k| block = iterator->next(iterator)) ------------------ 470| 1.59k| { 471| 1.59k| if (offset >= block->base && offset < block->base + block->size) ------------------ | Branch (471:9): [True: 1.59k, False: 0] | Branch (471:34): [True: 1.59k, False: 0] ------------------ 472| 1.59k| { 473| 1.59k| unsigned int monte[6]; 474| | 475| 1.59k| size_t data_offset = (size_t) (offset - block->base); 476| 1.59k| size_t data_len = (size_t) yr_min( ------------------ | | 112| 1.59k|#define yr_min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (112:23): [True: 0, False: 1.59k] | | ------------------ ------------------ 477| 1.59k| length, (size_t) (block->size - data_offset)); 478| | 479| 1.59k| const uint8_t* block_data = yr_fetch_block_data(block); 480| | 481| 1.59k| if (block_data == NULL) ------------------ | Branch (481:11): [True: 0, False: 1.59k] ------------------ 482| 1.59k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 483| | 484| 1.59k| offset += data_len; 485| 1.59k| length -= data_len; 486| | 487| 29.0M| for (i = 0; i < data_len; i++) ------------------ | Branch (487:19): [True: 29.0M, False: 1.59k] ------------------ 488| 29.0M| { 489| 29.0M| monte[i % 6] = (unsigned int) *(block_data + data_offset + i); 490| | 491| 29.0M| if (i % 6 == 5) ------------------ | Branch (491:13): [True: 4.84M, False: 24.2M] ------------------ 492| 4.84M| { 493| 4.84M| double mx = 0; 494| 4.84M| double my = 0; 495| 4.84M| int j; 496| | 497| 4.84M| mcount++; 498| | 499| 19.3M| for (j = 0; j < 3; j++) ------------------ | Branch (499:23): [True: 14.5M, False: 4.84M] ------------------ 500| 14.5M| { 501| 14.5M| mx = (mx * 256.0) + monte[j]; 502| 14.5M| my = (my * 256.0) + monte[j + 3]; 503| 14.5M| } 504| | 505| 4.84M| if ((mx * mx + my * my) <= INCIRC) ------------------ | Branch (505:15): [True: 4.25M, False: 591k] ------------------ 506| 4.25M| inmont++; 507| 4.84M| } 508| 29.0M| } 509| | 510| 1.59k| past_first_block = true; 511| 1.59k| } 512| 0| else if (past_first_block) ------------------ | Branch (512:14): [True: 0, False: 0] ------------------ 513| 0| { 514| | // If offset is not within current block and we already 515| | // past the first block then the we are trying to compute 516| | // the checksum over a range of non contiguous blocks. As 517| | // range contains gaps of undefined data the checksum is 518| | // undefined. 519| 0| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 520| 0| } 521| | 522| 1.59k| if (block->base + block->size >= offset + length) ------------------ | Branch (522:9): [True: 1.59k, False: 0] ------------------ 523| 1.59k| break; 524| 1.59k| } 525| | 526| 1.59k| if (!past_first_block || mcount == 0) ------------------ | Branch (526:7): [True: 0, False: 1.59k] | Branch (526:28): [True: 4, False: 1.59k] ------------------ 527| 1.59k| return_float(YR_UNDEFINED); ------------------ | | 257| 4| { \ | | 258| 4| double d = (double) (double_); \ | | 259| 4| assertf( \ | | ------------------ | | | | 164| 4| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 4] | | | | ------------------ | | | | 165| 4| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 4| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 4| "return type differs from function declaration"); \ | | 262| 4| return yr_object_set_float( \ | | 263| 4| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 4|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 4] | | ------------------ | | 264| 4| __function_obj->return_obj, \ | | 265| 4| NULL); \ | | 266| 4| } ------------------ 528| | 529| 1.59k| mpi = 4.0 * ((double) inmont / mcount); 530| | 531| 1.59k| return_float(fabs((mpi - PI) / PI)); ------------------ | | 257| 1.59k| { \ | | 258| 1.59k| double d = (double) (double_); \ | | 259| 1.59k| assertf( \ | | ------------------ | | | | 164| 1.59k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.59k] | | | | ------------------ | | | | 165| 1.59k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 1.59k| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 1.59k| "return type differs from function declaration"); \ | | 262| 1.59k| return yr_object_set_float( \ | | 263| 1.59k| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 1.59k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 1.59k, False: 0] | | ------------------ | | 264| 1.59k| __function_obj->return_obj, \ | | 265| 1.59k| NULL); \ | | 266| 1.59k| } ------------------ 532| 0|} min: 594| 1.59k|{ 595| 1.59k| uint64_t i = integer_argument(1); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 596| 1.59k| uint64_t j = integer_argument(2); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 597| | 598| 1.59k| return_integer(i < j ? i : j); ------------------ | | 249| 1.59k| { \ | | 250| 1.59k| assertf( \ | | ------------------ | | | | 164| 1.59k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.59k] | | | | ------------------ | | | | 165| 1.59k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 251| 1.59k| __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \ | | 252| 1.59k| "return type differs from function declaration"); \ | | 253| 3.18k| return yr_object_set_integer((integer), __function_obj->return_obj, NULL); \ | | ------------------ | | | Branch (253:35): [True: 1.59k, False: 0] | | ------------------ | | 254| 1.59k| } ------------------ 599| 0|} max: 602| 1.59k|{ 603| 1.59k| uint64_t i = integer_argument(1); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 604| 1.59k| uint64_t j = integer_argument(2); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 605| | 606| 1.59k| return_integer(i > j ? i : j); ------------------ | | 249| 1.59k| { \ | | 250| 1.59k| assertf( \ | | ------------------ | | | | 164| 1.59k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.59k] | | | | ------------------ | | | | 165| 1.59k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 251| 1.59k| __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \ | | 252| 1.59k| "return type differs from function declaration"); \ | | 253| 3.18k| return yr_object_set_integer((integer), __function_obj->return_obj, NULL); \ | | ------------------ | | | Branch (253:35): [True: 0, False: 1.59k] | | ------------------ | | 254| 1.59k| } ------------------ 607| 0|} count_range: 620| 1.59k|{ 621| 1.59k| int64_t byte = integer_argument(1); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 622| 1.59k| int64_t offset = integer_argument(2); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 623| 1.59k| int64_t length = integer_argument(3); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 624| | 625| 1.59k| if (byte < 0 || byte > 255) ------------------ | Branch (625:7): [True: 0, False: 1.59k] | Branch (625:19): [True: 0, False: 1.59k] ------------------ 626| 1.59k| return_integer(YR_UNDEFINED); ------------------ | | 249| 0| { \ | | 250| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 251| 0| __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \ | | 252| 0| "return type differs from function declaration"); \ | | 253| 0| return yr_object_set_integer((integer), __function_obj->return_obj, NULL); \ | | 254| 0| } ------------------ 627| | 628| 1.59k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.59k|#define yr_scan_context() (__context) ------------------ 629| | 630| 1.59k| uint32_t* distribution = get_distribution(offset, length, context); 631| | 632| 1.59k| if (distribution == NULL) ------------------ | Branch (632:7): [True: 0, False: 1.59k] ------------------ 633| 1.59k| return_integer(YR_UNDEFINED); ------------------ | | 249| 0| { \ | | 250| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 251| 0| __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \ | | 252| 0| "return type differs from function declaration"); \ | | 253| 0| return yr_object_set_integer((integer), __function_obj->return_obj, NULL); \ | | 254| 0| } ------------------ 634| | 635| 1.59k| int64_t count = (int64_t) distribution[byte]; 636| 1.59k| yr_free(distribution); 637| 1.59k| return_integer(count); ------------------ | | 249| 1.59k| { \ | | 250| 1.59k| assertf( \ | | ------------------ | | | | 164| 1.59k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.59k] | | | | ------------------ | | | | 165| 1.59k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 251| 1.59k| __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \ | | 252| 1.59k| "return type differs from function declaration"); \ | | 253| 1.59k| return yr_object_set_integer((integer), __function_obj->return_obj, NULL); \ | | 254| 1.59k| } ------------------ 638| 0|} percentage_range: 660| 1.59k|{ 661| 1.59k| int64_t byte = integer_argument(1); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 662| 1.59k| int64_t offset = integer_argument(2); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 663| 1.59k| int64_t length = integer_argument(3); ------------------ | | 207| 1.59k|#define integer_argument(n) (__args[n - 1].i) ------------------ 664| | 665| 1.59k| if (byte < 0 || byte > 255) ------------------ | Branch (665:7): [True: 0, False: 1.59k] | Branch (665:19): [True: 0, False: 1.59k] ------------------ 666| 1.59k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 667| | 668| 1.59k| YR_SCAN_CONTEXT* context = yr_scan_context(); ------------------ | | 215| 1.59k|#define yr_scan_context() (__context) ------------------ 669| | 670| 1.59k| uint32_t* distribution = get_distribution(offset, length, context); 671| | 672| 1.59k| if (distribution == NULL) ------------------ | Branch (672:7): [True: 0, False: 1.59k] ------------------ 673| 1.59k| return_float(YR_UNDEFINED); ------------------ | | 257| 0| { \ | | 258| 0| double d = (double) (double_); \ | | 259| 0| assertf( \ | | ------------------ | | | | 164| 0| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 0] | | | | ------------------ | | | | 165| 0| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 0| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 0| "return type differs from function declaration"); \ | | 262| 0| return yr_object_set_float( \ | | 263| 0| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 0, False: 0] | | ------------------ | | 264| 0| __function_obj->return_obj, \ | | 265| 0| NULL); \ | | 266| 0| } ------------------ 674| | 675| 1.59k| int64_t count = (int64_t) distribution[byte]; 676| 1.59k| int64_t total_count = 0; 677| 1.59k| int64_t i; 678| | 679| 409k| for (i = 0; i < 256; i++) total_count += distribution[i]; ------------------ | Branch (679:15): [True: 407k, False: 1.59k] ------------------ 680| | 681| 1.59k| yr_free(distribution); 682| 1.59k| return_float(((float) count) / ((float) total_count)); ------------------ | | 257| 1.59k| { \ | | 258| 1.59k| double d = (double) (double_); \ | | 259| 1.59k| assertf( \ | | ------------------ | | | | 164| 1.59k| if (!(expr)) \ | | | | ------------------ | | | | | Branch (164:7): [True: 0, False: 1.59k] | | | | ------------------ | | | | 165| 1.59k| { \ | | | | 166| 0| fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \ | | | | 167| 0| abort(); \ | | | | 168| 0| } | | ------------------ | | 260| 1.59k| __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \ | | 261| 1.59k| "return type differs from function declaration"); \ | | 262| 1.59k| return yr_object_set_float( \ | | 263| 1.59k| (d != (double) YR_UNDEFINED) ? d : NAN, \ | | ------------------ | | | | 38| 1.59k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL | | ------------------ | | | Branch (263:9): [True: 1.59k, False: 0] | | ------------------ | | 264| 1.59k| __function_obj->return_obj, \ | | 265| 1.59k| NULL); \ | | 266| 1.59k| } ------------------ 683| 0|} math__declarations: 788| 1.70k|begin_declarations ------------------ | | 59| 1.70k| { \ | | 60| 1.70k| YR_OBJECT* stack[64]; \ | | 61| 1.70k| int stack_top = 0; \ | | 62| 1.70k| stack[stack_top] = module; ------------------ 789| 1.70k| declare_float("MEAN_BYTES"); ------------------ | | 147| 1.70k| { \ | | 148| 1.70k| FAIL_ON_ERROR( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 149| 1.70k| yr_object_create(OBJECT_TYPE_FLOAT, name, stack[stack_top], NULL)); \ | | 150| 1.70k| } ------------------ 790| 1.70k| declare_function("in_range", "fff", "i", in_range); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 791| 1.70k| declare_function("deviation", "iif", "f", data_deviation); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 792| 1.70k| declare_function("deviation", "sf", "f", string_deviation); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 793| 1.70k| declare_function("mean", "ii", "f", data_mean); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 794| 1.70k| declare_function("mean", "s", "f", string_mean); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 795| 1.70k| declare_function("serial_correlation", "ii", "f", data_serial_correlation); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 796| 1.70k| declare_function("serial_correlation", "s", "f", string_serial_correlation); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 797| 1.70k| declare_function("monte_carlo_pi", "ii", "f", data_monte_carlo_pi); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 798| 1.70k| declare_function("monte_carlo_pi", "s", "f", string_monte_carlo_pi); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 799| 1.70k| declare_function("entropy", "ii", "f", data_entropy); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 800| 1.70k| declare_function("entropy", "s", "f", string_entropy); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 801| 1.70k| declare_function("min", "ii", "i", min); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 802| 1.70k| declare_function("max", "ii", "i", max); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 803| 1.70k| declare_function("to_number", "b", "i", to_number); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 804| 1.70k| declare_function("abs", "i", "i", yr_math_abs); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 805| 1.70k| declare_function("count", "iii", "i", count_range); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 806| 1.70k| declare_function("count", "i", "i", count_global); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 807| 1.70k| declare_function("percentage", "iii", "f", percentage_range); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 808| 1.70k| declare_function("percentage", "i", "f", percentage_global); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 809| 1.70k| declare_function("mode", "ii", "i", mode_range); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 810| 1.70k| declare_function("mode", "", "i", mode_global); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 811| 1.70k| declare_function("to_string", "i", "s", to_string); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 812| 1.70k| declare_function("to_string", "ii", "s", to_string_base); ------------------ | | 191| 1.70k| { \ | | 192| 1.70k| YR_OBJECT* function; \ | | 193| 1.70k| FAIL_ON_ERROR(yr_object_function_create( \ | | ------------------ | | | | 134| 1.70k| { \ | | | | 135| 1.70k| int __error = (x); \ | | | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | | | ------------------ | | | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | | | ------------------ | | | | | Branch (136:9): [True: 0, False: 1.70k] | | | | ------------------ | | | | 137| 1.70k| return __error; \ | | | | 138| 1.70k| } | | ------------------ | | 194| 1.70k| name, args_fmt, ret_fmt, func, stack[stack_top], &function)); \ | | 195| 1.70k| } ------------------ 813| 1.70k|end_declarations ------------------ | | 65| 1.70k| return ERROR_SUCCESS; \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | 66| 1.70k| } ------------------ math__initialize: 816| 2|{ 817| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 818| 2|} math__load: 830| 1.70k|{ 831| 1.70k| yr_set_float(127.5, module_object, "MEAN_BYTES"); ------------------ | | 239| 1.70k| yr_object_set_float(value, object, __VA_ARGS__) ------------------ 832| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 833| 1.70k|} math__unload: 836| 1.70k|{ 837| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 838| 1.70k|} pe__initialize: 4008| 2|{ 4009| |#if defined(HAVE_LIBCRYPTO) && !defined(BORINGSSL) 4010| | // Initialize OpenSSL global objects for the auth library before any 4011| | // multithreaded environment as it is not thread-safe. This can 4012| | // only be called once per process. 