1. clamav-devel
  2. Commit b897e2ecf6e5d38f1b48d83cd3630e033f6452b8
Browse code

add generated yara [ch] files to git repo.

Steven Morgan authored on 2015/02/06 10:43:17
Showing 3 changed files
libclamav/yara_grammar.c
History View file @ b897e2e
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,4104 @@
0 
+/* A Bison parser, made by GNU Bison 2.5.  */
1 
+
2 
+/* Bison implementation for Yacc-like parsers in C
3 
+
4 
+      Copyright (C) 1984, 1989-1990, 2000-2011 Free Software Foundation, Inc.
5 
+
6 
+   This program is free software: you can redistribute it and/or modify
7 
+   it under the terms of the GNU General Public License as published by
8 
+   the Free Software Foundation, either version 3 of the License, or
9 
+   (at your option) any later version.
10 
+
11 
+   This program is distributed in the hope that it will be useful,
12 
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
13 
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 
+   GNU General Public License for more details.
15 
+
16 
+   You should have received a copy of the GNU General Public License
17 
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
18 
+
19 
+/* As a special exception, you may create a larger work that contains
20 
+   part or all of the Bison parser skeleton and distribute that work
21 
+   under terms of your choice, so long as that work isn't itself a
22 
+   parser generator using the skeleton or a modified version thereof
23 
+   as a parser skeleton.  Alternatively, if you modify or redistribute
24 
+   the parser skeleton itself, you may (at your option) remove this
25 
+   special exception, which will cause the skeleton and the resulting
26 
+   Bison output files to be licensed under the GNU General Public
27 
+   License without this special exception.
28 
+
29 
+   This special exception was added by the Free Software Foundation in
30 
+   version 2.2 of Bison.  */
31 
+
32 
+/* C LALR(1) parser skeleton written by Richard Stallman, by
33 
+   simplifying the original so-called "semantic" parser.  */
34 
+
35 
+/* All symbols defined below should begin with yy or YY, to avoid
36 
+   infringing on user name space.  This should be done even for local
37 
+   variables, as they might otherwise be expanded by user macros.
38 
+   There are some unavoidable exceptions within include files to
39 
+   define necessary library symbols; they are noted "INFRINGES ON
40 
+   USER NAME SPACE" below.  */
41 
+
42 
+/* Identify Bison output.  */
43 
+#define YYBISON 1
44 
+
45 
+/* Bison version.  */
46 
+#define YYBISON_VERSION "2.5"
47 
+
48 
+/* Skeleton name.  */
49 
+#define YYSKELETON_NAME "yacc.c"
50 
+
51 
+/* Pure parsers.  */
52 
+#define YYPURE 1
53 
+
54 
+/* Push parsers.  */
55 
+#define YYPUSH 0
56 
+
57 
+/* Pull parsers.  */
58 
+#define YYPULL 1
59 
+
60 
+/* Using locations.  */
61 
+#define YYLSP_NEEDED 0
62 
+
63 
+/* Substitute the variable and function names.  */
64 
+#define yyparse         yara_yyparse
65 
+#define yylex           yara_yylex
66 
+#define yyerror         yara_yyerror
67 
+#define yylval          yara_yylval
68 
+#define yychar          yara_yychar
69 
+#define yydebug         yara_yydebug
70 
+#define yynerrs         yara_yynerrs
71 
+
72 
+
73 
+/* Copy the first part of user declarations.  */
74 
+
75 
+/* Line 268 of yacc.c  */
76 
+#line 39 "yara_grammar.y"
77 
+
78 
+
79 
+#include <assert.h>
80 
+#include <stdio.h>
81 
+#include <stdint.h>
82 
+#include <string.h>
83 
+#include <limits.h>
84 
+#include <stddef.h>
85 
+
86 
+#ifdef REAL_YARA
87 
+#include <yara/utils.h>
88 
+#include <yara/compiler.h>
89 
+#include <yara/object.h>
90 
+#include <yara/sizedstr.h>
91 
+#include <yara/exec.h>
92 
+#include <yara/error.h>
93 
+#include <yara/mem.h>
94 
+#include <yara/lexer.h>
95 
+#include <yara/parser.h>
96 
+#else
97 
+#define YYDEBUG 1 /* Set for development testing */
98 
+#include "libclamav/yara_clam.h"
99 
+#include "clamav-config.h"
100 
+#include "libclamav/yara_grammar.h"
101 
+#include "libclamav/yara_lexer.h"
102 
+#include "libclamav/yara_parser.h"
103 
+#endif
104 
+
105 
+#define YYERROR_VERBOSE
106 
+
107 
+#define INTEGER_SET_ENUMERATION   1
108 
+#define INTEGER_SET_RANGE         2
109 
+
110 
+#define EXPRESSION_TYPE_BOOLEAN   1
111 
+#define EXPRESSION_TYPE_INTEGER   2
112 
+#define EXPRESSION_TYPE_STRING    3
113 
+#define EXPRESSION_TYPE_REGEXP    4
114 
+
115 
+
116 
+#define ERROR_IF(x) \
117 
+    if (x) \
118 
+    { \
119 
+      yyerror(yyscanner, compiler, NULL); \
120 
+      YYERROR; \
121 
+    } \
122 
+
123 
+#define CHECK_TYPE_WITH_CLEANUP(actual_type, expected_type, op, cleanup) \
124 
+    if (actual_type != expected_type) \
125 
+    { \
126 
+      switch(actual_type) \
127 
+      { \
128 
+        case EXPRESSION_TYPE_INTEGER: \
129 
+          yr_compiler_set_error_extra_info( \
130 
+              compiler, "wrong type \"integer\" for " op " operator"); \
131 
+          break; \
132 
+        case EXPRESSION_TYPE_STRING: \
133 
+          yr_compiler_set_error_extra_info( \
134 
+              compiler, "wrong type \"string\" for \"" op "\" operator"); \
135 
+          break; \
136 
+      } \
137 
+      compiler->last_result = ERROR_WRONG_TYPE; \
138 
+      cleanup; \
139 
+      yyerror(yyscanner, compiler, NULL); \
140 
+      YYERROR; \
141 
+    }
142 
+
143 
+#define CHECK_TYPE(actual_type, expected_type, op) \
144 
+    CHECK_TYPE_WITH_CLEANUP(actual_type, expected_type, op, ) \
145 
+
146 
+
147 
+#define MSG(op)  "wrong type \"string\" for \"" op "\" operator"
148 
+
149 
+
150 
+
151 
+/* Line 268 of yacc.c  */
152 
+#line 154 "yara_grammar.c"
153 
+
154 
+/* Enabling traces.  */
155 
+#ifndef YYDEBUG
156 
+# define YYDEBUG 1
157 
+#endif
158 
+
159 
+/* Enabling verbose error messages.  */
160 
+#ifdef YYERROR_VERBOSE
161 
+# undef YYERROR_VERBOSE
162 
+# define YYERROR_VERBOSE 1
163 
+#else
164 
+# define YYERROR_VERBOSE 0
165 
+#endif
166 
+
167 
+/* Enabling the token table.  */
168 
+#ifndef YYTOKEN_TABLE
169 
+# define YYTOKEN_TABLE 0
170 
+#endif
171 
+
172 
+
173 
+/* Tokens.  */
174 
+#ifndef YYTOKENTYPE
175 
+# define YYTOKENTYPE
176 
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
177 
+      know about them.  */
178 
+   enum yytokentype {
179 
+     _RULE_ = 258,
180 
+     _PRIVATE_ = 259,
181 
+     _GLOBAL_ = 260,
182 
+     _META_ = 261,
183 
+     _STRINGS_ = 262,
184 
+     _CONDITION_ = 263,
185 
+     _IDENTIFIER_ = 264,
186 
+     _STRING_IDENTIFIER_ = 265,
187 
+     _STRING_COUNT_ = 266,
188 
+     _STRING_OFFSET_ = 267,
189 
+     _STRING_IDENTIFIER_WITH_WILDCARD_ = 268,
190 
+     _NUMBER_ = 269,
191 
+     _TEXT_STRING_ = 270,
192 
+     _HEX_STRING_ = 271,
193 
+     _REGEXP_ = 272,
194 
+     _ASCII_ = 273,
195 
+     _WIDE_ = 274,
196 
+     _NOCASE_ = 275,
197 
+     _FULLWORD_ = 276,
198 
+     _AT_ = 277,
199 
+     _FILESIZE_ = 278,
200 
+     _ENTRYPOINT_ = 279,
201 
+     _ALL_ = 280,
202 
+     _ANY_ = 281,
203 
+     _IN_ = 282,
204 
+     _OF_ = 283,
205 
+     _FOR_ = 284,
206 
+     _THEM_ = 285,
207 
+     _INT8_ = 286,
208 
+     _INT16_ = 287,
209 
+     _INT32_ = 288,
210 
+     _UINT8_ = 289,
211 
+     _UINT16_ = 290,
212 
+     _UINT32_ = 291,
213 
+     _MATCHES_ = 292,
214 
+     _CONTAINS_ = 293,
215 
+     _IMPORT_ = 294,
216 
+     _TRUE_ = 295,
217 
+     _FALSE_ = 296,
218 
+     _OR_ = 297,
219 
+     _AND_ = 298,
220 
+     _IS_ = 299,
221 
+     _NEQ_ = 300,
222 
+     _EQ_ = 301,
223 
+     _GE_ = 302,
224 
+     _GT_ = 303,
225 
+     _LE_ = 304,
226 
+     _LT_ = 305,
227 
+     _SHIFT_RIGHT_ = 306,
228 
+     _SHIFT_LEFT_ = 307,
229 
+     _NOT_ = 308
230 
+   };
231 
+#endif
232 
+/* Tokens.  */
233 
+#define _RULE_ 258
234 
+#define _PRIVATE_ 259
235 
+#define _GLOBAL_ 260
236 
+#define _META_ 261
237 
+#define _STRINGS_ 262
238 
+#define _CONDITION_ 263
239 
+#define _IDENTIFIER_ 264
240 
+#define _STRING_IDENTIFIER_ 265
241 
+#define _STRING_COUNT_ 266
242 
+#define _STRING_OFFSET_ 267
243 
+#define _STRING_IDENTIFIER_WITH_WILDCARD_ 268
244 
+#define _NUMBER_ 269
245 
+#define _TEXT_STRING_ 270
246 
+#define _HEX_STRING_ 271
247 
+#define _REGEXP_ 272
248 
+#define _ASCII_ 273
249 
+#define _WIDE_ 274
250 
+#define _NOCASE_ 275
251 
+#define _FULLWORD_ 276
252 
+#define _AT_ 277
253 
+#define _FILESIZE_ 278
254 
+#define _ENTRYPOINT_ 279
255 
+#define _ALL_ 280
256 
+#define _ANY_ 281
257 
+#define _IN_ 282
258 
+#define _OF_ 283
259 
+#define _FOR_ 284
260 
+#define _THEM_ 285
261 
+#define _INT8_ 286
262 
+#define _INT16_ 287
263 
+#define _INT32_ 288
264 
+#define _UINT8_ 289
265 
+#define _UINT16_ 290
266 
+#define _UINT32_ 291
267 
+#define _MATCHES_ 292
268 
+#define _CONTAINS_ 293
269 
+#define _IMPORT_ 294
270 
+#define _TRUE_ 295
271 
+#define _FALSE_ 296
272 
+#define _OR_ 297
273 
+#define _AND_ 298
274 
+#define _IS_ 299
275 
+#define _NEQ_ 300
276 
+#define _EQ_ 301
277 
+#define _GE_ 302
278 
+#define _GT_ 303
279 
+#define _LE_ 304
280 
+#define _LT_ 305
281 
+#define _SHIFT_RIGHT_ 306
282 
+#define _SHIFT_LEFT_ 307
283 
+#define _NOT_ 308
284 
+
285 
+
286 
+
287 
+
288 
+#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
289 
+typedef union YYSTYPE
290 
+{
291 
+
292 
+/* Line 293 of yacc.c  */
293 
+#line 213 "yara_grammar.y"
294 
+
295 
+  SIZED_STRING*   sized_string;
296 
+  char*           c_string;
297 
+  int8_t          expression_type;
298 
+  int64_t         integer;
299 
+  YR_STRING*      string;
300 
+  YR_META*        meta;
301 
+  YR_OBJECT*      object;
302 
+
303 
+
304 
+
305 
+/* Line 293 of yacc.c  */
306 
+#line 308 "yara_grammar.c"
307 
+} YYSTYPE;
308 
+# define YYSTYPE_IS_TRIVIAL 1
309 
+# define yystype YYSTYPE /* obsolescent; will be withdrawn */
310 
+# define YYSTYPE_IS_DECLARED 1
311 
+#endif
312 
+
313 
+
314 
+/* Copy the second part of user declarations.  */
315 
+
316 
+
317 
+/* Line 343 of yacc.c  */
318 
+#line 320 "yara_grammar.c"
319 
+
320 
+#ifdef short
321 
+# undef short
322 
+#endif
323 
+
324 
+#ifdef YYTYPE_UINT8
325 
+typedef YYTYPE_UINT8 yytype_uint8;
326 
+#else
327 
+typedef unsigned char yytype_uint8;
328 
+#endif
329 
+
330 
+#ifdef YYTYPE_INT8
331 
+typedef YYTYPE_INT8 yytype_int8;
332 
+#elif (defined __STDC__ || defined __C99__FUNC__ \
333 
+     || defined __cplusplus || defined _MSC_VER)
334 
+typedef signed char yytype_int8;
335 
+#else
336 
+typedef short int yytype_int8;
337 
+#endif
338 
+
339 
+#ifdef YYTYPE_UINT16
340 
+typedef YYTYPE_UINT16 yytype_uint16;
341 
+#else
342 
+typedef unsigned short int yytype_uint16;
343 
+#endif
344 
+
345 
+#ifdef YYTYPE_INT16
346 
+typedef YYTYPE_INT16 yytype_int16;
347 
+#else
348 
+typedef short int yytype_int16;
349 
+#endif
350 
+
351 
+#ifndef YYSIZE_T
352 
+# ifdef __SIZE_TYPE__
353 
+#  define YYSIZE_T __SIZE_TYPE__
354 
+# elif defined size_t
355 
+#  define YYSIZE_T size_t
356 
+# elif ! defined YYSIZE_T && (defined __STDC__ || defined __C99__FUNC__ \
357 
+     || defined __cplusplus || defined _MSC_VER)
358 
+#  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
359 
+#  define YYSIZE_T size_t
360 
+# else
361 
+#  define YYSIZE_T unsigned int
362 
+# endif
363 
+#endif
364 
+
365 
+#define YYSIZE_MAXIMUM ((YYSIZE_T) -1)
366 
+
367 
+#ifndef YY_
368 
+# if defined YYENABLE_NLS && YYENABLE_NLS
369 
+#  if ENABLE_NLS
370 
+#   include <libintl.h> /* INFRINGES ON USER NAME SPACE */
371 
+#   define YY_(msgid) dgettext ("bison-runtime", msgid)
372 
+#  endif
373 
+# endif
374 
+# ifndef YY_
375 
+#  define YY_(msgid) msgid
376 
+# endif
377 
+#endif
378 
+
379 
+/* Suppress unused-variable warnings by "using" E.  */
380 
+#if ! defined lint || defined __GNUC__
381 
+# define YYUSE(e) ((void) (e))
382 
+#else
383 
+# define YYUSE(e) /* empty */
384 
+#endif
385 
+
386 
+/* Identity function, used to suppress warnings about constant conditions.  */
387 
+#ifndef lint
388 
+# define YYID(n) (n)
389 
+#else
390 
+#if (defined __STDC__ || defined __C99__FUNC__ \
391 
+     || defined __cplusplus || defined _MSC_VER)
392 
+static int
393 
+YYID (int yyi)
394 
+#else
395 
+static int
396 
+YYID (yyi)
397 
+    int yyi;
398 
+#endif
399 
+{
400 
+  return yyi;
401 
+}
402 
+#endif
403 
+
404 
+#if ! defined yyoverflow || YYERROR_VERBOSE
405 
+
406 
+/* The parser invokes alloca or malloc; define the necessary symbols.  */
407 
+
408 
+# ifdef YYSTACK_USE_ALLOCA
409 
+#  if YYSTACK_USE_ALLOCA
410 
+#   ifdef __GNUC__
411 
+#    define YYSTACK_ALLOC __builtin_alloca
412 
+#   elif defined __BUILTIN_VA_ARG_INCR
413 
+#    include <alloca.h> /* INFRINGES ON USER NAME SPACE */
414 
+#   elif defined _AIX
415 
+#    define YYSTACK_ALLOC __alloca
416 
+#   elif defined _MSC_VER
417 
+#    include <malloc.h> /* INFRINGES ON USER NAME SPACE */
418 
+#    define alloca _alloca
419 
+#   else
420 
+#    define YYSTACK_ALLOC alloca
421 
+#    if ! defined _ALLOCA_H && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \
422 
+     || defined __cplusplus || defined _MSC_VER)
423 
+#     include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
424 
+#     ifndef EXIT_SUCCESS
425 
+#      define EXIT_SUCCESS 0
426 
+#     endif
427 
+#    endif
428 
+#   endif
429 
+#  endif
430 
+# endif
431 
+
432 
+# ifdef YYSTACK_ALLOC
433 
+   /* Pacify GCC's `empty if-body' warning.  */
434 
+#  define YYSTACK_FREE(Ptr) do { /* empty */; } while (YYID (0))
435 
+#  ifndef YYSTACK_ALLOC_MAXIMUM
436 
+    /* The OS might guarantee only one guard page at the bottom of the stack,
437 
+       and a page size can be as small as 4096 bytes.  So we cannot safely
438 
+       invoke alloca (N) if N exceeds 4096.  Use a slightly smaller number
439 
+       to allow for a few compiler-allocated temporary stack slots.  */
440 
+#   define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */
441 
+#  endif
442 
+# else
443 
+#  define YYSTACK_ALLOC YYMALLOC
444 
+#  define YYSTACK_FREE YYFREE
445 
+#  ifndef YYSTACK_ALLOC_MAXIMUM
446 
+#   define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM
447 
+#  endif
448 
+#  if (defined __cplusplus && ! defined EXIT_SUCCESS \
449 
+       && ! ((defined YYMALLOC || defined malloc) \
450 
+	     && (defined YYFREE || defined free)))
451 
+#   include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
452 
+#   ifndef EXIT_SUCCESS
453 
+#    define EXIT_SUCCESS 0
454 
+#   endif
455 
+#  endif
456 
+#  ifndef YYMALLOC
457 
+#   define YYMALLOC malloc
458 
+#   if ! defined malloc && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \
459 
+     || defined __cplusplus || defined _MSC_VER)
460 
+void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */
461 
+#   endif
462 
+#  endif
463 
+#  ifndef YYFREE
464 
+#   define YYFREE free
465 
+#   if ! defined free && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \
466 
+     || defined __cplusplus || defined _MSC_VER)
467 
+void free (void *); /* INFRINGES ON USER NAME SPACE */
468 
+#   endif
469 
+#  endif
470 
+# endif
471 
+#endif /* ! defined yyoverflow || YYERROR_VERBOSE */
472 
+
473 
+
474 
+#if (! defined yyoverflow \
475 
+     && (! defined __cplusplus \
476 
+	 || (defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL)))
477 
+
478 
+/* A type that is properly aligned for any stack member.  */
479 
+union yyalloc
480 
+{
481 
+  yytype_int16 yyss_alloc;
482 
+  YYSTYPE yyvs_alloc;
483 
+};
484 
+
485 
+/* The size of the maximum gap between one aligned stack and the next.  */
486 
+# define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
487 
+
488 
+/* The size of an array large to enough to hold all stacks, each with
489 
+   N elements.  */
490 
+# define YYSTACK_BYTES(N) \
491 
+     ((N) * (sizeof (yytype_int16) + sizeof (YYSTYPE)) \
492 
+      + YYSTACK_GAP_MAXIMUM)
493 
+
494 
+# define YYCOPY_NEEDED 1
495 
+
496 
+/* Relocate STACK from its old location to the new one.  The
497 
+   local variables YYSIZE and YYSTACKSIZE give the old and new number of
498 
+   elements in the stack, and YYPTR gives the new location of the
499 
+   stack.  Advance YYPTR to a properly aligned location for the next
500 
+   stack.  */
501 
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
502 
+    do									\
503 
+      {									\
504 
+	YYSIZE_T yynewbytes;						\
505 
+	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
506 
+	Stack = &yyptr->Stack_alloc;					\
507 
+	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
508 
+	yyptr += yynewbytes / sizeof (*yyptr);				\
509 
+      }									\
510 
+    while (YYID (0))
511 
+
512 
+#endif
513 
+
514 
+#if defined YYCOPY_NEEDED && YYCOPY_NEEDED
515 
+/* Copy COUNT objects from FROM to TO.  The source and destination do
516 
+   not overlap.  */
517 
+# ifndef YYCOPY
518 
+#  if defined __GNUC__ && 1 < __GNUC__
519 
+#   define YYCOPY(To, From, Count) \
520 
+      __builtin_memcpy (To, From, (Count) * sizeof (*(From)))
521 
+#  else
522 
+#   define YYCOPY(To, From, Count)		\
523 
+      do					\
524 
+	{					\
525 
+	  YYSIZE_T yyi;				\
526 
+	  for (yyi = 0; yyi < (Count); yyi++)	\
527 
+	    (To)[yyi] = (From)[yyi];		\
528 
+	}					\
529 
+      while (YYID (0))
530 
+#  endif
531 
+# endif
532 
+#endif /* !YYCOPY_NEEDED */
533 
+
534 
+/* YYFINAL -- State number of the termination state.  */
535 
+#define YYFINAL  2
536 
+/* YYLAST -- Last index in YYTABLE.  */
537 
+#define YYLAST   433
538 
+
539 
+/* YYNTOKENS -- Number of terminals.  */
540 
+#define YYNTOKENS  74
541 
+/* YYNNTS -- Number of nonterminals.  */
542 
+#define YYNNTS  35
543 
+/* YYNRULES -- Number of rules.  */
544 
+#define YYNRULES  115
545 
+/* YYNRULES -- Number of states.  */
546 
+#define YYNSTATES  216
547 
+
548 
+/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
549 
+#define YYUNDEFTOK  2
550 
+#define YYMAXUTOK   308
551 
+
552 
+#define YYTRANSLATE(YYX)						\
553 
+  ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
554 
+
555 
+/* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX.  */
556 
+static const yytype_uint8 yytranslate[] =
557 
+{
558 
+       0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
559 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
560 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
561 
+       2,     2,     2,     2,     2,     2,     2,    60,    44,     2,
562 
+      71,    72,    58,    56,    73,    57,    68,     2,     2,     2,
563 
+       2,     2,     2,     2,     2,     2,     2,     2,    66,     2,
564 
+       2,    67,     2,     2,     2,     2,     2,     2,     2,     2,
565 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
566 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
567 
+       2,    69,    59,    70,    46,     2,     2,     2,     2,     2,
568 
