/*
  * YARA parser for ClamAV: back-end functions
  * 

  * Copyright (C) 2014-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

  * 
  * Authors: Steven Morgan
  * 
  * This program is free software; you can redistribute it and/or modify it under
  * the terms of the GNU General Public License version 2 as published by the
  * Free Software Foundation.
  * 
  * This program is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  * more details.
  * 
  * You should have received a copy of the GNU General Public License along with
  * this program; if not, write to the Free Software Foundation, Inc., 51
  * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  */

 /*

 Copyright (c) 2013. The YARA Authors. All Rights Reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
 
 #include <stddef.h>
 #include <string.h>
 
 #ifdef REAL_YARA
 #include <yara/ahocorasick.h>
 #include <yara/arena.h>
 #include <yara/re.h>
 #include <yara/error.h>
 #include <yara/exec.h>
 #include <yara/object.h>
 #include <yara/utils.h>
 #include <yara/modules.h>
 #include <yara/parser.h>
 #include <yara/mem.h>
 #else
 #include <stdint.h>
 #include <stdio.h>
 #include "yara_clam.h"
 #include "yara_grammar.h"
 #include "yara_lexer.h"

 #include "yara_exec.h"

 #include "others.h"
 #endif
 

 #define todigit(x) ((x) >= 'A' && (x) <= 'F')      \
                        ? ((uint8_t)(x - 'A' + 10)) \
                        : ((uint8_t)(x - '0'))

 
 int yr_parser_emit(
     yyscan_t yyscanner,
     int8_t instruction,
     int8_t** instruction_address)
 {

     return yr_arena_write_data(
         yyget_extra(yyscanner)->code_arena,
         &instruction,
         sizeof(int8_t),
         (void**)instruction_address);

 }
 
 int yr_parser_emit_with_arg(
     yyscan_t yyscanner,
     int8_t instruction,
     int64_t argument,
     int8_t** instruction_address)
 {

     int result = yr_arena_write_data(

         yyget_extra(yyscanner)->code_arena,

         &instruction,
         sizeof(int8_t),
         (void**)instruction_address);

     if (result == ERROR_SUCCESS)
         result = yr_arena_write_data(
             yyget_extra(yyscanner)->code_arena,
             &argument,
             sizeof(int64_t),
             NULL);

     return result;
 }

 
 int yr_parser_emit_with_arg_reloc(
     yyscan_t yyscanner,
     int8_t instruction,
     int64_t argument,
     int8_t** instruction_address)
 {

     void* ptr;

     int result = yr_arena_write_data(

         yyget_extra(yyscanner)->code_arena,

         &instruction,
         sizeof(int8_t),
         (void**)instruction_address);

     if (result == ERROR_SUCCESS)
         result = yr_arena_write_data(
             yyget_extra(yyscanner)->code_arena,
             &argument,
             sizeof(int64_t),
             &ptr);

     if (result == ERROR_SUCCESS)
         result = yr_arena_make_relocatable(
             yyget_extra(yyscanner)->code_arena,
             ptr,
             0,
             EOL);

     return result;
 }

 
 int yr_parser_emit_pushes_for_strings(
     yyscan_t yyscanner,
     const char* identifier)
 {

     YR_COMPILER* compiler = yyget_extra(yyscanner);
     YR_STRING* string     = compiler->current_rule_strings;
 
     const char* string_identifier;
     const char* target_identifier;
 
     int matching = 0;
 
     while (!STRING_IS_NULL(string)) {
         // Don't generate pushes for strings chained to another one, we are
         // only interested in non-chained strings or the head of the chain.
 
         if (string->chained_to == NULL) {
             string_identifier = string->identifier;
             target_identifier = identifier;
 
             while (*target_identifier != '\0' &&
                    *string_identifier != '\0' &&
                    *target_identifier == *string_identifier) {
                 target_identifier++;
                 string_identifier++;
             }
 
             if ((*target_identifier == '\0' && *string_identifier == '\0') ||
                 *target_identifier == '*') {
                 yr_parser_emit_with_arg_reloc(
                     yyscanner,
                     OP_PUSH,
                     PTR_TO_UINT64(string),
                     NULL);
 
                 string->g_flags |= STRING_GFLAGS_REFERENCED;
                 matching++;
             }
         }

         string = yr_arena_next_address(
             compiler->strings_arena,
             string,
             sizeof(YR_STRING));