4013| | static bool s_initialized = false; 4014| | 4015| | if (!s_initialized) 4016| | { 4017| | s_initialized = true; 4018| | initialize_authenticode_parser(); 4019| | } 4020| |#endif 4021| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 4022| 2|} string__initialize: 103| 2|{ 104| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 105| 2|} tests__initialize: 158| 2|{ 159| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 160| 2|} time__initialize: 51| 2|{ 52| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 53| 2|} yr_notebook_create: 86| 3.41k|{ 87| 3.41k| YR_NOTEBOOK* new_notebook = yr_malloc(sizeof(YR_NOTEBOOK)); 88| | 89| 3.41k| if (new_notebook == NULL) ------------------ | Branch (89:7): [True: 0, False: 3.41k] ------------------ 90| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 91| | 92| 3.41k| new_notebook->page_list_head = yr_malloc( 93| 3.41k| sizeof(YR_NOTEBOOK_PAGE) + min_page_size); 94| | 95| 3.41k| if (new_notebook->page_list_head == NULL) ------------------ | Branch (95:7): [True: 0, False: 3.41k] ------------------ 96| 0| { 97| 0| yr_free(new_notebook); 98| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 99| 0| } 100| | 101| 3.41k| new_notebook->min_page_size = min_page_size; 102| 3.41k| new_notebook->page_list_head->size = min_page_size; 103| 3.41k| new_notebook->page_list_head->used = 0; 104| 3.41k| new_notebook->page_list_head->next = NULL; 105| | 106| 3.41k| *notebook = new_notebook; 107| | 108| 3.41k| return ERROR_SUCCESS; ------------------ | | 40| 3.41k|#define ERROR_SUCCESS 0 ------------------ 109| 3.41k|} yr_notebook_destroy: 121| 3.41k|{ 122| 3.41k| YR_NOTEBOOK_PAGE* page = notebook->page_list_head; 123| | 124| 6.82k| while (page != NULL) ------------------ | Branch (124:10): [True: 3.41k, False: 3.41k] ------------------ 125| 3.41k| { 126| 3.41k| YR_NOTEBOOK_PAGE* next = page->next; 127| 3.41k| yr_free(page); 128| 3.41k| page = next; 129| 3.41k| } 130| | 131| 3.41k| yr_free(notebook); 132| | 133| 3.41k| return ERROR_SUCCESS; ------------------ | | 40| 3.41k|#define ERROR_SUCCESS 0 ------------------ 134| 3.41k|} yr_object_create: 56| 66.0k|{ 57| 66.0k| YR_OBJECT* obj; 58| 66.0k| size_t object_size = 0; 59| | 60| 66.0k| assert(parent != NULL || object != NULL); ------------------ | Branch (60:3): [True: 66.0k, False: 0] | Branch (60:3): [True: 0, False: 0] | Branch (60:3): [True: 49.5k, False: 16.5k] | Branch (60:3): [True: 16.5k, False: 0] ------------------ 61| 66.0k| assert(identifier != NULL); ------------------ | Branch (61:3): [True: 0, False: 66.0k] | Branch (61:3): [True: 66.0k, False: 0] ------------------ 62| | 63| 66.0k| switch (type) 64| 66.0k| { 65| 1.70k| case OBJECT_TYPE_STRUCTURE: ------------------ | | 60| 1.70k|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (65:3): [True: 1.70k, False: 64.3k] ------------------ 66| 1.70k| object_size = sizeof(YR_OBJECT_STRUCTURE); 67| 1.70k| break; 68| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (68:3): [True: 0, False: 66.0k] ------------------ 69| 0| object_size = sizeof(YR_OBJECT_ARRAY); 70| 0| break; 71| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (71:3): [True: 0, False: 66.0k] ------------------ 72| 0| object_size = sizeof(YR_OBJECT_DICTIONARY); 73| 0| break; 74| 16.7k| case OBJECT_TYPE_INTEGER: ------------------ | | 58| 16.7k|#define OBJECT_TYPE_INTEGER 1 ------------------ | Branch (74:3): [True: 16.7k, False: 49.3k] ------------------ 75| 16.7k| object_size = sizeof(YR_OBJECT); 76| 16.7k| break; 77| 21.9k| case OBJECT_TYPE_FLOAT: ------------------ | | 64| 21.9k|#define OBJECT_TYPE_FLOAT 7 ------------------ | Branch (77:3): [True: 21.9k, False: 44.0k] ------------------ 78| 21.9k| object_size = sizeof(YR_OBJECT); 79| 21.9k| break; 80| 1.70k| case OBJECT_TYPE_STRING: ------------------ | | 59| 1.70k|#define OBJECT_TYPE_STRING 2 ------------------ | Branch (80:3): [True: 1.70k, False: 64.3k] ------------------ 81| 1.70k| object_size = sizeof(YR_OBJECT); 82| 1.70k| break; 83| 23.9k| case OBJECT_TYPE_FUNCTION: ------------------ | | 62| 23.9k|#define OBJECT_TYPE_FUNCTION 5 ------------------ | Branch (83:3): [True: 23.9k, False: 42.1k] ------------------ 84| 23.9k| object_size = sizeof(YR_OBJECT_FUNCTION); 85| 23.9k| break; 86| 0| default: ------------------ | Branch (86:3): [True: 0, False: 66.0k] ------------------ 87| 0| assert(false); ------------------ | Branch (87:5): [Folded, False: 0] | Branch (87:5): [Folded, False: 0] ------------------ 88| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 89| 66.0k| } 90| | 91| 66.0k| obj = (YR_OBJECT*) yr_malloc(object_size); 92| | 93| 66.0k| if (obj == NULL) ------------------ | Branch (93:7): [True: 0, False: 66.0k] ------------------ 94| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 95| | 96| 66.0k| obj->type = type; 97| 66.0k| obj->identifier = yr_strdup(identifier); 98| 66.0k| obj->parent = parent; 99| 66.0k| obj->data = NULL; 100| | 101| 66.0k| switch (type) ------------------ | Branch (101:11): [True: 66.0k, False: 0] ------------------ 102| 66.0k| { 103| 16.7k| case OBJECT_TYPE_INTEGER: ------------------ | | 58| 16.7k|#define OBJECT_TYPE_INTEGER 1 ------------------ | Branch (103:3): [True: 16.7k, False: 49.3k] ------------------ 104| 16.7k| obj->value.i = YR_UNDEFINED; ------------------ | | 38| 16.7k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 105| 16.7k| break; 106| 21.9k| case OBJECT_TYPE_FLOAT: ------------------ | | 64| 21.9k|#define OBJECT_TYPE_FLOAT 7 ------------------ | Branch (106:3): [True: 21.9k, False: 44.0k] ------------------ 107| 21.9k| obj->value.d = NAN; 108| 21.9k| break; 109| 1.70k| case OBJECT_TYPE_STRING: ------------------ | | 59| 1.70k|#define OBJECT_TYPE_STRING 2 ------------------ | Branch (109:3): [True: 1.70k, False: 64.3k] ------------------ 110| 1.70k| obj->value.ss = NULL; 111| 1.70k| break; 112| 1.70k| case OBJECT_TYPE_STRUCTURE: ------------------ | | 60| 1.70k|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (112:3): [True: 1.70k, False: 64.3k] ------------------ 113| 1.70k| object_as_structure(obj)->members = NULL; ------------------ | | 909| 1.70k|#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj)) ------------------ 114| 1.70k| break; 115| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (115:3): [True: 0, False: 66.0k] ------------------ 116| 0| object_as_array(obj)->items = NULL; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 117| 0| object_as_array(obj)->prototype_item = NULL; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 118| 0| break; 119| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (119:3): [True: 0, False: 66.0k] ------------------ 120| 0| object_as_dictionary(obj)->items = NULL; ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 121| 0| object_as_dictionary(obj)->prototype_item = NULL; ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 122| 0| break; 123| 23.9k| case OBJECT_TYPE_FUNCTION: ------------------ | | 62| 23.9k|#define OBJECT_TYPE_FUNCTION 5 ------------------ | Branch (123:3): [True: 23.9k, False: 42.1k] ------------------ 124| 23.9k| object_as_function(obj)->return_obj = NULL; ------------------ | | 912| 23.9k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 125| 263k| for (int i = 0; i < YR_MAX_OVERLOADED_FUNCTIONS; i++) ------------------ | | 135| 263k|#define YR_MAX_OVERLOADED_FUNCTIONS 10 ------------------ | Branch (125:21): [True: 239k, False: 23.9k] ------------------ 126| 239k| { 127| 239k| object_as_function(obj)->prototypes[i].arguments_fmt = NULL; ------------------ | | 912| 239k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 128| 239k| object_as_function(obj)->prototypes[i].code = NULL; ------------------ | | 912| 239k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 129| 239k| } 130| 23.9k| break; 131| 66.0k| } 132| | 133| 66.0k| if (obj->identifier == NULL) ------------------ | Branch (133:7): [True: 0, False: 66.0k] ------------------ 134| 0| { 135| 0| yr_free(obj); 136| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 137| 0| } 138| | 139| 66.0k| if (parent != NULL) ------------------ | Branch (139:7): [True: 49.5k, False: 16.5k] ------------------ 140| 49.5k| { 141| 49.5k| assert( ------------------ | Branch (141:5): [True: 49.5k, False: 0] | Branch (141:5): [True: 0, False: 0] | Branch (141:5): [True: 0, False: 0] | Branch (141:5): [True: 0, False: 0] | Branch (141:5): [True: 25.6k, False: 23.9k] | Branch (141:5): [True: 0, False: 23.9k] | Branch (141:5): [True: 0, False: 23.9k] | Branch (141:5): [True: 23.9k, False: 0] ------------------ 142| 49.5k| parent->type == OBJECT_TYPE_STRUCTURE || 143| 49.5k| parent->type == OBJECT_TYPE_ARRAY || 144| 49.5k| parent->type == OBJECT_TYPE_DICTIONARY || 145| 49.5k| parent->type == OBJECT_TYPE_FUNCTION); 146| | 147| | // Objects with a parent take the canary from it. 148| 49.5k| obj->canary = parent->canary; 149| | 150| 49.5k| switch (parent->type) ------------------ | Branch (150:13): [True: 49.5k, False: 0] ------------------ 151| 49.5k| { 152| 25.6k| case OBJECT_TYPE_STRUCTURE: ------------------ | | 60| 25.6k|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (152:5): [True: 25.6k, False: 23.9k] ------------------ 153| 25.6k| FAIL_ON_ERROR_WITH_CLEANUP(yr_object_structure_set_member(parent, obj), { ------------------ | | 142| 25.6k| { \ | | 143| 25.6k| int __error = (x); \ | | 144| 25.6k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 25.6k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 25.6k] | | ------------------ | | 145| 25.6k| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 25.6k| } ------------------ 154| 25.6k| yr_free((void*) obj->identifier); 155| 25.6k| yr_free(obj); 156| 25.6k| }); 157| 25.6k| break; 158| | 159| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (159:5): [True: 0, False: 49.5k] ------------------ 160| 0| object_as_array(parent)->prototype_item = obj; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 161| 0| break; 162| | 163| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (163:5): [True: 0, False: 49.5k] ------------------ 164| 0| object_as_dictionary(parent)->prototype_item = obj; ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 165| 0| break; 166| | 167| 23.9k| case OBJECT_TYPE_FUNCTION: ------------------ | | 62| 23.9k|#define OBJECT_TYPE_FUNCTION 5 ------------------ | Branch (167:5): [True: 23.9k, False: 25.6k] ------------------ 168| 23.9k| object_as_function(parent)->return_obj = obj; ------------------ | | 912| 23.9k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 169| 23.9k| break; 170| 49.5k| } 171| 49.5k| } 172| | 173| 66.0k| if (object != NULL) ------------------ | Branch (173:7): [True: 64.3k, False: 1.70k] ------------------ 174| 64.3k| *object = obj; 175| | 176| 66.0k| return ERROR_SUCCESS; ------------------ | | 40| 66.0k|#define ERROR_SUCCESS 0 ------------------ 177| 66.0k|} yr_object_set_canary: 180| 1.70k|{ 181| 1.70k| object->canary = canary; 182| 1.70k|} yr_object_function_create: 191| 39.3k|{ 192| 39.3k| YR_OBJECT* return_obj; 193| 39.3k| YR_OBJECT* o = NULL; 194| 39.3k| YR_OBJECT_FUNCTION* f = NULL; 195| | 196| 39.3k| int8_t return_type; 197| | 198| | // The parent of a function must be a structure. 199| 39.3k| assert(parent != NULL && parent->type == OBJECT_TYPE_STRUCTURE); ------------------ | Branch (199:3): [True: 0, False: 39.3k] | Branch (199:3): [True: 0, False: 0] | Branch (199:3): [True: 39.3k, False: 0] | Branch (199:3): [True: 39.3k, False: 0] ------------------ 200| | 201| 39.3k| switch (*return_fmt) 202| 39.3k| { 203| 15.3k| case 'i': ------------------ | Branch (203:3): [True: 15.3k, False: 23.9k] ------------------ 204| 15.3k| return_type = OBJECT_TYPE_INTEGER; ------------------ | | 58| 15.3k|#define OBJECT_TYPE_INTEGER 1 ------------------ 205| 15.3k| break; 206| 3.41k| case 's': ------------------ | Branch (206:3): [True: 3.41k, False: 35.8k] ------------------ 207| 3.41k| return_type = OBJECT_TYPE_STRING; ------------------ | | 59| 3.41k|#define OBJECT_TYPE_STRING 2 ------------------ 208| 3.41k| break; 209| 20.5k| case 'f': ------------------ | Branch (209:3): [True: 20.5k, False: 18.7k] ------------------ 210| 20.5k| return_type = OBJECT_TYPE_FLOAT; ------------------ | | 64| 20.5k|#define OBJECT_TYPE_FLOAT 7 ------------------ 211| 20.5k| break; 212| 0| default: ------------------ | Branch (212:3): [True: 0, False: 39.3k] ------------------ 213| 0| return ERROR_INVALID_FORMAT; ------------------ | | 85| 0|#define ERROR_INVALID_FORMAT 38 ------------------ 214| 39.3k| } 215| | 216| | // Try to find if the structure already has a function 217| | // with that name. In that case this is a function overload. 218| 39.3k| f = object_as_function(yr_object_lookup_field(parent, identifier)); ------------------ | | 912| 39.3k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 219| | 220| | // Overloaded functions must have the same return type. 221| 39.3k| if (f != NULL && return_type != f->return_obj->type) ------------------ | Branch (221:7): [True: 15.3k, False: 23.9k] | Branch (221:20): [True: 0, False: 15.3k] ------------------ 222| 0| return ERROR_WRONG_RETURN_TYPE; ------------------ | | 88| 0|#define ERROR_WRONG_RETURN_TYPE 41 ------------------ 223| | 224| 39.3k| if (f == NULL) // Function doesn't exist yet ------------------ | Branch (224:7): [True: 23.9k, False: 15.3k] ------------------ 225| 23.9k| { 226| 23.9k| FAIL_ON_ERROR( ------------------ | | 134| 23.9k| { \ | | 135| 23.9k| int __error = (x); \ | | 136| 23.9k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 23.9k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 23.9k] | | ------------------ | | 137| 23.9k| return __error; \ | | 138| 23.9k| } ------------------ 227| 23.9k| yr_object_create(OBJECT_TYPE_FUNCTION, identifier, parent, &o)); 228| | 229| | // In case of failure while creating return_obj we don't need to free the 230| | // previously created "o" object, as it is already associated with its 231| | // parent and will be destroyed when the parent is destroyed. 232| 23.9k| FAIL_ON_ERROR(yr_object_create(return_type, "result", o, &return_obj)); ------------------ | | 134| 23.9k| { \ | | 135| 23.9k| int __error = (x); \ | | 136| 23.9k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 23.9k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 23.9k] | | ------------------ | | 137| 23.9k| return __error; \ | | 138| 23.9k| } ------------------ 233| | 234| 23.9k| f = object_as_function(o); ------------------ | | 912| 23.9k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 235| 23.9k| } 236| | 237| 54.6k| for (int i = 0; i < YR_MAX_OVERLOADED_FUNCTIONS; i++) ------------------ | | 135| 54.6k|#define YR_MAX_OVERLOADED_FUNCTIONS 10 ------------------ | Branch (237:19): [True: 54.6k, False: 0] ------------------ 238| 54.6k| { 239| 54.6k| if (f->prototypes[i].arguments_fmt == NULL) ------------------ | Branch (239:9): [True: 39.3k, False: 15.3k] ------------------ 240| 39.3k| { 241| 39.3k| f->prototypes[i].arguments_fmt = arguments_fmt; 242| 39.3k| f->prototypes[i].code = code; 243| | 244| 39.3k| break; 245| 39.3k| } 246| 54.6k| } 247| | 248| 39.3k| if (function != NULL) ------------------ | Branch (248:7): [True: 39.3k, False: 0] ------------------ 249| 39.3k| *function = (YR_OBJECT*) f; 250| | 251| 39.3k| return ERROR_SUCCESS; ------------------ | | 40| 39.3k|#define ERROR_SUCCESS 0 ------------------ 252| 39.3k|} yr_object_destroy: 324| 66.0k|{ 325| 66.0k| YR_STRUCTURE_MEMBER* member; 326| 66.0k| YR_STRUCTURE_MEMBER* next_member; 327| 66.0k| YR_ARRAY_ITEMS* array_items; 328| 66.0k| YR_DICTIONARY_ITEMS* dict_items; 329| | 330| 66.0k| if (object == NULL) ------------------ | Branch (330:7): [True: 0, False: 66.0k] ------------------ 331| 0| return; 332| | 333| 66.0k| switch (object->type) ------------------ | Branch (333:11): [True: 27.3k, False: 38.7k] ------------------ 334| 66.0k| { 335| 1.70k| case OBJECT_TYPE_STRUCTURE: ------------------ | | 60| 1.70k|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (335:3): [True: 1.70k, False: 64.3k] ------------------ 336| 1.70k| member = object_as_structure(object)->members; ------------------ | | 909| 1.70k|#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj)) ------------------ 337| | 338| 27.3k| while (member != NULL) ------------------ | Branch (338:12): [True: 25.6k, False: 1.70k] ------------------ 339| 25.6k| { 340| 25.6k| next_member = member->next; 341| 25.6k| yr_object_destroy(member->object); 342| 25.6k| yr_free(member); 343| 25.6k| member = next_member; 344| 25.6k| } 345| 1.70k| break; 346| | 347| 1.70k| case OBJECT_TYPE_STRING: ------------------ | | 59| 1.70k|#define OBJECT_TYPE_STRING 2 ------------------ | Branch (347:3): [True: 1.70k, False: 64.3k] ------------------ 348| 1.70k| if (object->value.ss != NULL) ------------------ | Branch (348:9): [True: 0, False: 1.70k] ------------------ 349| 0| yr_free(object->value.ss); 350| 1.70k| break; 351| | 352| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (352:3): [True: 0, False: 66.0k] ------------------ 353| 0| if (object_as_array(object)->prototype_item != NULL) ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ | Branch (353:9): [True: 0, False: 0] ------------------ 354| 0| yr_object_destroy(object_as_array(object)->prototype_item); ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 355| | 356| 