+       2,     2,     2,     2,     2,    63,     2,     2,     2,     2,
569 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
570 
+       2,     2,     2,    64,    45,    65,    62,     2,     2,     2,
571 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
572 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
573 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
574 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
575 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
576 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
577 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
578 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
579 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
580 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
581 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
582 
+       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
583 
+       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
584 
+       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
585 
+      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
586 
+      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
587 
+      35,    36,    37,    38,    39,    40,    41,    42,    43,    47,
588 
+      48,    49,    50,    51,    52,    53,    54,    55,    61
589 
+};
590 
+
591 
+#if YYDEBUG
592 
+/* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in
593 
+   YYRHS.  */
594 
+static const yytype_uint16 yyprhs[] =
595 
+{
596 
+       0,     0,     3,     4,     7,    10,    14,    18,    21,    31,
597 
+      32,    36,    37,    41,    45,    46,    49,    51,    53,    54,
598 
+      57,    59,    62,    64,    67,    71,    75,    79,    83,    85,
599 
+      88,    93,    94,   100,   104,   105,   108,   110,   112,   114,
600 
+     116,   118,   122,   127,   132,   133,   135,   139,   141,   143,
601 
+     145,   147,   151,   155,   157,   161,   165,   166,   167,   179,
602 
+     180,   190,   194,   197,   201,   205,   209,   213,   217,   221,
603 
+     225,   229,   233,   235,   239,   243,   245,   252,   254,   258,
604 
+     259,   264,   266,   268,   272,   274,   276,   278,   280,   282,
605 
+     286,   288,   290,   295,   300,   305,   310,   315,   320,   322,
606 
+     324,   326,   331,   333,   335,   339,   343,   347,   351,   355,
607 
+     359,   363,   367,   370,   374,   378
608 
+};
609 
+
610 
+/* YYRHS -- A `-1'-separated list of the rules' RHS.  */
611 
+static const yytype_int8 yyrhs[] =
612 
+{
613 
+      75,     0,    -1,    -1,    75,    77,    -1,    75,    76,    -1,
614 
+      75,     1,    77,    -1,    75,     1,    63,    -1,    39,    15,
615 
+      -1,    81,     3,     9,    83,    64,    78,    79,    80,    65,
616 
+      -1,    -1,     6,    66,    85,    -1,    -1,     7,    66,    87,
617 
+      -1,     8,    66,    95,    -1,    -1,    81,    82,    -1,     4,
618 
+      -1,     5,    -1,    -1,    66,    84,    -1,     9,    -1,    84,
619 
+       9,    -1,    86,    -1,    85,    86,    -1,     9,    67,    15,
620 
+      -1,     9,    67,    14,    -1,     9,    67,    40,    -1,     9,
621 
+      67,    41,    -1,    88,    -1,    87,    88,    -1,    10,    67,
622 
+      15,    90,    -1,    -1,    10,    67,    89,    17,    90,    -1,
623 
+      10,    67,    16,    -1,    -1,    90,    91,    -1,    19,    -1,
624 
+      18,    -1,    20,    -1,    21,    -1,     9,    -1,    92,    68,
625 
+       9,    -1,    92,    69,   108,    70,    -1,    92,    71,    93,
626 
+      72,    -1,    -1,    96,    -1,    93,    73,    96,    -1,    17,
627 
+      -1,    96,    -1,    40,    -1,    41,    -1,   108,    37,    94,
628 
+      -1,   108,    38,   108,    -1,    10,    -1,    10,    22,   108,
629 
+      -1,    10,    27,   101,    -1,    -1,    -1,    29,   107,     9,
630 
+      27,    97,   100,    66,    98,    71,    95,    72,    -1,    -1,
631 
+      29,   107,    28,   103,    66,    99,    71,    95,    72,    -1,
632 
+     107,    28,   103,    -1,    61,    95,    -1,    95,    43,    95,
633 
+      -1,    95,    42,    95,    -1,   108,    53,   108,    -1,   108,
634 
+      51,   108,    -1,   108,    52,   108,    -1,   108,    50,   108,
635 
+      -1,   108,    49,   108,    -1,   108,    47,   108,    -1,   108,
636 
+      48,   108,    -1,   108,    -1,    71,    96,    72,    -1,    71,
637 
+     102,    72,    -1,   101,    -1,    71,   108,    68,    68,   108,
638 
+      72,    -1,   108,    -1,   102,    73,   108,    -1,    -1,    71,
639 
+     104,   105,    72,    -1,    30,    -1,   106,    -1,   105,    73,
640 
+     106,    -1,    10,    -1,    13,    -1,   108,    -1,    25,    -1,
641 
+      26,    -1,    71,   108,    72,    -1,    23,    -1,    24,    -1,
642 
+      31,    71,   108,    72,    -1,    32,    71,   108,    72,    -1,
643 
+      33,    71,   108,    72,    -1,    34,    71,   108,    72,    -1,
644 
+      35,    71,   108,    72,    -1,    36,    71,   108,    72,    -1,
645 
+      14,    -1,    15,    -1,    11,    -1,    12,    69,   108,    70,
646 
+      -1,    12,    -1,    92,    -1,   108,    56,   108,    -1,   108,
647 
+      57,   108,    -1,   108,    58,   108,    -1,   108,    59,   108,
648 
+      -1,   108,    60,   108,    -1,   108,    46,   108,    -1,   108,
649 
+      44,   108,    -1,   108,    45,   108,    -1,    62,   108,    -1,
650 
+     108,    55,   108,    -1,   108,    54,   108,    -1,    94,    -1
651 
+};
652 
+
653 
+/* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
654 
+static const yytype_uint16 yyrline[] =
655 
+{
656 
+       0,   226,   226,   228,   229,   230,   231,   236,   248,   267,
657 
+     270,   300,   306,   336,   341,   342,   347,   348,   354,   357,
658 
+     377,   394,   433,   434,   439,   455,   468,   481,   498,   499,
659 
+     504,   518,   517,   536,   553,   554,   559,   560,   561,   562,
660 
+     567,   663,   714,   739,   781,   784,   806,   839,   886,   904,
661 
+     913,   922,   937,   951,   964,   979,   993,  1029,   992,  1150,
662 
+    1149,  1229,  1235,  1241,  1247,  1255,  1264,  1273,  1282,  1291,
663 
+    1318,  1345,  1372,  1376,  1384,  1385,  1390,  1412,  1424,  1440,
664 
+    1439,  1445,  1457,  1458,  1463,  1468,  1477,  1478,  1485,  1496,
665 
+    1500,  1509,  1524,  1535,  1546,  1557,  1568,  1579,  1590,  1599,
666 
+    1624,  1637,  1650,  1670,  1705,  1714,  1723,  1732,  1741,  1750,
667 
+    1759,  1768,  1777,  1785,  1794,  1803
668 
+};
669 
+#endif
670 
+
671 
+#if YYDEBUG || YYERROR_VERBOSE || YYTOKEN_TABLE
672 
+/* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
673 
+   First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
674 
+static const char *const yytname[] =
675 
+{
676 
+  "$end", "error", "$undefined", "_RULE_", "_PRIVATE_", "_GLOBAL_",
677 
+  "_META_", "_STRINGS_", "_CONDITION_", "_IDENTIFIER_",
678 
+  "_STRING_IDENTIFIER_", "_STRING_COUNT_", "_STRING_OFFSET_",
679 
+  "_STRING_IDENTIFIER_WITH_WILDCARD_", "_NUMBER_", "_TEXT_STRING_",
680 
+  "_HEX_STRING_", "_REGEXP_", "_ASCII_", "_WIDE_", "_NOCASE_",
681 
+  "_FULLWORD_", "_AT_", "_FILESIZE_", "_ENTRYPOINT_", "_ALL_", "_ANY_",
682 
+  "_IN_", "_OF_", "_FOR_", "_THEM_", "_INT8_", "_INT16_", "_INT32_",
683 
+  "_UINT8_", "_UINT16_", "_UINT32_", "_MATCHES_", "_CONTAINS_", "_IMPORT_",
684 
+  "_TRUE_", "_FALSE_", "_OR_", "_AND_", "'&'", "'|'", "'^'", "_IS_",
685 
+  "_NEQ_", "_EQ_", "_GE_", "_GT_", "_LE_", "_LT_", "_SHIFT_RIGHT_",
686 
+  "_SHIFT_LEFT_", "'+'", "'-'", "'*'", "'\\\\'", "'%'", "_NOT_", "'~'",
687 
+  "'i'", "'{'", "'}'", "':'", "'='", "'.'", "'['", "']'", "'('", "')'",
688 
+  "','", "$accept", "rules", "import", "rule", "meta", "strings",
689 
+  "condition", "rule_modifiers", "rule_modifier", "tags", "tag_list",
690 
+  "meta_declarations", "meta_declaration", "string_declarations",
691 
+  "string_declaration", "$@1", "string_modifiers", "string_modifier",
692 
+  "identifier", "arguments_list", "regexp", "boolean_expression",
693 
+  "expression", "$@2", "$@3", "$@4", "integer_set", "range",
694 
+  "integer_enumeration", "string_set", "$@5", "string_enumeration",
695 
+  "string_enumeration_item", "for_expression", "primary_expression", 0
696 
+};
697 
+#endif
698 
+
699 
+# ifdef YYPRINT
700 
+/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to
701 
+   token YYLEX-NUM.  */
702 
+static const yytype_uint16 yytoknum[] =
703 
+{
704 
+       0,   256,   257,   258,   259,   260,   261,   262,   263,   264,
705 
+     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
706 
+     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
707 
+     285,   286,   287,   288,   289,   290,   291,   292,   293,   294,
708 
+     295,   296,   297,   298,    38,   124,    94,   299,   300,   301,
709 
+     302,   303,   304,   305,   306,   307,    43,    45,    42,    92,
710 
+      37,   308,   126,   105,   123,   125,    58,    61,    46,    91,
711 
+      93,    40,    41,    44
712 
+};
713 
+# endif
714 
+
715 
+/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
716 
+static const yytype_uint8 yyr1[] =
717 
+{
718 
+       0,    74,    75,    75,    75,    75,    75,    76,    77,    78,
719 
+      78,    79,    79,    80,    81,    81,    82,    82,    83,    83,
720 
+      84,    84,    85,    85,    86,    86,    86,    86,    87,    87,
721 
+      88,    89,    88,    88,    90,    90,    91,    91,    91,    91,
722 
+      92,    92,    92,    92,    93,    93,    93,    94,    95,    96,
723 
+      96,    96,    96,    96,    96,    96,    97,    98,    96,    99,
724 
+      96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
725 
+      96,    96,    96,    96,   100,   100,   101,   102,   102,   104,
726 
+     103,   103,   105,   105,   106,   106,   107,   107,   107,   108,
727 
+     108,   108,   108,   108,   108,   108,   108,   108,   108,   108,
728 
+     108,   108,   108,   108,   108,   108,   108,   108,   108,   108,
729 
+     108,   108,   108,   108,   108,   108
730 
+};
731 
+
732 
+/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
733 
+static const yytype_uint8 yyr2[] =
734 
+{
735 
+       0,     2,     0,     2,     2,     3,     3,     2,     9,     0,
736 
+       3,     0,     3,     3,     0,     2,     1,     1,     0,     2,
737 
+       1,     2,     1,     2,     3,     3,     3,     3,     1,     2,
738 
+       4,     0,     5,     3,     0,     2,     1,     1,     1,     1,
739 
+       1,     3,     4,     4,     0,     1,     3,     1,     1,     1,
740 
+       1,     3,     3,     1,     3,     3,     0,     0,    11,     0,
741 
+       9,     3,     2,     3,     3,     3,     3,     3,     3,     3,
742 
+       3,     3,     1,     3,     3,     1,     6,     1,     3,     0,
743 
+       4,     1,     1,     3,     1,     1,     1,     1,     1,     3,
744 
+       1,     1,     4,     4,     4,     4,     4,     4,     1,     1,
745 
+       1,     4,     1,     1,     3,     3,     3,     3,     3,     3,
746 
+       3,     3,     2,     3,     3,     1
747 
+};
748 
+
749 
+/* YYDEFACT[STATE-NAME] -- Default reduction number in state STATE-NUM.
750 
+   Performed when YYTABLE doesn't specify something else to do.  Zero
751 
+   means the default is an error.  */
752 
+static const yytype_uint8 yydefact[] =
753 
+{
754 
+       2,     0,     1,    14,     0,     4,     3,     0,     6,     5,
755 
+       7,     0,    16,    17,    15,    18,     0,     0,    20,    19,
756 
+       9,    21,     0,    11,     0,     0,     0,     0,    10,    22,
757 
+       0,     0,     0,     0,    23,     0,    12,    28,     0,     8,
758 
+      25,    24,    26,    27,    31,    29,    40,    53,   100,   102,
759 
+      98,    99,    47,    90,    91,    87,    88,     0,     0,     0,
760 
+       0,     0,     0,     0,    49,    50,     0,     0,     0,   103,
761 
+     115,    13,    48,     0,    72,    34,    33,     0,     0,     0,
762 
+       0,     0,     0,    86,     0,     0,     0,     0,     0,     0,
763 
+      62,   112,     0,    48,    72,     0,     0,    44,     0,     0,
764 
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
765 
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
766 
+      30,    34,    54,     0,    55,     0,     0,     0,     0,     0,
767 
+       0,     0,     0,     0,     0,    73,    89,    41,     0,     0,
768 
+      45,    64,    63,    81,    79,    61,    51,    52,   110,   111,
769 
+     109,    70,    71,    69,    68,    66,    67,    65,   114,   113,
770 
+     104,   105,   106,   107,   108,    37,    36,    38,    39,    35,
771 
+      32,     0,   101,    56,     0,    92,    93,    94,    95,    96,
772 
+      97,    42,    43,     0,     0,     0,     0,    59,    46,    84,
773 
+      85,     0,    82,     0,     0,     0,    75,     0,    80,     0,
774 
+       0,     0,    77,    57,     0,    83,    76,    74,     0,     0,
775 
+       0,    78,     0,    60,     0,    58
776 
+};
777 
+
778 
+/* YYDEFGOTO[NTERM-NUM].  */
779 
+static const yytype_int16 yydefgoto[] =
780 
+{
781 
+      -1,     1,     5,     6,    23,    26,    32,     7,    14,    17,
782 
+      19,    28,    29,    36,    37,    77,   120,   169,    69,   139,
783 
+      70,    92,    72,   186,   209,   197,   195,   124,   201,   145,
784 
+     184,   191,   192,    73,    74
785 
+};
786 
+
787 
+/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
788 
+   STATE-NUM.  */
789 
+#define YYPACT_NINF -66
790 
+static const yytype_int16 yypact[] =
791 
+{
792 
+     -66,     6,   -66,   -59,     0,   -66,   -66,    59,   -66,   -66,
793 
+     -66,     9,   -66,   -66,   -66,   -44,    16,   -24,   -66,    49,
794 
+      81,   -66,    26,    88,    92,    43,   115,    54,    92,   -66,
795 
+     116,    63,    66,    -2,   -66,    75,   116,   -66,    79,   -66,
796 
+     -66,   -66,   -66,   -66,    82,   -66,   -66,    -8,   -66,    83,
797 
+     -66,   -66,   -66,   -66,   -66,   -66,   -66,   113,    72,    80,
798 
+      84,    94,    96,    97,   -66,   -66,    79,   168,    79,   -42,
799 
+     -66,    57,   -66,   125,   205,   -66,   -66,   137,   168,    98,
800 
+     168,   168,    -7,   372,   168,   168,   168,   168,   168,   168,
801 
+     -66,   -66,    57,   100,   169,   161,   168,    79,    79,    79,
802 
+     -29,   156,   168,   168,   168,   168,   168,   168,   168,   168,
803 
+     168,   168,   168,   168,   168,   168,   168,   168,   168,   168,
804 
+      36,   -66,   372,   168,   -66,   338,   222,   149,   -29,   229,
805 
+     251,   258,   280,   287,   309,   -66,   -66,   -66,   345,    34,
806 
+      74,   135,   -66,   -66,   -66,   -66,   -66,   372,   104,   104,
807 
+     104,   372,   372,   372,   372,   372,   372,   372,   -23,   -23,
808 
+      25,    25,   -66,   -66,   -66,   -66,   -66,   -66,   -66,   -66,
809 
+      36,   365,   -66,   -66,   120,   -66,   -66,   -66,   -66,   -66,
810 
+     -66,   -66,   -66,    79,    -5,   119,   110,   -66,    74,   -66,
811 
+     -66,    60,   -66,   168,   168,   122,   -66,   118,   -66,    -5,
812 
+     316,    62,   365,   -66,    79,   -66,   -66,   -66,   168,   123,
813 
+     -26,   372,    79,   -66,   -19,   -66
814 
+};
815 
+
816 
+/* YYPGOTO[NTERM-NUM].  */
817 
+static const yytype_int16 yypgoto[] =
818 
+{
819 
+     -66,   -66,   -66,   187,   -66,   -66,   -66,   -66,   -66,   -66,
820 
+     -66,   -66,   165,   -66,   159,   -66,    77,   -66,   -66,   -66,
821 
+      95,   -38,   -65,   -66,   -66,   -66,   -66,    19,   -66,   103,
822 
+     -66,   -66,    10,   151,   -37
823 
+};
824 
+
825 
+/* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
826 
+   positive, shift that token.  If negative, reduce the rule which
827 
+   number is the opposite.  If YYTABLE_NINF, syntax error.  */
828 
+#define YYTABLE_NINF -87
829 
+static const yytype_int16 yytable[] =
830 
+{
831 
+      71,   143,   127,    93,     8,   189,     2,     3,   190,   -14,
832 
+     -14,   -14,    40,    41,    78,    10,    98,    99,    15,    79,
833 
+      83,   128,    16,    98,    99,    18,    95,    96,    90,    97,
834 
+      91,    94,   140,   115,   116,   117,   118,   119,    42,    43,
835 
+      20,   122,   144,   125,   126,     4,   213,   129,   130,   131,
836 
+     132,   133,   134,   215,   165,   166,   167,   168,    21,   138,
837 
+     141,   142,    11,    12,    13,   147,   148,   149,   150,   151,
838 
+     152,   153,   154,   155,   156,   157,   158,   159,   160,   161,
839 
+     162,   163,   164,   117,   118,   119,   171,    22,    46,    47,
840 
+      48,    49,    24,    50,    51,    25,    52,    75,    76,    98,
841 
+      99,    27,    53,    54,    55,    56,   182,   183,    57,    30,
842 
+      58,    59,    60,    61,    62,    63,   -48,   -48,   188,    64,
843 
+      65,    33,    46,    31,    48,    49,    35,    50,    51,    38,
844 
+      52,    39,   198,   199,   207,   208,    53,    54,    55,    56,
845 
+      66,    67,    44,    84,    58,    59,    60,    61,    62,    63,
846 
+      68,    85,    80,   100,   121,    86,   200,   202,   113,   114,
847 
+     115,   116,   117,   118,   119,    87,   210,    88,    89,   123,
848 
+     137,   211,   135,    52,   214,    67,   173,    46,    99,    48,
849 
+      49,   194,    50,    51,    81,    52,   187,   193,   203,   204,
850 
+       9,    53,    54,    34,   212,    45,   146,   -86,   170,    58,
851 
+      59,    60,    61,    62,    63,   196,   101,   102,    82,   205,
852 
+       0,     0,     0,   103,   104,   105,   106,   107,   108,   109,
853 
+     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
854 
+      67,   174,     0,   -86,     0,     0,     0,     0,     0,    81,
855 
+       0,   136,   101,   102,     0,     0,     0,     0,     0,   103,
856 
+     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
857 
+     114,   115,   116,   117,   118,   119,   103,   104,   105,     0,
858 
+       0,     0,     0,   103,   104,   105,   113,   114,   115,   116,
859 
+     117,   118,   119,   113,   114,   115,   116,   117,   118,   119,
860 
+       0,     0,     0,     0,   136,   103,   104,   105,     0,     0,
861 
+       0,   175,   103,   104,   105,   113,   114,   115,   116,   117,
862 
+     118,   119,   113,   114,   115,   116,   117,   118,   119,     0,
863 
+       0,     0,     0,   176,   103,   104,   105,     0,     0,     0,
864 
+     177,   103,   104,   105,   113,   114,   115,   116,   117,   118,
865 
+     119,   113,   114,   115,   116,   117,   118,   119,     0,     0,