     }
 

     if (matching == 0) {
         yr_compiler_set_error_extra_info(compiler, identifier);
         compiler->last_result = ERROR_UNDEFINED_STRING;
     }

     return compiler->last_result;

 }
 
 int yr_parser_check_types(
     YR_COMPILER* compiler,
     YR_OBJECT_FUNCTION* function,
     const char* actual_args_fmt)
 {

     int i;

     char message[MAX_COMPILER_ERROR_EXTRA_INFO];

     const char* expected = function->arguments_fmt;
     const char* actual   = actual_args_fmt;

     i = 0;

     while (*expected != '\0' || *actual != '\0') {
         i++;

         if (*expected != *actual) {
             if (*expected == '\0' || *actual == '\0') {
                 snprintf(
                     message,
                     sizeof(message),
                     "wrong number of arguments for \"%s\"",
                     function->identifier);

                 compiler->last_result = ERROR_WRONG_NUMBER_OF_ARGUMENTS;
             } else {
                 snprintf(
                     message,
                     sizeof(message),
                     "wrong type for argument %i of \"%s\"",
                     i,
                     function->identifier);

                 compiler->last_result = ERROR_WRONG_TYPE;
             }

             yr_compiler_set_error_extra_info(compiler, message);
             break;
         }

         expected++;
         actual++;
     }
 
     return compiler->last_result;
 }

 
 YR_STRING* yr_parser_lookup_string(
     yyscan_t yyscanner,
     const char* identifier)
 {

     YR_STRING* string;
     YR_COMPILER* compiler = yyget_extra(yyscanner);

     string = compiler->current_rule_strings;

     while (!STRING_IS_NULL(string)) {
         // If some string $a gets fragmented into multiple chained
         // strings, all those fragments have the same $a identifier
         // but we are interested in the heading fragment, which is
         // that with chained_to == NULL

         if (strcmp(string->identifier, identifier) == 0 &&
             string->chained_to == NULL) {
             return string;
         }

         string = yr_arena_next_address(
             compiler->strings_arena,
             string,
             sizeof(YR_STRING));
     }

     yr_compiler_set_error_extra_info(compiler, identifier);
     compiler->last_result = ERROR_UNDEFINED_STRING;

     return NULL;

 }
 
 int yr_parser_lookup_loop_variable(
     yyscan_t yyscanner,
     const char* identifier)
 {

     YR_COMPILER* compiler = yyget_extra(yyscanner);
     int i;

     for (i = 0; i < compiler->loop_depth; i++) {
         if (compiler->loop_identifier[i] != NULL &&
             strcmp(identifier, compiler->loop_identifier[i]) == 0)
             return i;
     }

     return -1;
 }

 
 int _yr_parser_write_string(
     const char* identifier,
     int flags,
     YR_COMPILER* compiler,
     SIZED_STRING* str,
     RE* re,
     YR_STRING** string,
     int* min_atom_length)
 {

     SIZED_STRING* literal_string;

 #ifdef REAL_YARA

     YR_AC_MATCH* new_match;

     YR_ATOM_LIST_ITEM* atom;
     YR_ATOM_LIST_ITEM* atom_list = NULL;

 #endif

     int result;

 #if REAL_YARA

     int max_string_len;
     int free_literal = FALSE;

 #endif
 
 #if !REAL_YARA
     UNUSEDPARAM(re);
     UNUSEDPARAM(min_atom_length);
 #endif

     *string = NULL;

     result = yr_arena_allocate_struct(
         compiler->strings_arena,
         sizeof(YR_STRING),
         (void**)string,
         offsetof(YR_STRING, identifier),
         offsetof(YR_STRING, string),
         offsetof(YR_STRING, chained_to),
         EOL);

     if (result != ERROR_SUCCESS)
         return result;

     result = yr_arena_write_string(
         compiler->sz_arena,
         identifier,
         &(*string)->identifier);

     if (result != ERROR_SUCCESS)
         return result;

