... | ... |
@@ -284,18 +284,19 @@ am_libclamav_la_OBJECTS = libclamav_la-matcher-ac.lo \ |
284 | 284 |
libclamav_la-asn1.lo libclamav_la-fpu.lo libclamav_la-stats.lo \ |
285 | 285 |
libclamav_la-www.lo libclamav_la-stats_json.lo \ |
286 | 286 |
libclamav_la-hostid.lo libclamav_la-openioc.lo \ |
287 |
- libclamav_la-yara_arena.lo libclamav_la-yara_exec.lo \ |
|
288 |
- libclamav_la-yara_hash.lo libclamav_la-yara_grammar.lo \ |
|
289 |
- libclamav_la-yara_lexer.lo libclamav_la-yara_parser.lo \ |
|
290 |
- libclamav_la-msdoc.lo libclamav_la-matcher-pcre.lo \ |
|
291 |
- libclamav_la-regex_pcre.lo libclamav_la-msxml.lo \ |
|
292 |
- libclamav_la-msxml_parser.lo libclamav_la-fp_add.lo \ |
|
293 |
- libclamav_la-fp_add_d.lo libclamav_la-fp_addmod.lo \ |
|
294 |
- libclamav_la-fp_cmp.lo libclamav_la-fp_cmp_d.lo \ |
|
295 |
- libclamav_la-fp_cmp_mag.lo libclamav_la-fp_sub.lo \ |
|
296 |
- libclamav_la-fp_sub_d.lo libclamav_la-fp_submod.lo \ |
|
297 |
- libclamav_la-s_fp_add.lo libclamav_la-s_fp_sub.lo \ |
|
298 |
- libclamav_la-fp_radix_size.lo libclamav_la-fp_read_radix.lo \ |
|
287 |
+ libclamav_la-yara_arena.lo libclamav_la-yara_compiler.lo \ |
|
288 |
+ libclamav_la-yara_exec.lo libclamav_la-yara_hash.lo \ |
|
289 |
+ libclamav_la-yara_grammar.lo libclamav_la-yara_lexer.lo \ |
|
290 |
+ libclamav_la-yara_parser.lo libclamav_la-msdoc.lo \ |
|
291 |
+ libclamav_la-matcher-pcre.lo libclamav_la-regex_pcre.lo \ |
|
292 |
+ libclamav_la-msxml.lo libclamav_la-msxml_parser.lo \ |
|
293 |
+ libclamav_la-fp_add.lo libclamav_la-fp_add_d.lo \ |
|
294 |
+ libclamav_la-fp_addmod.lo libclamav_la-fp_cmp.lo \ |
|
295 |
+ libclamav_la-fp_cmp_d.lo libclamav_la-fp_cmp_mag.lo \ |
|
296 |
+ libclamav_la-fp_sub.lo libclamav_la-fp_sub_d.lo \ |
|
297 |
+ libclamav_la-fp_submod.lo libclamav_la-s_fp_add.lo \ |
|
298 |
+ libclamav_la-s_fp_sub.lo libclamav_la-fp_radix_size.lo \ |
|
299 |
+ libclamav_la-fp_read_radix.lo \ |
|
299 | 300 |
libclamav_la-fp_read_signed_bin.lo \ |
300 | 301 |
libclamav_la-fp_read_unsigned_bin.lo \ |
301 | 302 |
libclamav_la-fp_reverse.lo libclamav_la-fp_s_rmap.lo \ |
... | ... |
@@ -920,12 +921,13 @@ libclamav_la_SOURCES = matcher-ac.c matcher-ac.h matcher-bm.c \ |
920 | 920 |
iso9660.h arc4.c arc4.h rijndael.c rijndael.h crtmgr.c \ |
921 | 921 |
crtmgr.h asn1.c asn1.h fpu.c fpu.h stats.c stats.h www.c www.h \ |
922 | 922 |
stats_json.c stats_json.h hostid.c hostid.h openioc.c \ |
923 |
- openioc.h yara_arena.c yara_arena.h yara_exec.c yara_exec.h \ |
|
924 |
- yara_hash.c yara_hash.h yara_grammar.y yara_lexer.l \ |
|
925 |
- yara_lexer.h yara_parser.c yara_parser.h yara_clam.h msdoc.c \ |
|
926 |
- msdoc.h matcher-pcre.c matcher-pcre.h regex_pcre.c \ |
|
927 |
- regex_pcre.h msxml.c msxml.h msxml_parser.c msxml_parser.h \ |
|
928 |
- bignum.h bignum_fast.h tomsfastmath/addsub/fp_add.c \ |
|
923 |
+ openioc.h yara_arena.c yara_arena.h yara_compiler.c \ |
|
924 |
+ yara_compiler.h yara_exec.c yara_exec.h yara_hash.c \ |
|
925 |
+ yara_hash.h yara_grammar.y yara_lexer.l yara_lexer.h \ |
|
926 |
+ yara_parser.c yara_parser.h yara_clam.h msdoc.c msdoc.h \ |
|
927 |
+ matcher-pcre.c matcher-pcre.h regex_pcre.c regex_pcre.h \ |
|
928 |
+ msxml.c msxml.h msxml_parser.c msxml_parser.h bignum.h \ |
|
929 |
+ bignum_fast.h tomsfastmath/addsub/fp_add.c \ |
|
929 | 930 |
tomsfastmath/addsub/fp_add_d.c tomsfastmath/addsub/fp_addmod.c \ |
930 | 931 |
tomsfastmath/addsub/fp_cmp.c tomsfastmath/addsub/fp_cmp_d.c \ |
931 | 932 |
tomsfastmath/addsub/fp_cmp_mag.c tomsfastmath/addsub/fp_sub.c \ |
... | ... |
@@ -1350,6 +1352,7 @@ distclean-compile: |
1350 | 1350 |
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-xdp.Plo@am__quote@ |
1351 | 1351 |
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-xz_iface.Plo@am__quote@ |
1352 | 1352 |
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-yara_arena.Plo@am__quote@ |
1353 |
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-yara_compiler.Plo@am__quote@ |
|
1353 | 1354 |
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-yara_exec.Plo@am__quote@ |
1354 | 1355 |
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-yara_grammar.Plo@am__quote@ |
1355 | 1356 |
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-yara_hash.Plo@am__quote@ |
... | ... |
@@ -2354,6 +2357,13 @@ libclamav_la-yara_arena.lo: yara_arena.c |
2354 | 2354 |
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ |
2355 | 2355 |
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -c -o libclamav_la-yara_arena.lo `test -f 'yara_arena.c' || echo '$(srcdir)/'`yara_arena.c |
2356 | 2356 |
|
2357 |
+libclamav_la-yara_compiler.lo: yara_compiler.c |
|
2358 |
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -MT libclamav_la-yara_compiler.lo -MD -MP -MF $(DEPDIR)/libclamav_la-yara_compiler.Tpo -c -o libclamav_la-yara_compiler.lo `test -f 'yara_compiler.c' || echo '$(srcdir)/'`yara_compiler.c |
|
2359 |
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/libclamav_la-yara_compiler.Tpo $(DEPDIR)/libclamav_la-yara_compiler.Plo |
|