0| array_items = object_as_array(object)->items; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 357| | 358| 0| if (array_items != NULL) ------------------ | Branch (358:9): [True: 0, False: 0] ------------------ 359| 0| { 360| 0| for (int i = 0; i < array_items->length; i++) ------------------ | Branch (360:23): [True: 0, False: 0] ------------------ 361| 0| if (array_items->objects[i] != NULL) ------------------ | Branch (361:13): [True: 0, False: 0] ------------------ 362| 0| yr_object_destroy(array_items->objects[i]); 363| 0| } 364| | 365| 0| yr_free(array_items); 366| 0| break; 367| | 368| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (368:3): [True: 0, False: 66.0k] ------------------ 369| 0| if (object_as_dictionary(object)->prototype_item != NULL) ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ | Branch (369:9): [True: 0, False: 0] ------------------ 370| 0| yr_object_destroy(object_as_dictionary(object)->prototype_item); ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 371| | 372| 0| dict_items = object_as_dictionary(object)->items; ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 373| | 374| 0| if (dict_items != NULL) ------------------ | Branch (374:9): [True: 0, False: 0] ------------------ 375| 0| { 376| 0| for (int i = 0; i < dict_items->used; i++) ------------------ | Branch (376:23): [True: 0, False: 0] ------------------ 377| 0| { 378| 0| if (dict_items->objects[i].key != NULL) ------------------ | Branch (378:13): [True: 0, False: 0] ------------------ 379| 0| yr_free(dict_items->objects[i].key); 380| | 381| 0| if (dict_items->objects[i].obj != NULL) ------------------ | Branch (381:13): [True: 0, False: 0] ------------------ 382| 0| yr_object_destroy(dict_items->objects[i].obj); 383| 0| } 384| 0| } 385| | 386| 0| yr_free(dict_items); 387| 0| break; 388| | 389| 23.9k| case OBJECT_TYPE_FUNCTION: ------------------ | | 62| 23.9k|#define OBJECT_TYPE_FUNCTION 5 ------------------ | Branch (389:3): [True: 23.9k, False: 42.1k] ------------------ 390| 23.9k| yr_object_destroy(object_as_function(object)->return_obj); ------------------ | | 912| 23.9k|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 391| 23.9k| break; 392| 66.0k| } 393| | 394| 66.0k| yr_free((void*) object->identifier); 395| 66.0k| yr_free(object); 396| 66.0k|} yr_object_lookup_field: 399| 81.4k|{ 400| 81.4k| YR_STRUCTURE_MEMBER* member; 401| | 402| 81.4k| assert(object != NULL); ------------------ | Branch (402:3): [True: 0, False: 81.4k] | Branch (402:3): [True: 81.4k, False: 0] ------------------ 403| 81.4k| assert(object->type == OBJECT_TYPE_STRUCTURE); ------------------ | Branch (403:3): [True: 0, False: 81.4k] | Branch (403:3): [True: 81.4k, False: 0] ------------------ 404| | 405| 81.4k| member = object_as_structure(object)->members; ------------------ | | 909| 81.4k|#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj)) ------------------ 406| | 407| 577k| while (member != NULL) ------------------ | Branch (407:10): [True: 527k, False: 49.5k] ------------------ 408| 527k| { 409| 527k| if (strcmp(member->object->identifier, field_name) == 0) ------------------ | Branch (409:9): [True: 31.9k, False: 495k] ------------------ 410| 31.9k| return member->object; 411| | 412| 495k| member = member->next; 413| 495k| } 414| | 415| 49.5k| return NULL; 416| 81.4k|} yr_object_copy: 540| 14.7k|{ 541| 14.7k| YR_OBJECT* copy; 542| 14.7k| YR_OBJECT* o; 543| | 544| 14.7k| YR_STRUCTURE_MEMBER* structure_member; 545| | 546| 14.7k| *object_copy = NULL; 547| | 548| 14.7k| FAIL_ON_ERROR( ------------------ | | 134| 14.7k| { \ | | 135| 14.7k| int __error = (x); \ | | 136| 14.7k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 14.7k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 14.7k] | | ------------------ | | 137| 14.7k| return __error; \ | | 138| 14.7k| } ------------------ 549| 14.7k| yr_object_create(object->type, object->identifier, NULL, ©)); 550| | 551| 14.7k| copy->canary = object->canary; 552| | 553| 14.7k| switch (object->type) 554| 14.7k| { 555| 4.77k| case OBJECT_TYPE_INTEGER: ------------------ | | 58| 4.77k|#define OBJECT_TYPE_INTEGER 1 ------------------ | Branch (555:3): [True: 4.77k, False: 10.0k] ------------------ 556| 4.77k| copy->value.i = object->value.i; 557| 4.77k| break; 558| | 559| 10.0k| case OBJECT_TYPE_FLOAT: ------------------ | | 64| 10.0k|#define OBJECT_TYPE_FLOAT 7 ------------------ | Branch (559:3): [True: 10.0k, False: 4.77k] ------------------ 560| 10.0k| copy->value.d = object->value.d; 561| 10.0k| break; 562| | 563| 0| case OBJECT_TYPE_STRING: ------------------ | | 59| 0|#define OBJECT_TYPE_STRING 2 ------------------ | Branch (563:3): [True: 0, False: 14.7k] ------------------ 564| | 565| 0| if (object->value.ss != NULL) ------------------ | Branch (565:9): [True: 0, False: 0] ------------------ 566| 0| copy->value.ss = ss_dup(object->value.ss); 567| 0| else 568| 0| copy->value.ss = NULL; 569| | 570| 0| break; 571| | 572| 0| case OBJECT_TYPE_FUNCTION: ------------------ | | 62| 0|#define OBJECT_TYPE_FUNCTION 5 ------------------ | Branch (572:3): [True: 0, False: 14.7k] ------------------ 573| | 574| 0| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 575| 0| yr_object_copy( 576| 0| object_as_function(object)->return_obj, 577| 0| &object_as_function(copy)->return_obj), 578| | // cleanup 579| 0| yr_object_destroy(copy)); 580| | 581| 0| for (int i = 0; i < YR_MAX_OVERLOADED_FUNCTIONS; i++) ------------------ | | 135| 0|#define YR_MAX_OVERLOADED_FUNCTIONS 10 ------------------ | Branch (581:21): [True: 0, False: 0] ------------------ 582| 0| object_as_function(copy)->prototypes[i] = ------------------ | | 912| 0|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 583| 0| object_as_function(object)->prototypes[i]; ------------------ | | 912| 0|#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj)) ------------------ 584| | 585| 0| break; 586| | 587| 0| case OBJECT_TYPE_STRUCTURE: ------------------ | | 60| 0|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (587:3): [True: 0, False: 14.7k] ------------------ 588| | 589| 0| structure_member = object_as_structure(object)->members; ------------------ | | 909| 0|#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj)) ------------------ 590| | 591| 0| while (structure_member != NULL) ------------------ | Branch (591:12): [True: 0, False: 0] ------------------ 592| 0| { 593| 0| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 594| 0| yr_object_copy(structure_member->object, &o), 595| 0| yr_object_destroy(copy)); 596| | 597| 0| FAIL_ON_ERROR_WITH_CLEANUP(yr_object_structure_set_member(copy, o), ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 598| | // cleanup 599| 0| yr_free(o); 600| 0| yr_object_destroy(copy)); 601| | 602| 0| structure_member = structure_member->next; 603| 0| } 604| | 605| 0| break; 606| | 607| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (607:3): [True: 0, False: 14.7k] ------------------ 608| | 609| 0| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 610| 0| yr_object_copy(object_as_array(object)->prototype_item, &o), 611| 0| yr_object_destroy(copy)); 612| | 613| 0| object_as_array(copy)->prototype_item = o; ------------------ | | 910| 0|#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj)) ------------------ 614| | 615| 0| break; 616| | 617| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (617:3): [True: 0, False: 14.7k] ------------------ 618| | 619| 0| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 620| 0| yr_object_copy(object_as_dictionary(object)->prototype_item, &o), 621| 0| yr_object_destroy(copy)); 622| | 623| 0| object_as_dictionary(copy)->prototype_item = o; ------------------ | | 911| 0|#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj)) ------------------ 624| | 625| 0| break; 626| | 627| 0| default: ------------------ | Branch (627:3): [True: 0, False: 14.7k] ------------------ 628| 0| assert(false); ------------------ | Branch (628:5): [Folded, False: 0] | Branch (628:5): [Folded, False: 0] ------------------ 629| 14.7k| } 630| | 631| 14.7k| *object_copy = copy; 632| | 633| 14.7k| return ERROR_SUCCESS; ------------------ | | 40| 14.7k|#define ERROR_SUCCESS 0 ------------------ 634| 14.7k|} yr_object_structure_set_member: 637| 25.6k|{ 638| 25.6k| YR_STRUCTURE_MEMBER* sm; 639| | 640| 25.6k| assert(object->type == OBJECT_TYPE_STRUCTURE); ------------------ | Branch (640:3): [True: 0, False: 25.6k] | Branch (640:3): [True: 25.6k, False: 0] ------------------ 641| | 642| | // Check if the object already have a member with the same identifier 643| | 644| 25.6k| if (yr_object_lookup_field(object, member->identifier) != NULL) ------------------ | Branch (644:7): [True: 0, False: 25.6k] ------------------ 645| 0| return ERROR_DUPLICATED_STRUCTURE_MEMBER; ------------------ | | 89| 0|#define ERROR_DUPLICATED_STRUCTURE_MEMBER 42 ------------------ 646| | 647| 25.6k| sm = (YR_STRUCTURE_MEMBER*) yr_malloc(sizeof(YR_STRUCTURE_MEMBER)); 648| | 649| 25.6k| if (sm == NULL) ------------------ | Branch (649:7): [True: 0, False: 25.6k] ------------------ 650| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 651| | 652| 25.6k| member->parent = object; 653| 25.6k| sm->object = member; 654| 25.6k| sm->next = object_as_structure(object)->members; ------------------ | | 909| 25.6k|#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj)) ------------------ 655| | 656| 25.6k| object_as_structure(object)->members = sm; ------------------ | | 909| 25.6k|#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj)) ------------------ 657| | 658| 25.6k| return ERROR_SUCCESS; ------------------ | | 40| 25.6k|#define ERROR_SUCCESS 0 ------------------ 659| 25.6k|} yr_object_set_integer: 953| 4.77k|{ 954| 4.77k| YR_OBJECT* integer_obj; 955| | 956| 4.77k| va_list args; 957| 4.77k| va_start(args, field); 958| | 959| 4.77k| if (field != NULL) ------------------ | Branch (959:7): [True: 0, False: 4.77k] ------------------ 960| 0| integer_obj = _yr_object_lookup(object, OBJECT_CREATE, field, args); ------------------ | | 56| 0|#define OBJECT_CREATE 1 ------------------ 961| 4.77k| else 962| 4.77k| integer_obj = object; 963| | 964| 4.77k| va_end(args); 965| | 966| 4.77k| if (integer_obj == NULL) ------------------ | Branch (966:7): [True: 0, False: 4.77k] ------------------ 967| 0| { 968| 0| if (field != NULL) ------------------ | Branch (968:9): [True: 0, False: 0] ------------------ 969| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 970| 0| else 971| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 972| 0| } 973| | 974| 4.77k| assert(integer_obj->type == OBJECT_TYPE_INTEGER); ------------------ | Branch (974:3): [True: 0, False: 4.77k] | Branch (974:3): [True: 4.77k, False: 0] ------------------ 975| | 976| 4.77k| integer_obj->value.i = value; 977| | 978| 4.77k| return ERROR_SUCCESS; ------------------ | | 40| 4.77k|#define ERROR_SUCCESS 0 ------------------ 979| 4.77k|} yr_object_set_float: 982| 11.7k|{ 983| 11.7k| YR_OBJECT* double_obj; 984| | 985| 11.7k| va_list args; 986| 11.7k| va_start(args, field); 987| | 988| 11.7k| if (field != NULL) ------------------ | Branch (988:7): [True: 1.70k, False: 10.0k] ------------------ 989| 1.70k| double_obj = _yr_object_lookup(object, OBJECT_CREATE, field, args); ------------------ | | 56| 1.70k|#define OBJECT_CREATE 1 ------------------ 990| 10.0k| else 991| 10.0k| double_obj = object; 992| | 993| 11.7k| va_end(args); 994| | 995| 11.7k| if (double_obj == NULL) ------------------ | Branch (995:7): [True: 0, False: 11.7k] ------------------ 996| 0| { 997| 0| if (field != NULL) ------------------ | Branch (997:9): [True: 0, False: 0] ------------------ 998| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 999| 0| else 1000| 0| return ERROR_INVALID_ARGUMENT; ------------------ | | 76| 0|#define ERROR_INVALID_ARGUMENT 29 ------------------ 1001| 0| } 1002| | 1003| 11.7k| assert(double_obj->type == OBJECT_TYPE_FLOAT); ------------------ | Branch (1003:3): [True: 0, False: 11.7k] | Branch (1003:3): [True: 11.7k, False: 0] ------------------ 1004| | 1005| 11.7k| double_obj->value.d = value; 1006| | 1007| 11.7k| return ERROR_SUCCESS; ------------------ | | 40| 11.7k|#define ERROR_SUCCESS 0 ------------------ 1008| 11.7k|} object.c:_yr_object_lookup: 423| 1.70k|{ 424| 1.70k| YR_OBJECT* obj = object; 425| | 426| 1.70k| const char* p = pattern; 427| 1.70k| const char* key = NULL; 428| | 429| 1.70k| char str[256]; 430| | 431| 1.70k| int i; 432| 1.70k| int index = -1; 433| | 434| 1.70k| while (obj != NULL) ------------------ | Branch (434:10): [True: 1.70k, False: 0] ------------------ 435| 1.70k| { 436| 1.70k| i = 0; 437| | 438| 18.7k| while (*p != '\0' && *p != '.' && *p != '[' && i < sizeof(str) - 1) ------------------ | Branch (438:12): [True: 17.0k, False: 1.70k] | Branch (438:26): [True: 17.0k, False: 0] | Branch (438:39): [True: 17.0k, False: 0] | Branch (438:52): [True: 17.0k, False: 0] ------------------ 439| 17.0k| { 440| 17.0k| str[i++] = *p++; 441| 17.0k| } 442| | 443| 1.70k| str[i] = '\0'; 444| | 445| 1.70k| if (obj->type != OBJECT_TYPE_STRUCTURE) ------------------ | | 60| 1.70k|#define OBJECT_TYPE_STRUCTURE 3 ------------------ | Branch (445:9): [True: 0, False: 1.70k] ------------------ 446| 0| return NULL; 447| | 448| 1.70k| obj = yr_object_lookup_field(obj, str); 449| | 450| 1.70k| if (obj == NULL) ------------------ | Branch (450:9): [True: 0, False: 1.70k] ------------------ 451| 0| return NULL; 452| | 453| 1.70k| if (*p == '[') ------------------ | Branch (453:9): [True: 0, False: 1.70k] ------------------ 454| 0| { 455| 0| p++; 456| | 457| 0| if (*p == '%') ------------------ | Branch (457:11): [True: 0, False: 0] ------------------ 458| 0| { 459| 0| p++; 460| | 461| 0| switch (*p++) 462| 0| { 463| 0| case 'i': ------------------ | Branch (463:9): [True: 0, False: 0] ------------------ 464| 0| index = va_arg(args, int); 465| 0| break; 466| 0| case 's': ------------------ | Branch (466:9): [True: 0, False: 0] ------------------ 467| 0| key = va_arg(args, const char*); 468| 0| break; 469| | 470| 0| default: ------------------ | Branch (470:9): [True: 0, False: 0] ------------------ 471| 0| return NULL; 472| 0| } 473| 0| } 474| 0| else if (*p >= '0' && *p <= '9') ------------------ | Branch (474:16): [True: 0, False: 0] | Branch (474:29): [True: 0, False: 0] ------------------ 475| 0| { 476| 0| index = (int) strtol(p, (char**) &p, 10); 477| 0| } 478| 0| else if (*p == '"') ------------------ | Branch (478:16): [True: 0, False: 0] ------------------ 479| 0| { 480| 0| i = 0; 481| 0| p++; // skip the opening quotation mark 482| | 483| 0| while (*p != '"' && *p != '\0' && i < sizeof(str) - 1) str[i++] = *p++; ------------------ | Branch (483:16): [True: 0, False: 0] | Branch (483:29): [True: 0, False: 0] | Branch (483:43): [True: 0, False: 0] ------------------ 484| | 485| 0| str[i] = '\0'; 486| 0| p++; // skip the closing quotation mark 487| 0| key = str; 488| 0| } 489| 0| else 490| 0| { 491| 0| return NULL; 492| 0| } 493| | 494| 0| assert(*p == ']'); ------------------ | Branch (494:7): [True: 0, False: 0] | Branch (494:7): [True: 0, False: 0] ------------------ 495| 0| p++; 496| 0| assert(*p == '.' || *p == '\0'); ------------------ | Branch (496:7): [True: 0, False: 0] | Branch (496:7): [True: 0, False: 0] | Branch (496:7): [True: 0, False: 0] | Branch (496:7): [True: 0, False: 0] ------------------ 497| | 498| 0| switch (obj->type) ------------------ | Branch (498:15): [True: 0, False: 0] ------------------ 499| 0| { 500| 0| case OBJECT_TYPE_ARRAY: ------------------ | | 61| 0|#define OBJECT_TYPE_ARRAY 4 ------------------ | Branch (500:7): [True: 0, False: 0] ------------------ 501| 0| assert(index != -1); ------------------ | Branch (501:9): [True: 0, False: 0] | Branch (501:9): [True: 0, False: 0] ------------------ 502| 0| obj = yr_object_array_get_item(obj, flags, index); 503| 0| break; 504| | 505| 0| case OBJECT_TYPE_DICTIONARY: ------------------ | | 63| 0|#define OBJECT_TYPE_DICTIONARY 6 ------------------ | Branch (505:7): [True: 0, False: 0] ------------------ 506| 0| assert(key != NULL); ------------------ | Branch (506:9): [True: 0, False: 0] | Branch (506:9): [True: 0, False: 0] ------------------ 507| 0| obj = yr_object_dict_get_item(obj, flags, key); 508| 0| break; 509| 0| } 510| 0| } 511| | 512| 1.70k| if (*p == '\0') ------------------ | Branch (512:9): [True: 1.70k, False: 0] ------------------ 513| 1.70k| break; 514| | 515| 0| p++; 516| 0| } 517| | 518| 1.70k| return obj; 519| 1.70k|} yr_parser_emit: 57| 70|{ 58| 70| return yr_arena_write_data( 59| 70| yyget_extra(yyscanner)->arena, ------------------ | | 54| 70|#define yyget_extra yara_yyget_extra ------------------ 60| 70| YR_CODE_SECTION, ------------------ | | 63| 70|#define YR_CODE_SECTION 6 ------------------ 61| 70| &instruction, 62| 