 #if REAL_YARA

     if (flags & STRING_GFLAGS_HEXADECIMAL ||
         flags & STRING_GFLAGS_REGEXP) {
         literal_string = yr_re_extract_literal(re);

         if (literal_string != NULL) {
             flags |= STRING_GFLAGS_LITERAL;
             free_literal = TRUE;
         }
     } else {
         literal_string = str;
         flags |= STRING_GFLAGS_LITERAL;

     }

 #else

     literal_string    = str;

 #endif

     (*string)->g_flags    = flags;
     (*string)->chained_to = NULL;

 #ifdef PROFILING_ENABLED
     (*string)->clock_ticks = 0;
 #endif

 #if REAL_YARA

     memset((*string)->matches, 0,
            sizeof((*string)->matches));
 
     memset((*string)->unconfirmed_matches, 0,
            sizeof((*string)->unconfirmed_matches));
 
     if (flags & STRING_GFLAGS_LITERAL) {
         (*string)->length = literal_string->length;
 
         result = yr_arena_write_data(
             compiler->sz_arena,
             literal_string->c_string,
             literal_string->length,
             (void*)&(*string)->string);
 
         if (result == ERROR_SUCCESS) {
             result = yr_atoms_extract_from_string(
                 (uint8_t*)literal_string->c_string,
                 literal_string->length,
                 flags,
                 &atom_list);
         }
     } else {
         result = yr_re_emit_code(re, compiler->re_code_arena);

         if (result == ERROR_SUCCESS)
             result = yr_atoms_extract_from_re(re, flags, &atom_list);

     }
 

     if (result == ERROR_SUCCESS) {
         // Add the string to Aho-Corasick automaton.
 
         if (atom_list != NULL) {
             result = yr_ac_add_string(
                 compiler->automaton_arena,
                 compiler->automaton,
                 *string,
                 atom_list);
         } else {
             result = yr_arena_allocate_struct(
                 compiler->automaton_arena,
                 sizeof(YR_AC_MATCH),
                 (void**)&new_match,
                 offsetof(YR_AC_MATCH, string),
                 offsetof(YR_AC_MATCH, forward_code),
                 offsetof(YR_AC_MATCH, backward_code),
                 offsetof(YR_AC_MATCH, next),
                 EOL);
 
             if (result == ERROR_SUCCESS) {
                 new_match->backtrack               = 0;
                 new_match->string                  = *string;
                 new_match->forward_code            = re->root_node->forward_code;
                 new_match->backward_code           = NULL;
                 new_match->next                    = compiler->automaton->root->matches;
                 compiler->automaton->root->matches = new_match;
             }
         }

     }
 

     atom = atom_list;

     if (atom != NULL)
         *min_atom_length = MAX_ATOM_LENGTH;
     else
         *min_atom_length = 0;

     while (atom != NULL) {
         if (atom->atom_length < *min_atom_length)
             *min_atom_length = atom->atom_length;
         atom = atom->next;
     }

     if (flags & STRING_GFLAGS_LITERAL) {
         if (flags & STRING_GFLAGS_WIDE)
             max_string_len = (*string)->length * 2;
         else
             max_string_len = (*string)->length;

         if (max_string_len == *min_atom_length)
             (*string)->g_flags |= STRING_GFLAGS_FITS_IN_ATOM;
     }

     if (free_literal)
         yr_free(literal_string);

     if (atom_list != NULL)
         yr_atoms_list_destroy(atom_list);

 #else

     (*string)->length = literal_string->length;
 
     result = yr_arena_write_data(

         compiler->sz_arena,
         literal_string->c_string,
         literal_string->length,

         (void*)&(*string)->string);

 #endif

     return result;