2360 |
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='yara_compiler.c' object='libclamav_la-yara_compiler.lo' libtool=yes @AMDEPBACKSLASH@ |
|
2361 |
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ |
|
2362 |
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -c -o libclamav_la-yara_compiler.lo `test -f 'yara_compiler.c' || echo '$(srcdir)/'`yara_compiler.c |
|
2363 |
+ |
|
2357 | 2364 |
libclamav_la-yara_exec.lo: yara_exec.c |
2358 | 2365 |
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -MT libclamav_la-yara_exec.lo -MD -MP -MF $(DEPDIR)/libclamav_la-yara_exec.Tpo -c -o libclamav_la-yara_exec.lo `test -f 'yara_exec.c' || echo '$(srcdir)/'`yara_exec.c |
2359 | 2366 |
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/libclamav_la-yara_exec.Tpo $(DEPDIR)/libclamav_la-yara_exec.Plo |
... | ... |
@@ -436,34 +436,8 @@ struct cl_engine *cl_engine_new(void) |
436 | 436 |
new->pcre_recmatch_limit = CLI_DEFAULT_PCRE_RECMATCH_LIMIT; |
437 | 437 |
new->pcre_max_filesize = CLI_DEFAULT_PCRE_MAX_FILESIZE; |
438 | 438 |
|
439 |
- /* Initialize YARA */ |
|
440 |
- if (ERROR_SUCCESS != yr_arena_create(1024, 0, &new->the_arena)) { |
|
441 |
- cli_errmsg("cli_engine_new: failed to create the YARA arena\n"); |
|
442 |
- mpool_free(new->mempool, new->dconf); |
|
443 |
- mpool_free(new->mempool, new->root); |
|
444 |
-#ifdef USE_MPOOL |
|
445 |
- mpool_destroy(new->mempool); |
|
446 |
-#endif |
|
447 |
- free(new); |
|
448 |
- free(intel); |
|
449 |
- return NULL; |
|
450 |
- } |
|
451 |
- if (ERROR_SUCCESS != yr_hash_table_create(10007, &new->rules_table)) { |
|
452 |
- cli_errmsg("cli_engine_new: failed to create the YARA rules table\n"); |
|
453 |
- yr_arena_destroy(new->the_arena); |
|
454 |
- mpool_free(new->mempool, new->dconf); |
|
455 |
- mpool_free(new->mempool, new->root); |
|
456 |
-#ifdef USE_MPOOL |
|
457 |
- mpool_destroy(new->mempool); |
|
458 |
-#endif |
|
459 |
- free(new); |
|
460 |
- free(intel); |
|
461 |
- return NULL; |
|
462 |
- } |
|
463 |
- if (ERROR_SUCCESS != yr_hash_table_create(10007, &new->objects_table)) { |
|
464 |
- cli_errmsg("cli_engine_new: failed to create the YARA objects table\n"); |
|
465 |
- yr_hash_table_destroy(new->rules_table, NULL); |
|
466 |
- yr_arena_destroy(new->the_arena); |
|
439 |
+ if (cli_yara_init(new) != CL_SUCCESS) { |
|
440 |
+ cli_errmsg("cli_engine_new: failed to initialize YARA\n"); |
|
467 | 441 |
mpool_free(new->mempool, new->dconf); |
468 | 442 |
mpool_free(new->mempool, new->root); |
469 | 443 |
#ifdef USE_MPOOL |
... | ... |
@@ -83,6 +83,7 @@ static pthread_mutex_t cli_ref_mutex = PTHREAD_MUTEX_INITIALIZER; |
83 | 83 |
#endif |
84 | 84 |
#ifndef _WIN32 |
85 | 85 |
#include "yara_clam.h" |
86 |
+#include "yara_compiler.h" |
|
86 | 87 |
#endif |
87 | 88 |
|
88 | 89 |
#define MAX_LDB_SUBSIGS 64 |
... | ... |
@@ -3782,6 +3783,101 @@ static int load_oneyara(YR_RULE *rule, int chkpua, struct cl_engine *engine, uns |
3782 | 3782 |
return CL_SUCCESS; |
3783 | 3783 |
} |
3784 | 3784 |
|
3785 |
+struct _yara_global { |
|
3786 |
+ YR_ARENA * the_arena; |
|
3787 |
+ YR_HASH_TABLE * rules_table; |
|
3788 |
+ YR_HASH_TABLE * objects_table; |
|
3789 |
+ YR_HASH_TABLE * db_table; |
|
3790 |
+}; |
|
3791 |
+ |
|
3792 |
+int cli_yara_init(struct cl_engine * engine) |
|
3793 |
+{ |
|
3794 |
+ /* Initialize YARA */ |
|
3795 |
+ engine->yara_global = cli_calloc(1, sizeof(struct _yara_global)); |
|
3796 |
+ if (NULL == engine->yara_global) { |
|
3797 |
+ cli_errmsg("cli_yara_init: failed to create YARA global\n"); |
|
3798 |
+ return CL_EMEM; |
|
3799 |
+ } |
|
3800 |
+ if (ERROR_SUCCESS != yr_arena_create(1024, 0, &engine->yara_global->the_arena)) { |
|
3801 |
+ cli_errmsg("cli_yara_init: failed to create the YARA arena\n"); |
|
3802 |
+ free(engine->yara_global); |
|
3803 |
+ engine->yara_global = NULL; |
|
3804 |
+ return CL_EMEM; |
|
3805 |
+ } |
|
3806 |
+ if (ERROR_SUCCESS != yr_hash_table_create(10007, &engine->yara_global->rules_table)) { |
|
3807 |
+ cli_errmsg("cli_yara_init: failed to create the YARA rules table\n"); |
|
3808 |
+ yr_arena_destroy(engine->yara_global->the_arena); |
|
3809 |
+ engine->yara_global->the_arena = NULL; |
|
3810 |
+ free(engine->yara_global); |
|
3811 |
+ engine->yara_global = NULL; |
|
3812 |
+ return CL_EMEM; |
|
3813 |
+ } |
|
3814 |
+ if (ERROR_SUCCESS != yr_hash_table_create(10007, &engine->yara_global->objects_table)) { |
|
3815 |
+ cli_errmsg("cli_yara_init: failed to create the YARA objects table\n"); |
|
3816 |
+ yr_hash_table_destroy(engine->yara_global->rules_table, NULL); |
|
3817 |
+ yr_arena_destroy(engine->yara_global->the_arena); |
|
3818 |
+ engine->yara_global->rules_table = NULL; |
|
3819 |
+ engine->yara_global->the_arena = NULL; |
|
3820 |
+ free(engine->yara_global); |
|
3821 |
+ engine->yara_global = NULL; |
|
3822 |
+ engine->yara_global = NULL; |
|
3823 |
+ return CL_EMEM; |
|
3824 |
+ } |
|
3825 |
+ if (ERROR_SUCCESS != yr_hash_table_create(10007, &engine->yara_global->db_table)) { |
|
3826 |