70| sizeof(uint8_t), 63| 70| instruction_ref); 64| 70|} yr_parser_emit_with_arg_double: 72| 2|{ 73| 2| int result = yr_arena_write_data( 74| 2| yyget_extra(yyscanner)->arena, ------------------ | | 54| 2|#define yyget_extra yara_yyget_extra ------------------ 75| 2| YR_CODE_SECTION, ------------------ | | 63| 2|#define YR_CODE_SECTION 6 ------------------ 76| 2| &instruction, 77| 2| sizeof(uint8_t), 78| 2| instruction_ref); 79| | 80| 2| if (result == ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (80:7): [True: 2, False: 0] ------------------ 81| 2| result = yr_arena_write_data( 82| 2| yyget_extra(yyscanner)->arena, ------------------ | | 54| 2|#define yyget_extra yara_yyget_extra ------------------ 83| 2| YR_CODE_SECTION, ------------------ | | 63| 2|#define YR_CODE_SECTION 6 ------------------ 84| 2| &argument, 85| 2| sizeof(double), 86| 2| argument_ref); 87| | 88| 2| return result; 89| 2|} yr_parser_emit_with_arg_int32: 97| 18|{ 98| 18| int result = yr_arena_write_data( 99| 18| yyget_extra(yyscanner)->arena, ------------------ | | 54| 18|#define yyget_extra yara_yyget_extra ------------------ 100| 18| YR_CODE_SECTION, ------------------ | | 63| 18|#define YR_CODE_SECTION 6 ------------------ 101| 18| &instruction, 102| 18| sizeof(uint8_t), 103| 18| instruction_ref); 104| | 105| 18| if (result == ERROR_SUCCESS) ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ | Branch (105:7): [True: 18, False: 0] ------------------ 106| 18| result = yr_arena_write_data( 107| 18| yyget_extra(yyscanner)->arena, ------------------ | | 54| 18|#define yyget_extra yara_yyget_extra ------------------ 108| 18| YR_CODE_SECTION, ------------------ | | 63| 18|#define YR_CODE_SECTION 6 ------------------ 109| 18| &argument, 110| 18| sizeof(int32_t), 111| 18| argument_ref); 112| | 113| 18| return result; 114| 18|} yr_parser_emit_with_arg: 122| 14|{ 123| 14| int result = yr_arena_write_data( 124| 14| yyget_extra(yyscanner)->arena, ------------------ | | 54| 14|#define yyget_extra yara_yyget_extra ------------------ 125| 14| YR_CODE_SECTION, ------------------ | | 63| 14|#define YR_CODE_SECTION 6 ------------------ 126| 14| &instruction, 127| 14| sizeof(uint8_t), 128| 14| instruction_ref); 129| | 130| 14| if (result == ERROR_SUCCESS) ------------------ | | 40| 14|#define ERROR_SUCCESS 0 ------------------ | Branch (130:7): [True: 14, False: 0] ------------------ 131| 14| result = yr_arena_write_data( 132| 14| yyget_extra(yyscanner)->arena, ------------------ | | 54| 14|#define yyget_extra yara_yyget_extra ------------------ 133| 14| YR_CODE_SECTION, ------------------ | | 63| 14|#define YR_CODE_SECTION 6 ------------------ 134| 14| &argument, 135| 14| sizeof(int64_t), 136| 14| argument_ref); 137| | 138| 14| return result; 139| 14|} yr_parser_emit_with_arg_reloc: 147| 56|{ 148| 56| YR_ARENA_REF ref = YR_ARENA_NULL_REF; ------------------ | | 43| 56| (YR_ARENA_REF) \ | | 44| 56| { \ | | 45| 56| UINT32_MAX, UINT32_MAX \ | | 46| 56| } ------------------ 149| | 150| 56| DECLARE_REFERENCE(void*, ptr) arg; ------------------ | | 45| 56| union \ | | 46| 56| { \ | | 47| 56| type name; \ | | 48| 56| YR_ARENA_REF name##_; \ | | 49| 56| } YR_ALIGN(8) ------------------ 151| | 152| 56| memset(&arg, 0, sizeof(arg)); 153| 56| arg.ptr = argument; 154| | 155| 56| int result = yr_arena_write_data( 156| 56| yyget_extra(yyscanner)->arena, ------------------ | | 54| 56|#define yyget_extra yara_yyget_extra ------------------ 157| 56| YR_CODE_SECTION, ------------------ | | 63| 56|#define YR_CODE_SECTION 6 ------------------ 158| 56| &instruction, 159| 56| sizeof(uint8_t), 160| 56| instruction_ref); 161| | 162| 56| if (result == ERROR_SUCCESS) ------------------ | | 40| 56|#define ERROR_SUCCESS 0 ------------------ | Branch (162:7): [True: 56, False: 0] ------------------ 163| 56| result = yr_arena_write_data( 164| 56| yyget_extra(yyscanner)->arena, ------------------ | | 54| 56|#define yyget_extra yara_yyget_extra ------------------ 165| 56| YR_CODE_SECTION, ------------------ | | 63| 56|#define YR_CODE_SECTION 6 ------------------ 166| 56| &arg, 167| 56| sizeof(arg), 168| 56| &ref); 169| | 170| 56| if (result == ERROR_SUCCESS) ------------------ | | 40| 56|#define ERROR_SUCCESS 0 ------------------ | Branch (170:7): [True: 56, False: 0] ------------------ 171| 56| result = yr_arena_make_ptr_relocatable( 172| 56| yyget_extra(yyscanner)->arena, YR_CODE_SECTION, ref.offset, EOL); ------------------ | | 54| 56|#define yyget_extra yara_yyget_extra ------------------ yyget_extra(yyscanner)->arena, YR_CODE_SECTION, ref.offset, EOL); ------------------ | | 63| 56|#define YR_CODE_SECTION 6 ------------------ yyget_extra(yyscanner)->arena, YR_CODE_SECTION, ref.offset, EOL); ------------------ | | 38| 56|#define EOL ((size_t) -1) ------------------ 173| | 174| 56| if (argument_ref != NULL) ------------------ | Branch (174:7): [True: 0, False: 56] ------------------ 175| 0| *argument_ref = ref; 176| | 177| 56| return result; 178| 56|} yr_parser_emit_push_const: 309| 40|{ 310| 40| uint8_t opcode[9]; 311| 40| int opcode_len = 1; 312| | 313| 40| if (argument == YR_UNDEFINED) ------------------ | | 38| 40|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ | Branch (313:7): [True: 0, False: 40] ------------------ 314| 0| { 315| 0| opcode[0] = OP_PUSH_U; ------------------ | | 114| 0|#define OP_PUSH_U 66 ------------------ 316| 0| } 317| 40| else if (argument <= 0xff) ------------------ | Branch (317:12): [True: 40, False: 0] ------------------ 318| 40| { 319| 40| opcode[0] = OP_PUSH_8; ------------------ | | 111| 40|#define OP_PUSH_8 63 ------------------ 320| 40| opcode[1] = (uint8_t) argument; 321| 40| opcode_len += sizeof(uint8_t); 322| 40| } 323| 0| else if (argument <= 0xffff) ------------------ | Branch (323:12): [True: 0, False: 0] ------------------ 324| 0| { 325| 0| opcode[0] = OP_PUSH_16; ------------------ | | 112| 0|#define OP_PUSH_16 64 ------------------ 326| 0| uint16_t u = (uint16_t) argument; 327| 0| memcpy(opcode + 1, &u, sizeof(uint16_t)); 328| 0| opcode_len += sizeof(uint16_t); 329| 0| } 330| 0| else if (argument <= 0xffffffff) ------------------ | Branch (330:12): [True: 0, False: 0] ------------------ 331| 0| { 332| 0| opcode[0] = OP_PUSH_32; ------------------ | | 113| 0|#define OP_PUSH_32 65 ------------------ 333| 0| uint32_t u = (uint32_t) argument; 334| 0| memcpy(opcode + 1, &u, sizeof(uint32_t)); 335| 0| opcode_len += sizeof(uint32_t); 336| 0| } 337| 0| else 338| 0| { 339| 0| opcode[0] = OP_PUSH; ------------------ | | 61| 0|#define OP_PUSH 13 ------------------ 340| 0| memcpy(opcode + 1, &argument, sizeof(uint64_t)); 341| 0| opcode_len += sizeof(uint64_t); 342| 0| } 343| | 344| 40| return yr_arena_write_data( 345| 40| yyget_extra(yyscanner)->arena, YR_CODE_SECTION, opcode, opcode_len, NULL); ------------------ | | 54| 40|#define yyget_extra yara_yyget_extra ------------------ yyget_extra(yyscanner)->arena, YR_CODE_SECTION, opcode, opcode_len, NULL); ------------------ | | 63| 40|#define YR_CODE_SECTION 6 ------------------ 346| 40|} yr_parser_check_types: 352| 18|{ 353| 18| int i; 354| | 355| 18| for (i = 0; i < YR_MAX_OVERLOADED_FUNCTIONS; i++) ------------------ | | 135| 18|#define YR_MAX_OVERLOADED_FUNCTIONS 10 ------------------ | Branch (355:15): [True: 18, False: 0] ------------------ 356| 18| { 357| 18| if (function->prototypes[i].arguments_fmt == NULL) ------------------ | Branch (357:9): [True: 0, False: 18] ------------------ 358| 0| break; 359| | 360| 18| if (strcmp(function->prototypes[i].arguments_fmt, actual_args_fmt) == 0) ------------------ | Branch (360:9): [True: 18, False: 0] ------------------ 361| 18| return ERROR_SUCCESS; ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ 362| 18| } 363| | 364| 0| yr_compiler_set_error_extra_info(compiler, function->identifier) ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 365| | 366| 0| return ERROR_WRONG_ARGUMENTS; ------------------ | | 87| 0|#define ERROR_WRONG_ARGUMENTS 40 ------------------ 367| 18|} yr_parser_lookup_loop_variable: 419| 18|{ 420| 18| YR_COMPILER* compiler = yyget_extra(yyscanner); ------------------ | | 54| 18|#define yyget_extra yara_yyget_extra ------------------ 421| 18| int i, j; 422| 18| int var_offset = 0; 423| | 424| 18| for (i = 0; i <= compiler->loop_index; i++) ------------------ | Branch (424:15): [True: 0, False: 18] ------------------ 425| 0| { 426| 0| var_offset += compiler->loop[i].vars_internal_count; 427| | 428| 0| for (j = 0; j < compiler->loop[i].vars_count; j++) ------------------ | Branch (428:17): [True: 0, False: 0] ------------------ 429| 0| { 430| 0| if (compiler->loop[i].vars[j].identifier.ptr != NULL && ------------------ | Branch (430:11): [True: 0, False: 0] ------------------ 431| 0| strcmp(identifier, compiler->loop[i].vars[j].identifier.ptr) == 0) ------------------ | Branch (431:11): [True: 0, False: 0] ------------------ 432| 0| { 433| 0| if (expr != NULL) ------------------ | Branch (433:13): [True: 0, False: 0] ------------------ 434| 0| *expr = compiler->loop[i].vars[j]; 435| | 436| 0| return var_offset + j; 437| 0| } 438| 0| } 439| | 440| 0| var_offset += compiler->loop[i].vars_count; 441| 0| } 442| | 443| 18| return -1; 444| 18|} yr_parser_reduce_rule_declaration_phase_1: 987| 2|{ 988| 2| int result; 989| 2| YR_FIXUP* fixup; 990| 2| YR_COMPILER* compiler = yyget_extra(yyscanner); ------------------ | | 54| 2|#define yyget_extra yara_yyget_extra ------------------ 991| | 992| 2| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 993| 2| compiler->arena, 994| 2| YR_NAMESPACES_TABLE, ------------------ | | 57| 2|#define YR_NAMESPACES_TABLE 0 ------------------ 995| 2| compiler->current_namespace_idx * sizeof(struct YR_NAMESPACE)); 996| | 997| 2| if (yr_hash_table_lookup_uint32( ------------------ | Branch (997:7): [True: 0, False: 2] ------------------ 998| 2| compiler->rules_table, identifier, ns->name) != UINT32_MAX || 999| 2| yr_hash_table_lookup(compiler->objects_table, identifier, NULL) != NULL) ------------------ | Branch (999:7): [True: 0, False: 2] ------------------ 1000| 0| { 1001| | // A rule or variable with the same identifier already exists, return the 1002| | // appropriate error. 1003| | 1004| 0| yr_compiler_set_error_extra_info(compiler, identifier); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1005| 0| return ERROR_DUPLICATED_IDENTIFIER; ------------------ | | 59| 0|#define ERROR_DUPLICATED_IDENTIFIER 14 ------------------ 1006| 0| } 1007| | 1008| | // Iterate over all identifiers in wildcard_identifiers_table, and check if 1009| | // any of them are a prefix of the identifier being declared. If so, return 1010| | // ERROR_IDENTIFIER_MATCHES_WILDCARD. 1011| 2| result = yr_hash_table_iterate( 1012| 2| compiler->wildcard_identifiers_table, 1013| 2| ns->name, 1014| 2| wildcard_iterator, 1015| 2| (void*) identifier); 1016| | 1017| 2| if (result == ERROR_IDENTIFIER_MATCHES_WILDCARD) ------------------ | | 110| 2|#define ERROR_IDENTIFIER_MATCHES_WILDCARD 63 ------------------ | Branch (1017:7): [True: 0, False: 2] ------------------ 1018| 0| { 1019| | // This rule matches an existing wildcard rule set. 1020| 0| yr_compiler_set_error_extra_info(compiler, identifier); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1021| 0| } 1022| | 1023| 2| FAIL_ON_ERROR(result); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1024| | 1025| 2| FAIL_ON_ERROR(yr_arena_allocate_struct( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1026| 2| compiler->arena, 1027| 2| YR_RULES_TABLE, 1028| 2| sizeof(YR_RULE), 1029| 2| rule_ref, 1030| 2| offsetof(YR_RULE, identifier), 1031| 2| offsetof(YR_RULE, tags), 1032| 2| offsetof(YR_RULE, strings), 1033| 2| offsetof(YR_RULE, metas), 1034| 2| offsetof(YR_RULE, ns), 1035| 2| EOL)); 1036| | 1037| 2| YR_RULE* rule = (YR_RULE*) yr_arena_ref_to_ptr(compiler->arena, rule_ref); 1038| | 1039| 2| YR_ARENA_REF ref; 1040| | 1041| 2| FAIL_ON_ERROR(_yr_compiler_store_string(compiler, identifier, &ref)); ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1042| | 1043| 2| rule->identifier = (const char*) yr_arena_ref_to_ptr(compiler->arena, &ref); 1044| 2| rule->flags = flags; 1045| 2| rule->ns = ns; 1046| 2| rule->num_atoms = 0; 1047| | 1048| 2| YR_ARENA_REF jmp_offset_ref; 1049| | 1050| | // We are starting to parse a new rule, set current_rule_idx accordingly. 1051| 2| compiler->current_rule_idx = compiler->next_rule_idx; 1052| 2| compiler->next_rule_idx++; 1053| | 1054| | // The OP_INIT_RULE instruction behaves like a jump. When the rule is 1055| | // disabled it skips over the rule's code and go straight to the next rule's 1056| | // code. The jmp_offset_ref variable points to the jump's offset. The offset 1057| | // is set to 0 as we don't know the jump target yet. When we finish 1058| | // generating the rule's code in yr_parser_reduce_rule_declaration_phase_2 1059| | // the jump offset is set to its final value. 1060| | 1061| 2| FAIL_ON_ERROR(yr_parser_emit_with_arg_int32( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1062| 2| yyscanner, OP_INIT_RULE, 0, NULL, &jmp_offset_ref)); 1063| | 1064| 2| FAIL_ON_ERROR(yr_arena_write_data( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1065| 2| compiler->arena, 1066| 2| YR_CODE_SECTION, 1067| 2| &compiler->current_rule_idx, 1068| 2| sizeof(compiler->current_rule_idx), 1069| 2| NULL)); 1070| | 1071| | // Create a fixup entry for the jump and push it in the stack 1072| 2| fixup = (YR_FIXUP*) yr_malloc(sizeof(YR_FIXUP)); 1073| | 1074| 2| if (fixup == NULL) ------------------ | Branch (1074:7): [True: 0, False: 2] ------------------ 1075| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 1076| | 1077| 2| fixup->ref = jmp_offset_ref; 1078| 2| fixup->next = compiler->fixup_stack_head; 1079| 2| compiler->fixup_stack_head = fixup; 1080| | 1081| | // Clean strings_table as we are starting to parse a new rule. 1082| 2| yr_hash_table_clean(compiler->strings_table, NULL); 1083| | 1084| 2| FAIL_ON_ERROR(yr_hash_table_add_uint32( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1085| 2| compiler->rules_table, identifier, ns->name, compiler->current_rule_idx)); 1086| | 1087| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 1088| 2|} yr_parser_reduce_rule_declaration_phase_2: 1093| 2|{ 1094| 2| uint32_t max_strings_per_rule; 1095| 2| uint32_t strings_in_rule = 0; 1096| | 1097| 2| YR_FIXUP* fixup; 1098| 2| YR_STRING* string; 1099| 2| YR_COMPILER* compiler = yyget_extra(yyscanner); ------------------ | | 54| 2|#define yyget_extra yara_yyget_extra ------------------ 1100| | 1101| 2| yr_get_configuration_uint32( 1102| 2| YR_CONFIG_MAX_STRINGS_PER_RULE, &max_strings_per_rule); 1103| | 1104| 2| YR_RULE* rule = (YR_RULE*) yr_arena_ref_to_ptr(compiler->arena, rule_ref); 1105| | 1106| | // Show warning if the rule is generating too many atoms. The warning is 1107| | // shown if the number of atoms is greater than 20 times the maximum number 1108| | // of strings allowed for a rule, as 20 is minimum number of atoms generated 1109| | // for a string using *nocase*, *ascii* and *wide* modifiers simultaneously. 1110| | 1111| 2| if (rule->num_atoms > YR_ATOMS_PER_RULE_WARNING_THRESHOLD) ------------------ | | 89| 2|#define YR_ATOMS_PER_RULE_WARNING_THRESHOLD 12000 ------------------ | Branch (1111:7): [True: 0, False: 2] ------------------ 1112| 0| { 1113| 0| yywarning(yyscanner, "rule is slowing down scanning"); ------------------ | | 50| 0|#define yywarning yara_yywarning ------------------ 1114| 0| } 1115| | 1116| 2| yr_rule_strings_foreach(rule, string) ------------------ | | 60| 2| for (string = rule->strings; string != NULL; \ | | ------------------ | | | Branch (60:32): [True: 0, False: 2] | | ------------------ | | 61| 2| string = STRING_IS_LAST_IN_RULE(string) ? NULL : string + 1) | | ------------------ | | | | 122| 0|#define STRING_IS_LAST_IN_RULE(x) (((x)->flags) & STRING_FLAGS_LAST_IN_RULE) | | | | ------------------ | | | | | | 78| 0|#define STRING_FLAGS_LAST_IN_RULE 0x1000 | | | | ------------------ | | | | | Branch (122:35): [True: 0, False: 0] | | | | ------------------ | | ------------------ ------------------ 1117| 0| { 1118| | // Only the heading fragment in a chain of strings (the one with 1119| | // chained_to == NULL) must be referenced. All other fragments 1120| | // are never marked as referenced. 1121| | // 1122| | // Any string identifier that starts with '_' can be unreferenced. Anonymous 1123| | // strings must always be referenced. 