 }
 
 #include <stdint.h>
 #include <limits.h>
 
 YR_STRING* yr_parser_reduce_string_declaration(
     yyscan_t yyscanner,
     int32_t string_flags,
     const char* identifier,
     SIZED_STRING* str)
 {

     int min_atom_length;
     int re_flags = 0;

     YR_COMPILER* compiler = yyget_extra(yyscanner);
     YR_STRING* string     = NULL;

 
 #if REAL_YARA
     int min_atom_length_aux;
     char message[512];
     int32_t min_gap;
     int32_t max_gap;

     YR_STRING* aux_string;
     YR_STRING* prev_string;

     RE* re = NULL;
     RE* remainder_re;
     RE_ERROR re_error;

 #endif

     if (str->flags & SIZED_STRING_FLAGS_NO_CASE)
         string_flags |= STRING_GFLAGS_NO_CASE;

     if (str->flags & SIZED_STRING_FLAGS_DOT_ALL)
         re_flags |= RE_FLAGS_DOT_ALL;

     if (strcmp(identifier, "$") == 0)
         string_flags |= STRING_GFLAGS_ANONYMOUS;

     if (!(string_flags & STRING_GFLAGS_WIDE))
         string_flags |= STRING_GFLAGS_ASCII;

     if (string_flags & STRING_GFLAGS_NO_CASE)
         re_flags |= RE_FLAGS_NO_CASE;

     // The STRING_GFLAGS_SINGLE_MATCH flag indicates that finding
     // a single match for the string is enough. This is true in
     // most cases, except when the string count (#) and string offset (@)
     // operators are used. All strings are marked STRING_FLAGS_SINGLE_MATCH
     // initially, and unmarked later if required.

     string_flags |= STRING_GFLAGS_SINGLE_MATCH;

 #if REAL_YARA

     if (string_flags & STRING_GFLAGS_HEXADECIMAL ||
         string_flags & STRING_GFLAGS_REGEXP) {
         if (string_flags & STRING_GFLAGS_HEXADECIMAL)
             compiler->last_result = yr_re_parse_hex(
                 str->c_string, re_flags, &re, &re_error);
         else
             compiler->last_result = yr_re_parse(
                 str->c_string, re_flags, &re, &re_error);
 
         if (compiler->last_result != ERROR_SUCCESS) {
             snprintf(
                 message,
                 sizeof(message),
                 "invalid %s \"%s\": %s",
                 (string_flags & STRING_GFLAGS_HEXADECIMAL) ? "hex string" : "regular expression",
                 identifier,
                 re_error.message);
 
             yr_compiler_set_error_extra_info(
                 compiler, message);
 
             goto _exit;
         }

         if (re->flags & RE_FLAGS_FAST_HEX_REGEXP)
             string_flags |= STRING_GFLAGS_FAST_HEX_REGEXP;

         compiler->last_result = yr_re_split_at_chaining_point(
             re, &re, &remainder_re, &min_gap, &max_gap);

         if (compiler->last_result != ERROR_SUCCESS)
             goto _exit;

         compiler->last_result = _yr_parser_write_string(
             identifier,
             string_flags,
             compiler,
             NULL,
             re,
             &string,
             &min_atom_length);

         if (compiler->last_result != ERROR_SUCCESS)
             goto _exit;

         if (remainder_re != NULL) {
             string->g_flags |= STRING_GFLAGS_CHAIN_TAIL | STRING_GFLAGS_CHAIN_PART;
             string->chain_gap_min = min_gap;
             string->chain_gap_max = max_gap;

             // Use "aux_string" from now on, we want to keep the value of "string"
             // because it will returned.

             aux_string = string;

             while (remainder_re != NULL) {
                 // Destroy regexp pointed by 're' before yr_re_split_at_jmp
                 // overwrites 're' with another value.