866 
+       0,     0,   178,   103,   104,   105,     0,     0,     0,   179,
867 
+     103,   104,   105,   113,   114,   115,   116,   117,   118,   119,
868 
+     113,   114,   115,   116,   117,   118,   119,     0,     0,     0,
869 
+       0,   180,   103,   104,   105,     0,     0,     0,   206,   103,
870 
+     104,   105,   113,   114,   115,   116,   117,   118,   119,   113,
871 
+     114,   115,   116,   117,   118,   119,     0,     0,   172,   103,
872 
+     104,   105,     0,     0,     0,   181,   103,   104,   105,   113,
873 
+     114,   115,   116,   117,   118,   119,   113,   114,   115,   116,
874 
+     117,   118,   119,   185
875 
+};
876 
+
877 
+#define yypact_value_is_default(yystate) \
878 
+  ((yystate) == (-66))
879 
+
880 
+#define yytable_value_is_error(yytable_value) \
881 
+  YYID (0)
882 
+
883 
+static const yytype_int16 yycheck[] =
884 
+{
885 
+      38,    30,     9,    68,    63,    10,     0,     1,    13,     3,
886 
+       4,     5,    14,    15,    22,    15,    42,    43,     9,    27,
887 
+      57,    28,    66,    42,    43,     9,    68,    69,    66,    71,
888 
+      67,    68,    97,    56,    57,    58,    59,    60,    40,    41,
889 
+      64,    78,    71,    80,    81,    39,    72,    84,    85,    86,
890 
+      87,    88,    89,    72,    18,    19,    20,    21,     9,    96,
891 
+      98,    99,     3,     4,     5,   102,   103,   104,   105,   106,
892 
+     107,   108,   109,   110,   111,   112,   113,   114,   115,   116,
893 
+     117,   118,   119,    58,    59,    60,   123,     6,     9,    10,
894 
+      11,    12,    66,    14,    15,     7,    17,    15,    16,    42,
895 
+      43,     9,    23,    24,    25,    26,    72,    73,    29,    66,
896 
+      31,    32,    33,    34,    35,    36,    42,    43,   183,    40,
897 
+      41,    67,     9,     8,    11,    12,    10,    14,    15,    66,
898 
+      17,    65,    72,    73,    72,    73,    23,    24,    25,    26,
899 
+      61,    62,    67,    71,    31,    32,    33,    34,    35,    36,
900 
+      71,    71,    69,    28,    17,    71,   193,   194,    54,    55,
901 
+      56,    57,    58,    59,    60,    71,   204,    71,    71,    71,
902 
+       9,   208,    72,    17,   212,    62,    27,     9,    43,    11,
903 
+      12,    71,    14,    15,    71,    17,    66,    68,    66,    71,
904 
+       3,    23,    24,    28,    71,    36,   101,    28,   121,    31,
905 
+      32,    33,    34,    35,    36,   186,    37,    38,    57,   199,
906 
+      -1,    -1,    -1,    44,    45,    46,    47,    48,    49,    50,
907 
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
908 
+      62,   128,    -1,    28,    -1,    -1,    -1,    -1,    -1,    71,
909 
+      -1,    72,    37,    38,    -1,    -1,    -1,    -1,    -1,    44,
910 
+      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
911 
+      55,    56,    57,    58,    59,    60,    44,    45,    46,    -1,
912 
+      -1,    -1,    -1,    44,    45,    46,    54,    55,    56,    57,
913 
+      58,    59,    60,    54,    55,    56,    57,    58,    59,    60,
914 
+      -1,    -1,    -1,    -1,    72,    44,    45,    46,    -1,    -1,
915 
+      -1,    72,    44,    45,    46,    54,    55,    56,    57,    58,
916 
+      59,    60,    54,    55,    56,    57,    58,    59,    60,    -1,
917 
+      -1,    -1,    -1,    72,    44,    45,    46,    -1,    -1,    -1,
918 
+      72,    44,    45,    46,    54,    55,    56,    57,    58,    59,
919 
+      60,    54,    55,    56,    57,    58,    59,    60,    -1,    -1,
920 
+      -1,    -1,    72,    44,    45,    46,    -1,    -1,    -1,    72,
921 
+      44,    45,    46,    54,    55,    56,    57,    58,    59,    60,
922 
+      54,    55,    56,    57,    58,    59,    60,    -1,    -1,    -1,
923 
+      -1,    72,    44,    45,    46,    -1,    -1,    -1,    72,    44,
924 
+      45,    46,    54,    55,    56,    57,    58,    59,    60,    54,
925 
+      55,    56,    57,    58,    59,    60,    -1,    -1,    70,    44,
926 
+      45,    46,    -1,    -1,    -1,    70,    44,    45,    46,    54,
927 
+      55,    56,    57,    58,    59,    60,    54,    55,    56,    57,
928 
+      58,    59,    60,    68
929 
+};
930 
+
931 
+/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
932 
+   symbol of state STATE-NUM.  */
933 
+static const yytype_uint8 yystos[] =
934 
+{
935 
+       0,    75,     0,     1,    39,    76,    77,    81,    63,    77,
936 
+      15,     3,     4,     5,    82,     9,    66,    83,     9,    84,
937 
+      64,     9,     6,    78,    66,     7,    79,     9,    85,    86,
938 
+      66,     8,    80,    67,    86,    10,    87,    88,    66,    65,
939 
+      14,    15,    40,    41,    67,    88,     9,    10,    11,    12,
940 
+      14,    15,    17,    23,    24,    25,    26,    29,    31,    32,
941 
+      33,    34,    35,    36,    40,    41,    61,    62,    71,    92,
942 
+      94,    95,    96,   107,   108,    15,    16,    89,    22,    27,
943 
+      69,    71,   107,   108,    71,    71,    71,    71,    71,    71,
944 
+      95,   108,    95,    96,   108,    68,    69,    71,    42,    43,
945 
+      28,    37,    38,    44,    45,    46,    47,    48,    49,    50,
946 
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
947 
+      90,    17,   108,    71,   101,   108,   108,     9,    28,   108,
948 
+     108,   108,   108,   108,   108,    72,    72,     9,   108,    93,
949 
+      96,    95,    95,    30,    71,   103,    94,   108,   108,   108,
950 
+     108,   108,   108,   108,   108,   108,   108,   108,   108,   108,
951 
+     108,   108,   108,   108,   108,    18,    19,    20,    21,    91,
952 
+      90,   108,    70,    27,   103,    72,    72,    72,    72,    72,
953 
+      72,    70,    72,    73,   104,    68,    97,    66,    96,    10,
954 
+      13,   105,   106,    68,    71,   100,   101,    99,    72,    73,
955 
+     108,   102,   108,    66,    71,   106,    72,    72,    73,    98,
956 
+      95,   108,    71,    72,    95,    72
957 
+};
958 
+
959 
+#define yyerrok		(yyerrstatus = 0)
960 
+#define yyclearin	(yychar = YYEMPTY)
961 
+#define YYEMPTY		(-2)
962 
+#define YYEOF		0
963 
+
964 
+#define YYACCEPT	goto yyacceptlab
965 
+#define YYABORT		goto yyabortlab
966 
+#define YYERROR		goto yyerrorlab
967 
+
968 
+
969 
+/* Like YYERROR except do call yyerror.  This remains here temporarily
970 
+   to ease the transition to the new meaning of YYERROR, for GCC.
971 
+   Once GCC version 2 has supplanted version 1, this can go.  However,
972 
+   YYFAIL appears to be in use.  Nevertheless, it is formally deprecated
973 
+   in Bison 2.4.2's NEWS entry, where a plan to phase it out is
974 
+   discussed.  */
975 
+
976 
+#define YYFAIL		goto yyerrlab
977 
+#if defined YYFAIL
978 
+  /* This is here to suppress warnings from the GCC cpp's
979 
+     -Wunused-macros.  Normally we don't worry about that warning, but
980 
+     some users do, and we want to make it easy for users to remove
981 
+     YYFAIL uses, which will produce warnings from Bison 2.5.  */
982 
+#endif
983 
+
984 
+#define YYRECOVERING()  (!!yyerrstatus)
985 
+
986 
+#define YYBACKUP(Token, Value)					\
987 
+do								\
988 
+  if (yychar == YYEMPTY && yylen == 1)				\
989 
+    {								\
990 
+      yychar = (Token);						\
991 
+      yylval = (Value);						\
992 
+      YYPOPSTACK (1);						\
993 
+      goto yybackup;						\
994 
+    }								\
995 
+  else								\
996 
+    {								\
997 
+      yyerror (yyscanner, compiler, YY_("syntax error: cannot back up")); \
998 
+      YYERROR;							\
999 
+    }								\
1000 
+while (YYID (0))
1001 
+
1002 
+
1003 
+#define YYTERROR	1
1004 
+#define YYERRCODE	256
1005 
+
1006 
+
1007 
+/* YYLLOC_DEFAULT -- Set CURRENT to span from RHS[1] to RHS[N].
1008 
+   If N is 0, then set CURRENT to the empty location which ends
1009 
+   the previous symbol: RHS[0] (always defined).  */
1010 
+
1011 
+#define YYRHSLOC(Rhs, K) ((Rhs)[K])
1012 
+#ifndef YYLLOC_DEFAULT
1013 
+# define YYLLOC_DEFAULT(Current, Rhs, N)				\
1014 
+    do									\
1015 
+      if (YYID (N))                                                    \
1016 
+	{								\
1017 
+	  (Current).first_line   = YYRHSLOC (Rhs, 1).first_line;	\
1018 
+	  (Current).first_column = YYRHSLOC (Rhs, 1).first_column;	\
1019 
+	  (Current).last_line    = YYRHSLOC (Rhs, N).last_line;		\
1020 
+	  (Current).last_column  = YYRHSLOC (Rhs, N).last_column;	\
1021 
+	}								\
1022 
+      else								\
1023 
+	{								\
1024 
+	  (Current).first_line   = (Current).last_line   =		\
1025 
+	    YYRHSLOC (Rhs, 0).last_line;				\
1026 
+	  (Current).first_column = (Current).last_column =		\
1027 
+	    YYRHSLOC (Rhs, 0).last_column;				\
1028 
+	}								\
1029 
+    while (YYID (0))
1030 
+#endif
1031 
+
1032 
+
1033 
+/* This macro is provided for backward compatibility. */
1034 
+
1035 
+#ifndef YY_LOCATION_PRINT
1036 
+# define YY_LOCATION_PRINT(File, Loc) ((void) 0)
1037 
+#endif
1038 
+
1039 
+
1040 
+/* YYLEX -- calling `yylex' with the right arguments.  */
1041 
+
1042 
+#ifdef YYLEX_PARAM
1043 
+# define YYLEX yylex (&yylval, YYLEX_PARAM)
1044 
+#else
1045 
+# define YYLEX yylex (&yylval, yyscanner, compiler)
1046 
+#endif
1047 
+
1048 
+/* Enable debugging if requested.  */
1049 
+#if YYDEBUG
1050 
+
1051 
+# ifndef YYFPRINTF
1052 
+#  include <stdio.h> /* INFRINGES ON USER NAME SPACE */
1053 
+#  define YYFPRINTF fprintf
1054 
+# endif
1055 
+
1056 
+# define YYDPRINTF(Args)			\
1057 
+do {						\
1058 
+  if (yydebug)					\
1059 
+    YYFPRINTF Args;				\
1060 
+} while (YYID (0))
1061 
+
1062 
+# define YY_SYMBOL_PRINT(Title, Type, Value, Location)			  \
1063 
+do {									  \
1064 
+  if (yydebug)								  \
1065 
+    {									  \
1066 
+      YYFPRINTF (stderr, "%s ", Title);					  \
1067 
+      yy_symbol_print (stderr,						  \
1068 
+		  Type, Value, yyscanner, compiler); \
1069 
+      YYFPRINTF (stderr, "\n");						  \
1070 
+    }									  \
1071 
+} while (YYID (0))
1072 
+
1073 
+
1074 
+/*--------------------------------.
1075 
+| Print this symbol on YYOUTPUT.  |
1076 
+`--------------------------------*/
1077 
+
1078 
+/*ARGSUSED*/
1079 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1080 
+     || defined __cplusplus || defined _MSC_VER)
1081 
+static void
1082 
+yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, void *yyscanner, YR_COMPILER* compiler)
1083 
+#else
1084 
+static void
1085 
+yy_symbol_value_print (yyoutput, yytype, yyvaluep, yyscanner, compiler)
1086 
+    FILE *yyoutput;
1087 
+    int yytype;
1088 
+    YYSTYPE const * const yyvaluep;
1089 
+    void *yyscanner;
1090 
+    YR_COMPILER* compiler;
1091 
+#endif
1092 
+{
1093 
+  if (!yyvaluep)
1094 
+    return;
1095 
+  YYUSE (yyscanner);
1096 
+  YYUSE (compiler);
1097 
+# ifdef YYPRINT
1098 
+  if (yytype < YYNTOKENS)
1099 
+    YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep);
1100 
+# else
1101 
+  YYUSE (yyoutput);
1102 
+# endif
1103 
+  switch (yytype)
1104 
+    {
1105 
+      default:
1106 
+	break;
1107 
+    }
1108 
+}
1109 
+
1110 
+
1111 
+/*--------------------------------.
1112 
+| Print this symbol on YYOUTPUT.  |
1113 
+`--------------------------------*/
1114 
+
1115 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1116 
+     || defined __cplusplus || defined _MSC_VER)
1117 
+static void
1118 
+yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, void *yyscanner, YR_COMPILER* compiler)
1119 
+#else
1120 
+static void
1121 
+yy_symbol_print (yyoutput, yytype, yyvaluep, yyscanner, compiler)
1122 
+    FILE *yyoutput;
1123 
+    int yytype;
1124 
+    YYSTYPE const * const yyvaluep;
1125 
+    void *yyscanner;
1126 
+    YR_COMPILER* compiler;
1127 
+#endif
1128 
+{
1129 
+  if (yytype < YYNTOKENS)
1130 
+    YYFPRINTF (yyoutput, "token %s (", yytname[yytype]);
1131 
+  else
1132 
+    YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]);
1133 
+
1134 
+  yy_symbol_value_print (yyoutput, yytype, yyvaluep, yyscanner, compiler);
1135 
+  YYFPRINTF (yyoutput, ")");
1136 
+}
1137 
+
1138 
+/*------------------------------------------------------------------.
1139 
+| yy_stack_print -- Print the state stack from its BOTTOM up to its |
1140 
+| TOP (included).                                                   |
1141 
+`------------------------------------------------------------------*/
1142 
+
1143 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1144 
+     || defined __cplusplus || defined _MSC_VER)
1145 
+static void
1146 
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
1147 
+#else
1148 
+static void
1149 
+yy_stack_print (yybottom, yytop)
1150 
+    yytype_int16 *yybottom;
1151 
+    yytype_int16 *yytop;
1152 
+#endif
1153 
+{
1154 
+  YYFPRINTF (stderr, "Stack now");
1155 
+  for (; yybottom <= yytop; yybottom++)
1156 
+    {
1157 
+      int yybot = *yybottom;
1158 
+      YYFPRINTF (stderr, " %d", yybot);
1159 
+    }
1160 
+  YYFPRINTF (stderr, "\n");
1161 
+}
1162 
+
1163 
+# define YY_STACK_PRINT(Bottom, Top)				\
1164 
+do {								\
1165 
+  if (yydebug)							\
1166 
+    yy_stack_print ((Bottom), (Top));				\
1167 
+} while (YYID (0))
1168 
+
1169 
+
1170 
+/*------------------------------------------------.
1171 
+| Report that the YYRULE is going to be reduced.  |
1172 
+`------------------------------------------------*/
1173 
+
1174 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1175 
+     || defined __cplusplus || defined _MSC_VER)
1176 
+static void
1177 
+yy_reduce_print (YYSTYPE *yyvsp, int yyrule, void *yyscanner, YR_COMPILER* compiler)
1178 
+#else
1179 
+static void
1180 
+yy_reduce_print (yyvsp, yyrule, yyscanner, compiler)
1181 
+    YYSTYPE *yyvsp;
1182 
+    int yyrule;
1183 
+    void *yyscanner;
1184 
+    YR_COMPILER* compiler;
1185 
+#endif
1186 
+{
1187 
+  int yynrhs = yyr2[yyrule];
1188 
+  int yyi;
1189 
+  unsigned long int yylno = yyrline[yyrule];
1190 
+  YYFPRINTF (stderr, "Reducing stack by rule %d (line %lu):\n",
1191 
+	     yyrule - 1, yylno);
1192 
+  /* The symbols being reduced.  */
1193 
+  for (yyi = 0; yyi < yynrhs; yyi++)
1194 
+    {
1195 
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
1196 
+      yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
1197 
+		       &(yyvsp[(yyi + 1) - (yynrhs)])
1198 
+		       		       , yyscanner, compiler);
1199 
+      YYFPRINTF (stderr, "\n");
1200 
+    }
1201 
+}
1202 
+
1203 
+# define YY_REDUCE_PRINT(Rule)		\
1204 
+do {					\
1205 
+  if (yydebug)				\
1206 
+    yy_reduce_print (yyvsp, Rule, yyscanner, compiler); \
1207 
+} while (YYID (0))
1208 
+
1209 
+/* Nonzero means print parse trace.  It is left uninitialized so that
1210 
+   multiple parsers can coexist.  */
1211 
+int yydebug;
1212 
+#else /* !YYDEBUG */
1213 
+# define YYDPRINTF(Args)
1214 
+# define YY_SYMBOL_PRINT(Title, Type, Value, Location)
1215 
+# define YY_STACK_PRINT(Bottom, Top)
1216 
+# define YY_REDUCE_PRINT(Rule)
1217 
+#endif /* !YYDEBUG */
1218 
+
1219 
+
1220 
+/* YYINITDEPTH -- initial size of the parser's stacks.  */
1221 
+#ifndef	YYINITDEPTH
1222 
+# define YYINITDEPTH 200
1223 
+#endif
1224 
+
1225 
+/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
1226 
+   if the built-in stack extension method is used).
1227 
+
1228 
+   Do not make this value too large; the results are undefined if
1229 
+   YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH)
1230 
+   evaluated with infinite-precision integer arithmetic.  */
1231 
+
1232 
+#ifndef YYMAXDEPTH
1233 
+# define YYMAXDEPTH 10000
1234 
+#endif
1235 
+
1236 
+
1237 
+#if YYERROR_VERBOSE
1238 
+
1239 
+# ifndef yystrlen
1240 
+#  if defined __GLIBC__ && defined _STRING_H
1241 
+#   define yystrlen strlen
1242 
+#  else
1243 
+/* Return the length of YYSTR.  */
1244 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1245 
+     || defined __cplusplus || defined _MSC_VER)
1246 
+static YYSIZE_T
1247 
+yystrlen (const char *yystr)
1248 
+#else
1249 
+static YYSIZE_T
1250 
+yystrlen (yystr)
1251 
+    const char *yystr;
1252 
+#endif
1253 
+{
1254 
+  YYSIZE_T yylen;
1255 
+  for (yylen = 0; yystr[yylen]; yylen++)
1256 
+    continue;
1257 
+  return yylen;
1258 
+}
1259 
+#  endif
1260 
+# endif
1261 
+
1262 
+# ifndef yystpcpy
1263 
+#  if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE
1264 
+#   define yystpcpy stpcpy
1265 
+#  else
1266 
+/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in
1267 
+   YYDEST.  */
1268 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1269 
+     || defined __cplusplus || defined _MSC_VER)
1270 
+static char *
1271 
+yystpcpy (char *yydest, const char *yysrc)
1272 
+#else
1273 
+static char *
1274 
+yystpcpy (yydest, yysrc)
1275 
+    char *yydest;
1276 
+    const char *yysrc;
1277 
+#endif
1278 
+{
1279 
+  char *yyd = yydest;
1280 
+  const char *yys = yysrc;
1281 
+
1282 
+  while ((*yyd++ = *yys++) != '\0')
1283 
+    continue;
1284 
+
1285 
+  return yyd - 1;
1286 
+}
1287 
+#  endif
1288 
+# endif
1289 
+
1290 
+# ifndef yytnamerr
1291 
+/* Copy to YYRES the contents of YYSTR after stripping away unnecessary
1292 
+   quotes and backslashes, so that it's suitable for yyerror.  The
1293 
+   heuristic is that double-quoting is unnecessary unless the string
1294 
+   contains an apostrophe, a comma, or backslash (other than
1295 
+   backslash-backslash).  YYSTR is taken from yytname.  If YYRES is
1296 
+   null, do not copy; instead, return the length of what the result
1297 
+   would have been.  */
1298 
+static YYSIZE_T
1299 
+yytnamerr (char *yyres, const char *yystr)
1300 
+{
1301 
+  if (*yystr == '"')
1302 
+    {
1303 
+      YYSIZE_T yyn = 0;
1304 
+      char const *yyp = yystr;
1305 
+
1306 
+      for (;;)
1307 
+	switch (*++yyp)
1308 
+	  {
1309 
+	  case '\'':
1310 
+	  case ',':
1311 
+	    goto do_not_strip_quotes;
1312 
+
1313 
+	  case '\\':
1314 
+	    if (*++yyp != '\\')
1315 
+	      goto do_not_strip_quotes;
1316 
+	    /* Fall through.  */
1317 
+	  default:
1318 
+	    if (yyres)
1319 
+	      yyres[yyn] = *yyp;
1320 
+	    yyn++;
1321 
+	    break;
1322 
+
1323 
+	  case '"':
1324 
+	    if (yyres)
1325 
+	      yyres[yyn] = '\0';
1326 
+	    return yyn;
1327 
+	  }
1328 
+    do_not_strip_quotes: ;
1329 
+    }
1330 
+
1331 
+  if (! yyres)
1332 
+    return yystrlen (yystr);
1333 
+
1334 
+  return yystpcpy (yyres, yystr) - yyres;
1335 
+}
1336 
+# endif
1337 
+
1338 
+/* Copy into *YYMSG, which is of size *YYMSG_ALLOC, an error message
1339 
+   about the unexpected token YYTOKEN for the state stack whose top is
1340 
+   YYSSP.