+ cli_errmsg("cli_yara_init: failed to create the YARA objects table\n"); |
|
3827 |
+ yr_hash_table_destroy(engine->yara_global->objects_table, NULL); |
|
3828 |
+ yr_hash_table_destroy(engine->yara_global->rules_table, NULL); |
|
3829 |
+ yr_arena_destroy(engine->yara_global->the_arena); |
|
3830 |
+ engine->yara_global->objects_table = NULL; |
|
3831 |
+ engine->yara_global->rules_table = NULL; |
|
3832 |
+ engine->yara_global->the_arena = NULL; |
|
3833 |
+ free(engine->yara_global); |
|
3834 |
+ engine->yara_global = NULL; |
|
3835 |
+ return CL_EMEM; |
|
3836 |
+ } |
|
3837 |
+ return CL_SUCCESS; |
|
3838 |
+} |
|
3839 |
+ |
|
3840 |
+void cli_yara_free(struct cl_engine * engine) |
|
3841 |
+{ |
|
3842 |
+ if (engine->yara_global != NULL) { |
|
3843 |
+ if (engine->yara_global->db_table != NULL) { |
|
3844 |
+ yr_hash_table_destroy(engine->yara_global->db_table, NULL); |
|
3845 |
+ engine->yara_global->db_table = NULL; |
|
3846 |
+ } |
|
3847 |
+ if (engine->yara_global->rules_table != NULL) { |
|
3848 |
+ yr_hash_table_destroy(engine->yara_global->rules_table, NULL); |
|
3849 |
+ engine->yara_global->rules_table = NULL; |
|
3850 |
+ } |
|
3851 |
+ if (engine->yara_global->objects_table != NULL) { |
|
3852 |
+ yr_hash_table_destroy(engine->yara_global->objects_table, NULL); |
|
3853 |
+ engine->yara_global->objects_table = NULL; |
|
3854 |
+ } |
|
3855 |
+ if (engine->yara_global->the_arena != NULL) { |
|
3856 |
+ yr_arena_destroy(engine->yara_global->the_arena); |
|
3857 |
+ engine->yara_global->the_arena = NULL; |
|
3858 |
+ } |
|
3859 |
+ free(engine->yara_global); |
|
3860 |
+ engine->yara_global = NULL; |
|
3861 |
+ } |
|
3862 |
+} |
|
3863 |
+ |
|
3864 |
+#if 0 |
|
3865 |
+int cli_yara_hash_db_file(char * fname) |
|
3866 |
+{ |
|
3867 |
+ if (yr_hash_table_lookup(db_table, fname, NULL) == NULL) { |
|
3868 |
+ cli_errmsg("***** ADDING %s\n", fbname); |
|
3869 |
+ if ((rc = yr_hash_table_add(db_table, fname, NULL, (void*) 1)) != ERROR_SUCCESS) { |
|
3870 |
+ cli_errmsg("****** Could not add %s to db_table\n", dbname); |
|
3871 |
+ } |
|
3872 |
+ } else { |
|
3873 |
+ cli_warnmsg("cli_loadyara: db file %s already included\n", dbname); |
|
3874 |
+ return 1; |
|
3875 |
+ } |
|
3876 |
+ return 0; |
|
3877 |
+} |
|
3878 |
+#endif |
|
3879 |
+ |
|
3785 | 3880 |
//TODO - pua? dbio? |
3786 | 3881 |
static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo, unsigned int options, struct cli_dbio *dbio, const char *dbname) |
3787 | 3882 |
{ |
... | ... |
@@ -3796,6 +3892,12 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo, |
3796 | 3796 |
if((rc = cli_initroots(engine, options))) |
3797 | 3797 |
return rc; |
3798 | 3798 |
|
3799 |
+#if 0 |
|
3800 |
+ /* eliminate duplicate files */ |
|
3801 |
+ if (cli_yara_hash_db_file(dbname)) |
|
3802 |
+ return CL_SUCCESS; |
|
3803 |
+#endif |
|
3804 |
+ |
|
3799 | 3805 |
compiler.last_result = ERROR_SUCCESS; |
3800 | 3806 |
STAILQ_INIT(&compiler.rule_q); |
3801 | 3807 |
STAILQ_INIT(&compiler.current_rule_string_q); |
... | ... |
@@ -3814,9 +3916,11 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo, |
3814 | 3814 |
compiler.loop_for_of_mem_offset = -1; |
3815 | 3815 |
ns.name = "default"; |
3816 | 3816 |
compiler.current_namespace = &ns; |
3817 |
- compiler.the_arena = engine->the_arena; |
|
3818 |
- compiler.rules_table = engine->rules_table; |
|
3819 |
- compiler.objects_table = engine->objects_table; |
|
3817 |
+ compiler.the_arena = engine->yara_global->the_arena; |
|
3818 |
+ compiler.rules_table = engine->yara_global->rules_table; |
|
3819 |
+ compiler.objects_table = engine->yara_global->objects_table; |
|
3820 |
+ compiler.allow_includes = 1; |
|
3821 |
+ _yr_compiler_push_file_name(&compiler, dbname); |
|
3820 | 3822 |
|
3821 | 3823 |
rc = yr_lex_parse_rules_file(fs, &compiler); |
3822 | 3824 |
if (rc > 0) { /* rc = number of errors */ |
... | ... |
@@ -3827,6 +3931,7 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo, |
3827 | 3827 |
yr_arena_destroy(compiler.code_arena); |
3828 | 3828 |
yr_arena_destroy(compiler.strings_arena); |
3829 | 3829 |
yr_arena_destroy(compiler.metas_arena); |
3830 |
+ _yr_compiler_pop_file_name(&compiler); |
|
3830 | 3831 |
#ifdef YARA_FINISHED |
3831 | 3832 |
return CL_EMALFDB; |
3832 | 3833 |
#else |
... | ... |
@@ -3850,11 +3955,12 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo, |
3850 | 3850 |
} |
3851 | 3851 |
} |
3852 | 3852 |
|
3853 |
- yr_arena_append(engine->the_arena, compiler.sz_arena); |
|
3854 |
- yr_arena_append(engine->the_arena, compiler.rules_arena); |
|
3855 |
- yr_arena_append(engine->the_arena, compiler.strings_arena); |
|
3853 |
+ yr_arena_append(engine->yara_global->the_arena, compiler.sz_arena); |
|
3854 |
+ yr_arena_append(engine->yara_global->the_arena, compiler.rules_arena); |
|
3855 |
+ yr_arena_append(engine->yara_global->the_arena, compiler.strings_arena); |
|
3856 | 3856 |
yr_arena_destroy(compiler.code_arena); |
3857 | 3857 |
yr_arena_destroy(compiler.metas_arena); |
3858 |
+ _yr_compiler_pop_file_name(&compiler); |
|
3858 | 3859 |
|