1124| | 1125| 0| if (!STRING_IS_REFERENCED(string) && string->chained_to == NULL && ------------------ | | 108| 0|#define STRING_IS_REFERENCED(x) (((x)->flags) & STRING_FLAGS_REFERENCED) | | ------------------ | | | | 66| 0|#define STRING_FLAGS_REFERENCED 0x01 | | ------------------ ------------------ | Branch (1125:9): [True: 0, False: 0] | Branch (1125:42): [True: 0, False: 0] ------------------ 1126| 0| (STRING_IS_ANONYMOUS(string) || ------------------ | | 106| 0|#define STRING_IS_ANONYMOUS(x) (((x)->flags) & STRING_FLAGS_ANONYMOUS) | | ------------------ | | | | 74| 0|#define STRING_FLAGS_ANONYMOUS 0x100 | | ------------------ | | | Branch (106:32): [True: 0, False: 0] | | ------------------ ------------------ 1127| 0| (!STRING_IS_ANONYMOUS(string) && string->identifier[1] != '_'))) ------------------ | | 106| 0|#define STRING_IS_ANONYMOUS(x) (((x)->flags) & STRING_FLAGS_ANONYMOUS) | | ------------------ | | | | 74| 0|#define STRING_FLAGS_ANONYMOUS 0x100 | | ------------------ ------------------ | Branch (1127:11): [True: 0, False: 0] | Branch (1127:43): [True: 0, False: 0] ------------------ 1128| 0| { 1129| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1130| 0| compiler, string->identifier) return ERROR_UNREFERENCED_STRING; ------------------ | | 63| 0|#define ERROR_UNREFERENCED_STRING 18 ------------------ 1131| 0| } 1132| | 1133| | // If a string is unreferenced we need to unset the FIXED_OFFSET flag so 1134| | // that it will match anywhere. 1135| 0| if (!STRING_IS_REFERENCED(string) && string->chained_to == NULL && ------------------ | | 108| 0|#define STRING_IS_REFERENCED(x) (((x)->flags) & STRING_FLAGS_REFERENCED) | | ------------------ | | | | 66| 0|#define STRING_FLAGS_REFERENCED 0x01 | | ------------------ ------------------ | Branch (1135:9): [True: 0, False: 0] | Branch (1135:42): [True: 0, False: 0] ------------------ 1136| 0| STRING_IS_FIXED_OFFSET(string)) ------------------ | | 112| 0|#define STRING_IS_FIXED_OFFSET(x) (((x)->flags) & STRING_FLAGS_FIXED_OFFSET) | | ------------------ | | | | 81| 0|#define STRING_FLAGS_FIXED_OFFSET 0x8000 | | ------------------ | | | Branch (112:35): [True: 0, False: 0] | | ------------------ ------------------ 1137| 0| { 1138| 0| string->flags &= ~STRING_FLAGS_FIXED_OFFSET; ------------------ | | 81| 0|#define STRING_FLAGS_FIXED_OFFSET 0x8000 ------------------ 1139| 0| } 1140| | 1141| 0| strings_in_rule++; 1142| | 1143| 0| if (strings_in_rule > max_strings_per_rule) ------------------ | Branch (1143:9): [True: 0, False: 0] ------------------ 1144| 0| { 1145| 0| yr_compiler_set_error_extra_info( ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1146| 0| compiler, rule->identifier) return ERROR_TOO_MANY_STRINGS; ------------------ | | 98| 0|#define ERROR_TOO_MANY_STRINGS 51 ------------------ 1147| 0| } 1148| 0| } 1149| | 1150| 2| FAIL_ON_ERROR(yr_parser_emit_with_arg( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1151| 2| yyscanner, OP_MATCH_RULE, compiler->current_rule_idx, NULL, NULL)); 1152| | 1153| 2| fixup = compiler->fixup_stack_head; 1154| | 1155| 2| void* jmp_offset_addr = yr_arena_ref_to_ptr(compiler->arena, &fixup->ref); 1156| | 1157| 2| int32_t jmp_offset = yr_arena_get_current_offset( 1158| 2| compiler->arena, YR_CODE_SECTION) - ------------------ | | 63| 2|#define YR_CODE_SECTION 6 ------------------ 1159| 2| fixup->ref.offset + 1; 1160| | 1161| 2| memcpy(jmp_offset_addr, &jmp_offset, sizeof(jmp_offset)); 1162| | 1163| | // Remove fixup from the stack. 1164| 2| compiler->fixup_stack_head = fixup->next; 1165| 2| yr_free(fixup); 1166| | 1167| | // We have finished parsing the current rule set current_rule_idx to 1168| | // UINT32_MAX indicating that we are not currently parsing a rule. 1169| 2| compiler->current_rule_idx = UINT32_MAX; 1170| | 1171| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 1172| 2|} yr_parser_reduce_import: 1321| 2|{ 1322| 2| int result; 1323| | 1324| 2| YR_ARENA_REF ref; 1325| 2| YR_COMPILER* compiler = yyget_extra(yyscanner); ------------------ | | 54| 2|#define yyget_extra yara_yyget_extra ------------------ 1326| 2| YR_OBJECT* module_structure; 1327| | 1328| 2| if (!_yr_parser_valid_module_name(module_name)) ------------------ | Branch (1328:7): [True: 0, False: 2] ------------------ 1329| 0| { 1330| 0| yr_compiler_set_error_extra_info(compiler, module_name->c_string); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1331| | 1332| 0| return ERROR_INVALID_MODULE_NAME; ------------------ | | 97| 0|#define ERROR_INVALID_MODULE_NAME 50 ------------------ 1333| 0| } 1334| | 1335| 2| YR_NAMESPACE* ns = (YR_NAMESPACE*) yr_arena_get_ptr( 1336| 2| compiler->arena, 1337| 2| YR_NAMESPACES_TABLE, ------------------ | | 57| 2|#define YR_NAMESPACES_TABLE 0 ------------------ 1338| 2| compiler->current_namespace_idx * sizeof(struct YR_NAMESPACE)); 1339| | 1340| 2| module_structure = (YR_OBJECT*) yr_hash_table_lookup( 1341| 2| compiler->objects_table, module_name->c_string, ns->name); 1342| | 1343| | // if module already imported, do nothing 1344| | 1345| 2| if (module_structure != NULL) ------------------ | Branch (1345:7): [True: 0, False: 2] ------------------ 1346| 0| return ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 1347| | 1348| 2| FAIL_ON_ERROR(yr_object_create( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1349| 2| OBJECT_TYPE_STRUCTURE, module_name->c_string, NULL, &module_structure)); 1350| | 1351| 2| FAIL_ON_ERROR(yr_hash_table_add( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1352| 2| compiler->objects_table, 1353| 2| module_name->c_string, 1354| 2| ns->name, 1355| 2| module_structure)); 1356| | 1357| 2| result = yr_modules_do_declarations(module_name->c_string, module_structure); 1358| | 1359| 2| if (result == ERROR_UNKNOWN_MODULE) ------------------ | | 81| 2|#define ERROR_UNKNOWN_MODULE 34 ------------------ | Branch (1359:7): [True: 0, False: 2] ------------------ 1360| 0| yr_compiler_set_error_extra_info(compiler, module_name->c_string); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1361| | 1362| 2| if (result != ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (1362:7): [True: 0, False: 2] ------------------ 1363| 0| return result; 1364| | 1365| 2| FAIL_ON_ERROR( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1366| 2| _yr_compiler_store_string(compiler, module_name->c_string, &ref)); 1367| | 1368| 2| FAIL_ON_ERROR(yr_parser_emit_with_arg_reloc( ------------------ | | 134| 2| { \ | | 135| 2| int __error = (x); \ | | 136| 2| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 2|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 2] | | ------------------ | | 137| 2| return __error; \ | | 138| 2| } ------------------ 1369| 2| yyscanner, 1370| 2| OP_IMPORT, 1371| 2| yr_arena_ref_to_ptr(compiler->arena, &ref), 1372| 2| NULL, 1373| 2| NULL)); 1374| | 1375| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 1376| 2|} yr_parser_reduce_operation: 1448| 18|{ 1449| 18| int expression_type; 1450| | 1451| 18| YR_COMPILER* compiler = yyget_extra(yyscanner); ------------------ | | 54| 18|#define yyget_extra yara_yyget_extra ------------------ 1452| | 1453| 18| if ((left_operand.type == EXPRESSION_TYPE_INTEGER || ------------------ | | 47| 36|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (1453:8): [True: 6, False: 12] ------------------ 1454| 12| left_operand.type == EXPRESSION_TYPE_FLOAT) && ------------------ | | 51| 12|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (1454:8): [True: 12, False: 0] ------------------ 1455| 18| (right_operand.type == EXPRESSION_TYPE_INTEGER || ------------------ | | 47| 36|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (1455:8): [True: 18, False: 0] ------------------ 1456| 0| right_operand.type == EXPRESSION_TYPE_FLOAT)) ------------------ | | 51| 0|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (1456:8): [True: 0, False: 0] ------------------ 1457| 18| { 1458| 18| if (left_operand.type != right_operand.type) ------------------ | Branch (1458:9): [True: 12, False: 6] ------------------ 1459| 12| { 1460| | // One operand is double and the other is integer, 1461| | // cast the integer to double 1462| | 1463| 12| FAIL_ON_ERROR(yr_parser_emit_with_arg( ------------------ | | 134| 12| { \ | | 135| 24| int __error = (x); \ | | ------------------ | | | Branch (135:20): [True: 0, False: 12] | | ------------------ | | 136| 12| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 12|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 12] | | ------------------ | | 137| 12| return __error; \ | | 138| 12| } ------------------ 1464| 12| yyscanner, 1465| 12| OP_INT_TO_DBL, 1466| 12| (left_operand.type == EXPRESSION_TYPE_INTEGER) ? 2 : 1, 1467| 12| NULL, 1468| 12| NULL)); 1469| 12| } 1470| | 1471| 18| expression_type = EXPRESSION_TYPE_FLOAT; ------------------ | | 51| 18|#define EXPRESSION_TYPE_FLOAT 32 ------------------ 1472| | 1473| 18| if (left_operand.type == EXPRESSION_TYPE_INTEGER && ------------------ | | 47| 36|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (1473:9): [True: 6, False: 12] ------------------ 1474| 6| right_operand.type == EXPRESSION_TYPE_INTEGER) ------------------ | | 47| 6|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (1474:9): [True: 6, False: 0] ------------------ 1475| 6| { 1476| 6| expression_type = EXPRESSION_TYPE_INTEGER; ------------------ | | 47| 6|#define EXPRESSION_TYPE_INTEGER 2 ------------------ 1477| 6| } 1478| | 1479| 18| FAIL_ON_ERROR(yr_parser_emit( ------------------ | | 134| 18| { \ | | 135| 18| int __error = (x); \ | | 136| 18| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 18|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 18] | | ------------------ | | 137| 18| return __error; \ | | 138| 18| } ------------------ 1480| 18| yyscanner, _yr_parser_operator_to_opcode(op, expression_type), NULL)); 1481| 18| } 1482| 0| else if ( 1483| 0| left_operand.type == EXPRESSION_TYPE_STRING && ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (1483:7): [True: 0, False: 0] ------------------ 1484| 0| right_operand.type == EXPRESSION_TYPE_STRING) ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (1484:7): [True: 0, False: 0] ------------------ 1485| 0| { 1486| 0| int opcode = _yr_parser_operator_to_opcode(op, EXPRESSION_TYPE_STRING); ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ 1487| | 1488| 0| if (opcode != OP_ERROR) ------------------ | | 45| 0|#define OP_ERROR 0 ------------------ | Branch (1488:9): [True: 0, False: 0] ------------------ 1489| 0| { 1490| 0| FAIL_ON_ERROR(yr_parser_emit(yyscanner, opcode, NULL)); ------------------ | | 134| 0| { \ | | 135| 0| int __error = (x); \ | | 136| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 0] | | ------------------ | | 137| 0| return __error; \ | | 138| 0| } ------------------ 1491| 0| } 1492| 0| else 1493| 0| { 1494| 0| yr_compiler_set_error_extra_info_fmt( ------------------ | | 326| 0| snprintf( \ | | 327| 0| compiler->last_error_extra_info, \ | | 328| 0| sizeof(compiler->last_error_extra_info), \ | | 329| 0| fmt, \ | | 330| 0| __VA_ARGS__); ------------------ 1495| 0| compiler, "strings don't support \"%s\" operation", op); 1496| | 1497| 0| return ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 1498| 0| } 1499| 0| } 1500| 0| else 1501| 0| { 1502| 0| yr_compiler_set_error_extra_info(compiler, "type mismatch"); ------------------ | | 320| 0| strlcpy( \ | | 321| 0| compiler->last_error_extra_info, \ | | 322| 0| info, \ | | 323| 0| sizeof(compiler->last_error_extra_info)); ------------------ 1503| | 1504| 0| return ERROR_WRONG_TYPE; ------------------ | | 69| 0|#define ERROR_WRONG_TYPE 24 ------------------ 1505| 0| } 1506| | 1507| 18| return ERROR_SUCCESS; ------------------ | | 40| 18|#define ERROR_SUCCESS 0 ------------------ 1508| 18|} parser.c:_yr_parser_valid_module_name: 1310| 2|{ 1311| 2| if (module_name->length == 0) ------------------ | Branch (1311:7): [True: 0, False: 2] ------------------ 1312| 0| return false; 1313| | 1314| 2| if (strlen(module_name->c_string) != module_name->length) ------------------ | Branch (1314:7): [True: 0, False: 2] ------------------ 1315| 0| return false; 1316| | 1317| 2| return true; 1318| 2|} parser.c:_yr_parser_operator_to_opcode: 1379| 18|{ 1380| 18| int opcode = 0; 1381| | 1382| 18| switch (expression_type) 1383| 18| { 1384| 6| case EXPRESSION_TYPE_INTEGER: ------------------ | | 47| 6|#define EXPRESSION_TYPE_INTEGER 2 ------------------ | Branch (1384:3): [True: 6, False: 12] ------------------ 1385| 6| opcode = OP_INT_BEGIN; ------------------ | | 141| 6|#define OP_INT_BEGIN 100 ------------------ 1386| 6| break; 1387| 12| case EXPRESSION_TYPE_FLOAT: ------------------ | | 51| 12|#define EXPRESSION_TYPE_FLOAT 32 ------------------ | Branch (1387:3): [True: 12, False: 6] ------------------ 1388| 12| opcode = OP_DBL_BEGIN; ------------------ | | 155| 12|#define OP_DBL_BEGIN 120 ------------------ 1389| 12| break; 1390| 0| case EXPRESSION_TYPE_STRING: ------------------ | | 48| 0|#define EXPRESSION_TYPE_STRING 4 ------------------ | Branch (1390:3): [True: 0, False: 18] ------------------ 1391| 0| opcode = OP_STR_BEGIN; ------------------ | | 169| 0|#define OP_STR_BEGIN 140 ------------------ 1392| 0| break; 1393| 0| default: ------------------ | Branch (1393:3): [True: 0, False: 18] ------------------ 1394| 0| assert(false); ------------------ | Branch (1394:5): [Folded, False: 0] | Branch (1394:5): [Folded, False: 0] ------------------ 1395| 18| } 1396| | 1397| 18| if (op[0] == '<') ------------------ | Branch (1397:7): [True: 0, False: 18] ------------------ 1398| 0| { 1399| 0| if (op[1] == '=') ------------------ | Branch (1399:9): [True: 0, False: 0] ------------------ 1400| 0| opcode += _OP_LE; ------------------ | | 133| 0|#define _OP_LE 4 ------------------ 1401| 0| else 1402| 0| opcode += _OP_LT; ------------------ | | 131| 0|#define _OP_LT 2 ------------------ 1403| 0| } 1404| 18| else if (op[0] == '>') ------------------ | Branch (1404:12): [True: 18, False: 0] ------------------ 1405| 18| { 1406| 18| if (op[1] == '=') ------------------ | Branch (1406:9): [True: 18, False: 0] ------------------ 1407| 18| opcode += _OP_GE; ------------------ | | 134| 18|#define _OP_GE 5 ------------------ 1408| 0| else 1409| 0| opcode += _OP_GT; ------------------ | | 132| 0|#define _OP_GT 3 ------------------ 1410| 18| } 1411| 0| else if (op[1] == '=') ------------------ | Branch (1411:12): [True: 0, False: 0] ------------------ 1412| 0| { 1413| 0| if (op[0] == '=') ------------------ | Branch (1413:9): [True: 0, False: 0] ------------------ 1414| 0| opcode += _OP_EQ; ------------------ | | 129| 0|#define _OP_EQ 0 ------------------ 1415| 0| else 1416| 0| opcode += _OP_NEQ; ------------------ | | 130| 0|#define _OP_NEQ 1 ------------------ 1417| 0| } 1418| 0| else if (op[0] == '+') ------------------ | Branch (1418:12): [True: 0, False: 0] ------------------ 1419| 0| { 1420| 0| opcode += _OP_ADD; ------------------ | | 135| 0|#define _OP_ADD 6 ------------------ 1421| 0| } 1422| 0| else if (op[0] == '-') ------------------ | Branch (1422:12): [True: 0, False: 0] ------------------ 1423| 0| { 1424| 0| opcode += _OP_SUB; ------------------ | | 136| 0|#define _OP_SUB 7 ------------------ 1425| 0| } 1426| 0| else if (op[0] == '*') ------------------ | Branch (1426:12): [True: 0, False: 0] ------------------ 1427| 0| { 1428| 0| opcode += _OP_MUL; ------------------ | | 137| 0|#define _OP_MUL 8 ------------------ 1429| 0| } 1430| 0| else if (op[0] == '\\') ------------------ | Branch (1430:12): [True: 0, False: 0] ------------------ 1431| 0| { 1432| 0| opcode += _OP_DIV; ------------------ | | 138| 0|#define _OP_DIV 9 ------------------ 1433| 0| } 1434| | 1435| 18| if (IS_INT_OP(opcode) || IS_DBL_OP(opcode) || IS_STR_OP(opcode)) ------------------ | | 178| 36|#define IS_INT_OP(x) ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END) | | ------------------ | | | | 141| 36|#define OP_INT_BEGIN 100 | | ------------------ | | #define IS_INT_OP(x) ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END) | | ------------------ | | | | 153| 18|#define OP_INT_END OP_INT_MINUS | | | | ------------------ | | | | | | 152| 18|#define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS) | | | | | | ------------------ | | | | | | | | 141| 18|#define OP_INT_BEGIN 100 | | | | | | ------------------ | | | | | | #define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS) | | | | | | ------------------ | | | | | | | | 139| 18|#define _OP_MINUS 10 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | | Branch (178:23): [True: 18, False: 0] | | | Branch (178:46): [True: 6, False: 12] | | ------------------ ------------------ if (IS_INT_OP(opcode) || IS_DBL_OP(opcode) || IS_STR_OP(opcode)) ------------------ | | 179| 30|#define IS_DBL_OP(x) ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END) | | ------------------ | | | | 155| 24|#define OP_DBL_BEGIN 120 | | ------------------ | | #define IS_DBL_OP(x) ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END) | | ------------------ | | | | 167| 12|#define OP_DBL_END OP_DBL_MINUS | | | | ------------------ | | | | | | 166| 12|#define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS) | | | | | | ------------------ | | | | | | | | 155| 12|#define OP_DBL_BEGIN 120 | | | | | | ------------------ | | | | | | #define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS) | | | | | | ------------------ | | | | | | | | 139| 12|#define _OP_MINUS 10 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | | Branch (179:23): [True: 12, False: 0] | | | Branch (179:46): [True: 12, False: 0] | | ------------------ ------------------ if (IS_INT_OP(opcode) || IS_DBL_OP(opcode) || IS_STR_OP(opcode)) ------------------ | | 180| 0|#define IS_STR_OP(x) ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END) | | ------------------ | | | | 169| 0|#define OP_STR_BEGIN 140 | | ------------------ | | #define IS_STR_OP(x) ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END) | | ------------------ | | | | 176| 0|#define OP_STR_END OP_STR_GE | | | | ------------------ | | | | | | 175| 0|#define OP_STR_GE (OP_STR_BEGIN + _OP_GE) | | | | | | ------------------ | | | | | | | | 169| 0|#define OP_STR_BEGIN 140 | | | | | | ------------------ | | | | | | #define OP_STR_GE (OP_STR_BEGIN + _OP_GE) | | | | | | ------------------ | | | | | | | | 134| 0|#define _OP_GE 5 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | | Branch (180:23): [True: 0, False: 0] | | | Branch (180:46): [True: 0, False: 0] | | ------------------ ------------------ 1436| 18| { 1437| 18| return opcode; 1438| 18| } 1439| | 1440| 0| return OP_ERROR; ------------------ | | 45| 0|#define OP_ERROR 0 ------------------ 1441| 18|} yr_rules_scan_mem: 204| 1.70k|{ 205| 1.70k| YR_DEBUG_FPRINTF( 206| 1.70k| 2, 207| 1.70k| stderr, 208| 1.70k| "+ %s(buffer=%p buffer_size=%zu timeout=%d) {\n", 209| 1.70k| __FUNCTION__, 210| 1.70k| buffer, 211| 1.70k| buffer_size, 212| 1.70k| timeout); 213| | 214| 1.70k| YR_SCANNER* scanner; 215| 1.70k| int result = ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 1.70k|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 216| | 217| 1.70k| GOTO_EXIT_ON_ERROR(yr_scanner_create(rules, &scanner)); ------------------ | | 116| 1.70k| { \ | | 117| 1.70k| result = (x); \ | | 118| 1.70k| if (result != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (118:9): [True: 0, False: 1.70k] | | ------------------ | | 119| 1.70k| goto _exit; \ | | 120| 1.70k| } ------------------ 218| | 219| 1.70k| yr_scanner_set_callback(scanner, callback, user_data); 220| 1.70k| yr_scanner_set_timeout(scanner, timeout); 221| 1.70k| yr_scanner_set_flags(scanner, flags); 222| | 223| 1.70k| result = yr_scanner_scan_mem(scanner, buffer, buffer_size); 224| | 225| 1.70k| yr_scanner_destroy(scanner); 226| | 227| 1.70k|_exit: 228| | 229| 1.70k| YR_DEBUG_FPRINTF( 230| 1.70k| 2, 231| 1.70k| stderr, 232| 1.70k| "" 233| 1.70k| "} = %d AKA %s // %s()\n", 234| 1.70k| result, 235| 1.70k| yr_debug_error_as_string(result), 236| 1.70k| __FUNCTION__); 237| | 238| 1.70k| return result; 239| 1.70k|} yr_rules_from_arena: 327| 2|{ 328| 2| YR_SUMMARY* summary = (YR_SUMMARY*) yr_arena_get_ptr( 329| 2| arena, YR_SUMMARY_SECTION, 0); ------------------ | | 68| 2|#define YR_SUMMARY_SECTION 11 ------------------ 330| | 331| 2| if (summary == NULL) ------------------ | Branch (331:7): [True: 0, False: 2] ------------------ 332| 0| return ERROR_CORRUPT_FILE; ------------------ | | 52| 0|#define ERROR_CORRUPT_FILE 7 ------------------ 333| | 334| | // The rule, string and namespace counts are taken verbatim from the loaded 335| | // summary. Reject any count that doesn't fit the table it indexes, otherwise 336| | // the rules_table walk below (and the string/namespace tables the scanner 337| | // indexes with these counts) run past the end of the loaded buffers. 338| 2| if ((uint64_t) summary->num_rules * sizeof(YR_RULE) > ------------------ | Branch (338:7): [True: 0, False: 2] ------------------ 339| 2| yr_arena_get_current_offset(arena, YR_RULES_TABLE) || ------------------ | | 58| 2|#define YR_RULES_TABLE 1 ------------------ 340| 2| (uint64_t) summary->num_strings * sizeof(YR_STRING) > ------------------ | Branch (340:7): [True: 0, False: 2] ------------------ 341| 2| yr_arena_get_current_offset(arena, YR_STRINGS_TABLE) || ------------------ | | 60| 2|#define YR_STRINGS_TABLE 3 ------------------ 342| 2| (uint64_t) summary->num_namespaces * sizeof(YR_NAMESPACE) > ------------------ | Branch (342:7): [True: 0, False: 2] ------------------ 343| 2| yr_arena_get_current_offset(arena, YR_NAMESPACES_TABLE)) ------------------ | | 57| 2|#define YR_NAMESPACES_TABLE 0 ------------------ 344| 0| { 345| 0| return ERROR_CORRUPT_FILE; ------------------ | | 52| 0|#define ERROR_CORRUPT_FILE 7 ------------------ 346| 0| } 347| | 348| 2| YR_RULES* new_rules = (YR_RULES*) yr_malloc(sizeof(YR_RULES)); 349| | 350| 2| if (new_rules == NULL) ------------------ | Branch (350:7): [True: 0, False: 2] ------------------ 351| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 352| | 353| 2| new_rules->no_required_strings = (YR_BITMASK*) yr_calloc( 354| 2| sizeof(YR_BITMASK), YR_BITMASK_SIZE(summary->num_rules)); ------------------ | | 57| 2|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 2|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 355| | 356| 2| if (new_rules->no_required_strings == NULL) ------------------ | Branch (356:7): [True: 0, False: 2] ------------------ 357| 0| { 358| 0| yr_free(new_rules); 359| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 360| 0| } 361| | 362| | // Now YR_RULES relies on this arena, let's increment the arena's 363| | // reference count so that if the original owner of the arena calls 364| | // yr_arena_destroy the arena is not destroyed. 365| 2| yr_arena_acquire(arena); 366| | 367| 2| new_rules->arena = arena; 368| 2| new_rules->num_rules = summary->num_rules; 369| 2| new_rules->num_strings = summary->num_strings; 370| 2| new_rules->num_namespaces = summary->num_namespaces; 371| | 372| 2| new_rules->rules_table = yr_arena_get_ptr(arena, YR_RULES_TABLE, 0); ------------------ | | 58| 2|#define YR_RULES_TABLE 1 ------------------ 373| | 374| 2| new_rules->strings_table = yr_arena_get_ptr(arena, YR_STRINGS_TABLE, 0); ------------------ | | 60| 2|#define YR_STRINGS_TABLE 3 ------------------ 375| | 376| 2| new_rules->ext_vars_table = yr_arena_get_ptr( 377| 2| arena, YR_EXTERNAL_VARIABLES_TABLE, 0); ------------------ | | 61| 2|#define YR_EXTERNAL_VARIABLES_TABLE 4 ------------------ 378| | 379| 2| new_rules->ac_transition_table = yr_arena_get_ptr( 380| 2| arena, YR_AC_TRANSITION_TABLE, 0); ------------------ | | 65| 2|#define YR_AC_TRANSITION_TABLE 8 ------------------ 381| | 382| 2| new_rules->ac_match_table = yr_arena_get_ptr( 383| 2| arena, YR_AC_STATE_MATCHES_TABLE, 0); ------------------ | | 66| 2|#define YR_AC_STATE_MATCHES_TABLE 9 ------------------ 384| | 385| 2| new_rules->ac_match_pool = yr_arena_get_ptr( 386| 2| arena, YR_AC_STATE_MATCHES_POOL, 0); ------------------ | | 67| 2|#define YR_AC_STATE_MATCHES_POOL 10 ------------------ 387| | 388| 2| new_rules->code_start = yr_arena_get_ptr(arena, YR_CODE_SECTION, 0); ------------------ | | 63| 2|#define YR_CODE_SECTION 6 ------------------ 389| | 390| | // If a rule has no required_strings, this means that the condition might 391| | // evaluate to true without any matching strings, and we therefore have to 392| | // mark it as "to be evaluated" from the beginning. 393| 4| for (int i = 0; i < new_rules->num_rules; i++) ------------------ | Branch (393:19): [True: 2, False: 2] ------------------ 394| 2| { 395| 2| if (new_rules->rules_table[i].required_strings == 0) ------------------ | Branch (395:9): [True: 2, False: 0] ------------------ 396| 2| yr_bitmask_set(new_rules->no_required_strings, i); ------------------ | | 60| 2| do \ | | 61| 2| { \ | | 62| 2| (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 2|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | (bm)[(i) / YR_BITMASK_SLOT_BITS] |= 1UL << ((i) % YR_BITMASK_SLOT_BITS); \ | | ------------------ | | | | 56| 2|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | 63| 2| } while (0) | | ------------------ | | | Branch (63:12): [Folded, False: 2] | | ------------------ ------------------ 397| 2| } 398| | 399| 2| *rules = new_rules; 400| | 401| 2| return ERROR_SUCCESS; ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ 402| 2|} yr_scanner_create: 239| 1.70k|{ 240| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "- %s() {} \n", __FUNCTION__); 241| | 242| 1.70k| YR_EXTERNAL_VARIABLE* external; 243| 1.70k| YR_SCANNER* new_scanner; 244| | 245| 1.70k| new_scanner = (YR_SCANNER*) yr_calloc(1, sizeof(YR_SCANNER)); 246| | 247| 1.70k| if (new_scanner == NULL) ------------------ | Branch (247:7): [True: 0, False: 1.70k] ------------------ 248| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 249| | 250| 1.70k| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 1.70k| { \ | | 143| 1.70k| int __error = (x); \ | | 144| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 1.70k] | | ------------------ | | 145| 1.70k| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 1.70k| } ------------------ 251| 1.70k| yr_hash_table_create(64, &new_scanner->objects_table), 252| 1.70k| yr_free(new_scanner)); 253| | 254| 1.70k| new_scanner->rules = rules; 255| 1.70k| new_scanner->entry_point = YR_UNDEFINED; ------------------ | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 256| 1.70k| new_scanner->file_size = YR_UNDEFINED; ------------------ | | 38| 1.70k|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 257| 1.70k| new_scanner->canary = rand(); 258| | 259| | // By default report both matching and non-matching rules. 260| 1.70k| new_scanner->flags = SCAN_FLAGS_REPORT_RULES_MATCHING | ------------------ | | 41| 1.70k|#define SCAN_FLAGS_REPORT_RULES_MATCHING 8 ------------------ 261| 1.70k| SCAN_FLAGS_REPORT_RULES_NOT_MATCHING; ------------------ | | 42| 1.70k|#define SCAN_FLAGS_REPORT_RULES_NOT_MATCHING 16 ------------------ 262| | 263| 1.70k| new_scanner->rule_matches_flags = (YR_BITMASK*) yr_calloc( 264| 1.70k| sizeof(YR_BITMASK), YR_BITMASK_SIZE(rules->num_rules)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 265| | 266| 1.70k| new_scanner->required_eval = (YR_BITMASK*) yr_calloc( 267| 1.70k| sizeof(YR_BITMASK), YR_BITMASK_SIZE(rules->num_rules)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 268| | 269| 1.70k| new_scanner->ns_unsatisfied_flags = (YR_BITMASK*) yr_calloc( 270| 1.70k| sizeof(YR_BITMASK), YR_BITMASK_SIZE(rules->num_namespaces)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 271| | 272| 1.70k| new_scanner->strings_temp_disabled = (YR_BITMASK*) yr_calloc( 273| 1.70k| sizeof(YR_BITMASK), YR_BITMASK_SIZE(rules->num_strings)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 274| | 275| 1.70k| new_scanner->matches = (YR_MATCHES*) yr_calloc( 276| 1.70k| rules->num_strings, sizeof(YR_MATCHES)); 277| | 278| 1.70k| new_scanner->unconfirmed_matches = (YR_MATCHES*) yr_calloc( 279| 1.70k| rules->num_strings, sizeof(YR_MATCHES)); 280| | 281| 1.70k| if (new_scanner->rule_matches_flags == NULL || ------------------ | Branch (281:7): [True: 0, False: 1.70k] ------------------ 282| 1.70k| new_scanner->required_eval == NULL || ------------------ | Branch (282:7): [True: 0, False: 1.70k] ------------------ 283| 1.70k| new_scanner->ns_unsatisfied_flags == NULL || ------------------ | Branch (283:7): [True: 0, False: 1.70k] ------------------ 284| 1.70k| new_scanner->strings_temp_disabled == NULL || ------------------ | Branch (284:7): [True: 0, False: 1.70k] ------------------ 285| 1.70k| (new_scanner->matches == NULL && rules->num_strings > 0) || ------------------ | Branch (285:8): [True: 0, False: 1.70k] | Branch (285:40): [True: 0, False: 0] ------------------ 286| 1.70k| (new_scanner->unconfirmed_matches == NULL && rules->num_strings > 0)) ------------------ | Branch (286:8): [True: 0, False: 1.70k] | Branch (286:52): [True: 0, False: 0] ------------------ 287| 0| { 288| 0| yr_scanner_destroy(new_scanner); 289| 0| return ERROR_INSUFFICIENT_MEMORY; ------------------ | | 47| 0|#define ERROR_INSUFFICIENT_MEMORY 1 ------------------ 290| 0| } 291| | 292| |#ifdef YR_PROFILING_ENABLED 293| | new_scanner->profiling_info = yr_calloc( 294| | rules->num_rules, sizeof(YR_PROFILING_INFO)); 295| | 296| | if (new_scanner->profiling_info == NULL && rules->num_rules > 0) 297| | { 298| | yr_scanner_destroy(new_scanner); 299| | return ERROR_INSUFFICIENT_MEMORY; 300| | } 301| |#else 302| 1.70k| new_scanner->profiling_info = NULL; 303| 1.70k|#endif 304| | 305| 1.70k| external = rules->ext_vars_table; 306| | 307| 1.70k| while (!EXTERNAL_VARIABLE_IS_NULL(external)) ------------------ | | 152| 1.70k| ((x) != NULL ? (x)->type == EXTERNAL_VARIABLE_TYPE_NULL : true) | | ------------------ | | | | 144| 1.70k|#define EXTERNAL_VARIABLE_TYPE_NULL 0 | | ------------------ | | | Branch (152:4): [True: 1.70k, False: 0] | | ------------------ ------------------ | Branch (307:10): [True: 0, False: 1.70k] ------------------ 308| 0| { 309| 0| YR_OBJECT* object; 310| | 311| 0| FAIL_ON_ERROR_WITH_CLEANUP( ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 312| 0| yr_object_from_external_variable(external, &object), 313| | // cleanup 314| 0| yr_scanner_destroy(new_scanner)); 315| | 316| 0| FAIL_ON_ERROR_WITH_CLEANUP(yr_hash_table_add( ------------------ | | 142| 0| { \ | | 143| 0| int __error = (x); \ | | 144| 0| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (144:9): [True: 0, False: 0] | | ------------------ | | 145| 0| { \ | | 146| 0| cleanup; \ | | 147| 0| return __error; \ | | 148| 0| } \ | | 149| 0| } ------------------ 317| 0| new_scanner->objects_table, 318| 0| external->identifier, 319| 0| NULL, 320| 0| (void*) object), 321| | // cleanup 322| 0| yr_object_destroy(object); 323| 0| yr_scanner_destroy(new_scanner)); 324| | 325| 0| yr_object_set_canary(object, new_scanner->canary); 326| 0| external++; 327| 0| } 328| | 329| 1.70k| *scanner = new_scanner; 330| | 331| 1.70k| return ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 332| 1.70k|} yr_scanner_destroy: 335| 1.70k|{ 336| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "- %s() {} \n", __FUNCTION__); 337| | 338| 1.70k| RE_FIBER* fiber = scanner->re_fiber_pool.fibers.head; 339| | 340| 1.70k| while (fiber != NULL) ------------------ | Branch (340:10): [True: 0, False: 1.70k] ------------------ 341| 0| { 342| 0| RE_FIBER* next = fiber->next; 343| 0| yr_free(fiber); 344| 0| fiber = next; 345| 0| } 346| | 347| 1.70k| RE_FAST_EXEC_POSITION* position = scanner->re_fast_exec_position_pool.head; 348| | 349| 1.70k| while (position != NULL) ------------------ | Branch (349:10): [True: 0, False: 1.70k] ------------------ 350| 0| { 351| 0| RE_FAST_EXEC_POSITION* next = position->next; 352| 0| yr_free(position); 353| 0| position = next; 354| 0| } 355| | 356| 1.70k| if (scanner->objects_table != NULL) ------------------ | Branch (356:7): [True: 1.70k, False: 0] ------------------ 357| 1.70k| { 358| 1.70k| yr_hash_table_destroy( 359| 1.70k| scanner->objects_table, 360| 1.70k| (YR_HASH_TABLE_FREE_VALUE_FUNC) yr_object_destroy); 361| 1.70k| } 362| | 363| |#ifdef YR_PROFILING_ENABLED 364| | yr_free(scanner->profiling_info); 365| |#endif 366| | 367| 1.70k| yr_free(scanner->rule_matches_flags); 368| 1.70k| yr_free(scanner->ns_unsatisfied_flags); 369| 1.70k| yr_free(scanner->required_eval); 370| 1.70k| yr_free(scanner->strings_temp_disabled); 371| 1.70k| yr_free(scanner->matches); 372| 1.70k| yr_free(scanner->unconfirmed_matches); 373| 1.70k| yr_free(scanner); 374| 1.70k|} yr_scanner_set_callback: 380| 1.70k|{ 381| 1.70k| scanner->callback = callback; 382| 1.70k| scanner->user_data = user_data; 383| 1.70k|} yr_scanner_set_timeout: 386| 1.70k|{ 387| | // Convert timeout from seconds to nanoseconds. 388| 1.70k| scanner->timeout = timeout * 1000000000ULL; 389| 1.70k|} yr_scanner_set_flags: 392| 1.70k|{ 393| | // For backward compatibility, if neither SCAN_FLAGS_REPORT_RULES_MATCHING 394| | // nor SCAN_FLAGS_REPORT_RULES_NOT_MATCHING are specified, both are assumed. 395| | 396| 1.70k| if (!(flags & SCAN_FLAGS_REPORT_RULES_MATCHING) && ------------------ | | 41| 1.70k|#define SCAN_FLAGS_REPORT_RULES_MATCHING 8 ------------------ | Branch (396:7): [True: 1.70k, False: 0] ------------------ 397| 1.70k| !