1341 
+
1342 
+   Return 0 if *YYMSG was successfully written.  Return 1 if *YYMSG is
1343 
+   not large enough to hold the message.  In that case, also set
1344 
+   *YYMSG_ALLOC to the required number of bytes.  Return 2 if the
1345 
+   required number of bytes is too large to store.  */
1346 
+static int
1347 
+yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg,
1348 
+                yytype_int16 *yyssp, int yytoken)
1349 
+{
1350 
+  YYSIZE_T yysize0 = yytnamerr (0, yytname[yytoken]);
1351 
+  YYSIZE_T yysize = yysize0;
1352 
+  YYSIZE_T yysize1;
1353 
+  enum { YYERROR_VERBOSE_ARGS_MAXIMUM = 5 };
1354 
+  /* Internationalized format string. */
1355 
+  const char *yyformat = 0;
1356 
+  /* Arguments of yyformat. */
1357 
+  char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM];
1358 
+  /* Number of reported tokens (one for the "unexpected", one per
1359 
+     "expected"). */
1360 
+  int yycount = 0;
1361 
+
1362 
+  /* There are many possibilities here to consider:
1363 
+     - Assume YYFAIL is not used.  It's too flawed to consider.  See
1364 
+       <http://lists.gnu.org/archive/html/bison-patches/2009-12/msg00024.html>
1365 
+       for details.  YYERROR is fine as it does not invoke this
1366 
+       function.
1367 
+     - If this state is a consistent state with a default action, then
1368 
+       the only way this function was invoked is if the default action
1369 
+       is an error action.  In that case, don't check for expected
1370 
+       tokens because there are none.
1371 
+     - The only way there can be no lookahead present (in yychar) is if
1372 
+       this state is a consistent state with a default action.  Thus,
1373 
+       detecting the absence of a lookahead is sufficient to determine
1374 
+       that there is no unexpected or expected token to report.  In that
1375 
+       case, just report a simple "syntax error".
1376 
+     - Don't assume there isn't a lookahead just because this state is a
1377 
+       consistent state with a default action.  There might have been a
1378 
+       previous inconsistent state, consistent state with a non-default
1379 
+       action, or user semantic action that manipulated yychar.
1380 
+     - Of course, the expected token list depends on states to have
1381 
+       correct lookahead information, and it depends on the parser not
1382 
+       to perform extra reductions after fetching a lookahead from the
1383 
+       scanner and before detecting a syntax error.  Thus, state merging
1384 
+       (from LALR or IELR) and default reductions corrupt the expected
1385 
+       token list.  However, the list is correct for canonical LR with
1386 
+       one exception: it will still contain any token that will not be
1387 
+       accepted due to an error action in a later state.
1388 
+  */
1389 
+  if (yytoken != YYEMPTY)
1390 
+    {
1391 
+      int yyn = yypact[*yyssp];
1392 
+      yyarg[yycount++] = yytname[yytoken];
1393 
+      if (!yypact_value_is_default (yyn))
1394 
+        {
1395 
+          /* Start YYX at -YYN if negative to avoid negative indexes in
1396 
+             YYCHECK.  In other words, skip the first -YYN actions for
1397 
+             this state because they are default actions.  */
1398 
+          int yyxbegin = yyn < 0 ? -yyn : 0;
1399 
+          /* Stay within bounds of both yycheck and yytname.  */
1400 
+          int yychecklim = YYLAST - yyn + 1;
1401 
+          int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
1402 
+          int yyx;
1403 
+
1404 
+          for (yyx = yyxbegin; yyx < yyxend; ++yyx)
1405 
+            if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR
1406 
+                && !yytable_value_is_error (yytable[yyx + yyn]))
1407 
+              {
1408 
+                if (yycount == YYERROR_VERBOSE_ARGS_MAXIMUM)
1409 
+                  {
1410 
+                    yycount = 1;
1411 
+                    yysize = yysize0;
1412 
+                    break;
1413 
+                  }
1414 
+                yyarg[yycount++] = yytname[yyx];
1415 
+                yysize1 = yysize + yytnamerr (0, yytname[yyx]);
1416 
+                if (! (yysize <= yysize1
1417 
+                       && yysize1 <= YYSTACK_ALLOC_MAXIMUM))
1418 
+                  return 2;
1419 
+                yysize = yysize1;
1420 
+              }
1421 
+        }
1422 
+    }
1423 
+
1424 
+  switch (yycount)
1425 
+    {
1426 
+# define YYCASE_(N, S)                      \
1427 
+      case N:                               \
1428 
+        yyformat = S;                       \
1429 
+      break
1430 
+      YYCASE_(0, YY_("syntax error"));
1431 
+      YYCASE_(1, YY_("syntax error, unexpected %s"));
1432 
+      YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s"));
1433 
+      YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s"));
1434 
+      YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s"));
1435 
+      YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s"));
1436 
+# undef YYCASE_
1437 
+    }
1438 
+
1439 
+  yysize1 = yysize + yystrlen (yyformat);
1440 
+  if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM))
1441 
+    return 2;
1442 
+  yysize = yysize1;
1443 
+
1444 
+  if (*yymsg_alloc < yysize)
1445 
+    {
1446 
+      *yymsg_alloc = 2 * yysize;
1447 
+      if (! (yysize <= *yymsg_alloc
1448 
+             && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM))
1449 
+        *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM;
1450 
+      return 1;
1451 
+    }
1452 
+
1453 
+  /* Avoid sprintf, as that infringes on the user's name space.
1454 
+     Don't have undefined behavior even if the translation
1455 
+     produced a string with the wrong number of "%s"s.  */
1456 
+  {
1457 
+    char *yyp = *yymsg;
1458 
+    int yyi = 0;
1459 
+    while ((*yyp = *yyformat) != '\0')
1460 
+      if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount)
1461 
+        {
1462 
+          yyp += yytnamerr (yyp, yyarg[yyi++]);
1463 
+          yyformat += 2;
1464 
+        }
1465 
+      else
1466 
+        {
1467 
+          yyp++;
1468 
+          yyformat++;
1469 
+        }
1470 
+  }
1471 
+  return 0;
1472 
+}
1473 
+#endif /* YYERROR_VERBOSE */
1474 
+
1475 
+/*-----------------------------------------------.
1476 
+| Release the memory associated to this symbol.  |
1477 
+`-----------------------------------------------*/
1478 
+
1479 
+/*ARGSUSED*/
1480 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1481 
+     || defined __cplusplus || defined _MSC_VER)
1482 
+static void
1483 
+yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep, void *yyscanner, YR_COMPILER* compiler)
1484 
+#else
1485 
+static void
1486 
+yydestruct (yymsg, yytype, yyvaluep, yyscanner, compiler)
1487 
+    const char *yymsg;
1488 
+    int yytype;
1489 
+    YYSTYPE *yyvaluep;
1490 
+    void *yyscanner;
1491 
+    YR_COMPILER* compiler;
1492 
+#endif
1493 
+{
1494 
+  YYUSE (yyvaluep);
1495 
+  YYUSE (yyscanner);
1496 
+  YYUSE (compiler);
1497 
+
1498 
+  if (!yymsg)
1499 
+    yymsg = "Deleting";
1500 
+  YY_SYMBOL_PRINT (yymsg, yytype, yyvaluep, yylocationp);
1501 
+
1502 
+  switch (yytype)
1503 
+    {
1504 
+      case 9: /* "_IDENTIFIER_" */
1505 
+
1506 
+/* Line 1391 of yacc.c  */
1507 
+#line 204 "yara_grammar.y"
1508 
+	{ yr_free((yyvaluep->c_string)); };
1509 
+
1510 
+/* Line 1391 of yacc.c  */
1511 
+#line 1513 "yara_grammar.c"
1512 
+	break;
1513 
+      case 10: /* "_STRING_IDENTIFIER_" */
1514 
+
1515 
+/* Line 1391 of yacc.c  */
1516 
+#line 205 "yara_grammar.y"
1517 
+	{ yr_free((yyvaluep->c_string)); };
1518 
+
1519 
+/* Line 1391 of yacc.c  */
1520 
+#line 1522 "yara_grammar.c"
1521 
+	break;
1522 
+      case 11: /* "_STRING_COUNT_" */
1523 
+
1524 
+/* Line 1391 of yacc.c  */
1525 
+#line 206 "yara_grammar.y"
1526 
+	{ yr_free((yyvaluep->c_string)); };
1527 
+
1528 
+/* Line 1391 of yacc.c  */
1529 
+#line 1531 "yara_grammar.c"
1530 
+	break;
1531 
+      case 12: /* "_STRING_OFFSET_" */
1532 
+
1533 
+/* Line 1391 of yacc.c  */
1534 
+#line 207 "yara_grammar.y"
1535 
+	{ yr_free((yyvaluep->c_string)); };
1536 
+
1537 
+/* Line 1391 of yacc.c  */
1538 
+#line 1540 "yara_grammar.c"
1539 
+	break;
1540 
+      case 13: /* "_STRING_IDENTIFIER_WITH_WILDCARD_" */
1541 
+
1542 
+/* Line 1391 of yacc.c  */
1543 
+#line 208 "yara_grammar.y"
1544 
+	{ yr_free((yyvaluep->c_string)); };
1545 
+
1546 
+/* Line 1391 of yacc.c  */
1547 
+#line 1549 "yara_grammar.c"
1548 
+	break;
1549 
+      case 15: /* "_TEXT_STRING_" */
1550 
+
1551 
+/* Line 1391 of yacc.c  */
1552 
+#line 209 "yara_grammar.y"
1553 
+	{ yr_free((yyvaluep->sized_string)); };
1554 
+
1555 
+/* Line 1391 of yacc.c  */
1556 
+#line 1558 "yara_grammar.c"
1557 
+	break;
1558 
+      case 16: /* "_HEX_STRING_" */
1559 
+
1560 
+/* Line 1391 of yacc.c  */
1561 
+#line 210 "yara_grammar.y"
1562 
+	{ yr_free((yyvaluep->sized_string)); };
1563 
+
1564 
+/* Line 1391 of yacc.c  */
1565 
+#line 1567 "yara_grammar.c"
1566 
+	break;
1567 
+      case 17: /* "_REGEXP_" */
1568 
+
1569 
+/* Line 1391 of yacc.c  */
1570 
+#line 211 "yara_grammar.y"
1571 
+	{ yr_free((yyvaluep->sized_string)); };
1572 
+
1573 
+/* Line 1391 of yacc.c  */
1574 
+#line 1576 "yara_grammar.c"
1575 
+	break;
1576 
+
1577 
+      default:
1578 
+	break;
1579 
+    }
1580 
+}
1581 
+
1582 
+
1583 
+/* Prevent warnings from -Wmissing-prototypes.  */
1584 
+#ifdef YYPARSE_PARAM
1585 
+#if defined __STDC__ || defined __cplusplus
1586 
+int yyparse (void *YYPARSE_PARAM);
1587 
+#else
1588 
+int yyparse ();
1589 
+#endif
1590 
+#else /* ! YYPARSE_PARAM */
1591 
+#if defined __STDC__ || defined __cplusplus
1592 
+int yyparse (void *yyscanner, YR_COMPILER* compiler);
1593 
+#else
1594 
+int yyparse ();
1595 
+#endif
1596 
+#endif /* ! YYPARSE_PARAM */
1597 
+
1598 
+
1599 
+/*----------.
1600 
+| yyparse.  |
1601 
+`----------*/
1602 
+
1603 
+#ifdef YYPARSE_PARAM
1604 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1605 
+     || defined __cplusplus || defined _MSC_VER)
1606 
+int
1607 
+yyparse (void *YYPARSE_PARAM)
1608 
+#else
1609 
+int
1610 
+yyparse (YYPARSE_PARAM)
1611 
+    void *YYPARSE_PARAM;
1612 
+#endif
1613 
+#else /* ! YYPARSE_PARAM */
1614 
+#if (defined __STDC__ || defined __C99__FUNC__ \
1615 
+     || defined __cplusplus || defined _MSC_VER)
1616 
+int
1617 
+yyparse (void *yyscanner, YR_COMPILER* compiler)
1618 
+#else
1619 
+int
1620 
+yyparse (yyscanner, compiler)
1621 
+    void *yyscanner;
1622 
+    YR_COMPILER* compiler;
1623 
+#endif
1624 
+#endif
1625 
+{
1626 
+/* The lookahead symbol.  */
1627 
+int yychar;
1628 
+
1629 
+/* The semantic value of the lookahead symbol.  */
1630 
+YYSTYPE yylval;
1631 
+
1632 
+    /* Number of syntax errors so far.  */
1633 
+    int yynerrs;
1634 
+
1635 
+    int yystate;
1636 
+    /* Number of tokens to shift before error messages enabled.  */
1637 
+    int yyerrstatus;
1638 
+
1639 
+    /* The stacks and their tools:
1640 
+       `yyss': related to states.
1641 
+       `yyvs': related to semantic values.
1642 
+
1643 
+       Refer to the stacks thru separate pointers, to allow yyoverflow
1644 
+       to reallocate them elsewhere.  */
1645 
+
1646 
+    /* The state stack.  */
1647 
+    yytype_int16 yyssa[YYINITDEPTH];
1648 
+    yytype_int16 *yyss;
1649 
+    yytype_int16 *yyssp;
1650 
+
1651 
+    /* The semantic value stack.  */
1652 
+    YYSTYPE yyvsa[YYINITDEPTH];
1653 
+    YYSTYPE *yyvs;
1654 
+    YYSTYPE *yyvsp;
1655 
+
1656 
+    YYSIZE_T yystacksize;
1657 
+
1658 
+  int yyn;
1659 
+  int yyresult;
1660 
+  /* Lookahead token as an internal (translated) token number.  */
1661 
+  int yytoken;
1662 
+  /* The variables used to return semantic value and location from the
1663 
+     action routines.  */
1664 
+  YYSTYPE yyval;
1665 
+
1666 
+#if YYERROR_VERBOSE
1667 
+  /* Buffer for error messages, and its allocated size.  */
1668 
+  char yymsgbuf[128];
1669 
+  char *yymsg = yymsgbuf;
1670 
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
1671 
+#endif
1672 
+
1673 
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
1674 
+
1675 
+  /* The number of symbols on the RHS of the reduced rule.
1676 
+     Keep to zero when no symbol should be popped.  */
1677 
+  int yylen = 0;
1678 
+
1679 
+  yytoken = 0;
1680 
+  yyss = yyssa;
1681 
+  yyvs = yyvsa;
1682 
+  yystacksize = YYINITDEPTH;
1683 
+
1684 
+  YYDPRINTF ((stderr, "Starting parse\n"));
1685 
+
1686 
+  yystate = 0;
1687 
+  yyerrstatus = 0;
1688 
+  yynerrs = 0;
1689 
+  yychar = YYEMPTY; /* Cause a token to be read.  */
1690 
+
1691 
+  /* Initialize stack pointers.
1692 
+     Waste one element of value and location stack
1693 
+     so that they stay on the same level as the state stack.
1694 
+     The wasted elements are never initialized.  */
1695 
+  yyssp = yyss;
1696 
+  yyvsp = yyvs;
1697 
+
1698 
+  goto yysetstate;
1699 
+
1700 
+/*------------------------------------------------------------.
1701 
+| yynewstate -- Push a new state, which is found in yystate.  |
1702 
+`------------------------------------------------------------*/
1703 
+ yynewstate:
1704 
+  /* In all cases, when you get here, the value and location stacks
1705 
+     have just been pushed.  So pushing a state here evens the stacks.  */
1706 
+  yyssp++;
1707 
+
1708 
+ yysetstate:
1709 
+  *yyssp = yystate;
1710 
+
1711 
+  if (yyss + yystacksize - 1 <= yyssp)
1712 
+    {
1713 
+      /* Get the current used size of the three stacks, in elements.  */
1714 
+      YYSIZE_T yysize = yyssp - yyss + 1;
1715 
+
1716 
+#ifdef yyoverflow
1717 
+      {
1718 
+	/* Give user a chance to reallocate the stack.  Use copies of
1719 
+	   these so that the &'s don't force the real ones into
1720 
+	   memory.  */
1721 
+	YYSTYPE *yyvs1 = yyvs;
1722 
+	yytype_int16 *yyss1 = yyss;
1723 
+
1724 
+	/* Each stack pointer address is followed by the size of the
1725 
+	   data in use in that stack, in bytes.  This used to be a
1726 
+	   conditional around just the two extra args, but that might
1727 
+	   be undefined if yyoverflow is a macro.  */
1728 
+	yyoverflow (YY_("memory exhausted"),
1729 
+		    &yyss1, yysize * sizeof (*yyssp),
1730 
+		    &yyvs1, yysize * sizeof (*yyvsp),
1731 
+		    &yystacksize);
1732 
+
1733 
+	yyss = yyss1;
1734 
+	yyvs = yyvs1;
1735 
+      }
1736 
+#else /* no yyoverflow */
1737 
+# ifndef YYSTACK_RELOCATE
1738 
+      goto yyexhaustedlab;
1739 
+# else
1740 
+      /* Extend the stack our own way.  */
1741 
+      if (YYMAXDEPTH <= yystacksize)
1742 
+	goto yyexhaustedlab;
1743 
+      yystacksize *= 2;
1744 
+      if (YYMAXDEPTH < yystacksize)
1745 
+	yystacksize = YYMAXDEPTH;
1746 
+
1747 
+      {
1748 
+	yytype_int16 *yyss1 = yyss;
1749 
+	union yyalloc *yyptr =
1750 
+	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
1751 
+	if (! yyptr)
1752 
+	  goto yyexhaustedlab;
1753 
+	YYSTACK_RELOCATE (yyss_alloc, yyss);
1754 
+	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
1755 
+#  undef YYSTACK_RELOCATE
1756 
+	if (yyss1 != yyssa)
1757 
+	  YYSTACK_FREE (yyss1);
1758 
+      }
1759 
+# endif
1760 
+#endif /* no yyoverflow */
1761 
+
1762 
+      yyssp = yyss + yysize - 1;
1763 
+      yyvsp = yyvs + yysize - 1;
1764 
+
1765 
+      YYDPRINTF ((stderr, "Stack size increased to %lu\n",
1766 
+		  (unsigned long int) yystacksize));
1767 
+
1768 
+      if (yyss + yystacksize - 1 <= yyssp)
1769 
+	YYABORT;
1770 
+    }
1771 
+
1772 
+  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
1773 
+
1774 
+  if (yystate == YYFINAL)
1775 
+    YYACCEPT;
1776 
+
1777 
+  goto yybackup;
1778 
+
1779 
+/*-----------.