3859 | 3860 |
if(rc) |
3860 | 3861 |
return rc; |
... | ... |
@@ -4688,14 +4794,8 @@ int cl_engine_free(struct cl_engine *engine) |
4688 | 4688 |
if(engine->mempool) mpool_destroy(engine->mempool); |
4689 | 4689 |
#endif |
4690 | 4690 |
|
4691 |
- if (engine->rules_table) |
|
4692 |
- yr_hash_table_destroy(engine->rules_table, NULL); |
|
4693 |
- |
|
4694 |
- if (engine->objects_table) |
|
4695 |
- yr_hash_table_destroy(engine->objects_table, NULL); |
|
4696 |
- |
|
4697 |
- if (engine->the_arena) |
|
4698 |
- yr_arena_destroy(engine->the_arena); |
|
4691 |
+ |
|
4692 |
+ cli_yara_free(engine); |
|
4699 | 4693 |
|
4700 | 4694 |
free(engine); |
4701 | 4695 |
return CL_SUCCESS; |
... | ... |
@@ -4711,11 +4811,13 @@ int cl_engine_compile(struct cl_engine *engine) |
4711 | 4711 |
return CL_ENULLARG; |
4712 | 4712 |
|
4713 | 4713 |
/* Free YARA hash tables - only needed for parse and load */ |
4714 |
- if (engine->rules_table) |
|
4715 |
- yr_hash_table_destroy(engine->rules_table, NULL); |
|
4716 |
- if (engine->objects_table) |
|
4717 |
- yr_hash_table_destroy(engine->objects_table, NULL); |
|
4718 |
- engine->rules_table = engine->objects_table = NULL; |
|
4714 |
+ if (engine->yara_global != NULL) { |
|
4715 |
+ if (engine->yara_global->rules_table) |
|
4716 |
+ yr_hash_table_destroy(engine->yara_global->rules_table, NULL); |
|
4717 |
+ if (engine->yara_global->objects_table) |
|
4718 |
+ yr_hash_table_destroy(engine->yara_global->objects_table, NULL); |
|
4719 |
+ engine->yara_global->rules_table = engine->yara_global->objects_table = NULL; |
|
4720 |
+ } |
|
4719 | 4721 |
|
4720 | 4722 |
if(!engine->ftypes) |
4721 | 4723 |
if((ret = cli_loadftm(NULL, engine, 0, 1, NULL))) |
... | ... |
@@ -77,4 +77,8 @@ char *cli_dbgets(char *buff, unsigned int size, FILE *fs, struct cli_dbio *dbio) |
77 | 77 |
|
78 | 78 |
int cli_initroots(struct cl_engine *engine, unsigned int options); |
79 | 79 |
|
80 |
+int cli_yara_init(struct cl_engine *engine); |
|
81 |
+ |
|
82 |
+void cli_yara_free(struct cl_engine *engine); |
|
83 |
+ |
|
80 | 84 |
#endif |
... | ... |
@@ -41,7 +41,6 @@ limitations under the License. |
41 | 41 |
#define _YARA_CLAM_H_ |
42 | 42 |
|
43 | 43 |
#include "shared/queue.h" |
44 |
-#include "yara_arena.h" |
|
45 | 44 |
#include "yara_hash.h" |
46 | 45 |
#include "others.h" |
47 | 46 |
|
... | ... |
@@ -413,7 +412,10 @@ struct RE { |
413 | 413 |
#define MAX_FUNCTION_ARGS 128 |
414 | 414 |
#define LOOP_LOCAL_VARS 4 |
415 | 415 |
#define LEX_BUF_SIZE 1024 |
416 |
- |
|
416 |
+#define MAX_INCLUDE_DEPTH 16 |
|
417 |
+#ifndef MAX_PATH |
|
418 |
+#define MAX_PATH 1024 |
|
419 |
+#endif |
|
417 | 420 |
|
418 | 421 |
/* From libyara/include/yara/object.h */ |
419 | 422 |
#define OBJECT_TYPE_INTEGER 1 |
... | ... |
@@ -468,44 +470,6 @@ typedef struct _yc_string { |
468 | 468 |
int32_t subsig_id; |
469 | 469 |
} yc_string; |
470 | 470 |
|
471 |
-typedef struct _yc_compiler { |
|
472 |
- int errors; |
|
473 |
- int error_line; |
|
474 |
- int last_error; |
|
475 |
- int last_error_line; |
|
476 |
- int last_result; |
|
477 |
- |
|
478 |
- YR_ARENA *sz_arena; |
|
479 |
- YR_ARENA *rules_arena; |
|
480 |
- YR_ARENA *strings_arena; |
|
481 |
- YR_ARENA *code_arena; |
|
482 |
- YR_ARENA *metas_arena; |
|
483 |
- YR_ARENA *the_arena; |
|
484 |
- YR_HASH_TABLE *rules_table; |
|
485 |
- YR_HASH_TABLE *objects_table; |
|
486 |
- YR_NAMESPACE *current_namespace; |
|
487 |
- yc_string *current_rule_strings; |
|
488 |
- uint32_t current_rule_flags; |
|
489 |
- uint32_t current_rule_clflags; |
|
490 |
- |
|
491 |
- int8_t *loop_address[MAX_LOOP_NESTING]; |
|
492 |
- char *loop_identifier[MAX_LOOP_NESTING]; |
|
493 |
- int loop_depth; |
|
494 |
- int loop_for_of_mem_offset; |
|
495 |
- |
|
496 |
- char last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO]; |
|
497 |
- |
|
498 |
- char lex_buf[LEX_BUF_SIZE]; |
|
499 |
- char *lex_buf_ptr; |
|
500 |
- unsigned short lex_buf_len; |
|
501 |
- |
|
502 |
- char *error_msg; |
|
503 |
- |
|
504 |
- STAILQ_HEAD(rq, _yc_rule) rule_q; |
|
505 |
- STAILQ_HEAD(cs, _yc_string) current_rule_string_q; |
|
506 |
-} yc_compiler; |
|
507 |
- |
|
508 |
-typedef yc_compiler YR_COMPILER; |
|
509 | 471 |
typedef yc_rule YR_RULE; |
510 | 472 |
typedef yc_string YR_STRING; |
511 | 473 |
|
... | ... |
@@ -1301,7 +1301,6 @@ case 48: |
1301 | 1301 |
YY_RULE_SETUP |
1302 | 1302 |
#line 173 "yara_lexer.l" |
1303 | 1303 |
{ |
1304 |
-#ifdef REAL_YARA |
|
1305 | 1304 |
|
1306 | 1305 |
char buffer[1024]; |
1307 | 1306 |
char *current_file_name; |
... | ... |
@@ -1399,10 +1398,6 @@ YY_RULE_SETUP |
1399 | 1399 |
} |
1400 | 1400 |
|
1401 | 1401 |
BEGIN(INITIAL); |
1402 |
-#else |
|
1403 |
- yyerror(yyscanner, compiler, "includes are disabled"); |
|
1404 |
- yyterminate(); |
|
1405 |
-#endif |
|
1406 | 1402 |
} |
1407 | 1403 |
YY_BREAK |
1408 | 1404 |
case YY_STATE_EOF(INITIAL): |
... | ... |
@@ -1410,9 +1405,8 @@ case YY_STATE_EOF(str): |
1410 | 1410 |
case YY_STATE_EOF(regexp): |
1411 | 1411 |
case YY_STATE_EOF(include): |
1412 | 1412 |