                 yr_re_destroy(re);

                 compiler->last_result = yr_re_split_at_chaining_point(
                     remainder_re, &re, &remainder_re, &min_gap, &max_gap);

                 if (compiler->last_result != ERROR_SUCCESS)
                     goto _exit;

                 prev_string = aux_string;

                 compiler->last_result = _yr_parser_write_string(
                     identifier,
                     string_flags,
                     compiler,
                     NULL,
                     re,
                     &aux_string,
                     &min_atom_length_aux);

                 if (compiler->last_result != ERROR_SUCCESS)
                     goto _exit;

                 if (min_atom_length_aux < min_atom_length)
                     min_atom_length = min_atom_length_aux;

                 aux_string->g_flags |= STRING_GFLAGS_CHAIN_PART;
                 aux_string->chain_gap_min = min_gap;
                 aux_string->chain_gap_max = max_gap;

                 prev_string->chained_to = aux_string;
             }
         } else {

 #endif

             compiler->last_result = _yr_parser_write_string(
                 identifier,
                 string_flags,
                 compiler,
                 str,
                 NULL,
                 &string,
                 &min_atom_length);
 
             if (compiler->last_result != ERROR_SUCCESS)
                 goto _exit;

 #if REAL_YARA

         }

 #endif

         if (string == NULL) {
             cli_errmsg("yara_parser: no mem for struct _yc_string.\n");
             compiler->last_result = CL_EMEM;
             return NULL;
         }

         STAILQ_INSERT_TAIL(&compiler->current_rule_string_q, string, link);

 
 #if REAL_YARA

         if (min_atom_length < 2 && compiler->callback != NULL) {
             snprintf(
                 message,
                 sizeof(message),
                 "%s is slowing down scanning%s",
                 string->identifier,
                 min_atom_length == 0 ? " (critical!)" : "");
 
             yywarning(yyscanner, message);
         }

 #endif

     _exit:

 #if REAL_YARA
         if (re != NULL)
             yr_re_destroy(re);

 #endif

         if (compiler->last_result != ERROR_SUCCESS)
             return NULL;

         return string;
     }

     int yr_parser_reduce_rule_declaration(
         yyscan_t yyscanner,
         int32_t flags,
         const char* identifier,
         char* tags,
         YR_STRING* strings,
         YR_META* metas)
     {
         YR_COMPILER* compiler = yyget_extra(yyscanner);
 
         YR_RULE* rule;
         YR_STRING* string;
         uint8_t halt = OP_HALT;
 

 #if !REAL_YARA
         UNUSEDPARAM(tags);
         UNUSEDPARAM(strings);
         UNUSEDPARAM(metas);
 #endif
 

         if (yr_hash_table_lookup(
                 compiler->rules_table,
                 identifier,
                 compiler->current_namespace->name) != NULL ||
             yr_hash_table_lookup(
                 compiler->objects_table,
                 identifier,
                 compiler->current_namespace->name) != NULL) {
             // A rule or variable with the same identifier already exists, return the
             // appropriate error.
 
             yr_compiler_set_error_extra_info(compiler, identifier);
             compiler->last_result = ERROR_DUPLICATE_IDENTIFIER;
             return compiler->last_result;
         }

         // Check for unreferenced (unused) strings.

         string = compiler->current_rule_strings;

         while (!STRING_IS_NULL(string)) {
             // Only the heading fragment in a chain of strings (the one with
             // chained_to == NULL) must be referenced. All other fragments
             // are never marked as referenced.
 
             if (!STRING_IS_REFERENCED(string) &&
                 string->chained_to == NULL) {
                 yr_compiler_set_error_extra_info(compiler, string->identifier);
                 compiler->last_result = ERROR_UNREFERENCED_STRING;
                 break;
             }
 
             string = yr_arena_next_address(
                 compiler->strings_arena,
                 string,
                 sizeof(YR_STRING));
         }

         if (compiler->last_result != ERROR_SUCCESS)
             return compiler->last_result;
 