1780 
+| yybackup.  |
1781 
+`-----------*/
1782 
+yybackup:
1783 
+
1784 
+  /* Do appropriate processing given the current state.  Read a
1785 
+     lookahead token if we need one and don't already have one.  */
1786 
+
1787 
+  /* First try to decide what to do without reference to lookahead token.  */
1788 
+  yyn = yypact[yystate];
1789 
+  if (yypact_value_is_default (yyn))
1790 
+    goto yydefault;
1791 
+
1792 
+  /* Not known => get a lookahead token if don't already have one.  */
1793 
+
1794 
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
1795 
+  if (yychar == YYEMPTY)
1796 
+    {
1797 
+      YYDPRINTF ((stderr, "Reading a token: "));
1798 
+      yychar = YYLEX;
1799 
+    }
1800 
+
1801 
+  if (yychar <= YYEOF)
1802 
+    {
1803 
+      yychar = yytoken = YYEOF;
1804 
+      YYDPRINTF ((stderr, "Now at end of input.\n"));
1805 
+    }
1806 
+  else
1807 
+    {
1808 
+      yytoken = YYTRANSLATE (yychar);
1809 
+      YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc);
1810 
+    }
1811 
+
1812 
+  /* If the proper action on seeing token YYTOKEN is to reduce or to
1813 
+     detect an error, take that action.  */
1814 
+  yyn += yytoken;
1815 
+  if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken)
1816 
+    goto yydefault;
1817 
+  yyn = yytable[yyn];
1818 
+  if (yyn <= 0)
1819 
+    {
1820 
+      if (yytable_value_is_error (yyn))
1821 
+        goto yyerrlab;
1822 
+      yyn = -yyn;
1823 
+      goto yyreduce;
1824 
+    }
1825 
+
1826 
+  /* Count tokens shifted since error; after three, turn off error
1827 
+     status.  */
1828 
+  if (yyerrstatus)
1829 
+    yyerrstatus--;
1830 
+
1831 
+  /* Shift the lookahead token.  */
1832 
+  YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
1833 
+
1834 
+  /* Discard the shifted token.  */
1835 
+  yychar = YYEMPTY;
1836 
+
1837 
+  yystate = yyn;
1838 
+  *++yyvsp = yylval;
1839 
+
1840 
+  goto yynewstate;
1841 
+
1842 
+
1843 
+/*-----------------------------------------------------------.
1844 
+| yydefault -- do the default action for the current state.  |
1845 
+`-----------------------------------------------------------*/
1846 
+yydefault:
1847 
+  yyn = yydefact[yystate];
1848 
+  if (yyn == 0)
1849 
+    goto yyerrlab;
1850 
+  goto yyreduce;
1851 
+
1852 
+
1853 
+/*-----------------------------.
1854 
+| yyreduce -- Do a reduction.  |
1855 
+`-----------------------------*/
1856 
+yyreduce:
1857 
+  /* yyn is the number of a rule to reduce with.  */
1858 
+  yylen = yyr2[yyn];
1859 
+
1860 
+  /* If YYLEN is nonzero, implement the default value of the action:
1861 
+     `$$ = $1'.
1862 
+
1863 
+     Otherwise, the following line sets YYVAL to garbage.
1864 
+     This behavior is undocumented and Bison
1865 
+     users should not rely upon it.  Assigning to YYVAL
1866 
+     unconditionally makes the parser a bit smaller, and it avoids a
1867 
+     GCC warning that YYVAL may be used uninitialized.  */
1868 
+  yyval = yyvsp[1-yylen];
1869 
+
1870 
+
1871 
+  YY_REDUCE_PRINT (yyn);
1872 
+  switch (yyn)
1873 
+    {
1874 
+        case 7:
1875 
+
1876 
+/* Line 1806 of yacc.c  */
1877 
+#line 237 "yara_grammar.y"
1878 
+    {
1879 
+        int result = yr_parser_reduce_import(yyscanner, (yyvsp[(2) - (2)].sized_string));
1880 
+
1881 
+        yr_free((yyvsp[(2) - (2)].sized_string));
1882 
+
1883 
+        ERROR_IF(result != ERROR_SUCCESS);
1884 
+      }
1885 
+    break;
1886 
+
1887 
+  case 8:
1888 
+
1889 
+/* Line 1806 of yacc.c  */
1890 
+#line 249 "yara_grammar.y"
1891 
+    {
1892 
+        int result = yr_parser_reduce_rule_declaration(
1893 
+            yyscanner,
1894 
+            (yyvsp[(1) - (9)].integer),
1895 
+            (yyvsp[(3) - (9)].c_string),
1896 
+            (yyvsp[(4) - (9)].c_string),
1897 
+            (yyvsp[(7) - (9)].string),
1898 
+            (yyvsp[(6) - (9)].meta));
1899 
+
1900 
+        yr_free((yyvsp[(3) - (9)].c_string));
1901 
+
1902 
+        ERROR_IF(result != ERROR_SUCCESS);
1903 
+      }
1904 
+    break;
1905 
+
1906 
+  case 9:
1907 
+
1908 
+/* Line 1806 of yacc.c  */
1909 
+#line 267 "yara_grammar.y"
1910 
+    {
1911 
+        (yyval.meta) = NULL;
1912 
+      }
1913 
+    break;
1914 
+
1915 
+  case 10:
1916 
+
1917 
+/* Line 1806 of yacc.c  */
1918 
+#line 271 "yara_grammar.y"
1919 
+    {
1920 
+#ifdef REAL_YARA
1921 
+        // Each rule have a list of meta-data info, consisting in a
1922 
+        // sequence of YR_META structures. The last YR_META structure does
1923 
+        // not represent a real meta-data, it's just a end-of-list marker
1924 
+        // identified by a specific type (META_TYPE_NULL). Here we
1925 
+        // write the end-of-list marker.
1926 
+
1927 
+        YR_META null_meta;
1928 
+
1929 
+        memset(&null_meta, 0xFF, sizeof(YR_META));
1930 
+        null_meta.type = META_TYPE_NULL;
1931 
+
1932 
+        compiler->last_result = yr_arena_write_data(
1933 
+            compiler->metas_arena,
1934 
+            &null_meta,
1935 
+            sizeof(YR_META),
1936 
+            NULL);
1937 
+
1938 
+#endif
1939 
+        (yyval.meta) = (yyvsp[(3) - (3)].meta);
1940 
+
1941 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
1942 
+      }
1943 
+    break;
1944 
+
1945 
+  case 11:
1946 
+
1947 
+/* Line 1806 of yacc.c  */
1948 
+#line 300 "yara_grammar.y"
1949 
+    {
1950 
+        (yyval.string) = NULL;
1951 
+#ifdef REAL_YARA
1952 
+        compiler->current_rule_strings = (yyval.string);
1953 
+#endif
1954 
+      }
1955 
+    break;
1956 
+
1957 
+  case 12:
1958 
+
1959 
+/* Line 1806 of yacc.c  */
1960 
+#line 307 "yara_grammar.y"
1961 
+    {
1962 
+#ifdef REAL_YARA
1963 
+        // Each rule have a list of strings, consisting in a sequence
1964 
+        // of YR_STRING structures. The last YR_STRING structure does not
1965 
+        // represent a real string, it's just a end-of-list marker
1966 
+        // identified by a specific flag (STRING_FLAGS_NULL). Here we
1967 
+        // write the end-of-list marker.
1968 
+
1969 
+        YR_STRING null_string;
1970 
+
1971 
+        memset(&null_string, 0xFF, sizeof(YR_STRING));
1972 
+        null_string.g_flags = STRING_GFLAGS_NULL;
1973 
+
1974 
+        compiler->last_result = yr_arena_write_data(
1975 
+            compiler->strings_arena,
1976 
+            &null_string,
1977 
+            sizeof(YR_STRING),
1978 
+            NULL);
1979 
+
1980 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
1981 
+
1982 
+        compiler->current_rule_strings = (yyvsp[(3) - (3)].string);
1983 
+#endif
1984 
+        (yyval.string) = (yyvsp[(3) - (3)].string);
1985 
+      }
1986 
+    break;
1987 
+
1988 
+  case 14:
1989 
+
1990 
+/* Line 1806 of yacc.c  */
1991 
+#line 341 "yara_grammar.y"
1992 
+    { (yyval.integer) = 0;  }
1993 
+    break;
1994 
+
1995 
+  case 15:
1996 
+
1997 
+/* Line 1806 of yacc.c  */
1998 
+#line 342 "yara_grammar.y"
1999 
+    { (yyval.integer) = (yyvsp[(1) - (2)].integer) | (yyvsp[(2) - (2)].integer); }
2000 
+    break;
2001 
+
2002 
+  case 16:
2003 
+
2004 
+/* Line 1806 of yacc.c  */
2005 
+#line 347 "yara_grammar.y"
2006 
+    { (yyval.integer) = RULE_GFLAGS_PRIVATE; }
2007 
+    break;
2008 
+
2009 
+  case 17:
2010 
+
2011 
+/* Line 1806 of yacc.c  */
2012 
+#line 348 "yara_grammar.y"
2013 
+    { (yyval.integer) = RULE_GFLAGS_GLOBAL; }
2014 
+    break;
2015 
+
2016 
+  case 18:
2017 
+
2018 
+/* Line 1806 of yacc.c  */
2019 
+#line 354 "yara_grammar.y"
2020 
+    {
2021 
+        (yyval.c_string) = NULL;
2022 
+      }
2023 
+    break;
2024 
+
2025 
+  case 19:
2026 
+
2027 
+/* Line 1806 of yacc.c  */
2028 
+#line 358 "yara_grammar.y"
2029 
+    {
2030 
+#ifdef REAL_YARA
2031 
+        // Tags list is represented in the arena as a sequence
2032 
+        // of null-terminated strings, the sequence ends with an
2033 
+        // additional null character. Here we write the ending null
2034 
+        //character. Example: tag1\0tag2\0tag3\0\0
2035 
+
2036 
+        compiler->last_result = yr_arena_write_string(
2037 
+            yyget_extra(yyscanner)->sz_arena, "", NULL);
2038 
+
2039 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2040 
+#endif
2041 
+
2042 
+        (yyval.c_string) = (yyvsp[(2) - (2)].c_string);
2043 
+      }
2044 
+    break;
2045 
+
2046 
+  case 20:
2047 
+
2048 
+/* Line 1806 of yacc.c  */
2049 
+#line 378 "yara_grammar.y"
2050 
+    {
2051 
+#ifdef REAL_YARA
2052 
+        char* identifier;
2053 
+
2054 
+        compiler->last_result = yr_arena_write_string(
2055 
+            yyget_extra(yyscanner)->sz_arena, (yyvsp[(1) - (1)].c_string), &identifier);
2056 
+
2057 
+#endif
2058 
+        yr_free((yyvsp[(1) - (1)].c_string));
2059 
+
2060 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2061 
+
2062 
+#ifdef REAL_YARA
2063 
+        (yyval.c_string) = identifier;
2064 
+#endif
2065 
+      }
2066 
+    break;
2067 
+
2068 
+  case 21:
2069 
+
2070 
+/* Line 1806 of yacc.c  */
2071 
+#line 395 "yara_grammar.y"
2072 
+    {
2073 
+#ifdef REAL_YARA
2074 
+        char* tag_name = (yyvsp[(1) - (2)].c_string);
2075 
+        size_t tag_length = tag_name != NULL ? strlen(tag_name) : 0;
2076 
+
2077 
+        while (tag_length > 0)
2078 
+        {
2079 
+          if (strcmp(tag_name, (yyvsp[(2) - (2)].c_string)) == 0)
2080 
+          {
2081 
+            yr_compiler_set_error_extra_info(compiler, tag_name);
2082 
+            compiler->last_result = ERROR_DUPLICATE_TAG_IDENTIFIER;
2083 
+            break;
2084 
+          }
2085 
+
2086 
+          tag_name = yr_arena_next_address(
2087 
+              yyget_extra(yyscanner)->sz_arena,
2088 
+              tag_name,
2089 
+              tag_length + 1);
2090 
+
2091 
+          tag_length = tag_name != NULL ? strlen(tag_name) : 0;
2092 
+        }
2093 
+
2094 
+        if (compiler->last_result == ERROR_SUCCESS)
2095 
+          compiler->last_result = yr_arena_write_string(
2096 
+              yyget_extra(yyscanner)->sz_arena, (yyvsp[(2) - (2)].c_string), NULL);
2097 
+
2098 
+#endif
2099 
+        yr_free((yyvsp[(2) - (2)].c_string));
2100 
+
2101 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2102 
+
2103 
+        (yyval.c_string) = (yyvsp[(1) - (2)].c_string);
2104 
+      }
2105 
+    break;
2106 
+
2107 
+  case 22:
2108 
+
2109 
+/* Line 1806 of yacc.c  */
2110 
+#line 433 "yara_grammar.y"
2111 
+    {  (yyval.meta) = (yyvsp[(1) - (1)].meta); }
2112 
+    break;
2113 
+
2114 
+  case 23:
2115 
+
2116 
+/* Line 1806 of yacc.c  */
2117 
+#line 434 "yara_grammar.y"
2118 
+    {  (yyval.meta) = (yyvsp[(1) - (2)].meta); }
2119 
+    break;
2120 
+
2121 
+  case 24:
2122 
+
2123 
+/* Line 1806 of yacc.c  */
2124 
+#line 440 "yara_grammar.y"
2125 
+    {
2126 
+        SIZED_STRING* sized_string = (yyvsp[(3) - (3)].sized_string);
2127 
+
2128 
+        (yyval.meta) = yr_parser_reduce_meta_declaration(
2129 
+            yyscanner,
2130 
+            META_TYPE_STRING,
2131 
+            (yyvsp[(1) - (3)].c_string),
2132 
+            sized_string->c_string,
2133 
+            0);
2134 
+
2135 
+        yr_free((yyvsp[(1) - (3)].c_string));
2136 
+        yr_free((yyvsp[(3) - (3)].sized_string));
2137 
+
2138 
+        ERROR_IF((yyval.meta) == NULL);
2139 
+      }
2140 
+    break;
2141 
+
2142 
+  case 25:
2143 
+
2144 
+/* Line 1806 of yacc.c  */
2145 
+#line 456 "yara_grammar.y"
2146 
+    {
2147 
+        (yyval.meta) = yr_parser_reduce_meta_declaration(
2148 
+            yyscanner,
2149 
+            META_TYPE_INTEGER,
2150 
+            (yyvsp[(1) - (3)].c_string),
2151 
+            NULL,
2152 
+            (yyvsp[(3) - (3)].integer));
2153 
+
2154 
+        yr_free((yyvsp[(1) - (3)].c_string));
2155 
+
2156 
+        ERROR_IF((yyval.meta) == NULL);
2157 
+      }
2158 
+    break;
2159 
+
2160 
+  case 26:
2161 
+
2162 
+/* Line 1806 of yacc.c  */
2163 
+#line 469 "yara_grammar.y"
2164 
+    {
2165 
+        (yyval.meta) = yr_parser_reduce_meta_declaration(
2166 
+            yyscanner,
2167 
+            META_TYPE_BOOLEAN,
2168 
+            (yyvsp[(1) - (3)].c_string),
2169 
+            NULL,
2170 
+            TRUE);
2171 
+
2172 
+        yr_free((yyvsp[(1) - (3)].c_string));
2173 
+
2174 
+        ERROR_IF((yyval.meta) == NULL);
2175 
+      }
2176 
+    break;
2177 
+
2178 
+  case 27:
2179 
+
2180 
+/* Line 1806 of yacc.c  */
2181 
+#line 482 "yara_grammar.y"
2182 
+    {
2183 
+        (yyval.meta) = yr_parser_reduce_meta_declaration(
2184 
+            yyscanner,
2185 
+            META_TYPE_BOOLEAN,
2186 
+            (yyvsp[(1) - (3)].c_string),
2187 
+            NULL,
2188 
+            FALSE);
2189 
+
2190 
+        yr_free((yyvsp[(1) - (3)].c_string));
2191 
+
2192 
+        ERROR_IF((yyval.meta) == NULL);
2193 
+      }
2194 
+    break;
2195 
+
2196 
+  case 28:
2197 
+
2198 
+/* Line 1806 of yacc.c  */
2199 
+#line 498 "yara_grammar.y"
2200 
+    { (yyval.string) = (yyvsp[(1) - (1)].string); }
2201 
+    break;
2202 
+
2203 
+  case 29:
2204 
+
2205 
+/* Line 1806 of yacc.c  */
2206 
+#line 499 "yara_grammar.y"
2207 
+    { (yyval.string) = (yyvsp[(1) - (2)].string); }
2208 
+    break;
2209 
+
2210 
+  case 30:
2211 
+
2212 
+/* Line 1806 of yacc.c  */
2213 
+#line 505 "yara_grammar.y"
2214 
+    {
2215 
+        (yyval.string) = yr_parser_reduce_string_declaration(
2216 
+            yyscanner,
2217 
+            (yyvsp[(4) - (4)].integer),
2218 
+            (yyvsp[(1) - (4)].c_string),
2219 
+            (yyvsp[(3) - (4)].sized_string));
2220 
+
2221 
+        yr_free((yyvsp[(1) - (4)].c_string));
2222 
+        yr_free((yyvsp[(3) - (4)].sized_string));
2223 
+
2224 
+        ERROR_IF((yyval.string) == NULL);
2225 
+      }
2226 
+    break;
2227 
+
2228 
+  case 31:
2229 
+
2230 
+/* Line 1806 of yacc.c  */
2231 
+#line 518 "yara_grammar.y"
2232 
+    {
2233 
+#ifdef REAL_YARA
2234 
+        compiler->error_line = yyget_lineno(yyscanner);
2235 
+#endif
2236 
+      }
2237 
+    break;
2238 
+
2239 
+  case 32:
2240 
+
2241 
+/* Line 1806 of yacc.c  */
2242 
+#line 524 "yara_grammar.y"
2243 
+    {
2244 
+        (yyval.string) = yr_parser_reduce_string_declaration(
2245 
+            yyscanner,
2246 
+            (yyvsp[(5) - (5)].integer) | STRING_GFLAGS_REGEXP,
2247 
+            (yyvsp[(1) - (5)].c_string),
2248 
+            (yyvsp[(4) - (5)].sized_string));
2249 
+
2250 
+        yr_free((yyvsp[(1) - (5)].c_string));
2251 
+        yr_free((yyvsp[(4) - (5)].sized_string));
2252 
+
2253 
+        ERROR_IF((yyval.string) == NULL);
2254 
+      }
2255 
+    break;
2256 
+
2257 
+  case 33:
2258 
+
2259 
+/* Line 1806 of yacc.c  */
2260 
+#line 537 "yara_grammar.y"
2261 
+    {
2262 
+        (yyval.string) = yr_parser_reduce_string_declaration(
2263 
+            yyscanner,
2264 
+            STRING_GFLAGS_HEXADECIMAL,
2265 
+            (yyvsp[(1) - (3)].c_string),
2266 
+            (yyvsp[(3) - (3)].sized_string));
2267 
+
2268 
+        yr_free((yyvsp[(1) - (3)].c_string));
2269 
+        yr_free((yyvsp[(3) - (3)].sized_string));
2270 
+
2271 
+        ERROR_IF((yyval.string) == NULL);
2272 
+      }
2273 
+    break;
2274 
+
2275 
+  case 34:
2276 
+
2277 
+/* Line 1806 of yacc.c  */
2278 
+#line 553 "yara_grammar.y"
2279 
+    { (yyval.integer) = 0; }
2280 
+    break;
2281 
+
2282 
+  case 35:
2283 
+
2284 
+/* Line 1806 of yacc.c  */
2285 
+#line 554 "yara_grammar.y"
2286 
+    { (yyval.integer) = (yyvsp[(1) - (2)].integer) | (yyvsp[(2) - (2)].integer); }
2287 
+    break;
2288 
+
2289 
+  case 36:
2290 
+
2291 
+/* Line 1806 of yacc.c  */
2292 
+#line 559 "yara_grammar.y"
2293 
+    { (yyval.integer) = STRING_GFLAGS_WIDE; }
2294 
+    break;
2295 
+
2296 
+  case 37:
2297 
+
2298 
+/* Line 1806 of yacc.c  */
2299 
+#line 560 "yara_grammar.y"
2300 
+    { (yyval.integer) = STRING_GFLAGS_ASCII; }
2301 
+    break;
2302 
+
2303 
+  case 38:
2304 
+
2305 
+/* Line 1806 of yacc.c  */
2306 
+#line 561 "yara_grammar.y"
2307 
+    { (yyval.integer) = STRING_GFLAGS_NO_CASE; }
2308 
+    break;
2309 
+
2310 
+  case 39:
2311 
+
2312 
+/* Line 1806 of yacc.c  */
2313 
+#line 562 "yara_grammar.y"
2314 
+    { (yyval.integer) = STRING_GFLAGS_FULL_WORD; }
2315 
+    break;
2316 
+
2317 
+  case 40:
2318 
+
2319 
+/* Line 1806 of yacc.c  */
2320 
+#line 568 "yara_grammar.y"
2321 
+    {
2322 
+          //#ifdef REAL_YARA
2323 
+        YR_OBJECT* object = NULL;
2324 
+        YR_RULE* rule;
2325 
+
2326 
+        char* id;
2327 
+        char* ns = NULL;
2328 
+
2329 
+        int var_index;
2330 
+
2331 
+        var_index = yr_parser_lookup_loop_variable(yyscanner, (yyvsp[(1) - (1)].c_string));
2332 
+
2333 
+        if (var_index >= 0)
2334 
+        {
2335 
+         compiler->last_result = yr_parser_emit_with_arg(
2336 
+            yyscanner,
2337 
+            OP_PUSH_M,
2338 
+            LOOP_LOCAL_VARS * var_index,
2339 
+            NULL);
2340 
+
2341 
+          (yyval.object) = (YR_OBJECT*) -1;
2342 
+        }
2343 
+        else
2344 
+        {
2345 
+          // Search for identifier within the global namespace, where the
2346 
+          // externals variables reside.
2347 
+#if REAL_YARA
2348 
+          object = (YR_OBJECT*) yr_hash_table_lookup(
2349 
+                compiler->objects_table,
2350 
+                (yyvsp[(1) - (1)].c_string),
2351 
+                NULL);
2352 
+#endif
2353 
+          if (object == NULL)
2354 
+          {
2355 
+            // If not found, search within the current namespace.