case YY_STATE_EOF(comment): |
1413 |
-#line 280 "yara_lexer.l" |
|
1413 |
+#line 275 "yara_lexer.l" |
|
1414 | 1414 |
{ |
1415 |
-#ifdef REAL_YARA |
|
1416 | 1415 |
|
1417 | 1416 |
YR_COMPILER* compiler = yara_yyget_extra(yyscanner); |
1418 | 1417 |
FILE* file = _yr_compiler_pop_file(compiler); |
... | ... |
@@ -1429,7 +1423,7 @@ case YY_STATE_EOF(comment): |
1429 | 1429 |
{ |
1430 | 1430 |
yyterminate(); |
1431 | 1431 |
} |
1432 |
-#endif |
|
1432 |
+ |
|
1433 | 1433 |
yara_yypop_buffer_state(yyscanner); |
1434 | 1434 |
|
1435 | 1435 |
if (!YY_CURRENT_BUFFER) |
... | ... |
@@ -1440,7 +1434,7 @@ case YY_STATE_EOF(comment): |
1440 | 1440 |
YY_BREAK |
1441 | 1441 |
case 49: |
1442 | 1442 |
YY_RULE_SETUP |
1443 |
-#line 308 "yara_lexer.l" |
|
1443 |
+#line 302 "yara_lexer.l" |
|
1444 | 1444 |
{ |
1445 | 1445 |
|
1446 | 1446 |
yylval->c_string = yr_strdup(yytext); |
... | ... |
@@ -1456,7 +1450,7 @@ YY_RULE_SETUP |
1456 | 1456 |
YY_BREAK |
1457 | 1457 |
case 50: |
1458 | 1458 |
YY_RULE_SETUP |
1459 |
-#line 322 "yara_lexer.l" |
|
1459 |
+#line 316 "yara_lexer.l" |
|
1460 | 1460 |
{ |
1461 | 1461 |
|
1462 | 1462 |
yylval->c_string = yr_strdup(yytext); |
... | ... |
@@ -1472,7 +1466,7 @@ YY_RULE_SETUP |
1472 | 1472 |
YY_BREAK |
1473 | 1473 |
case 51: |
1474 | 1474 |
YY_RULE_SETUP |
1475 |
-#line 336 "yara_lexer.l" |
|
1475 |
+#line 330 "yara_lexer.l" |
|
1476 | 1476 |
{ |
1477 | 1477 |
|
1478 | 1478 |
yylval->c_string = yr_strdup(yytext); |
... | ... |
@@ -1489,7 +1483,7 @@ YY_RULE_SETUP |
1489 | 1489 |
YY_BREAK |
1490 | 1490 |
case 52: |
1491 | 1491 |
YY_RULE_SETUP |
1492 |
-#line 351 "yara_lexer.l" |
|
1492 |
+#line 345 "yara_lexer.l" |
|
1493 | 1493 |
{ |
1494 | 1494 |
|
1495 | 1495 |
yylval->c_string = yr_strdup(yytext); |
... | ... |
@@ -1506,7 +1500,7 @@ YY_RULE_SETUP |
1506 | 1506 |
YY_BREAK |
1507 | 1507 |
case 53: |
1508 | 1508 |
YY_RULE_SETUP |
1509 |
-#line 366 "yara_lexer.l" |
|
1509 |
+#line 360 "yara_lexer.l" |
|
1510 | 1510 |
{ |
1511 | 1511 |
|
1512 | 1512 |
if (strlen(yytext) > 128) |
... | ... |
@@ -1526,7 +1520,7 @@ YY_RULE_SETUP |
1526 | 1526 |
YY_BREAK |
1527 | 1527 |
case 54: |
1528 | 1528 |
YY_RULE_SETUP |
1529 |
-#line 384 "yara_lexer.l" |
|
1529 |
+#line 378 "yara_lexer.l" |
|
1530 | 1530 |
{ |
1531 | 1531 |
|
1532 | 1532 |
yylval->integer = (size_t) atol(yytext); |
... | ... |
@@ -1544,7 +1538,7 @@ YY_RULE_SETUP |
1544 | 1544 |
YY_BREAK |
1545 | 1545 |
case 55: |
1546 | 1546 |
YY_RULE_SETUP |
1547 |
-#line 400 "yara_lexer.l" |
|
1547 |
+#line 394 "yara_lexer.l" |
|
1548 | 1548 |
{ |
1549 | 1549 |
|
1550 | 1550 |
yylval->integer = xtoi(yytext + 2); |
... | ... |
@@ -1553,7 +1547,7 @@ YY_RULE_SETUP |
1553 | 1553 |
YY_BREAK |
1554 | 1554 |
case 56: |
1555 | 1555 |
YY_RULE_SETUP |
1556 |
-#line 407 "yara_lexer.l" |
|
1556 |
+#line 401 "yara_lexer.l" |
|
1557 | 1557 |
{ /* saw closing quote - all done */ |
1558 | 1558 |
|
1559 | 1559 |
SIZED_STRING* s; |
... | ... |
@@ -1579,7 +1573,7 @@ YY_RULE_SETUP |
1579 | 1579 |
YY_BREAK |
1580 | 1580 |
case 57: |
1581 | 1581 |
YY_RULE_SETUP |
1582 |
-#line 431 "yara_lexer.l" |
|
1582 |
+#line 425 "yara_lexer.l" |
|
1583 | 1583 |
{ |
1584 | 1584 |
|
1585 | 1585 |
LEX_CHECK_SPACE_OK("\t", yyextra->lex_buf_len, LEX_BUF_SIZE); |
... | ... |
@@ -1589,7 +1583,7 @@ YY_RULE_SETUP |
1589 | 1589 |
YY_BREAK |
1590 | 1590 |
case 58: |
1591 | 1591 |
YY_RULE_SETUP |
1592 |
-#line 439 "yara_lexer.l" |
|
1592 |
+#line 433 "yara_lexer.l" |
|
1593 | 1593 |
{ |
1594 | 1594 |
|
1595 | 1595 |
LEX_CHECK_SPACE_OK("\n", yyextra->lex_buf_len, LEX_BUF_SIZE); |
... | ... |
@@ -1599,7 +1593,7 @@ YY_RULE_SETUP |
1599 | 1599 |
YY_BREAK |
1600 | 1600 |
case 59: |
1601 | 1601 |
YY_RULE_SETUP |
1602 |
-#line 447 "yara_lexer.l" |
|
1602 |
+#line 441 "yara_lexer.l" |
|
1603 | 1603 |
{ |
1604 | 1604 |
|
1605 | 1605 |
LEX_CHECK_SPACE_OK("\"", yyextra->lex_buf_len, LEX_BUF_SIZE); |
... | ... |
@@ -1609,7 +1603,7 @@ YY_RULE_SETUP |
1609 | 1609 |
YY_BREAK |
1610 | 1610 |
case 60: |
1611 | 1611 |
YY_RULE_SETUP |
1612 |
-#line 455 "yara_lexer.l" |
|
1612 |
+#line 449 "yara_lexer.l" |
|
1613 | 1613 |
{ |
1614 | 1614 |
|
1615 | 1615 |
LEX_CHECK_SPACE_OK("\\", yyextra->lex_buf_len, LEX_BUF_SIZE); |
... | ... |
@@ -1619,7 +1613,7 @@ YY_RULE_SETUP |
1619 | 1619 |
YY_BREAK |
1620 | 1620 |
case 61: |
1621 | 1621 |
YY_RULE_SETUP |
1622 |
-#line 463 "yara_lexer.l" |
|
1622 |
+#line 457 "yara_lexer.l" |
|
1623 | 1623 |
{ |
1624 | 1624 |
|
1625 | 1625 |
int result; |
... | ... |
@@ -1632,13 +1626,13 @@ YY_RULE_SETUP |
1632 | 1632 |
YY_BREAK |
1633 | 1633 |
case 62: |
1634 | 1634 |
YY_RULE_SETUP |
1635 |
-#line 474 "yara_lexer.l" |
|
1635 |
+#line 468 "yara_lexer.l" |
|
1636 | 1636 |
{ YYTEXT_TO_BUFFER; } |
1637 | 1637 |
YY_BREAK |
1638 | 1638 |
case 63: |
1639 | 1639 |
/* rule 63 can match eol */ |
1640 | 1640 |
YY_RULE_SETUP |
1641 |
-#line 477 "yara_lexer.l" |
|
1641 |
+#line 471 "yara_lexer.l" |
|
1642 | 1642 |
{ |
1643 | 1643 |
|
1644 | 1644 |
yyerror(yyscanner, compiler, "unterminated string"); |
... | ... |