         FAIL_ON_COMPILER_ERROR(yr_arena_allocate_struct(
             compiler->rules_arena,
             sizeof(YR_RULE),
             (void**)&rule,
             offsetof(YR_RULE, identifier),
             //      offsetof(YR_RULE, tags), ClamAV - later
             offsetof(YR_RULE, strings),
             //      offsetof(YR_RULE, metas), ClamAV - later
             //      offsetof(YR_RULE, ns), ClamAV - later
             EOL));
 
         if (rule == NULL) {
             cli_errmsg("yara_parser: no mem for struct _yc_rule.\n");
             return CL_EMEM;
         }
         STAILQ_INIT(&rule->strings);
         STAILQ_CONCAT(&rule->strings, &compiler->current_rule_string_q);
         STAILQ_INIT(&compiler->current_rule_string_q);

         rule->g_flags = flags | compiler->current_rule_flags;
 #if REAL_YARA
         rule->tags    = tags;
         rule->strings = strings;
         rule->metas   = metas;
         rule->ns      = compiler->current_namespace;

 #ifdef PROFILING_ENABLED
         rule->clock_ticks = 0;
 #endif
 #endif
         FAIL_ON_COMPILER_ERROR(yr_arena_write_string(
             compiler->sz_arena,
             identifier,
             (char**)&rule->identifier));

         FAIL_ON_COMPILER_ERROR(yr_parser_emit_with_arg_reloc(
             yyscanner,
             OP_MATCH_RULE,
             PTR_TO_UINT64(rule),
             NULL));

         FAIL_ON_COMPILER_ERROR(yr_hash_table_add(
             compiler->rules_table,
             identifier,
             compiler->current_namespace->name,
             (void*)rule));

         compiler->current_rule_flags = 0;

 #if REAL_YARA

         compiler->current_rule_strings = NULL;

 #else

     rule->cl_flags                 = compiler->current_rule_clflags;
     compiler->current_rule_clflags = 0;
     // Write halt instruction at the end of code.
     yr_arena_write_data(
         compiler->code_arena,
         &halt,
         sizeof(int8_t),
         NULL);
     //TBD: seems like we will need the following yr_arena_coalesce, but it is not working.
     //Yara condition code will work OK as long as it is less than 64K.
     //FAIL_ON_COMPILER_ERROR(yr_arena_coalesce(compiler->code_arena));
     rule->code_start = yr_arena_base_address(compiler->code_arena);
     yr_arena_append(compiler->the_arena, compiler->code_arena);
     FAIL_ON_COMPILER_ERROR(yr_arena_create(65536, 0, &compiler->code_arena));
     STAILQ_INSERT_TAIL(&compiler->rule_q, rule, link);

 #endif

         return compiler->last_result;
     }

     int yr_parser_reduce_string_identifier(
         yyscan_t yyscanner,
         const char* identifier,
         int8_t instruction)

     {

         YR_STRING* string;
         YR_COMPILER* compiler = yyget_extra(yyscanner);
 
         if (strcmp(identifier, "$") == 0) {
             if (compiler->loop_for_of_mem_offset >= 0) {
                 yr_parser_emit_with_arg(
                     yyscanner,
                     OP_PUSH_M,
                     compiler->loop_for_of_mem_offset,
                     NULL);
 
                 yr_parser_emit(yyscanner, instruction, NULL);
 
                 if (instruction != OP_STR_FOUND) {
                     string = compiler->current_rule_strings;
 
                     while (!STRING_IS_NULL(string)) {
                         string->g_flags &= ~STRING_GFLAGS_SINGLE_MATCH;
                         string = yr_arena_next_address(
                             compiler->strings_arena,
                             string,
                             sizeof(YR_STRING));
                     }
                 }
             } else {
                 compiler->last_result = ERROR_MISPLACED_ANONYMOUS_STRING;
             }
         } else {
             string = yr_parser_lookup_string(yyscanner, identifier);
 
             if (string != NULL) {
                 yr_parser_emit_with_arg_reloc(
                     yyscanner,
                     OP_PUSH,
                     PTR_TO_UINT64(string),
                     NULL);
 
                 if (instruction != OP_STR_FOUND)
                     string->g_flags &= ~STRING_GFLAGS_SINGLE_MATCH;
 
                 yr_parser_emit(yyscanner, instruction, NULL);
 
                 string->g_flags |= STRING_GFLAGS_REFERENCED;
             }

         }

         return compiler->last_result;