2356 
+
2357 
+#if REAL_YARA
2358 
+            ns = compiler->current_namespace->name;
2359 
+            object = (YR_OBJECT*) yr_hash_table_lookup(
2360 
+                compiler->objects_table,
2361 
+                (yyvsp[(1) - (1)].c_string),
2362 
+                ns);
2363 
+#endif
2364 
+          }
2365 
+
2366 
+          if (object != NULL)
2367 
+          {
2368 
+#if REAL_YARA
2369 
+            compiler->last_result = yr_arena_write_string(
2370 
+                compiler->sz_arena,
2371 
+                (yyvsp[(1) - (1)].c_string),
2372 
+                &id);
2373 
+
2374 
+            if (compiler->last_result == ERROR_SUCCESS)
2375 
+              compiler->last_result = yr_parser_emit_with_arg_reloc(
2376 
+                  yyscanner,
2377 
+                  OP_OBJ_LOAD,
2378 
+                  PTR_TO_UINT64(id),
2379 
+                  NULL);
2380 
+#endif
2381 
+
2382 
+            (yyval.object) = object;
2383 
+          }
2384 
+          else
2385 
+          {
2386 
+ #if REAL_YARA
2387 
+           rule = (YR_RULE*) yr_hash_table_lookup(
2388 
+                compiler->rules_table,
2389 
+                (yyvsp[(1) - (1)].c_string),
2390 
+                compiler->current_namespace->name);
2391 
+
2392 
+            if (rule != NULL)
2393 
+            {
2394 
+              compiler->last_result = yr_parser_emit_with_arg_reloc(
2395 
+                  yyscanner,
2396 
+                  OP_PUSH_RULE,
2397 
+                  PTR_TO_UINT64(rule),
2398 
+                  NULL);
2399 
+            }
2400 
+            else
2401 
+            {
2402 
+              yr_compiler_set_error_extra_info(compiler, (yyvsp[(1) - (1)].c_string));
2403 
+              compiler->last_result = ERROR_UNDEFINED_IDENTIFIER;
2404 
+            }
2405 
+#endif
2406 
+
2407 
+            (yyval.object) = (YR_OBJECT*) -2;
2408 
+          }
2409 
+        }
2410 
+
2411 
+        yr_free((yyvsp[(1) - (1)].c_string));
2412 
+
2413 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2414 
+        //#endif
2415 
+      }
2416 
+    break;
2417 
+
2418 
+  case 41:
2419 
+
2420 
+/* Line 1806 of yacc.c  */
2421 
+#line 664 "yara_grammar.y"
2422 
+    {
2423 
+#ifdef REAL_YARA
2424 
+        YR_OBJECT* object = (yyvsp[(1) - (3)].object);
2425 
+        YR_OBJECT* field = NULL;
2426 
+
2427 
+        char* ident;
2428 
+
2429 
+        if (object != NULL &&
2430 
+            object != (YR_OBJECT*) -1 &&    // not a loop variable identifier
2431 
+            object != (YR_OBJECT*) -2 &&    // not a rule identifier
2432 
+            object->type == OBJECT_TYPE_STRUCTURE)
2433 
+        {
2434 
+          field = yr_object_lookup_field(object, (yyvsp[(3) - (3)].c_string));
2435 
+
2436 
+          if (field != NULL)
2437 
+          {
2438 
+            compiler->last_result = yr_arena_write_string(
2439 
+              compiler->sz_arena,
2440 
+              (yyvsp[(3) - (3)].c_string),
2441 
+              &ident);
2442 
+
2443 
+            if (compiler->last_result == ERROR_SUCCESS)
2444 
+              compiler->last_result = yr_parser_emit_with_arg_reloc(
2445 
+                  yyscanner,
2446 
+                  OP_OBJ_FIELD,
2447 
+                  PTR_TO_UINT64(ident),
2448 
+                  NULL);
2449 
+          }
2450 
+          else
2451 
+          {
2452 
+            yr_compiler_set_error_extra_info(compiler, (yyvsp[(3) - (3)].c_string));
2453 
+            compiler->last_result = ERROR_INVALID_FIELD_NAME;
2454 
+          }
2455 
+        }
2456 
+        else
2457 
+        {
2458 
+          yr_compiler_set_error_extra_info(
2459 
+              compiler,
2460 
+              object->identifier);
2461 
+
2462 
+          compiler->last_result = ERROR_NOT_A_STRUCTURE;
2463 
+        }
2464 
+
2465 
+        (yyval.object) = field;
2466 
+
2467 
+        yr_free((yyvsp[(3) - (3)].c_string));
2468 
+
2469 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2470 
+#endif
2471 
+      }
2472 
+    break;
2473 
+
2474 
+  case 42:
2475 
+
2476 
+/* Line 1806 of yacc.c  */
2477 
+#line 715 "yara_grammar.y"
2478 
+    {
2479 
+#ifdef REAL_YARA
2480 
+        if ((yyvsp[(1) - (4)].object) != NULL && (yyvsp[(1) - (4)].object)->type == OBJECT_TYPE_ARRAY)
2481 
+        {
2482 
+          compiler->last_result = yr_parser_emit(
2483 
+              yyscanner,
2484 
+              OP_INDEX_ARRAY,
2485 
+              NULL);
2486 
+
2487 
+          (yyval.object) = ((YR_OBJECT_ARRAY*) (yyvsp[(1) - (4)].object))->items->objects[0];
2488 
+        }
2489 
+        else
2490 
+        {
2491 
+          yr_compiler_set_error_extra_info(
2492 
+              compiler,
2493 
+              (yyvsp[(1) - (4)].object)->identifier);
2494 
+
2495 
+          compiler->last_result = ERROR_NOT_AN_ARRAY;
2496 
+        }
2497 
+
2498 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2499 
+#endif
2500 
+      }
2501 
+    break;
2502 
+
2503 
+  case 43:
2504 
+
2505 
+/* Line 1806 of yacc.c  */
2506 
+#line 740 "yara_grammar.y"
2507 
+    {
2508 
+#ifdef REAL_YARA
2509 
+        int args_count;
2510 
+
2511 
+        if ((yyvsp[(1) - (4)].object) != NULL && (yyvsp[(1) - (4)].object)->type == OBJECT_TYPE_FUNCTION)
2512 
+        {
2513 
+          compiler->last_result = yr_parser_check_types(
2514 
+              compiler, (YR_OBJECT_FUNCTION*) (yyvsp[(1) - (4)].object), (yyvsp[(3) - (4)].c_string));
2515 
+
2516 
+          if (compiler->last_result == ERROR_SUCCESS)
2517 
+          {
2518 
+            args_count = strlen((yyvsp[(3) - (4)].c_string));
2519 
+
2520 
+            compiler->last_result = yr_parser_emit_with_arg(
2521 
+                yyscanner,
2522 
+                OP_CALL,
2523 
+                args_count,
2524 
+                NULL);
2525 
+          }
2526 
+
2527 
+          (yyval.object) = ((YR_OBJECT_FUNCTION*) (yyvsp[(1) - (4)].object))->return_obj;
2528 
+        }
2529 
+        else
2530 
+        {
2531 
+          yr_compiler_set_error_extra_info(
2532 
+              compiler,
2533 
+              (yyvsp[(1) - (4)].object)->identifier);
2534 
+
2535 
+          compiler->last_result = ERROR_NOT_A_FUNCTION;
2536 
+        }
2537 
+
2538 
+        yr_free((yyvsp[(3) - (4)].c_string));
2539 
+
2540 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2541 
+#endif
2542 
+      }
2543 
+    break;
2544 
+
2545 
+  case 44:
2546 
+
2547 
+/* Line 1806 of yacc.c  */
2548 
+#line 781 "yara_grammar.y"
2549 
+    {
2550 
+        (yyval.c_string) = yr_strdup("");
2551 
+      }
2552 
+    break;
2553 
+
2554 
+  case 45:
2555 
+
2556 
+/* Line 1806 of yacc.c  */
2557 
+#line 785 "yara_grammar.y"
2558 
+    {
2559 
+        (yyval.c_string) = yr_malloc(MAX_FUNCTION_ARGS + 1);
2560 
+
2561 
+        switch((yyvsp[(1) - (1)].expression_type))
2562 
+        {
2563 
+          case EXPRESSION_TYPE_INTEGER:
2564 
+            strlcpy((yyval.c_string), "i", MAX_FUNCTION_ARGS);
2565 
+            break;
2566 
+          case EXPRESSION_TYPE_BOOLEAN:
2567 
+            strlcpy((yyval.c_string), "b", MAX_FUNCTION_ARGS);
2568 
+            break;
2569 
+          case EXPRESSION_TYPE_STRING:
2570 
+            strlcpy((yyval.c_string), "s", MAX_FUNCTION_ARGS);
2571 
+            break;
2572 
+          case EXPRESSION_TYPE_REGEXP:
2573 
+            strlcpy((yyval.c_string), "r", MAX_FUNCTION_ARGS);
2574 
+            break;
2575 
+        }
2576 
+
2577 
+        ERROR_IF((yyval.c_string) == NULL);
2578 
+      }
2579 
+    break;
2580 
+
2581 
+  case 46:
2582 
+
2583 
+/* Line 1806 of yacc.c  */
2584 
+#line 807 "yara_grammar.y"
2585 
+    {
2586 
+        if (strlen((yyvsp[(1) - (3)].c_string)) == MAX_FUNCTION_ARGS)
2587 
+        {
2588 
+          compiler->last_result = ERROR_TOO_MANY_ARGUMENTS;
2589 
+        }
2590 
+        else
2591 
+        {
2592 
+          switch((yyvsp[(3) - (3)].expression_type))
2593 
+          {
2594 
+            case EXPRESSION_TYPE_INTEGER:
2595 
+              strlcat((yyvsp[(1) - (3)].c_string), "i", MAX_FUNCTION_ARGS);
2596 
+              break;
2597 
+            case EXPRESSION_TYPE_BOOLEAN:
2598 
+              strlcat((yyvsp[(1) - (3)].c_string), "b", MAX_FUNCTION_ARGS);
2599 
+              break;
2600 
+            case EXPRESSION_TYPE_STRING:
2601 
+              strlcat((yyvsp[(1) - (3)].c_string), "s", MAX_FUNCTION_ARGS);
2602 
+              break;
2603 
+            case EXPRESSION_TYPE_REGEXP:
2604 
+              strlcat((yyvsp[(1) - (3)].c_string), "r", MAX_FUNCTION_ARGS);
2605 
+              break;
2606 
+          }
2607 
+        }
2608 
+
2609 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2610 
+
2611 
+        (yyval.c_string) = (yyvsp[(1) - (3)].c_string);
2612 
+      }
2613 
+    break;
2614 
+
2615 
+  case 47:
2616 
+
2617 
+/* Line 1806 of yacc.c  */
2618 
+#line 840 "yara_grammar.y"
2619 
+    {
2620 
+#ifdef REAL_YARA
2621 
+        SIZED_STRING* sized_string = (yyvsp[(1) - (1)].sized_string);
2622 
+        RE* re;
2623 
+        RE_ERROR error;
2624 
+
2625 
+        int re_flags = 0;
2626 
+
2627 
+        if (sized_string->flags & SIZED_STRING_FLAGS_NO_CASE)
2628 
+          re_flags |= RE_FLAGS_NO_CASE;
2629 
+
2630 
+        if (sized_string->flags & SIZED_STRING_FLAGS_DOT_ALL)
2631 
+          re_flags |= RE_FLAGS_DOT_ALL;
2632 
+
2633 
+        compiler->last_result = yr_re_compile(
2634 
+            sized_string->c_string,
2635 
+            re_flags,
2636 
+            compiler->re_code_arena,
2637 
+            &re,
2638 
+            &error);
2639 
+
2640 
+        yr_free((yyvsp[(1) - (1)].sized_string));
2641 
+
2642 
+        if (compiler->last_result == ERROR_INVALID_REGULAR_EXPRESSION)
2643 
+          yr_compiler_set_error_extra_info(compiler, error.message);
2644 
+
2645 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2646 
+
2647 
+        if (compiler->last_result == ERROR_SUCCESS)
2648 
+          compiler->last_result = yr_parser_emit_with_arg_reloc(
2649 
+              yyscanner,
2650 
+              OP_PUSH,
2651 
+              PTR_TO_UINT64(re->root_node->forward_code),
2652 
+              NULL);
2653 
+
2654 
+        yr_re_destroy(re);
2655 
+
2656 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2657 
+#endif
2658 
+
2659 
+        (yyval.expression_type) = EXPRESSION_TYPE_REGEXP;
2660 
+      }
2661 
+    break;
2662 
+
2663 
+  case 48:
2664 
+
2665 
+/* Line 1806 of yacc.c  */
2666 
+#line 887 "yara_grammar.y"
2667 
+    {
2668 
+        if ((yyvsp[(1) - (1)].expression_type) == EXPRESSION_TYPE_STRING)
2669 
+        {
2670 
+          compiler->last_result = yr_parser_emit(
2671 
+              yyscanner,
2672 
+              OP_SZ_TO_BOOL,
2673 
+              NULL);
2674 
+
2675 
+          ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2676 
+        }
2677 
+
2678 
+
2679 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2680 
+      }
2681 
+    break;
2682 
+
2683 
+  case 49:
2684 
+
2685 
+/* Line 1806 of yacc.c  */
2686 
+#line 905 "yara_grammar.y"
2687 
+    {
2688 
+        compiler->last_result = yr_parser_emit_with_arg(
2689 
+            yyscanner, OP_PUSH, 1, NULL);
2690 
+
2691 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2692 
+
2693 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2694 
+      }
2695 
+    break;
2696 
+
2697 
+  case 50:
2698 
+
2699 
+/* Line 1806 of yacc.c  */
2700 
+#line 914 "yara_grammar.y"
2701 
+    {
2702 
+        compiler->last_result = yr_parser_emit_with_arg(
2703 
+            yyscanner, OP_PUSH, 0, NULL);
2704 
+
2705 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2706 
+
2707 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2708 
+      }
2709 
+    break;
2710 
+
2711 
+  case 51:
2712 
+
2713 
+/* Line 1806 of yacc.c  */
2714 
+#line 923 "yara_grammar.y"
2715 
+    {
2716 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_STRING, "matches");
2717 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_REGEXP, "matches");
2718 
+
2719 
+        if (compiler->last_result == ERROR_SUCCESS)
2720 
+          compiler->last_result = yr_parser_emit(
2721 
+              yyscanner,
2722 
+              OP_MATCHES,
2723 
+              NULL);
2724 
+
2725 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2726 
+
2727 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2728 
+      }
2729 
+    break;
2730 
+
2731 
+  case 52:
2732 
+
2733 
+/* Line 1806 of yacc.c  */
2734 
+#line 938 "yara_grammar.y"
2735 
+    {
2736 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_STRING, "contains");
2737 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_STRING, "contains");
2738 
+
2739 
+        compiler->last_result = yr_parser_emit(
2740 
+            yyscanner,
2741 
+            OP_CONTAINS,
2742 
+            NULL);
2743 
+
2744 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2745 
+
2746 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2747 
+      }
2748 
+    break;
2749 
+
2750 
+  case 53:
2751 
+
2752 
+/* Line 1806 of yacc.c  */
2753 
+#line 952 "yara_grammar.y"
2754 
+    {
2755 
+        int result = yr_parser_reduce_string_identifier(
2756 
+            yyscanner,
2757 
+            (yyvsp[(1) - (1)].c_string),
2758 
+            OP_STR_FOUND);
2759 
+
2760 
+        yr_free((yyvsp[(1) - (1)].c_string));
2761 
+
2762 
+        ERROR_IF(result != ERROR_SUCCESS);
2763 
+
2764 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2765 
+      }
2766 
+    break;
2767 
+
2768 
+  case 54:
2769 
+
2770 
+/* Line 1806 of yacc.c  */
2771 
+#line 965 "yara_grammar.y"
2772 
+    {
2773 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "at");
2774 
+
2775 
+        compiler->last_result = yr_parser_reduce_string_identifier(
2776 
+            yyscanner,
2777 
+            (yyvsp[(1) - (3)].c_string),
2778 
+            OP_STR_FOUND_AT);
2779 
+
2780 
+        yr_free((yyvsp[(1) - (3)].c_string));
2781 
+
2782 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2783 
+
2784 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2785 
+      }
2786 
+    break;
2787 
+
2788 
+  case 55:
2789 
+
2790 
+/* Line 1806 of yacc.c  */
2791 
+#line 980 "yara_grammar.y"
2792 
+    {
2793 
+        compiler->last_result = yr_parser_reduce_string_identifier(
2794 
+            yyscanner,
2795 
+            (yyvsp[(1) - (3)].c_string),
2796 
+            OP_STR_FOUND_IN);
2797 
+
2798 
+        yr_free((yyvsp[(1) - (3)].c_string));
2799 
+
2800 
+        ERROR_IF(compiler->last_result!= ERROR_SUCCESS);
2801 
+
2802 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2803 
+      }
2804 
+    break;
2805 
+
2806 
+  case 56:
2807 
+
2808 
+/* Line 1806 of yacc.c  */
2809 
+#line 993 "yara_grammar.y"
2810 
+    {
2811 
+#ifdef REAL_YARA
2812 
+        int var_index;
2813 
+
2814 
+        if (compiler->loop_depth == MAX_LOOP_NESTING)
2815 
+          compiler->last_result = \
2816 
+              ERROR_LOOP_NESTING_LIMIT_EXCEEDED;
2817 
+
2818 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2819 
+
2820 
+        var_index = yr_parser_lookup_loop_variable(
2821 
+            yyscanner,
2822 
+            (yyvsp[(3) - (4)].c_string));
2823 
+
2824 
+        if (var_index >= 0)
2825 
+        {
2826 
+          yr_compiler_set_error_extra_info(
2827 
+              compiler,
2828 
+              (yyvsp[(3) - (4)].c_string));
2829 
+
2830 
+          compiler->last_result = \
2831 
+              ERROR_DUPLICATE_LOOP_IDENTIFIER;
2832 
+        }
2833 
+#endif
2834 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2835 
+
2836 
+        // Push end-of-list marker
2837 
+        compiler->last_result = yr_parser_emit_with_arg(
2838 
+            yyscanner,
2839 
+            OP_PUSH,
2840 
+            UNDEFINED,
2841 
+            NULL);
2842 
+
2843 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2844 
+      }
2845 
+    break;
2846 
+
2847 
+  case 57:
2848 
+
2849 
+/* Line 1806 of yacc.c  */
2850 
+#line 1029 "yara_grammar.y"
2851 
+    {
2852 
+        int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth;
2853 
+
2854 
+        int8_t* addr;
2855 
+
2856 
+        // Clear counter for number of expressions evaluating
2857 
+        // to TRUE.
2858 
+        yr_parser_emit_with_arg(
2859 
+            yyscanner, OP_CLEAR_M, mem_offset + 1, NULL);
2860 
+
2861 
+        // Clear iterations counter
2862 
+        yr_parser_emit_with_arg(
2863 
+            yyscanner, OP_CLEAR_M, mem_offset + 2, NULL);
2864 
+
2865 
+        if ((yyvsp[(6) - (7)].integer) == INTEGER_SET_ENUMERATION)
2866 
+        {
2867 
+          // Pop the first integer
2868 
+          yr_parser_emit_with_arg(
2869 
+              yyscanner, OP_POP_M, mem_offset, &addr);
2870 
+        }
2871 
+        else // INTEGER_SET_RANGE
2872 
+        {
2873 
+          // Pop higher bound of set range
2874 
+          yr_parser_emit_with_arg(
2875 
+              yyscanner, OP_POP_M, mem_offset + 3, &addr);
2876 
+
2877 
+          // Pop lower bound of set range
2878 
+          yr_parser_emit_with_arg(
2879 
+              yyscanner, OP_POP_M, mem_offset, NULL);
2880 
+        }
2881 
+#ifdef REAL_YARA
2882 
+        compiler->loop_address[compiler->loop_depth] = addr;
2883 
+        compiler->loop_identifier[compiler->loop_depth] = (yyvsp[(3) - (7)].c_string);
2884 
+        compiler->loop_depth++;
2885 
+#endif
2886 
+      }
2887 
+    break;
2888 
+
2889 
+  case 58:
2890 
+
2891 
+/* Line 1806 of yacc.c  */
2892 
+#line 1066 "yara_grammar.y"
2893 
+    {
2894 
+        int mem_offset;
2895 
+
2896 
+        compiler->loop_depth--;
2897 
+        mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth;
2898 
+
2899 
+        // The value at the top of the stack is 1 if latest
2900 
+        // expression was true or 0 otherwise. Add this value
2901 
+        // to the counter for number of expressions evaluating
2902 
+        // to true.