@@ -1648,7 +1642,7 @@ YY_RULE_SETUP |
1648 | 1648 |
case 64: |
1649 | 1649 |
/* rule 64 can match eol */ |
1650 | 1650 |
YY_RULE_SETUP |
1651 |
-#line 483 "yara_lexer.l" |
|
1651 |
+#line 477 "yara_lexer.l" |
|
1652 | 1652 |
{ |
1653 | 1653 |
|
1654 | 1654 |
yyerror(yyscanner, compiler, "illegal escape sequence"); |
... | ... |
@@ -1656,7 +1650,7 @@ YY_RULE_SETUP |
1656 | 1656 |
YY_BREAK |
1657 | 1657 |
case 65: |
1658 | 1658 |
YY_RULE_SETUP |
1659 |
-#line 489 "yara_lexer.l" |
|
1659 |
+#line 483 "yara_lexer.l" |
|
1660 | 1660 |
{ |
1661 | 1661 |
|
1662 | 1662 |
SIZED_STRING* s; |
... | ... |
@@ -1689,7 +1683,7 @@ YY_RULE_SETUP |
1689 | 1689 |
YY_BREAK |
1690 | 1690 |
case 66: |
1691 | 1691 |
YY_RULE_SETUP |
1692 |
-#line 520 "yara_lexer.l" |
|
1692 |
+#line 514 "yara_lexer.l" |
|
1693 | 1693 |
{ |
1694 | 1694 |
|
1695 | 1695 |
LEX_CHECK_SPACE_OK("/", yyextra->lex_buf_len, LEX_BUF_SIZE); |
... | ... |
@@ -1699,7 +1693,7 @@ YY_RULE_SETUP |
1699 | 1699 |
YY_BREAK |
1700 | 1700 |
case 67: |
1701 | 1701 |
YY_RULE_SETUP |
1702 |
-#line 528 "yara_lexer.l" |
|
1702 |
+#line 522 "yara_lexer.l" |
|
1703 | 1703 |
{ |
1704 | 1704 |
|
1705 | 1705 |
LEX_CHECK_SPACE_OK("\\.", yyextra->lex_buf_len, LEX_BUF_SIZE); |
... | ... |
@@ -1710,13 +1704,13 @@ YY_RULE_SETUP |
1710 | 1710 |
YY_BREAK |
1711 | 1711 |
case 68: |
1712 | 1712 |
YY_RULE_SETUP |
1713 |
-#line 537 "yara_lexer.l" |
|
1713 |
+#line 531 "yara_lexer.l" |
|
1714 | 1714 |
{ YYTEXT_TO_BUFFER; } |
1715 | 1715 |
YY_BREAK |
1716 | 1716 |
case 69: |
1717 | 1717 |
/* rule 69 can match eol */ |
1718 | 1718 |
YY_RULE_SETUP |
1719 |
-#line 540 "yara_lexer.l" |
|
1719 |
+#line 534 "yara_lexer.l" |
|
1720 | 1720 |
{ |
1721 | 1721 |
|
1722 | 1722 |
yyerror(yyscanner, compiler, "unterminated regular expression"); |
... | ... |
@@ -1725,7 +1719,7 @@ YY_RULE_SETUP |
1725 | 1725 |
YY_BREAK |
1726 | 1726 |
case 70: |
1727 | 1727 |
YY_RULE_SETUP |
1728 |
-#line 547 "yara_lexer.l" |
|
1728 |
+#line 541 "yara_lexer.l" |
|
1729 | 1729 |
{ |
1730 | 1730 |
|
1731 | 1731 |
yyextra->lex_buf_ptr = yyextra->lex_buf; |
... | ... |
@@ -1735,7 +1729,7 @@ YY_RULE_SETUP |
1735 | 1735 |
YY_BREAK |
1736 | 1736 |
case 71: |
1737 | 1737 |
YY_RULE_SETUP |
1738 |
-#line 555 "yara_lexer.l" |
|
1738 |
+#line 549 "yara_lexer.l" |
|
1739 | 1739 |
{ |
1740 | 1740 |
|
1741 | 1741 |
yyextra->lex_buf_ptr = yyextra->lex_buf; |
... | ... |
@@ -1746,7 +1740,7 @@ YY_RULE_SETUP |
1746 | 1746 |
case 72: |
1747 | 1747 |
/* rule 72 can match eol */ |
1748 | 1748 |
YY_RULE_SETUP |
1749 |
-#line 563 "yara_lexer.l" |
|
1749 |
+#line 557 "yara_lexer.l" |
|
1750 | 1750 |
{ |
1751 | 1751 |
|
1752 | 1752 |
int len = strlen(yytext); |
... | ... |
@@ -1764,12 +1758,12 @@ YY_RULE_SETUP |
1764 | 1764 |
case 73: |
1765 | 1765 |
/* rule 73 can match eol */ |
1766 | 1766 |
YY_RULE_SETUP |
1767 |
-#line 578 "yara_lexer.l" |
|
1767 |
+#line 572 "yara_lexer.l" |
|
1768 | 1768 |
/* skip whitespace */ |
1769 | 1769 |
YY_BREAK |
1770 | 1770 |
case 74: |
1771 | 1771 |
YY_RULE_SETUP |
1772 |
-#line 580 "yara_lexer.l" |
|
1772 |
+#line 574 "yara_lexer.l" |
|
1773 | 1773 |
{ |
1774 | 1774 |
|
1775 | 1775 |
if (yytext[0] >= 32 && yytext[0] < 127) |
... | ... |
@@ -1785,10 +1779,10 @@ YY_RULE_SETUP |
1785 | 1785 |
YY_BREAK |
1786 | 1786 |
case 75: |
1787 | 1787 |
YY_RULE_SETUP |
1788 |
-#line 593 "yara_lexer.l" |
|
1788 |
+#line 587 "yara_lexer.l" |
|
1789 | 1789 |
ECHO; |
1790 | 1790 |
YY_BREAK |
1791 |
-#line 1792 "yara_lexer.c" |
|
1791 |
+#line 1786 "yara_lexer.c" |
|
1792 | 1792 |
|
1793 | 1793 |
case YY_END_OF_BUFFER: |
1794 | 1794 |
{ |
... | ... |
@@ -2922,7 +2916,7 @@ void yara_yyfree (void * ptr , yyscan_t yyscanner) |
2922 | 2922 |
|
2923 | 2923 |
#define YYTABLES_NAME "yytables" |
2924 | 2924 |
|
2925 |
-#line 593 "yara_lexer.l" |
|
2925 |
+#line 587 "yara_lexer.l" |
|
2926 | 2926 |
|
2927 | 2927 |
|
2928 | 2928 |
|
... | ... |
@@ -2931,7 +2925,6 @@ void yywarning( |
2931 | 2931 |
yyscan_t yyscanner, |
2932 | 2932 |
const char *warning_message) |
2933 | 2933 |
{ |
2934 |
-#ifdef REAL_YARA |
|
2935 | 2934 |
YR_COMPILER* compiler = yara_yyget_extra(yyscanner); |
2936 | 2935 |
char* file_name; |
2937 | 2936 |
|
... | ... |
@@ -2940,16 +2933,14 @@ void yywarning( |
2940 | 2940 |
else |
2941 | 2941 |
file_name = NULL; |
2942 | 2942 |
|
2943 |
+#ifdef REAL_YARA |
|
2943 | 2944 |
compiler->callback( |
2944 | 2945 |
YARA_ERROR_LEVEL_WARNING, |
2945 | 2946 |
file_name, |
2946 | 2947 |
yara_yyget_lineno(yyscanner), |
2947 | 2948 |
warning_message); |
2948 | 2949 |
#else |
2949 |
- if (warning_message != NULL) |
|
2950 |
- cli_errmsg("yara_lexer:yywarning() %s\n", warning_message); |
|
2951 |
- else |
|
2952 |
- cli_errmsg("yara_lexer:yywarning() unknown warning\n"); |
|
2950 |
+ cli_warnmsg("yywarning(): %s line %d %s\n", file_name?file_name:"(file name missing)", compiler->last_error_line, warning_message); |
|
2953 | 2951 |
#endif |
2954 | 2952 |
} |
2955 | 2953 |
|
... | ... |
@@ -2958,17 +2949,10 @@ void yyfatal( |
2958 | 2958 |
yyscan_t yyscanner, |
2959 | 2959 |