(flags & SCAN_FLAGS_REPORT_RULES_NOT_MATCHING)) ------------------ | | 42| 1.70k|#define SCAN_FLAGS_REPORT_RULES_NOT_MATCHING 16 ------------------ | Branch (397:7): [True: 1.70k, False: 0] ------------------ 398| 1.70k| { 399| 1.70k| flags |= SCAN_FLAGS_REPORT_RULES_MATCHING | ------------------ | | 41| 1.70k|#define SCAN_FLAGS_REPORT_RULES_MATCHING 8 ------------------ 400| 1.70k| SCAN_FLAGS_REPORT_RULES_NOT_MATCHING; ------------------ | | 42| 1.70k|#define SCAN_FLAGS_REPORT_RULES_NOT_MATCHING 16 ------------------ 401| 1.70k| } 402| | 403| 1.70k| scanner->flags = flags; 404| 1.70k|} yr_scanner_scan_mem_blocks: 468| 1.70k|{ 469| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "+ %s() {\n", __FUNCTION__); 470| | 471| 1.70k| YR_RULES* rules; 472| 1.70k| YR_RULE* rule; 473| 1.70k| YR_MEMORY_BLOCK* block; 474| | 475| 1.70k| int i, result = ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 476| | 477| 1.70k| if (scanner->callback == NULL) ------------------ | Branch (477:7): [True: 0, False: 1.70k] ------------------ 478| 0| { 479| 0| result = ERROR_CALLBACK_REQUIRED; ------------------ | | 100| 0|#define ERROR_CALLBACK_REQUIRED 53 ------------------ 480| 0| goto _exit; 481| 0| } 482| | 483| 1.70k| scanner->iterator = iterator; 484| 1.70k| rules = scanner->rules; 485| | 486| 1.70k| if (iterator->last_error == ERROR_BLOCK_NOT_READY) ------------------ | | 108| 1.70k|#define ERROR_BLOCK_NOT_READY 61 ------------------ | Branch (486:7): [True: 0, False: 1.70k] ------------------ 487| 0| { 488| | // The caller is invoking yr_scanner_scan_mem_blocks again because the 489| | // previous call returned ERROR_BLOCK_NOT_READY. 490| 0| block = iterator->next(iterator); 491| 0| } 492| 1.70k| else 493| 1.70k| { 494| | // Create the notebook that will hold the YR_MATCH structures representing 495| | // each match found. This notebook will also contain snippets of the 496| | // matching data (the "data" field in YR_MATCH points to the snippet 497| | // corresponding to the match). Each notebook's page can store up to 1024 498| | // matches. 499| 1.70k| uint32_t max_match_data; 500| | 501| 1.70k| FAIL_ON_ERROR( ------------------ | | 134| 1.70k| { \ | | 135| 1.70k| int __error = (x); \ | | 136| 1.70k| if (__error != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 1.70k|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (136:9): [True: 0, False: 1.70k] | | ------------------ | | 137| 1.70k| return __error; \ | | 138| 1.70k| } ------------------ 502| 1.70k| yr_get_configuration_uint32(YR_CONFIG_MAX_MATCH_DATA, &max_match_data)); 503| | 504| 1.70k| result = yr_notebook_create( 505| 1.70k| 1024 * (sizeof(YR_MATCH) + max_match_data), &scanner->matches_notebook); 506| | 507| 1.70k| if (result != ERROR_SUCCESS) ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ | Branch (507:9): [True: 0, False: 1.70k] ------------------ 508| 0| goto _exit; 509| | 510| | // Every rule that doesn't require a matching string must be evaluated 511| | // regardless of whether a string matched or not. 512| 1.70k| memcpy( 513| 1.70k| scanner->required_eval, 514| 1.70k| scanner->rules->no_required_strings, 515| 1.70k| sizeof(YR_BITMASK) * YR_BITMASK_SIZE(rules->num_rules)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 516| | 517| 1.70k| yr_stopwatch_start(&scanner->stopwatch); 518| | 519| 1.70k| block = iterator->first(iterator); 520| 1.70k| } 521| | 522| 1.70k| YR_TRYCATCH( ------------------ | | 239| 1.70k| do \ | | 240| 1.70k| { \ | | 241| 1.70k| if (_do_) \ | | ------------------ | | | Branch (241:9): [True: 0, False: 1.70k] | | ------------------ | | 242| 1.70k| { \ | | 243| 0| pthread_mutex_lock(&exception_handler_mutex); \ | | 244| 0| if (exception_handler_usecount == 0) \ | | ------------------ | | | Branch (244:11): [True: 0, False: 0] | | ------------------ | | 245| 0| { \ | | 246| 0| struct sigaction act; \ | | 247| 0| /* Set exception handler for SIGSEGV / SIGBUS */ \ | | 248| 0| act.sa_sigaction = exception_handler; \ | | 249| 0| act.sa_flags = SA_SIGINFO | SA_ONSTACK; \ | | 250| 0| sigfillset(&act.sa_mask); \ | | 251| 0| if (CATCH_SIGBUS) \ | | ------------------ | | | | 150| 0|#define CATCH_SIGBUS 1 | | | | ------------------ | | | | | Branch (150:22): [True: 0, Folded] | | | | ------------------ | | ------------------ | | 252| 0| sigaction(SIGBUS, &act, &old_sigbus_exception_handler); \ | | 253| 0| if (CATCH_SIGSEGV) \ | | ------------------ | | | | 149| 0|#define CATCH_SIGSEGV 0 | | | | ------------------ | | | | | Branch (149:23): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 254| 0| sigaction(SIGSEGV, &act, &old_sigsegv_exception_handler); \ | | 255| 0| } \ | | 256| 0| exception_handler_usecount++; \ | | 257| 0| pthread_mutex_unlock(&exception_handler_mutex); \ | | 258| 0| /* Save the current debug indentation level before the jump. */ \ | | 259| 0| int yr_debug_indent_before_jump = YR_DEBUG_INDENT_INITIAL; \ | | ------------------ | | | | 226| 0|#define YR_DEBUG_INDENT_INITIAL 0 | | ------------------ | | 260| 0| jumpinfo ji; \ | | 261| 0| ji.memfault_from = 0; \ | | 262| 0| ji.memfault_to = 0; \ | | 263| 0| sigjmp_buf jb; \ | | 264| 0| ji.jump_back = (void*) &jb; \ | | 265| 0| /* Store pointer to jumpinfo in TLS */ \ | | 266| 0| yr_thread_storage_set_value(&yr_trycatch_trampoline_tls, &ji); \ | | 267| 0| if (sigsetjmp(jb, 1) == 0) \ | | ------------------ | | | Branch (267:11): [True: 0, False: 0] | | ------------------ | | 268| 0| { \ | | 269| 0| _try_clause_ \ | | ------------------ | | | Branch (269:9): [True: 0, False: 0] | | | Branch (269:9): [True: 0, False: 0] | | | Branch (269:9): [True: 0, False: 0] | | | Branch (269:9): [True: 0, False: 0] | | | Branch (269:9): [True: 0, False: 0] | | ------------------ | | 270| 0| } \ | | 271| 0| else \ | | 272| 0| { \ | | 273| 0| /* Restore debug output indentation in case of failure */ \ | | 274| 0| YR_DEBUG_INDENT_SET(yr_debug_indent_before_jump); \ | | ------------------ | | | | 227| 0|#define YR_DEBUG_INDENT_SET(x) ; | | ------------------ | | 275| 0| \ | | 276| 0| _catch_clause_ \ | | 277| 0| } \ | | 278| 0| pthread_mutex_lock(&exception_handler_mutex); \ | | 279| 0| exception_handler_usecount--; \ | | 280| 0| if (exception_handler_usecount == 0) \ | | ------------------ | | | Branch (280:11): [True: 0, False: 0] | | ------------------ | | 281| 0| { \ | | 282| 0| /* Stop capturing relevant signals */ \ | | 283| 0| if (CATCH_SIGBUS) \ | | ------------------ | | | | 150| 0|#define CATCH_SIGBUS 1 | | | | ------------------ | | | | | Branch (150:22): [True: 0, Folded] | | | | ------------------ | | ------------------ | | 284| 0| sigaction(SIGBUS, &old_sigbus_exception_handler, NULL); \ | | 285| 0| if (CATCH_SIGSEGV) \ | | ------------------ | | | | 149| 0|#define CATCH_SIGSEGV 0 | | | | ------------------ | | | | | Branch (149:23): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 286| 0| sigaction(SIGSEGV, &old_sigsegv_exception_handler, NULL); \ | | 287| 0| } \ | | 288| 0| pthread_mutex_unlock(&exception_handler_mutex); \ | | 289| 0| yr_thread_storage_set_value(&yr_trycatch_trampoline_tls, NULL); \ | | 290| 0| } \ | | 291| 1.70k| else \ | | 292| 1.70k| { \ | | 293| 18.7k| _try_clause_ \ | | ------------------ | | | Branch (293:7): [True: 0, False: 1.70k] | | | Branch (293:7): [True: 0, False: 1.70k] | | | Branch (293:7): [True: 1.70k, False: 0] | | | Branch (293:7): [True: 0, False: 1.70k] | | | Branch (293:7): [True: 1.70k, False: 1.70k] | | ------------------ | | 294| 1.70k| } \ | | 295| 1.70k| } while (0) | | ------------------ | | | Branch (295:12): [Folded, False: 1.70k] | | ------------------ ------------------ 523| 1.70k| !(scanner->flags & SCAN_FLAGS_NO_TRYCATCH), 524| 1.70k| { 525| 1.70k| while (block != NULL) 526| 1.70k| { 527| 1.70k| const uint8_t* data = yr_fetch_block_data(block); 528| | 529| | // fetch_data may fail and return NULL. 530| 1.70k| if (data == NULL) 531| 1.70k| { 532| 1.70k| block = iterator->next(iterator); 533| 1.70k| continue; 534| 1.70k| } 535| | 536| 1.70k| if (scanner->entry_point == YR_UNDEFINED) 537| 1.70k| { 538| 1.70k| if (scanner->flags & SCAN_FLAGS_PROCESS_MEMORY) 539| 1.70k| scanner->entry_point = yr_get_entry_point_address( 540| 1.70k| data, block->size, block->base); 541| 1.70k| else 542| 1.70k| scanner->entry_point = yr_get_entry_point_offset( 543| 1.70k| data, block->size); 544| 1.70k| } 545| 1.70k| result = _yr_scanner_scan_mem_block(scanner, data, block); 546| 1.70k| if (result != ERROR_SUCCESS) 547| 1.70k| { 548| 1.70k| break; 549| 1.70k| } 550| 1.70k| block = iterator->next(iterator); 551| 1.70k| } 552| 1.70k| }, 553| 1.70k| { result = ERROR_COULD_NOT_MAP_FILE; }); 554| | 555| 1.70k| if (result != ERROR_SUCCESS) ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ | Branch (555:7): [True: 0, False: 1.70k] ------------------ 556| 0| goto _exit; 557| | 558| 1.70k| result = iterator->last_error; 559| | 560| 1.70k| if (result != ERROR_SUCCESS) ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ | Branch (560:7): [True: 0, False: 1.70k] ------------------ 561| 0| goto _exit; 562| | 563| | // If the iterator has a file_size function, ask the function for the file's 564| | // size, if not file size is undefined. 565| 1.70k| if (iterator->file_size != NULL) ------------------ | Branch (565:7): [True: 1.70k, False: 0] ------------------ 566| 1.70k| scanner->file_size = iterator->file_size(iterator); 567| 0| else 568| 0| scanner->file_size = YR_UNDEFINED; ------------------ | | 38| 0|#define YR_UNDEFINED 0xFFFABADAFABADAFFLL ------------------ 569| | 570| 1.70k| YR_TRYCATCH( ------------------ | | 239| 1.70k| do \ | | 240| 1.70k| { \ | | 241| 1.70k| if (_do_) \ | | ------------------ | | | Branch (241:9): [True: 0, False: 1.70k] | | ------------------ | | 242| 1.70k| { \ | | 243| 0| pthread_mutex_lock(&exception_handler_mutex); \ | | 244| 0| if (exception_handler_usecount == 0) \ | | ------------------ | | | Branch (244:11): [True: 0, False: 0] | | ------------------ | | 245| 0| { \ | | 246| 0| struct sigaction act; \ | | 247| 0| /* Set exception handler for SIGSEGV / SIGBUS */ \ | | 248| 0| act.sa_sigaction = exception_handler; \ | | 249| 0| act.sa_flags = SA_SIGINFO | SA_ONSTACK; \ | | 250| 0| sigfillset(&act.sa_mask); \ | | 251| 0| if (CATCH_SIGBUS) \ | | ------------------ | | | | 150| 0|#define CATCH_SIGBUS 1 | | | | ------------------ | | | | | Branch (150:22): [True: 0, Folded] | | | | ------------------ | | ------------------ | | 252| 0| sigaction(SIGBUS, &act, &old_sigbus_exception_handler); \ | | 253| 0| if (CATCH_SIGSEGV) \ | | ------------------ | | | | 149| 0|#define CATCH_SIGSEGV 0 | | | | ------------------ | | | | | Branch (149:23): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 254| 0| sigaction(SIGSEGV, &act, &old_sigsegv_exception_handler); \ | | 255| 0| } \ | | 256| 0| exception_handler_usecount++; \ | | 257| 0| pthread_mutex_unlock(&exception_handler_mutex); \ | | 258| 0| /* Save the current debug indentation level before the jump. */ \ | | 259| 0| int yr_debug_indent_before_jump = YR_DEBUG_INDENT_INITIAL; \ | | ------------------ | | | | 226| 0|#define YR_DEBUG_INDENT_INITIAL 0 | | ------------------ | | 260| 0| jumpinfo ji; \ | | 261| 0| ji.memfault_from = 0; \ | | 262| 0| ji.memfault_to = 0; \ | | 263| 0| sigjmp_buf jb; \ | | 264| 0| ji.jump_back = (void*) &jb; \ | | 265| 0| /* Store pointer to jumpinfo in TLS */ \ | | 266| 0| yr_thread_storage_set_value(&yr_trycatch_trampoline_tls, &ji); \ | | 267| 0| if (sigsetjmp(jb, 1) == 0) \ | | ------------------ | | | Branch (267:11): [True: 0, False: 0] | | ------------------ | | 268| 0| { \ | | 269| 0| _try_clause_ \ | | 270| 0| } \ | | 271| 0| else \ | | 272| 0| { \ | | 273| 0| /* Restore debug output indentation in case of failure */ \ | | 274| 0| YR_DEBUG_INDENT_SET(yr_debug_indent_before_jump); \ | | ------------------ | | | | 227| 0|#define YR_DEBUG_INDENT_SET(x) ; | | ------------------ | | 275| 0| \ | | 276| 0| _catch_clause_ \ | | 277| 0| } \ | | 278| 0| pthread_mutex_lock(&exception_handler_mutex); \ | | 279| 0| exception_handler_usecount--; \ | | 280| 0| if (exception_handler_usecount == 0) \ | | ------------------ | | | Branch (280:11): [True: 0, False: 0] | | ------------------ | | 281| 0| { \ | | 282| 0| /* Stop capturing relevant signals */ \ | | 283| 0| if (CATCH_SIGBUS) \ | | ------------------ | | | | 150| 0|#define CATCH_SIGBUS 1 | | | | ------------------ | | | | | Branch (150:22): [True: 0, Folded] | | | | ------------------ | | ------------------ | | 284| 0| sigaction(SIGBUS, &old_sigbus_exception_handler, NULL); \ | | 285| 0| if (CATCH_SIGSEGV) \ | | ------------------ | | | | 149| 0|#define CATCH_SIGSEGV 0 | | | | ------------------ | | | | | Branch (149:23): [Folded, False: 0] | | | | ------------------ | | ------------------ | | 286| 0| sigaction(SIGSEGV, &old_sigsegv_exception_handler, NULL); \ | | 287| 0| } \ | | 288| 0| pthread_mutex_unlock(&exception_handler_mutex); \ | | 289| 0| yr_thread_storage_set_value(&yr_trycatch_trampoline_tls, NULL); \ | | 290| 0| } \ | | 291| 1.70k| else \ | | 292| 1.70k| { \ | | 293| 1.70k| _try_clause_ \ | | 294| 1.70k| } \ | | 295| 1.70k| } while (0) | | ------------------ | | | Branch (295:12): [Folded, False: 1.70k] | | ------------------ ------------------ 571| 1.70k| !(scanner->flags & SCAN_FLAGS_NO_TRYCATCH), 572| 1.70k| { result = yr_execute_code(scanner); }, 573| 1.70k| { result = ERROR_COULD_NOT_MAP_FILE; }); 574| | 575| 1.70k| if (result != ERROR_SUCCESS) ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ | Branch (575:7): [True: 0, False: 1.70k] ------------------ 576| 0| goto _exit; 577| | 578| 3.41k| for (i = 0, rule = rules->rules_table; !RULE_IS_NULL(rule); i++, rule++) ------------------ | | 61| 3.41k|#define RULE_IS_NULL(x) (((x)->flags) & RULE_FLAGS_NULL) | | ------------------ | | | | 54| 3.41k|#define RULE_FLAGS_NULL 0x04 | | ------------------ ------------------ | Branch (578:42): [True: 1.70k, False: 1.70k] ------------------ 579| 1.70k| { 580| 1.70k| int message = 0; 581| | 582| 1.70k| if (yr_bitmask_is_set(scanner->rule_matches_flags, i) && ------------------ | | 75| 3.41k| ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ | | | Branch (75:3): [True: 1.59k, False: 114] | | ------------------ ------------------ 583| 1.59k| yr_bitmask_is_not_set(scanner->ns_unsatisfied_flags, rule->ns->idx)) ------------------ | | 77| 1.59k|#define yr_bitmask_is_not_set(bm, i) (!yr_bitmask_is_set(bm, i)) | | ------------------ | | | | 75| 1.59k| ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | | | ------------------ | | | | | | 56| 1.59k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | | | ------------------ | | | | ((bm)[(i) / YR_BITMASK_SLOT_BITS] & (1UL << ((i) % YR_BITMASK_SLOT_BITS))) | | | | ------------------ | | | | | | 56| 1.59k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | | | ------------------ | | ------------------ | | | Branch (77:38): [True: 1.59k, False: 0] | | ------------------ ------------------ 584| 1.59k| { 585| 1.59k| if (scanner->flags & SCAN_FLAGS_REPORT_RULES_MATCHING) ------------------ | | 41| 1.59k|#define SCAN_FLAGS_REPORT_RULES_MATCHING 8 ------------------ | Branch (585:11): [True: 1.59k, False: 0] ------------------ 586| 1.59k| message = CALLBACK_MSG_RULE_MATCHING; ------------------ | | 38| 1.59k|#define CALLBACK_MSG_RULE_MATCHING 1 ------------------ 587| 1.59k| } 588| 114| else 589| 114| { 590| 114| if (scanner->flags & SCAN_FLAGS_REPORT_RULES_NOT_MATCHING) ------------------ | | 42| 114|#define SCAN_FLAGS_REPORT_RULES_NOT_MATCHING 16 ------------------ | Branch (590:11): [True: 114, False: 0] ------------------ 591| 114| message = CALLBACK_MSG_RULE_NOT_MATCHING; ------------------ | | 39| 114|#define CALLBACK_MSG_RULE_NOT_MATCHING 2 ------------------ 592| 114| } 593| | 594| 1.70k| if (message != 0 && !RULE_IS_PRIVATE(rule)) ------------------ | | 57| 1.70k|#define RULE_IS_PRIVATE(x) (((x)->flags) & RULE_FLAGS_PRIVATE) | | ------------------ | | | | 52| 1.70k|#define RULE_FLAGS_PRIVATE 0x01 | | ------------------ ------------------ | Branch (594:9): [True: 1.70k, False: 0] | Branch (594:25): [True: 1.70k, False: 0] ------------------ 595| 1.70k| { 596| 1.70k| switch (scanner->callback(scanner, message, rule, scanner->user_data)) ------------------ | Branch (596:15): [True: 0, False: 1.70k] ------------------ 597| 1.70k| { 598| 0| case CALLBACK_ABORT: ------------------ | | 48| 0|#define CALLBACK_ABORT 1 ------------------ | Branch (598:7): [True: 0, False: 1.70k] ------------------ 599| 0| result = ERROR_SUCCESS; ------------------ | | 40| 0|#define ERROR_SUCCESS 0 ------------------ 600| 0| goto _exit; 601| | 602| 0| case CALLBACK_ERROR: ------------------ | | 49| 0|#define CALLBACK_ERROR 2 ------------------ | Branch (602:7): [True: 0, False: 1.70k] ------------------ 603| 0| result = ERROR_CALLBACK_ERROR; ------------------ | | 75| 0|#define ERROR_CALLBACK_ERROR 28 ------------------ 604| 0| goto _exit; 605| 1.70k| } 606| 1.70k| } 607| 1.70k| } 608| | 609| 1.70k| scanner->callback( 610| 1.70k| scanner, CALLBACK_MSG_SCAN_FINISHED, NULL, scanner->user_data); ------------------ | | 40| 1.70k|#define CALLBACK_MSG_SCAN_FINISHED 3 ------------------ 611| | 612| 1.70k|_exit: 613| | 614| | // If error is ERROR_BLOCK_NOT_READY we don't clean the matches and don't 615| | // destroy the notebook yet. ERROR_BLOCK_NOT_READY is not a permament error, 616| | // the caller can still call this function again for a retry. 