2903 
+        yr_parser_emit_with_arg(
2904 
+            yyscanner, OP_ADD_M, mem_offset + 1, NULL);
2905 
+
2906 
+        // Increment iterations counter
2907 
+        yr_parser_emit_with_arg(
2908 
+            yyscanner, OP_INCR_M, mem_offset + 2, NULL);
2909 
+
2910 
+        if ((yyvsp[(6) - (11)].integer) == INTEGER_SET_ENUMERATION)
2911 
+        {
2912 
+          yr_parser_emit_with_arg_reloc(
2913 
+              yyscanner,
2914 
+              OP_JNUNDEF,
2915 
+#ifdef REAL_YARA
2916 
+              PTR_TO_UINT64(
2917 
+                  compiler->loop_address[compiler->loop_depth]),
2918 
+#else
2919 
+              0,
2920 
+#endif
2921 
+              NULL);
2922 
+        }
2923 
+        else // INTEGER_SET_RANGE
2924 
+        {
2925 
+          // Increment lower bound of integer set
2926 
+          yr_parser_emit_with_arg(
2927 
+              yyscanner, OP_INCR_M, mem_offset, NULL);
2928 
+
2929 
+          // Push lower bound of integer set
2930 
+          yr_parser_emit_with_arg(
2931 
+              yyscanner, OP_PUSH_M, mem_offset, NULL);
2932 
+
2933 
+          // Push higher bound of integer set
2934 
+          yr_parser_emit_with_arg(
2935 
+              yyscanner, OP_PUSH_M, mem_offset + 3, NULL);
2936 
+
2937 
+#ifdef REAL_YARA
2938 
+          // Compare higher bound with lower bound, do loop again
2939 
+          // if lower bound is still lower or equal than higher bound
2940 
+          yr_parser_emit_with_arg_reloc(
2941 
+              yyscanner,
2942 
+              OP_JLE,
2943 
+              PTR_TO_UINT64(
2944 
+                compiler->loop_address[compiler->loop_depth]),
2945 
+              NULL);
2946 
+#endif
2947 
+
2948 
+          yr_parser_emit(yyscanner, OP_POP, NULL);
2949 
+          yr_parser_emit(yyscanner, OP_POP, NULL);
2950 
+        }
2951 
+
2952 
+        // Pop end-of-list marker.
2953 
+        yr_parser_emit(yyscanner, OP_POP, NULL);
2954 
+
2955 
+        // At this point the loop quantifier (any, all, 1, 2,..)
2956 
+        // is at the top of the stack. Check if the quantifier
2957 
+        // is undefined (meaning "all") and replace it with the
2958 
+        // iterations counter in that case.
2959 
+        yr_parser_emit_with_arg(
2960 
+            yyscanner, OP_SWAPUNDEF, mem_offset + 2, NULL);
2961 
+
2962 
+        // Compare the loop quantifier with the number of
2963 
+        // expressions evaluating to TRUE.
2964 
+        yr_parser_emit_with_arg(
2965 
+            yyscanner, OP_PUSH_M, mem_offset + 1, NULL);
2966 
+
2967 
+        yr_parser_emit(yyscanner, OP_LE, NULL);
2968 
+
2969 
+#ifdef REAL_YARA
2970 
+        compiler->loop_identifier[compiler->loop_depth] = NULL;
2971 
+#endif
2972 
+        yr_free((yyvsp[(3) - (11)].c_string));
2973 
+
2974 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
2975 
+      }
2976 
+    break;
2977 
+
2978 
+  case 59:
2979 
+
2980 
+/* Line 1806 of yacc.c  */
2981 
+#line 1150 "yara_grammar.y"
2982 
+    {
2983 
+#ifdef REAL_YARA
2984 
+        int mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth;
2985 
+        int8_t* addr;
2986 
+
2987 
+        if (compiler->loop_depth == MAX_LOOP_NESTING)
2988 
+          compiler->last_result = \
2989 
+            ERROR_LOOP_NESTING_LIMIT_EXCEEDED;
2990 
+
2991 
+        if (compiler->loop_for_of_mem_offset != -1)
2992 
+          compiler->last_result = \
2993 
+            ERROR_NESTED_FOR_OF_LOOP;
2994 
+
2995 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
2996 
+
2997 
+        yr_parser_emit_with_arg(
2998 
+            yyscanner, OP_CLEAR_M, mem_offset + 1, NULL);
2999 
+
3000 
+        yr_parser_emit_with_arg(
3001 
+            yyscanner, OP_CLEAR_M, mem_offset + 2, NULL);
3002 
+
3003 
+        // Pop the first string.
3004 
+        yr_parser_emit_with_arg(
3005 
+            yyscanner, OP_POP_M, mem_offset, &addr);
3006 
+
3007 
+        compiler->loop_for_of_mem_offset = mem_offset;
3008 
+        compiler->loop_address[compiler->loop_depth] = addr;
3009 
+        compiler->loop_identifier[compiler->loop_depth] = NULL;
3010 
+        compiler->loop_depth++;
3011 
+#endif
3012 
+      }
3013 
+    break;
3014 
+
3015 
+  case 60:
3016 
+
3017 
+/* Line 1806 of yacc.c  */
3018 
+#line 1182 "yara_grammar.y"
3019 
+    {
3020 
+#ifdef REAL_YARA
3021 
+        int mem_offset;
3022 
+
3023 
+        compiler->loop_depth--;
3024 
+        compiler->loop_for_of_mem_offset = -1;
3025 
+
3026 
+        mem_offset = LOOP_LOCAL_VARS * compiler->loop_depth;
3027 
+
3028 
+        // Increment counter by the value returned by the
3029 
+        // boolean expression (0 or 1).
3030 
+        yr_parser_emit_with_arg(
3031 
+            yyscanner, OP_ADD_M, mem_offset + 1, NULL);
3032 
+
3033 
+        // Increment iterations counter.
3034 
+        yr_parser_emit_with_arg(
3035 
+            yyscanner, OP_INCR_M, mem_offset + 2, NULL);
3036 
+
3037 
+        // If next string is not undefined, go back to the
3038 
+        // begining of the loop.
3039 
+        yr_parser_emit_with_arg_reloc(
3040 
+            yyscanner,
3041 
+            OP_JNUNDEF,
3042 
+            PTR_TO_UINT64(
3043 
+                compiler->loop_address[compiler->loop_depth]),
3044 
+            NULL);
3045 
+
3046 
+        // Pop end-of-list marker.
3047 
+        yr_parser_emit(yyscanner, OP_POP, NULL);
3048 
+
3049 
+        // At this point the loop quantifier (any, all, 1, 2,..)
3050 
+        // is at top of the stack. Check if the quantifier is
3051 
+        // undefined (meaning "all") and replace it with the
3052 
+        // iterations counter in that case.
3053 
+        yr_parser_emit_with_arg(
3054 
+            yyscanner, OP_SWAPUNDEF, mem_offset + 2, NULL);
3055 
+
3056 
+        // Compare the loop quantifier with the number of
3057 
+        // expressions evaluating to TRUE.
3058 
+        yr_parser_emit_with_arg(
3059 
+            yyscanner, OP_PUSH_M, mem_offset + 1, NULL);
3060 
+
3061 
+        yr_parser_emit(yyscanner, OP_LE, NULL);
3062 
+#endif
3063 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3064 
+
3065 
+      }
3066 
+    break;
3067 
+
3068 
+  case 61:
3069 
+
3070 
+/* Line 1806 of yacc.c  */
3071 
+#line 1230 "yara_grammar.y"
3072 
+    {
3073 
+        yr_parser_emit(yyscanner, OP_OF, NULL);
3074 
+
3075 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3076 
+      }
3077 
+    break;
3078 
+
3079 
+  case 62:
3080 
+
3081 
+/* Line 1806 of yacc.c  */
3082 
+#line 1236 "yara_grammar.y"
3083 
+    {
3084 
+        yr_parser_emit(yyscanner, OP_NOT, NULL);
3085 
+
3086 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3087 
+      }
3088 
+    break;
3089 
+
3090 
+  case 63:
3091 
+
3092 
+/* Line 1806 of yacc.c  */
3093 
+#line 1242 "yara_grammar.y"
3094 
+    {
3095 
+        yr_parser_emit(yyscanner, OP_AND, NULL);
3096 
+
3097 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3098 
+      }
3099 
+    break;
3100 
+
3101 
+  case 64:
3102 
+
3103 
+/* Line 1806 of yacc.c  */
3104 
+#line 1248 "yara_grammar.y"
3105 
+    {
3106 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_BOOLEAN, "or");
3107 
+
3108 
+        yr_parser_emit(yyscanner, OP_OR, NULL);
3109 
+
3110 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3111 
+      }
3112 
+    break;
3113 
+
3114 
+  case 65:
3115 
+
3116 
+/* Line 1806 of yacc.c  */
3117 
+#line 1256 "yara_grammar.y"
3118 
+    {
3119 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "<");
3120 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "<");
3121 
+
3122 
+        yr_parser_emit(yyscanner, OP_LT, NULL);
3123 
+
3124 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3125 
+      }
3126 
+    break;
3127 
+
3128 
+  case 66:
3129 
+
3130 
+/* Line 1806 of yacc.c  */
3131 
+#line 1265 "yara_grammar.y"
3132 
+    {
3133 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, ">");
3134 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, ">");
3135 
+
3136 
+        yr_parser_emit(yyscanner, OP_GT, NULL);
3137 
+
3138 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3139 
+      }
3140 
+    break;
3141 
+
3142 
+  case 67:
3143 
+
3144 
+/* Line 1806 of yacc.c  */
3145 
+#line 1274 "yara_grammar.y"
3146 
+    {
3147 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "<=");
3148 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "<=");
3149 
+
3150 
+        yr_parser_emit(yyscanner, OP_LE, NULL);
3151 
+
3152 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3153 
+      }
3154 
+    break;
3155 
+
3156 
+  case 68:
3157 
+
3158 
+/* Line 1806 of yacc.c  */
3159 
+#line 1283 "yara_grammar.y"
3160 
+    {
3161 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, ">=");
3162 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, ">=");
3163 
+
3164 
+        yr_parser_emit(yyscanner, OP_GE, NULL);
3165 
+
3166 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3167 
+      }
3168 
+    break;
3169 
+
3170 
+  case 69:
3171 
+
3172 
+/* Line 1806 of yacc.c  */
3173 
+#line 1292 "yara_grammar.y"
3174 
+    {
3175 
+        if ((yyvsp[(1) - (3)].expression_type) != (yyvsp[(3) - (3)].expression_type))
3176 
+        {
3177 
+          yr_compiler_set_error_extra_info(
3178 
+              compiler, "mismatching types for == operator");
3179 
+          compiler->last_result = ERROR_WRONG_TYPE;
3180 
+        }
3181 
+        else if ((yyvsp[(1) - (3)].expression_type) == EXPRESSION_TYPE_STRING)
3182 
+        {
3183 
+          compiler->last_result = yr_parser_emit(
3184 
+              yyscanner,
3185 
+              OP_SZ_EQ,
3186 
+              NULL);
3187 
+        }
3188 
+        else
3189 
+        {
3190 
+          compiler->last_result = yr_parser_emit(
3191 
+              yyscanner,
3192 
+              OP_EQ,
3193 
+              NULL);
3194 
+        }
3195 
+
3196 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3197 
+
3198 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3199 
+      }
3200 
+    break;
3201 
+
3202 
+  case 70:
3203 
+
3204 
+/* Line 1806 of yacc.c  */
3205 
+#line 1319 "yara_grammar.y"
3206 
+    {
3207 
+        if ((yyvsp[(1) - (3)].expression_type) != (yyvsp[(3) - (3)].expression_type))
3208 
+        {
3209 
+          yr_compiler_set_error_extra_info(
3210 
+              compiler, "mismatching types for == operator");
3211 
+          compiler->last_result = ERROR_WRONG_TYPE;
3212 
+        }
3213 
+        else if ((yyvsp[(1) - (3)].expression_type) == EXPRESSION_TYPE_STRING)
3214 
+        {
3215 
+          compiler->last_result = yr_parser_emit(
3216 
+              yyscanner,
3217 
+              OP_SZ_EQ,
3218 
+              NULL);
3219 
+        }
3220 
+        else
3221 
+        {
3222 
+          compiler->last_result = yr_parser_emit(
3223 
+              yyscanner,
3224 
+              OP_EQ,
3225 
+              NULL);
3226 
+        }
3227 
+
3228 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3229 
+
3230 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3231 
+      }
3232 
+    break;
3233 
+
3234 
+  case 71:
3235 
+
3236 
+/* Line 1806 of yacc.c  */
3237 
+#line 1346 "yara_grammar.y"
3238 
+    {
3239 
+        if ((yyvsp[(1) - (3)].expression_type) != (yyvsp[(3) - (3)].expression_type))
3240 
+        {
3241 
+          yr_compiler_set_error_extra_info(
3242 
+              compiler, "mismatching types for != operator");
3243 
+          compiler->last_result = ERROR_WRONG_TYPE;
3244 
+        }
3245 
+        else if ((yyvsp[(1) - (3)].expression_type) == EXPRESSION_TYPE_STRING)
3246 
+        {
3247 
+          compiler->last_result = yr_parser_emit(
3248 
+              yyscanner,
3249 
+              OP_SZ_NEQ,
3250 
+              NULL);
3251 
+        }
3252 
+        else
3253 
+        {
3254 
+          compiler->last_result = yr_parser_emit(
3255 
+              yyscanner,
3256 
+              OP_NEQ,
3257 
+              NULL);
3258 
+        }
3259 
+
3260 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3261 
+
3262 
+        (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3263 
+      }
3264 
+    break;
3265 
+
3266 
+  case 72:
3267 
+
3268 
+/* Line 1806 of yacc.c  */
3269 
+#line 1373 "yara_grammar.y"
3270 
+    {
3271 
+        (yyval.expression_type) = (yyvsp[(1) - (1)].expression_type);
3272 
+      }
3273 
+    break;
3274 
+
3275 
+  case 73:
3276 
+
3277 
+/* Line 1806 of yacc.c  */
3278 
+#line 1377 "yara_grammar.y"
3279 
+    {
3280 
+        (yyval.expression_type) = (yyvsp[(2) - (3)].expression_type);
3281 
+      }
3282 
+    break;
3283 
+
3284 
+  case 74:
3285 
+
3286 
+/* Line 1806 of yacc.c  */
3287 
+#line 1384 "yara_grammar.y"
3288 
+    { (yyval.integer) = INTEGER_SET_ENUMERATION; }
3289 
+    break;
3290 
+
3291 
+  case 75:
3292 
+
3293 
+/* Line 1806 of yacc.c  */
3294 
+#line 1385 "yara_grammar.y"
3295 
+    { (yyval.integer) = INTEGER_SET_RANGE; }
3296 
+    break;
3297 
+
3298 
+  case 76:
3299 
+
3300 
+/* Line 1806 of yacc.c  */
3301 
+#line 1391 "yara_grammar.y"
3302 
+    {
3303 
+        if ((yyvsp[(2) - (6)].expression_type) != EXPRESSION_TYPE_INTEGER)
3304 
+        {
3305 
+          yr_compiler_set_error_extra_info(
3306 
+              compiler, "wrong type for range's lower bound");
3307 
+          compiler->last_result = ERROR_WRONG_TYPE;
3308 
+        }
3309 
+
3310 
+        if ((yyvsp[(5) - (6)].expression_type) != EXPRESSION_TYPE_INTEGER)
3311 
+        {
3312 
+          yr_compiler_set_error_extra_info(
3313 
+              compiler, "wrong type for range's upper bound");
3314 
+          compiler->last_result = ERROR_WRONG_TYPE;
3315 
+        }
3316 
+
3317 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3318 
+      }
3319 
+    break;
3320 
+
3321 
+  case 77:
3322 
+
3323 
+/* Line 1806 of yacc.c  */
3324 
+#line 1413 "yara_grammar.y"
3325 
+    {
3326 
+        if ((yyvsp[(1) - (1)].expression_type) != EXPRESSION_TYPE_INTEGER)
3327 
+        {
3328 
+          yr_compiler_set_error_extra_info(
3329 
+              compiler, "wrong type for enumeration item");
3330 
+          compiler->last_result = ERROR_WRONG_TYPE;
3331 
+
3332 
+        }
3333 
+
3334 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3335 
+      }
3336 
+    break;
3337 
+
3338 
+  case 78:
3339 
+
3340 
+/* Line 1806 of yacc.c  */
3341 
+#line 1425 "yara_grammar.y"
3342 
+    {
3343 
+        if ((yyvsp[(3) - (3)].expression_type) != EXPRESSION_TYPE_INTEGER)
3344 
+        {
3345 
+          yr_compiler_set_error_extra_info(
3346 
+              compiler, "wrong type for enumeration item");
3347 
+          compiler->last_result = ERROR_WRONG_TYPE;
3348 
+        }
3349 
+
3350 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3351 
+      }
3352 
+    break;
3353 
+
3354 
+  case 79:
3355 
+
3356 
+/* Line 1806 of yacc.c  */
3357 
+#line 1440 "yara_grammar.y"
3358 
+    {
3359 
+        // Push end-of-list marker
3360 
+        yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL);
3361 
+      }
3362 
+    break;
3363 
+
3364 
+  case 81:
3365 
+
3366 
+/* Line 1806 of yacc.c  */
3367 
+#line 1446 "yara_grammar.y"
3368 
+    {
3369 
+        yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL);
3370 
+        yr_parser_emit_pushes_for_strings(yyscanner, "$*");
3371 
+#ifdef YARA_PROTO
3372 
+        compiler->current_rule_flags |= RULE_THEM;
3373 
+#endif
3374 
+      }
3375 
+    break;
3376 
+
3377 
+  case 84:
3378 
+
3379 
+/* Line 1806 of yacc.c  */
3380 
+#line 1464 "yara_grammar.y"
3381 
+    {
3382 
+        yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[(1) - (1)].c_string));
3383 
+        yr_free((yyvsp[(1) - (1)].c_string));
3384 
+      }
3385 
+    break;
3386 
+
3387 
+  case 85:
3388 
+
3389 
+/* Line 1806 of yacc.c  */
3390 
+#line 1469 "yara_grammar.y"
3391 
+    {
3392 
+        yr_parser_emit_pushes_for_strings(yyscanner, (yyvsp[(1) - (1)].c_string));
3393 
+        yr_free((yyvsp[(1) - (1)].c_string));
3394 
+      }
3395 
+    break;
3396 
+
3397 
+  case 87:
3398 
+
3399 
+/* Line 1806 of yacc.c  */
3400 
+#line 1479 "yara_grammar.y"
3401 
+    {
3402 
+        yr_parser_emit_with_arg(yyscanner, OP_PUSH, UNDEFINED, NULL);
3403 
+#ifdef YARA_PROTO
3404 
+        compiler->current_rule_flags |= RULE_ALL;
3405 
+#endif
3406 
+      }
3407 
+    break;
3408 
+
3409 
+  case 88:
3410 
+
3411 
+/* Line 1806 of yacc.c  */
3412 
+#line 1486 "yara_grammar.y"
3413 
+    {
3414 
+        yr_parser_emit_with_arg(yyscanner, OP_PUSH, 1, NULL);
3415 
+#ifdef YARA_PROTO
3416 
+        compiler->current_rule_flags |= RULE_ANY;
3417 
+#endif
3418 
+      }
3419 
+    break;
3420 
+
3421 
+  case 89:
3422 
+
3423 
+/* Line 1806 of yacc.c  */
3424 
+#line 1497 "yara_grammar.y"
3425 
+    {
3426 
+        (yyval.expression_type) = (yyvsp[(2) - (3)].expression_type);
3427 
+      }
3428 
+    break;
3429 
+
3430 
+  case 90:
3431 
+
3432 
+/* Line 1806 of yacc.c  */
3433 
+#line 1501 "yara_grammar.y"
3434 
+    {
3435 
+        compiler->last_result = yr_parser_emit(
3436 
+            yyscanner, OP_FILESIZE, NULL);
3437 
+
3438 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3439 
+
3440 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3441 
+      }
3442 
+    break;
3443 
+
3444 
+  case 91:
3445 
+
3446 
+/* Line 1806 of yacc.c  */
3447 
+#line 1510 "yara_grammar.y"
3448 
+    {
3449 
+#ifndef YARA_PROTO
3450 
+        yywarning(yyscanner,
3451 
+            "Using deprecated \"entrypoint\" keyword. Use the \"entry_point\" " "function from PE module instead.");
3452 
+#else
3453 
+        compiler->current_rule_flags |= RULE_EP;
3454 
+#endif
3455 
+        compiler->last_result = yr_parser_emit(
3456 
+            yyscanner, OP_ENTRYPOINT, NULL);
3457 
+
3458 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3459 
+
3460 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3461 
+      }
3462 
+    break;
3463 
+
3464 
+  case 92:
3465 
+
3466 
+/* Line 1806 of yacc.c  */
3467 
+#line 1525 "yara_grammar.y"
3468 
+    {
3469 
+        CHECK_TYPE((yyvsp[(3) - (4)].expression_type), EXPRESSION_TYPE_INTEGER, "int8");
3470 
+
3471 
+        compiler->last_result = yr_parser_emit(
3472 
+            yyscanner, OP_INT8, NULL);
3473 
+
3474 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3475 
+
3476 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3477 
+      }
3478 
+    break;
3479 
+
3480 
+  case 93:
3481 
+
3482 
+/* Line 1806 of yacc.c  */
3483 
+#line 1536 "yara_grammar.y"
3484 
+    {
3485 
+        CHECK_TYPE((yyvsp[(3) - (4)].expression_type), EXPRESSION_TYPE_INTEGER, "int16");
3486 
+
3487 
+        compiler->last_result = yr_parser_emit(
3488 
+            yyscanner, OP_INT16, NULL);
3489 
+
3490 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3491 
+
3492 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3493 
+      }
3494 
+    break;