const char *error_message) |
2960 | 2960 |
{ |
2961 |
-#ifdef REAL_YARA |
|
2962 | 2961 |
YR_COMPILER* compiler = yara_yyget_extra(yyscanner); |
2963 | 2962 |
|
2964 | 2963 |
yyerror(yyscanner, compiler, error_message); |
2965 | 2964 |
longjmp(compiler->error_recovery, 1); |
2966 |
-#else |
|
2967 |
- if (error_message != NULL) |
|
2968 |
- cli_errmsg("yara_lexer:yyfatal() %s\n", error_message); |
|
2969 |
- else |
|
2970 |
- cli_errmsg("yara_lexer:yyfatal() unknown error\n"); |
|
2971 |
-#endif |
|
2972 | 2965 |
} |
2973 | 2966 |
|
2974 | 2967 |
|
... | ... |
@@ -2977,7 +2961,6 @@ void yyerror( |
2977 | 2977 |
YR_COMPILER* compiler, |
2978 | 2978 |
const char *error_message) |
2979 | 2979 |
{ |
2980 |
-#ifdef REAL_YARA |
|
2981 | 2980 |
char message[512] = {'\0'}; |
2982 | 2981 |
char* file_name = NULL; |
2983 | 2982 |
|
... | ... |
@@ -3010,6 +2993,7 @@ void yyerror( |
3010 | 3010 |
yr_compiler_set_error_extra_info(compiler, error_message); |
3011 | 3011 |
compiler->last_error = ERROR_SYNTAX_ERROR; |
3012 | 3012 |
|
3013 |
+#ifdef REAL_YARA |
|
3013 | 3014 |
if (compiler->callback != NULL) |
3014 | 3015 |
{ |
3015 | 3016 |
compiler->callback( |
... | ... |
@@ -3018,11 +3002,15 @@ void yyerror( |
3018 | 3018 |
compiler->last_error_line, |
3019 | 3019 |
error_message); |
3020 | 3020 |
} |
3021 |
+#else |
|
3022 |
+ cli_errmsg("yyerror(): %s line %d %s\n", file_name?file_name:"(file name missing)", compiler->last_error_line, error_message); |
|
3023 |
+#endif |
|
3021 | 3024 |
} |
3022 | 3025 |
else |
3023 | 3026 |
{ |
3024 | 3027 |
compiler->last_error = compiler->last_result; |
3025 | 3028 |
|
3029 |
+#ifdef REAL_YARA |
|
3026 | 3030 |
if (compiler->callback != NULL) |
3027 | 3031 |
{ |
3028 | 3032 |
yr_compiler_get_error_message(compiler, message, sizeof(message)); |
... | ... |
@@ -3033,27 +3021,13 @@ void yyerror( |
3033 | 3033 |
compiler->last_error_line, |
3034 | 3034 |
message); |
3035 | 3035 |
} |
3036 |
- } |
|
3037 |
- |
|
3038 |
- compiler->last_result = ERROR_SUCCESS; |
|
3039 | 3036 |
#else |
3040 |
- compiler->errors++; |
|
3041 |
- if (error_message != NULL) |
|
3042 |
- cli_errmsg("yara_lexer:yyerror() error message: %s\n", error_message); |
|
3043 |
- if (compiler->error_msg != NULL) |
|
3044 |
- cli_errmsg("yara_lexer:yyerror() compiler error message: %s\n", compiler->error_msg); |
|
3045 |
- if (compiler->last_error_extra_info[0] != (char) 0) |
|
3046 |
- cli_errmsg("yara_lexer:yyerror() error extra info: %s\n", compiler->last_error_extra_info); |
|
3047 |
- if (compiler->last_result != ERROR_SUCCESS) |
|
3048 |
- cli_errmsg("yara_lexer:yyerror() last result is %i\n", compiler->last_result); |
|
3049 |
- if (compiler->error_line != 0) |
|
3050 |
- cli_errmsg("yara_lexer:yyerror() error line %i\n", compiler->error_line); |
|
3037 |
+ yr_compiler_get_error_message(compiler, message, sizeof(message)); |
|
3038 |
+ cli_errmsg("yyerror(): %s line %d %s\n", file_name?file_name:"NULL filename", compiler->last_error_line, message); |
|
3039 |
+#endif |
|
3040 |
+ } |
|
3051 | 3041 |
|
3052 |
- compiler->last_error_extra_info[0] = (char) 0; |
|
3053 |
- compiler->error_msg = NULL; |
|
3054 | 3042 |
compiler->last_result = ERROR_SUCCESS; |
3055 |
- compiler->error_line = 0; |
|
3056 |
-#endif |
|
3057 | 3043 |
} |
3058 | 3044 |
|
3059 | 3045 |
|
... | ... |
@@ -3095,12 +3069,10 @@ int yr_lex_parse_rules_file( |
3095 | 3095 |
{ |
3096 | 3096 |
yyscan_t yyscanner; |
3097 | 3097 |
|
3098 |
-#ifdef REAL_YARA |
|
3099 | 3098 |
compiler->errors = 0; |
3100 | 3099 |
|
3101 | 3100 |
if (setjmp(compiler->error_recovery) != 0) |
3102 | 3101 |
return compiler->errors; |
3103 |
-#endif |
|
3104 | 3102 |
|
3105 | 3103 |
yara_yylex_init(&yyscanner); |
3106 | 3104 |
|
... | ... |
@@ -171,7 +171,6 @@ include[ \t]+\" { |
171 | 171 |
|
172 | 172 |
|
173 | 173 |
<include>\" { |
174 |
-#ifdef REAL_YARA |
|
175 | 174 |
|
176 | 175 |
char buffer[1024]; |
177 | 176 |
char *current_file_name; |
... | ... |
@@ -270,15 +269,10 @@ include[ \t]+\" { |
270 | 270 |
} |
271 | 271 |
|
272 | 272 |
BEGIN(INITIAL); |
273 |
-#else |
|
274 |
- yyerror(yyscanner, compiler, "includes are disabled"); |
|
275 |
- yyterminate(); |
|
276 |
-#endif |
|
277 | 273 |
} |
278 | 274 |
|
279 | 275 |
|
280 | 276 |
<<EOF>> { |
281 |
-#ifdef REAL_YARA |
|
282 | 277 |
|
283 | 278 |
YR_COMPILER* compiler = yyget_extra(yyscanner); |
284 | 279 |
FILE* file = _yr_compiler_pop_file(compiler); |
... | ... |
@@ -295,7 +289,7 @@ include[ \t]+\" { |
295 | 295 |
{ |
296 | 296 |
yyterminate(); |
297 | 297 |
} |
298 |
-#endif |
|
298 |
+ |
|
299 | 299 |
yypop_buffer_state(yyscanner); |
300 | 300 |
|
301 | 301 |
if (!YY_CURRENT_BUFFER) |
... | ... |
@@ -597,7 +591,6 @@ void yywarning( |
597 | 597 |
yyscan_t yyscanner, |
598 | 598 |
const char *warning_message) |
599 | 599 |
{ |
600 |
-#ifdef REAL_YARA |
|
601 | 600 |
YR_COMPILER* compiler = yyget_extra(yyscanner); |
602 | 601 |
char* file_name; |
603 | 602 |
|
... | ... |
@@ -606,16 +599,14 @@ void yywarning( |
606 | 606 |
else |
607 | 607 |