617| 1.70k| if (result != ERROR_BLOCK_NOT_READY) ------------------ | | 108| 1.70k|#define ERROR_BLOCK_NOT_READY 61 ------------------ | Branch (617:7): [True: 1.70k, False: 0] ------------------ 618| 1.70k| { 619| 1.70k| _yr_scanner_clean_matches(scanner); 620| | 621| 1.70k| if (scanner->matches_notebook != NULL) ------------------ | Branch (621:9): [True: 1.70k, False: 0] ------------------ 622| 1.70k| { 623| 1.70k| yr_notebook_destroy(scanner->matches_notebook); 624| 1.70k| scanner->matches_notebook = NULL; 625| 1.70k| } 626| 1.70k| } 627| | 628| 1.70k| YR_DEBUG_FPRINTF( 629| 1.70k| 2, 630| 1.70k| stderr, 631| 1.70k| "} = %d AKA %s // %s()\n", 632| 1.70k| result, 633| 1.70k| yr_debug_error_as_string(result), 634| 1.70k| __FUNCTION__); 635| | 636| 1.70k| return result; 637| 1.70k|} yr_fetch_block_data: 688| 13.3k|{ 689| 13.3k| const uint8_t* data = block->fetch_data(block); 690| 13.3k| if (data == NULL) ------------------ | Branch (690:7): [True: 0, False: 13.3k] ------------------ 691| 0| { 692| 0| return NULL; 693| 0| } 694| 13.3k| jumpinfo* info = (jumpinfo*) yr_thread_storage_get_value( 695| 13.3k| &yr_trycatch_trampoline_tls); 696| 13.3k| if (info == NULL) // Not called from YR_TRYCATCH ------------------ | Branch (696:7): [True: 13.3k, False: 0] ------------------ 697| 13.3k| { 698| 13.3k| return data; 699| 13.3k| } 700| 0| info->memfault_from = (void*) data; 701| 0| info->memfault_to = (void*) (data + block->size); 702| 0| return data; 703| 13.3k|} yr_scanner_scan_mem: 709| 1.70k|{ 710| 1.70k| YR_DEBUG_FPRINTF( 711| 1.70k| 2, 712| 1.70k| stderr, 713| 1.70k| "+ %s(buffer=%p buffer_size=%zu) {\n", 714| 1.70k| __FUNCTION__, 715| 1.70k| buffer, 716| 1.70k| buffer_size); 717| | 718| 1.70k| YR_MEMORY_BLOCK block; 719| 1.70k| YR_MEMORY_BLOCK_ITERATOR iterator; 720| 1.70k| int result; 721| | 722| 1.70k| block.size = buffer_size; 723| 1.70k| block.base = 0; 724| 1.70k| block.fetch_data = _yr_fetch_block_data; 725| 1.70k| block.context = (void*) buffer; 726| | 727| 1.70k| iterator.context = █ 728| 1.70k| iterator.first = _yr_get_first_block; 729| 1.70k| iterator.next = _yr_get_next_block; 730| 1.70k| iterator.file_size = _yr_get_file_size; 731| 1.70k| iterator.last_error = ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 732| | 733| | // Detect cases where every byte of input is checked for match and input size 734| | // is bigger then 0.2 MB 735| 1.70k| if (scanner->rules->ac_match_table[YR_AC_ROOT_STATE] != 0 && ------------------ | | 45| 1.70k|#define YR_AC_ROOT_STATE 0 ------------------ | Branch (735:7): [True: 0, False: 1.70k] ------------------ 736| 0| buffer_size > YR_FILE_SIZE_THRESHOLD) ------------------ | | 125| 0|#define YR_FILE_SIZE_THRESHOLD 200000 ------------------ | Branch (736:7): [True: 0, False: 0] ------------------ 737| 0| { 738| 0| YR_STRING* report_string = 739| 0| scanner->rules->ac_match_pool[YR_AC_ROOT_STATE].string; ------------------ | | 45| 0|#define YR_AC_ROOT_STATE 0 ------------------ 740| 0| result = scanner->callback( 741| 0| scanner, 742| 0| CALLBACK_MSG_TOO_SLOW_SCANNING, ------------------ | | 45| 0|#define CALLBACK_MSG_TOO_SLOW_SCANNING 8 ------------------ 743| 0| (void*) report_string, 744| 0| scanner->user_data); 745| 0| if (result != CALLBACK_CONTINUE) ------------------ | | 47| 0|#define CALLBACK_CONTINUE 0 ------------------ | Branch (745:9): [True: 0, False: 0] ------------------ 746| 0| return ERROR_TOO_SLOW_SCANNING; ------------------ | | 112| 0|#define ERROR_TOO_SLOW_SCANNING 65 ------------------ 747| 0| } 748| | 749| 1.70k| result = yr_scanner_scan_mem_blocks(scanner, &iterator); 750| | 751| 1.70k| YR_DEBUG_FPRINTF( 752| 1.70k| 2, 753| 1.70k| stderr, 754| 1.70k| "} = %d AKA %s // %s()\n", 755| 1.70k| result, 756| 1.70k| yr_debug_error_as_string(result), 757| 1.70k| __FUNCTION__); 758| | 759| 1.70k| return result; 760| 1.70k|} scanner.c:_yr_scanner_scan_mem_block: 49| 1.70k|{ 50| 1.70k| YR_DEBUG_FPRINTF( 51| 1.70k| 2, 52| 1.70k| stderr, 53| 1.70k| "+ %s(block_data=%p block->base=0x%" PRIx64 " block->size=%zu) {\n", 54| 1.70k| __FUNCTION__, 55| 1.70k| block_data, 56| 1.70k| block->base, 57| 1.70k| block->size); 58| | 59| 1.70k| int result = ERROR_SUCCESS; ------------------ | | 40| 1.70k|#define ERROR_SUCCESS 0 ------------------ 60| | 61| 1.70k| YR_RULES* rules = scanner->rules; 62| 1.70k| YR_AC_TRANSITION* transition_table = rules->ac_transition_table; 63| 1.70k| uint32_t* match_table = rules->ac_match_table; 64| | 65| 1.70k| YR_AC_MATCH* match; 66| 1.70k| YR_AC_TRANSITION transition; 67| | 68| 1.70k| size_t i = 0; 69| 1.70k| uint32_t state = YR_AC_ROOT_STATE; ------------------ | | 45| 1.70k|#define YR_AC_ROOT_STATE 0 ------------------ 70| 1.70k| uint16_t index; 71| 1.70k| YR_STRING* report_string = NULL; 72| 1.70k| YR_RULE* rule = NULL; 73| | 74| 33.0M| while (i < block->size) ------------------ | Branch (74:10): [True: 33.0M, False: 1.70k] ------------------ 75| 33.0M| { 76| 33.0M| if (i % 4096 == 0 && scanner->timeout > 0) ------------------ | Branch (76:9): [True: 9.64k, False: 33.0M] | Branch (76:26): [True: 0, False: 9.64k] ------------------ 77| 0| { 78| 0| if (yr_stopwatch_elapsed_ns(&scanner->stopwatch) > scanner->timeout) ------------------ | Branch (78:11): [True: 0, False: 0] ------------------ 79| 0| { 80| 0| result = ERROR_SCAN_TIMEOUT; ------------------ | | 71| 0|#define ERROR_SCAN_TIMEOUT 26 ------------------ 81| 0| goto _exit; 82| 0| } 83| 0| } 84| | 85| |#if 2 == YR_DEBUG_VERBOSITY 86| | if (0 != state) 87| | YR_DEBUG_FPRINTF( 88| | 2, 89| | stderr, 90| | "- match_table[state=%u]=%'u i=%'ld " 91| | "block_data=%p block->base=0x%" PRIx64 " // %s()\n", 92| | state, 93| | match_table[state], 94| | i, 95| | block_data, 96| | block->base, 97| | __FUNCTION__); 98| |#endif 99| | 100| 33.0M| if (match_table[state] != 0) ------------------ | Branch (100:9): [True: 0, False: 33.0M] ------------------ 101| 0| { 102| | // If the entry corresponding to state N in the match table is zero, it 103| | // means that there's no match associated to the state. If it's non-zero, 104| | // its value is the 1-based index within ac_match_pool where the first 105| | // match resides. 106| | 107| 0| match = &rules->ac_match_pool[match_table[state] - 1]; 108| | 109| 0| if (scanner->matches->count >= YR_SLOW_STRING_MATCHES) ------------------ | | 119| 0|#define YR_SLOW_STRING_MATCHES 600000 ------------------ | Branch (109:11): [True: 0, False: 0] ------------------ 110| 0| { 111| 0| report_string = match->string; 112| 0| rule = report_string ------------------ | Branch (112:16): [True: 0, False: 0] ------------------ 113| 0| ? &scanner->rules->rules_table[report_string->rule_idx] 114| 0| : NULL; 115| 0| } 116| | 117| 0| while (match != NULL) ------------------ | Branch (117:14): [True: 0, False: 0] ------------------ 118| 0| { 119| 0| if (match->backtrack <= i) ------------------ | Branch (119:13): [True: 0, False: 0] ------------------ 120| 0| { 121| 0| GOTO_EXIT_ON_ERROR(yr_scan_verify_match( ------------------ | | 116| 0| { \ | | 117| 0| result = (x); \ | | 118| 0| if (result != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (118:9): [True: 0, False: 0] | | ------------------ | | 119| 0| goto _exit; \ | | 120| 0| } ------------------ 122| 0| scanner, 123| 0| match, 124| 0| block_data, 125| 0| block->size, 126| 0| block->base, 127| 0| i - match->backtrack)); 128| 0| } 129| | 130| 0| match = match->next; 131| 0| } 132| 0| } 133| | 134| 33.0M| index = block_data[i++] + 1; 135| 33.0M| transition = transition_table[state + index]; 136| | 137| 33.0M| while (YR_AC_INVALID_TRANSITION(transition, index)) ------------------ | | 47| 33.0M|#define YR_AC_INVALID_TRANSITION(t, c) (((t) &0x1FF) != c) | | ------------------ | | | Branch (47:40): [True: 33.0M, False: 0] | | ------------------ ------------------ 138| 33.0M| { 139| 33.0M| if (state != YR_AC_ROOT_STATE) ------------------ | | 45| 33.0M|#define YR_AC_ROOT_STATE 0 ------------------ | Branch (139:11): [True: 0, False: 33.0M] ------------------ 140| 0| { 141| 0| state = YR_AC_NEXT_STATE(transition_table[state]); ------------------ | | 46| 0|#define YR_AC_NEXT_STATE(t) (t >> YR_AC_SLOT_OFFSET_BITS) | | ------------------ | | | | 39| 0|#define YR_AC_SLOT_OFFSET_BITS 9 | | ------------------ ------------------ 142| 0| transition = transition_table[state + index]; 143| 0| } 144| 33.0M| else 145| 33.0M| { 146| 33.0M| transition = 0; 147| 33.0M| break; 148| 33.0M| } 149| 33.0M| } 150| | 151| 33.0M| state = YR_AC_NEXT_STATE(transition); ------------------ | | 46| 33.0M|#define YR_AC_NEXT_STATE(t) (t >> YR_AC_SLOT_OFFSET_BITS) | | ------------------ | | | | 39| 33.0M|#define YR_AC_SLOT_OFFSET_BITS 9 | | ------------------ ------------------ 152| 33.0M| } 153| | 154| 1.70k| if (match_table[state] != 0) ------------------ | Branch (154:7): [True: 0, False: 1.70k] ------------------ 155| 0| { 156| 0| match = &rules->ac_match_pool[match_table[state] - 1]; 157| | 158| 0| while (match != NULL) ------------------ | Branch (158:12): [True: 0, False: 0] ------------------ 159| 0| { 160| 0| if (match->backtrack <= i) ------------------ | Branch (160:11): [True: 0, False: 0] ------------------ 161| 0| { 162| 0| GOTO_EXIT_ON_ERROR(yr_scan_verify_match( ------------------ | | 116| 0| { \ | | 117| 0| result = (x); \ | | 118| 0| if (result != ERROR_SUCCESS) \ | | ------------------ | | | | 40| 0|#define ERROR_SUCCESS 0 | | ------------------ | | | Branch (118:9): [True: 0, False: 0] | | ------------------ | | 119| 0| goto _exit; \ | | 120| 0| } ------------------ 163| 0| scanner, 164| 0| match, 165| 0| block_data, 166| 0| block->size, 167| 0| block->base, 168| 0| i - match->backtrack)); 169| 0| } 170| | 171| 0| match = match->next; 172| 0| } 173| 0| } 174| | 175| 1.70k| if (rule != NULL && scanner->matches->count >= YR_SLOW_STRING_MATCHES && ------------------ | | 119| 1.70k|#define YR_SLOW_STRING_MATCHES 600000 ------------------ | Branch (175:7): [True: 0, False: 1.70k] | Branch (175:23): [True: 0, False: 0] ------------------ 176| 0| scanner->matches->count < YR_MAX_STRING_MATCHES) ------------------ | | 113| 0|#define YR_MAX_STRING_MATCHES 1000000 ------------------ | Branch (176:7): [True: 0, False: 0] ------------------ 177| 0| { 178| 0| if (rule != NULL && report_string != NULL) ------------------ | Branch (178:9): [True: 0, False: 0] | Branch (178:25): [True: 0, False: 0] ------------------ 179| 0| { 180| 0| result = scanner->callback( 181| 0| scanner, 182| 0| CALLBACK_MSG_TOO_SLOW_SCANNING, ------------------ | | 45| 0|#define CALLBACK_MSG_TOO_SLOW_SCANNING 8 ------------------ 183| 0| (void*) report_string, 184| 0| scanner->user_data); 185| 0| if (result != CALLBACK_CONTINUE) ------------------ | | 47| 0|#define CALLBACK_CONTINUE 0 ------------------ | Branch (185:11): [True: 0, False: 0] ------------------ 186| 0| { 187| 0| result = ERROR_TOO_SLOW_SCANNING; ------------------ | | 112| 0|#define ERROR_TOO_SLOW_SCANNING 65 ------------------ 188| 0| goto _exit; 189| 0| } 190| 0| } 191| 0| } 192| | 193| 1.70k|_exit: 194| | 195| 1.70k| YR_DEBUG_FPRINTF( 196| 1.70k| 2, 197| 1.70k| stderr, 198| 1.70k| "} = %d AKA %s // %s()\n", 199| 1.70k| result, 200| 1.70k| yr_debug_error_as_string(result), 201| 1.70k| __FUNCTION__); 202| | 203| 1.70k| return result; 204| 1.70k|} scanner.c:_yr_scanner_clean_matches: 207| 1.70k|{ 208| 1.70k| YR_DEBUG_FPRINTF(2, stderr, "- %s() {} \n", __FUNCTION__); 209| | 210| 1.70k| memset( 211| 1.70k| scanner->rule_matches_flags, 212| 1.70k| 0, 213| 1.70k| sizeof(YR_BITMASK) * YR_BITMASK_SIZE(scanner->rules->num_rules)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 214| | 215| 1.70k| memset( 216| 1.70k| scanner->required_eval, 217| 1.70k| 0, 218| 1.70k| sizeof(YR_BITMASK) * YR_BITMASK_SIZE(scanner->rules->num_rules)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 219| | 220| 1.70k| memset( 221| 1.70k| scanner->ns_unsatisfied_flags, 222| 1.70k| 0, 223| 1.70k| sizeof(YR_BITMASK) * YR_BITMASK_SIZE(scanner->rules->num_namespaces)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 224| | 225| 1.70k| memset( 226| 1.70k| scanner->strings_temp_disabled, 227| 1.70k| 0, 228| 1.70k| sizeof(YR_BITMASK) * YR_BITMASK_SIZE(scanner->rules->num_strings)); ------------------ | | 57| 1.70k|#define YR_BITMASK_SIZE(n) (((n) / (YR_BITMASK_SLOT_BITS)) + 1) | | ------------------ | | | | 56| 1.70k|#define YR_BITMASK_SLOT_BITS (sizeof(YR_BITMASK) * 8) | | ------------------ ------------------ 229| | 230| 1.70k| memset(scanner->matches, 0, sizeof(YR_MATCHES) * scanner->rules->num_strings); 231| | 232| 1.70k| memset( 233| 1.70k| scanner->unconfirmed_matches, 234| 1.70k| 0, 235| 1.70k| sizeof(YR_MATCHES) * scanner->rules->num_strings); 236| 1.70k|} scanner.c:_yr_fetch_block_data: 683| 13.3k|{ 684| 13.3k| return (const uint8_t*) block->context; 685| 13.3k|} scanner.c:_yr_get_first_block: 640| 24.9k|{ 641| 24.9k| YR_MEMORY_BLOCK* result = (YR_MEMORY_BLOCK*) iterator->context; 642| | 643| 24.9k| YR_DEBUG_FPRINTF( 644| 24.9k| 2, 645| 24.9k| stderr, 646| 24.9k| "- %s() {} = %p // default iterator; single memory block, blocking\n", 647| 24.9k| __FUNCTION__, 648| 24.9k| result); 649| | 650| 24.9k| return result; 651| 24.9k|} scanner.c:_yr_get_next_block: 654| 1.70k|{ 655| 1.70k| YR_MEMORY_BLOCK* result = NULL; 656| | 657| 1.70k| YR_DEBUG_FPRINTF( 658| 1.70k| 2, 659| 1.70k| stderr, 660| 1.70k| "- %s() {} = %p // default iterator; single memory block, blocking\n", 661| 1.70k| __FUNCTION__, 662| 1.70k| result); 663| | 664| 1.70k| return result; 665| 1.70k|} scanner.c:_yr_get_file_size: 668| 1.70k|{ 669| 1.70k| uint64_t file_size = ((YR_MEMORY_BLOCK*) iterator->context)->size; 670| | 671| 1.70k| YR_DEBUG_FPRINTF( 672| 1.70k| 2, 673| 1.70k| stderr, 674| 1.70k| "- %s() {} = %" PRIu64 675| 1.70k| " // default iterator; single memory block, blocking\n", 676| 1.70k| __FUNCTION__, 677| 1.70k| file_size); 678| | 679| 1.70k| return file_size; 680| 1.70k|} yr_stopwatch_start: 84| 1.70k|{ 85| | clock_gettime(CLOCK_MONOTONIC, &stopwatch->ts_start); 86| 1.70k|} strlcat: 125| 24|{ 126| 24| register char* d = dst; 127| 24| register const char* s = src; 128| 24| register size_t n = size; 129| 24| size_t dlen; 130| | 131| | // Find the end of dst and adjust bytes left but don't go past end 132| | 133| 54| while (n-- != 0 && *d != '\0') d++; ------------------ | Branch (133:10): [True: 54, False: 0] | Branch (133:22): [True: 30, False: 24] ------------------ 134| | 135| 24| dlen = d - dst; 136| 24| n = size - dlen; 137| | 138| 24| if (n == 0) ------------------ | Branch (138:7): [True: 0, False: 24] ------------------ 139| 0| return (dlen + strlen(s)); 140| | 141| 48| while (*s != '\0') ------------------ | Branch (141:10): [True: 24, False: 24] ------------------ 142| 24| { 143| 24| if (n != 1) ------------------ | Branch (143:9): [True: 24, False: 0] ------------------ 144| 24| { 145| 24| *d++ = *s; 146| 24| n--; 147| 24| } 148| 24| s++; 149| 24| } 150| | 151| 24| *d = '\0'; 152| | 153| 24| return (dlen + (s - src)); // count does not include NULL 154| 24|} yr_thread_storage_create: 160| 4|{ 161| 4| if (pthread_key_create(storage, NULL) != 0) ------------------ | Branch (161:7): [True: 0, False: 4] ------------------ 162| 0| return ERROR_INTERNAL_FATAL_ERROR; ------------------ | | 78| 0|#define ERROR_INTERNAL_FATAL_ERROR 31 ------------------ 163| | 164| 4| return ERROR_SUCCESS; ------------------ | | 40| 4|#define ERROR_SUCCESS 0 ------------------ 165| 4|} yr_thread_storage_get_value: 187| 13.3k|{ 188| 13.3k| return pthread_getspecific(*storage); 189| 13.3k|} LLVMFuzzerInitialize: 51| 2|{ 52| 2| YR_COMPILER* compiler; 53| | 54| 2| if (yr_initialize() != ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (54:7): [True: 0, False: 2] ------------------ 55| 0| return 0; 56| | 57| 2| if (yr_compiler_create(&compiler) != ERROR_SUCCESS) ------------------ | | 40| 2|#define ERROR_SUCCESS 0 ------------------ | Branch (57:7): [True: 0, False: 2] ------------------ 58| 0| return 0; 59| | 60| 2| if (yr_compiler_add_string(compiler, RULES, NULL) == 0) ------------------ | Branch (60:7): [True: 2, False: 0] ------------------ 61| 2| yr_compiler_get_rules(compiler, &rules); 62| | 63| 2| yr_compiler_destroy(compiler); 64| | 65| 2| return 0; 66| 2|} _Z8callbackP15YR_SCAN_CONTEXTiPvS1_: 74| 6.82k|{ 75| 6.82k| return CALLBACK_CONTINUE; ------------------ | | 47| 6.82k|#define CALLBACK_CONTINUE 0 ------------------ 76| 6.82k|} LLVMFuzzerTestOneInput: 80| 1.70k|{ 81| 1.70k| if (rules == NULL || size == 0) ------------------ | Branch (81:7): [True: 0, False: 1.70k] | Branch (81:24): [True: 0, False: 1.70k] ------------------ 82| 0| return 0; 83| | 84| 1.70k| yr_rules_scan_mem( 85| 1.70k| rules, data, size, SCAN_FLAGS_NO_TRYCATCH, callback, NULL, 0); ------------------ | | 40| 1.70k|#define SCAN_FLAGS_NO_TRYCATCH 4 ------------------ 86| | 87| 1.70k| return 0; 88| 1.70k|}