     }
 

     YR_META* yr_parser_reduce_meta_declaration(
         yyscan_t yyscanner,
         int32_t type,
         const char* identifier,
         const char* string,
         int32_t integer)

     {

         YR_COMPILER* compiler = yyget_extra(yyscanner);
         YR_META* meta;
         compiler->last_result = yr_arena_allocate_struct(
             compiler->metas_arena,
             sizeof(YR_META),
             (void**)&meta,
             offsetof(YR_META, identifier),
             offsetof(YR_META, string),
             EOL);
 
         if (compiler->last_result != ERROR_SUCCESS)
             return NULL;
 
         compiler->last_result = yr_arena_write_string(
             compiler->sz_arena,
             identifier,
             (char**)&meta->identifier);
 
         if (compiler->last_result != ERROR_SUCCESS)
             return NULL;
 
         if (string != NULL)
             compiler->last_result = yr_arena_write_string(
                 compiler->sz_arena,
                 string,
                 &meta->string);
         else
             meta->string = NULL;
 
         if (compiler->last_result != ERROR_SUCCESS)
             return NULL;
 
         meta->integer = integer;
         meta->type    = type;
 
         return meta;

 #if 0 //meta w.i.p.

   meta = cli_calloc(1, sizeof(YR_META));
   if (meta == NULL) {
       cli_errmsg("yara_parser: no mem for YR_META.\n");
       compiler->last_result = CL_EMEM;
       return NULL;
   }

   if (identifier != NULL) {
       meta->identifier = cli_strdup(identifier);
       if (meta->identifier == NULL) {
           cli_errmsg("yara_parser: no mem for meta->identifier.\n");
           compiler->last_result = CL_EMEM;
           return NULL;
       }
   }
   if (string != NULL) {
       meta->string = cli_strdup(string);
       if (meta->string == NULL) {
           cli_errmsg("yara_parser: no mem for meta->string.\n");
           compiler->last_result = CL_EMEM;
           return NULL;
       }
   }
   meta->integer = integer;
   meta->type = type;
 
   STAILQ_INSERT_TAIL(&compiler->current_meta, meta, link);

   return meta;
 #endif

     }

     int yr_parser_reduce_import(
         yyscan_t yyscanner,
         SIZED_STRING * module_name)
     {

 #if REAL_YARA

         YR_COMPILER* compiler = NULL;
         ///  YR_OBJECT* module_structure;

         char* name;

         compiler = yyget_extra(yyscanner);
 

         module_structure = yr_hash_table_lookup(
             compiler->objects_table,
             module_name->c_string,
             compiler->current_namespace->name);

         // if module already imported, do nothing

         if (module_structure != NULL)
             return ERROR_SUCCESS;

         compiler->last_result = yr_object_create(
             OBJECT_TYPE_STRUCTURE,
             module_name->c_string,
             NULL,
             &module_structure);

         if (compiler->last_result == ERROR_SUCCESS)
             compiler->last_result = yr_hash_table_add(
                 compiler->objects_table,
                 module_name->c_string,
                 compiler->current_namespace->name,
                 module_structure);
 
         if (compiler->last_result == ERROR_SUCCESS) {
             compiler->last_result = yr_modules_do_declarations(
                 module_name->c_string,
                 module_structure);

             if (compiler->last_result == ERROR_UNKNOWN_MODULE)
                 yr_compiler_set_error_extra_info(compiler, module_name->c_string);
         }
 
         if (compiler->last_result == ERROR_SUCCESS)
             compiler->last_result = yr_arena_write_string(
                 compiler->sz_arena,
                 module_name->c_string,
                 &name);
 
         if (compiler->last_result == ERROR_SUCCESS)
             compiler->last_result = yr_parser_emit_with_arg_reloc(
                 yyscanner,
                 OP_IMPORT,
                 PTR_TO_UINT64(name),
                 NULL);
 
         return compiler->last_result;

 #else

     UNUSEDPARAM(yyscanner);
     UNUSEDPARAM(module_name);
 

     return ERROR_SUCCESS;

 #endif

     }