file_name = NULL; |
608 | 608 |
|
609 |
+#ifdef REAL_YARA |
|
609 | 610 |
compiler->callback( |
610 | 611 |
YARA_ERROR_LEVEL_WARNING, |
611 | 612 |
file_name, |
612 | 613 |
yyget_lineno(yyscanner), |
613 | 614 |
warning_message); |
614 | 615 |
#else |
615 |
- if (warning_message != NULL) |
|
616 |
- cli_errmsg("yara_lexer:yywarning() %s\n", warning_message); |
|
617 |
- else |
|
618 |
- cli_errmsg("yara_lexer:yywarning() unknown warning\n"); |
|
616 |
+ cli_warnmsg("yywarning(): %s line %d %s\n", file_name?file_name:"(file name missing)", compiler->last_error_line, warning_message); |
|
619 | 617 |
#endif |
620 | 618 |
} |
621 | 619 |
|
... | ... |
@@ -624,17 +615,10 @@ void yyfatal( |
624 | 624 |
yyscan_t yyscanner, |
625 | 625 |
const char *error_message) |
626 | 626 |
{ |
627 |
-#ifdef REAL_YARA |
|
628 | 627 |
YR_COMPILER* compiler = yyget_extra(yyscanner); |
629 | 628 |
|
630 | 629 |
yyerror(yyscanner, compiler, error_message); |
631 | 630 |
longjmp(compiler->error_recovery, 1); |
632 |
-#else |
|
633 |
- if (error_message != NULL) |
|
634 |
- cli_errmsg("yara_lexer:yyfatal() %s\n", error_message); |
|
635 |
- else |
|
636 |
- cli_errmsg("yara_lexer:yyfatal() unknown error\n"); |
|
637 |
-#endif |
|
638 | 631 |
} |
639 | 632 |
|
640 | 633 |
|
... | ... |
@@ -643,7 +627,6 @@ void yyerror( |
643 | 643 |
YR_COMPILER* compiler, |
644 | 644 |
const char *error_message) |
645 | 645 |
{ |
646 |
-#ifdef REAL_YARA |
|
647 | 646 |
char message[512] = {'\0'}; |
648 | 647 |
char* file_name = NULL; |
649 | 648 |
|
... | ... |
@@ -676,6 +659,7 @@ void yyerror( |
676 | 676 |
yr_compiler_set_error_extra_info(compiler, error_message); |
677 | 677 |
compiler->last_error = ERROR_SYNTAX_ERROR; |
678 | 678 |
|
679 |
+#ifdef REAL_YARA |
|
679 | 680 |
if (compiler->callback != NULL) |
680 | 681 |
{ |
681 | 682 |
compiler->callback( |
... | ... |
@@ -684,11 +668,15 @@ void yyerror( |
684 | 684 |
compiler->last_error_line, |
685 | 685 |
error_message); |
686 | 686 |
} |
687 |
+#else |
|
688 |
+ cli_errmsg("yyerror(): %s line %d %s\n", file_name?file_name:"(file name missing)", compiler->last_error_line, error_message); |
|
689 |
+#endif |
|
687 | 690 |
} |
688 | 691 |
else |
689 | 692 |
{ |
690 | 693 |
compiler->last_error = compiler->last_result; |
691 | 694 |
|
695 |
+#ifdef REAL_YARA |
|
692 | 696 |
if (compiler->callback != NULL) |
693 | 697 |
{ |
694 | 698 |
yr_compiler_get_error_message(compiler, message, sizeof(message)); |
... | ... |
@@ -699,27 +687,13 @@ void yyerror( |
699 | 699 |
compiler->last_error_line, |
700 | 700 |
message); |
701 | 701 |
} |
702 |
- } |
|
703 |
- |
|
704 |
- compiler->last_result = ERROR_SUCCESS; |
|
705 | 702 |
#else |
706 |
- compiler->errors++; |
|
707 |
- if (error_message != NULL) |
|
708 |
- cli_errmsg("yara_lexer:yyerror() error message: %s\n", error_message); |
|
709 |
- if (compiler->error_msg != NULL) |
|
710 |
- cli_errmsg("yara_lexer:yyerror() compiler error message: %s\n", compiler->error_msg); |
|
711 |
- if (compiler->last_error_extra_info[0] != (char) 0) |
|
712 |
- cli_errmsg("yara_lexer:yyerror() error extra info: %s\n", compiler->last_error_extra_info); |
|
713 |
- if (compiler->last_result != ERROR_SUCCESS) |
|
714 |
- cli_errmsg("yara_lexer:yyerror() last result is %i\n", compiler->last_result); |
|
715 |
- if (compiler->error_line != 0) |
|
716 |
- cli_errmsg("yara_lexer:yyerror() error line %i\n", compiler->error_line); |
|
703 |
+ yr_compiler_get_error_message(compiler, message, sizeof(message)); |
|
704 |
+ cli_errmsg("yyerror(): %s line %d %s\n", file_name?file_name:"NULL filename", compiler->last_error_line, message); |
|
705 |
+#endif |
|
706 |
+ } |
|
717 | 707 |
|
718 |
- compiler->last_error_extra_info[0] = (char) 0; |
|
719 |
- compiler->error_msg = NULL; |
|
720 | 708 |
compiler->last_result = ERROR_SUCCESS; |
721 |
- compiler->error_line = 0; |
|
722 |
-#endif |
|
723 | 709 |
} |
724 | 710 |
|
725 | 711 |
|
... | ... |
@@ -761,12 +735,10 @@ int yr_lex_parse_rules_file( |
761 | 761 |
{ |
762 | 762 |
yyscan_t yyscanner; |
763 | 763 |
|
764 |
-#ifdef REAL_YARA |
|
765 | 764 |
compiler->errors = 0; |
766 | 765 |
|
767 | 766 |
if (setjmp(compiler->error_recovery) != 0) |
768 | 767 |
return compiler->errors; |
769 |
-#endif |
|
770 | 768 |
|
771 | 769 |
yylex_init(&yyscanner); |
772 | 770 |
|
... | ... |
@@ -800,8 +800,6 @@ int yr_parser_reduce_rule_declaration( |
800 | 800 |
#if REAL_YARA |
801 | 801 |
compiler->current_rule_strings = NULL; |
802 | 802 |
#else |
803 |
- rule->cl_flags = compiler->current_rule_clflags; |
|
804 |
- compiler->current_rule_clflags = 0; |
|
805 | 803 |
// Write halt instruction at the end of code. |
806 | 804 |
yr_arena_write_data( |
807 | 805 |
compiler->code_arena, |
... | ... |
@@ -953,7 +951,6 @@ YR_META* yr_parser_reduce_meta_declaration( |
953 | 953 |
|
954 | 954 |
STAILQ_INSERT_TAIL(&compiler->current_meta, meta, link); |
955 | 955 |
|
956 |
- //compiler->error_msg = "meta not yet supported"; |
|
957 | 956 |
return meta; |
958 | 957 |
#endif |
959 | 958 |
} |