3495 
+
3496 
+  case 94:
3497 
+
3498 
+/* Line 1806 of yacc.c  */
3499 
+#line 1547 "yara_grammar.y"
3500 
+    {
3501 
+        CHECK_TYPE((yyvsp[(3) - (4)].expression_type), EXPRESSION_TYPE_INTEGER, "int32");
3502 
+
3503 
+        compiler->last_result = yr_parser_emit(
3504 
+            yyscanner, OP_INT32, NULL);
3505 
+
3506 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3507 
+
3508 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3509 
+      }
3510 
+    break;
3511 
+
3512 
+  case 95:
3513 
+
3514 
+/* Line 1806 of yacc.c  */
3515 
+#line 1558 "yara_grammar.y"
3516 
+    {
3517 
+        CHECK_TYPE((yyvsp[(3) - (4)].expression_type), EXPRESSION_TYPE_INTEGER, "uint8");
3518 
+
3519 
+        compiler->last_result = yr_parser_emit(
3520 
+            yyscanner, OP_UINT8, NULL);
3521 
+
3522 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3523 
+
3524 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3525 
+      }
3526 
+    break;
3527 
+
3528 
+  case 96:
3529 
+
3530 
+/* Line 1806 of yacc.c  */
3531 
+#line 1569 "yara_grammar.y"
3532 
+    {
3533 
+        CHECK_TYPE((yyvsp[(3) - (4)].expression_type), EXPRESSION_TYPE_INTEGER, "uint16");
3534 
+
3535 
+        compiler->last_result = yr_parser_emit(
3536 
+            yyscanner, OP_UINT16, NULL);
3537 
+
3538 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3539 
+
3540 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3541 
+      }
3542 
+    break;
3543 
+
3544 
+  case 97:
3545 
+
3546 
+/* Line 1806 of yacc.c  */
3547 
+#line 1580 "yara_grammar.y"
3548 
+    {
3549 
+        CHECK_TYPE((yyvsp[(3) - (4)].expression_type), EXPRESSION_TYPE_INTEGER, "uint32");
3550 
+
3551 
+        compiler->last_result = yr_parser_emit(
3552 
+            yyscanner, OP_UINT32, NULL);
3553 
+
3554 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3555 
+
3556 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3557 
+      }
3558 
+    break;
3559 
+
3560 
+  case 98:
3561 
+
3562 
+/* Line 1806 of yacc.c  */
3563 
+#line 1591 "yara_grammar.y"
3564 
+    {
3565 
+        compiler->last_result = yr_parser_emit_with_arg(
3566 
+            yyscanner, OP_PUSH, (yyvsp[(1) - (1)].integer), NULL);
3567 
+
3568 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3569 
+
3570 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3571 
+      }
3572 
+    break;
3573 
+
3574 
+  case 99:
3575 
+
3576 
+/* Line 1806 of yacc.c  */
3577 
+#line 1600 "yara_grammar.y"
3578 
+    {
3579 
+        SIZED_STRING* sized_string = (yyvsp[(1) - (1)].sized_string);
3580 
+        char* string;
3581 
+
3582 
+#if REAL_YARA
3583 
+        compiler->last_result = yr_arena_write_string(
3584 
+            compiler->sz_arena,
3585 
+            sized_string->c_string,
3586 
+            &string);
3587 
+#endif
3588 
+
3589 
+        yr_free((yyvsp[(1) - (1)].sized_string));
3590 
+
3591 
+        if (compiler->last_result == ERROR_SUCCESS)
3592 
+          compiler->last_result = yr_parser_emit_with_arg_reloc(
3593 
+              yyscanner,
3594 
+              OP_PUSH,
3595 
+              PTR_TO_UINT64(string),
3596 
+              NULL);
3597 
+
3598 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3599 
+
3600 
+        (yyval.expression_type) = EXPRESSION_TYPE_STRING;
3601 
+      }
3602 
+    break;
3603 
+
3604 
+  case 100:
3605 
+
3606 
+/* Line 1806 of yacc.c  */
3607 
+#line 1625 "yara_grammar.y"
3608 
+    {
3609 
+        compiler->last_result = yr_parser_reduce_string_identifier(
3610 
+            yyscanner,
3611 
+            (yyvsp[(1) - (1)].c_string),
3612 
+            OP_STR_COUNT);
3613 
+
3614 
+        yr_free((yyvsp[(1) - (1)].c_string));
3615 
+
3616 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3617 
+
3618 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3619 
+      }
3620 
+    break;
3621 
+
3622 
+  case 101:
3623 
+
3624 
+/* Line 1806 of yacc.c  */
3625 
+#line 1638 "yara_grammar.y"
3626 
+    {
3627 
+        compiler->last_result = yr_parser_reduce_string_identifier(
3628 
+            yyscanner,
3629 
+            (yyvsp[(1) - (4)].c_string),
3630 
+            OP_STR_OFFSET);
3631 
+
3632 
+        yr_free((yyvsp[(1) - (4)].c_string));
3633 
+
3634 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3635 
+
3636 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3637 
+      }
3638 
+    break;
3639 
+
3640 
+  case 102:
3641 
+
3642 
+/* Line 1806 of yacc.c  */
3643 
+#line 1651 "yara_grammar.y"
3644 
+    {
3645 
+        compiler->last_result = yr_parser_emit_with_arg(
3646 
+            yyscanner,
3647 
+            OP_PUSH,
3648 
+            1,
3649 
+            NULL);
3650 
+
3651 
+        if (compiler->last_result == ERROR_SUCCESS)
3652 
+          compiler->last_result = yr_parser_reduce_string_identifier(
3653 
+              yyscanner,
3654 
+              (yyvsp[(1) - (1)].c_string),
3655 
+              OP_STR_OFFSET);
3656 
+
3657 
+        yr_free((yyvsp[(1) - (1)].c_string));
3658 
+
3659 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3660 
+
3661 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3662 
+      }
3663 
+    break;
3664 
+
3665 
+  case 103:
3666 
+
3667 
+/* Line 1806 of yacc.c  */
3668 
+#line 1671 "yara_grammar.y"
3669 
+    {
3670 
+        if ((yyvsp[(1) - (1)].object) == (YR_OBJECT*) -1)  // loop identifier
3671 
+        {
3672 
+          (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3673 
+        }
3674 
+        else if ((yyvsp[(1) - (1)].object) == (YR_OBJECT*) -2)  // rule identifier
3675 
+        {
3676 
+          (yyval.expression_type) = EXPRESSION_TYPE_BOOLEAN;
3677 
+        }
3678 
+        else if ((yyvsp[(1) - (1)].object) != NULL)
3679 
+        {
3680 
+          compiler->last_result = yr_parser_emit(
3681 
+              yyscanner, OP_OBJ_VALUE, NULL);
3682 
+
3683 
+          switch((yyvsp[(1) - (1)].object)->type)
3684 
+          {
3685 
+            case OBJECT_TYPE_INTEGER:
3686 
+              (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3687 
+              break;
3688 
+            case OBJECT_TYPE_STRING:
3689 
+              (yyval.expression_type) = EXPRESSION_TYPE_STRING;
3690 
+              break;
3691 
+            default:
3692 
+              assert(FALSE);
3693 
+          }
3694 
+        }
3695 
+        else
3696 
+        {
3697 
+          yr_compiler_set_error_extra_info(compiler, (yyvsp[(1) - (1)].object)->identifier);
3698 
+          compiler->last_result = ERROR_WRONG_TYPE;
3699 
+        }
3700 
+
3701 
+        ERROR_IF(compiler->last_result != ERROR_SUCCESS);
3702 
+      }
3703 
+    break;
3704 
+
3705 
+  case 104:
3706 
+
3707 
+/* Line 1806 of yacc.c  */
3708 
+#line 1706 "yara_grammar.y"
3709 
+    {
3710 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "+");
3711 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "+");
3712 
+
3713 
+        yr_parser_emit(yyscanner, OP_ADD, NULL);
3714 
+
3715 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3716 
+      }
3717 
+    break;
3718 
+
3719 
+  case 105:
3720 
+
3721 
+/* Line 1806 of yacc.c  */
3722 
+#line 1715 "yara_grammar.y"
3723 
+    {
3724 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "-");
3725 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "-");
3726 
+
3727 
+        yr_parser_emit(yyscanner, OP_SUB, NULL);
3728 
+
3729 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3730 
+      }
3731 
+    break;
3732 
+
3733 
+  case 106:
3734 
+
3735 
+/* Line 1806 of yacc.c  */
3736 
+#line 1724 "yara_grammar.y"
3737 
+    {
3738 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "*");
3739 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "*");
3740 
+
3741 
+        yr_parser_emit(yyscanner, OP_MUL, NULL);
3742 
+
3743 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3744 
+      }
3745 
+    break;
3746 
+
3747 
+  case 107:
3748 
+
3749 
+/* Line 1806 of yacc.c  */
3750 
+#line 1733 "yara_grammar.y"
3751 
+    {
3752 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "\\");
3753 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "\\");
3754 
+
3755 
+        yr_parser_emit(yyscanner, OP_DIV, NULL);
3756 
+
3757 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3758 
+      }
3759 
+    break;
3760 
+
3761 
+  case 108:
3762 
+
3763 
+/* Line 1806 of yacc.c  */
3764 
+#line 1742 "yara_grammar.y"
3765 
+    {
3766 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "%");
3767 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "%");
3768 
+
3769 
+        yr_parser_emit(yyscanner, OP_MOD, NULL);
3770 
+
3771 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3772 
+      }
3773 
+    break;
3774 
+
3775 
+  case 109:
3776 
+
3777 
+/* Line 1806 of yacc.c  */
3778 
+#line 1751 "yara_grammar.y"
3779 
+    {
3780 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "^");
3781 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "^");
3782 
+
3783 
+        yr_parser_emit(yyscanner, OP_XOR, NULL);
3784 
+
3785 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3786 
+      }
3787 
+    break;
3788 
+
3789 
+  case 110:
3790 
+
3791 
+/* Line 1806 of yacc.c  */
3792 
+#line 1760 "yara_grammar.y"
3793 
+    {
3794 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "^");
3795 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "^");
3796 
+
3797 
+        yr_parser_emit(yyscanner, OP_AND, NULL);
3798 
+
3799 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3800 
+      }
3801 
+    break;
3802 
+
3803 
+  case 111:
3804 
+
3805 
+/* Line 1806 of yacc.c  */
3806 
+#line 1769 "yara_grammar.y"
3807 
+    {
3808 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "|");
3809 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "|");
3810 
+
3811 
+        yr_parser_emit(yyscanner, OP_OR, NULL);
3812 
+
3813 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3814 
+      }
3815 
+    break;
3816 
+
3817 
+  case 112:
3818 
+
3819 
+/* Line 1806 of yacc.c  */
3820 
+#line 1778 "yara_grammar.y"
3821 
+    {
3822 
+        CHECK_TYPE((yyvsp[(2) - (2)].expression_type), EXPRESSION_TYPE_INTEGER, "~");
3823 
+
3824 
+        yr_parser_emit(yyscanner, OP_NEG, NULL);
3825 
+
3826 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3827 
+      }
3828 
+    break;
3829 
+
3830 
+  case 113:
3831 
+
3832 
+/* Line 1806 of yacc.c  */
3833 
+#line 1786 "yara_grammar.y"
3834 
+    {
3835 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "<<");
3836 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, "<<");
3837 
+
3838 
+        yr_parser_emit(yyscanner, OP_SHL, NULL);
3839 
+
3840 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3841 
+      }
3842 
+    break;
3843 
+
3844 
+  case 114:
3845 
+
3846 
+/* Line 1806 of yacc.c  */
3847 
+#line 1795 "yara_grammar.y"
3848 
+    {
3849 
+        CHECK_TYPE((yyvsp[(1) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, ">>");
3850 
+        CHECK_TYPE((yyvsp[(3) - (3)].expression_type), EXPRESSION_TYPE_INTEGER, ">>");
3851 
+
3852 
+        yr_parser_emit(yyscanner, OP_SHR, NULL);
3853 
+
3854 
+        (yyval.expression_type) = EXPRESSION_TYPE_INTEGER;
3855 
+      }
3856 
+    break;
3857 
+
3858 
+  case 115:
3859 
+
3860 
+/* Line 1806 of yacc.c  */
3861 
+#line 1804 "yara_grammar.y"
3862 
+    {
3863 
+        (yyval.expression_type) = (yyvsp[(1) - (1)].expression_type);
3864 
+      }
3865 
+    break;
3866 
+
3867 
+
3868 
+
3869 
+/* Line 1806 of yacc.c  */
3870 
+#line 3872 "yara_grammar.c"
3871 
+      default: break;
3872 
+    }
3873 
+  /* User semantic actions sometimes alter yychar, and that requires
3874 
+     that yytoken be updated with the new translation.  We take the
3875 
+     approach of translating immediately before every use of yytoken.
3876 
+     One alternative is translating here after every semantic action,
3877 
+     but that translation would be missed if the semantic action invokes
3878 
+     YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or
3879 
+     if it invokes YYBACKUP.  In the case of YYABORT or YYACCEPT, an
3880 
+     incorrect destructor might then be invoked immediately.  In the
3881 
+     case of YYERROR or YYBACKUP, subsequent parser actions might lead
3882 
+     to an incorrect destructor call or verbose syntax error message
3883 
+     before the lookahead is translated.  */
3884 
+  YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
3885 
+
3886 
+  YYPOPSTACK (yylen);
3887 
+  yylen = 0;
3888 
+  YY_STACK_PRINT (yyss, yyssp);
3889 
+
3890 
+  *++yyvsp = yyval;
3891 
+
3892 
+  /* Now `shift' the result of the reduction.  Determine what state
3893 
+     that goes to, based on the state we popped back to and the rule
3894 
+     number reduced by.  */
3895 
+
3896 
+  yyn = yyr1[yyn];
3897 
+
3898 
+  yystate = yypgoto[yyn - YYNTOKENS] + *yyssp;
3899 
+  if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp)
3900 
+    yystate = yytable[yystate];
3901 
+  else
3902 
+    yystate = yydefgoto[yyn - YYNTOKENS];
3903 
+
3904 
+  goto yynewstate;
3905 
+
3906 
+
3907 
+/*------------------------------------.
3908 
+| yyerrlab -- here on detecting error |
3909 
+`------------------------------------*/
3910 
+yyerrlab:
3911 
+  /* Make sure we have latest lookahead translation.  See comments at
3912 
+     user semantic actions for why this is necessary.  */
3913 
+  yytoken = yychar == YYEMPTY ? YYEMPTY : YYTRANSLATE (yychar);
3914 
+
3915 
+  /* If not already recovering from an error, report this error.  */
3916 
+  if (!yyerrstatus)
3917 
+    {
3918 
+      ++yynerrs;
3919 
+#if ! YYERROR_VERBOSE
3920 
+      yyerror (yyscanner, compiler, YY_("syntax error"));
3921 
+#else
3922 
+# define YYSYNTAX_ERROR yysyntax_error (&yymsg_alloc, &yymsg, \
3923 
+                                        yyssp, yytoken)
3924 
+      {
3925 
+        char const *yymsgp = YY_("syntax error");
3926 
+        int yysyntax_error_status;
3927 
+        yysyntax_error_status = YYSYNTAX_ERROR;
3928 
+        if (yysyntax_error_status == 0)
3929 
+          yymsgp = yymsg;
3930 
+        else if (yysyntax_error_status == 1)
3931 
+          {
3932 
+            if (yymsg != yymsgbuf)
3933 
+              YYSTACK_FREE (yymsg);
3934 
+            yymsg = (char *) YYSTACK_ALLOC (yymsg_alloc);
3935 
+            if (!yymsg)
3936 
+              {
3937 
+                yymsg = yymsgbuf;
3938 
+                yymsg_alloc = sizeof yymsgbuf;
3939 
+                yysyntax_error_status = 2;
3940 
+              }
3941 
+            else
3942 
+              {
3943 
+                yysyntax_error_status = YYSYNTAX_ERROR;
3944 
+                yymsgp = yymsg;
3945 
+              }
3946 
+          }
3947 
+        yyerror (yyscanner, compiler, yymsgp);
3948 
+        if (yysyntax_error_status == 2)
3949 
+          goto yyexhaustedlab;
3950 
+      }
3951 
+# undef YYSYNTAX_ERROR
3952 
+#endif
3953 
+    }
3954 
+
3955 
+
3956 
+
3957 
+  if (yyerrstatus == 3)
3958 
+    {
3959 
+      /* If just tried and failed to reuse lookahead token after an
3960 
+	 error, discard it.  */
3961 
+
3962 
+      if (yychar <= YYEOF)
3963 
+	{
3964 
+	  /* Return failure if at end of input.  */
3965 
+	  if (yychar == YYEOF)
3966 
+	    YYABORT;
3967 
+	}
3968 
+      else
3969 
+	{
3970 
+	  yydestruct ("Error: discarding",
3971 
+		      yytoken, &yylval, yyscanner, compiler);
3972 
+	  yychar = YYEMPTY;
3973 
+	}
3974 
+    }
3975 
+
3976 
+  /* Else will try to reuse lookahead token after shifting the error
3977 
+     token.  */
3978 
+  goto yyerrlab1;
3979 
+
3980 
+
3981 
+/*---------------------------------------------------.
3982 
+| yyerrorlab -- error raised explicitly by YYERROR.  |
3983 
+`---------------------------------------------------*/
3984 
+yyerrorlab:
3985 
+
3986 
+  /* Pacify compilers like GCC when the user code never invokes
3987 
+     YYERROR and the label yyerrorlab therefore never appears in user
3988 
+     code.  */
3989 
+  if (/*CONSTCOND*/ 0)
3990 
+     goto yyerrorlab;
3991 
+
3992 
+  /* Do not reclaim the symbols of the rule which action triggered
3993 
+     this YYERROR.  */
3994 
+  YYPOPSTACK (yylen);
3995 
+  yylen = 0;
3996 
+  YY_STACK_PRINT (yyss, yyssp);
3997 
+  yystate = *yyssp;
3998 
+  goto yyerrlab1;
3999 
+
4000 
+
4001 
+/*-------------------------------------------------------------.
4002 
+| yyerrlab1 -- common code for both syntax error and YYERROR.  |
4003 
+`-------------------------------------------------------------*/
4004 
+yyerrlab1:
4005 
+  yyerrstatus = 3;	/* Each real token shifted decrements this.  */
4006 
+
4007 
+  for (;;)
4008 
+    {
4009 
+      yyn = yypact[yystate];
4010 
+      if (!yypact_value_is_default (yyn))
4011 
+	{
4012 
+	  yyn += YYTERROR;
4013 
+	  if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR)
4014 
+	    {
4015 
+	      yyn = yytable[yyn];
4016 
+	      if (0 < yyn)
4017 
+		break;
4018 
+	    }
4019 
+	}
4020 
+
4021 
+      /* Pop the current state because it cannot handle the error token.  */
4022 
+      if (yyssp == yyss)
4023 
+	YYABORT;
4024 
+
4025 
+
4026 
+      yydestruct ("Error: popping",
4027 
+		  yystos[yystate], yyvsp, yyscanner, compiler);
4028 
+      YYPOPSTACK (1);
4029 
+      yystate = *yyssp;
4030 
+      YY_STACK_PRINT (yyss, yyssp);
4031 
+    }
4032 
+
4033 
+  *++yyvsp = yylval;
4034 
+
4035 
+
4036 
+  /* Shift the error token.  */
4037 
+  YY_SYMBOL_PRINT ("Shifting", yystos[yyn], yyvsp, yylsp);
4038 
+
4039 
+  yystate = yyn;
4040 
+  goto yynewstate;
4041 
+
4042 
+
4043 
+/*-------------------------------------.
4044 
+| yyacceptlab -- YYACCEPT comes here.  |
4045 
+`-------------------------------------*/
4046 
+yyacceptlab:
4047 
+  yyresult = 0;
4048 
+  goto yyreturn;
4049 
+
4050 
+/*-----------------------------------.
4051 
+| yyabortlab -- YYABORT comes here.  |
4052 
+`-----------------------------------*/
4053 
+yyabortlab:
4054 
+  yyresult = 1;
4055 
+  goto yyreturn;
4056 
+
4057 
+#if !defined(yyoverflow) || YYERROR_VERBOSE
4058 
+/*-------------------------------------------------.
4059 
+| yyexhaustedlab -- memory exhaustion comes here.  |
4060 
+`-------------------------------------------------*/
4061 
+yyexhaustedlab:
4062 
+  yyerror (yyscanner, compiler, YY_("memory exhausted"));
4063 
+  yyresult = 2;
4064 
+  /* Fall through.  */
4065 
+#endif
4066 
+
4067 
+yyreturn:
4068 
+  if (yychar != YYEMPTY)
4069 
+    {
4070 
+      /* Make sure we have latest lookahead translation.  See comments at
4071 
+         user semantic actions for why this is necessary.  */
4072 
+      yytoken = YYTRANSLATE (yychar);
4073 
+      yydestruct ("Cleanup: discarding lookahead",
4074 
+                  yytoken, &yylval, yyscanner, compiler);
4075 
+    }
4076 
+  /* Do not reclaim the symbols of the rule which action triggered
4077 
+     this YYABORT or YYACCEPT.  */
4078 
+  YYPOPSTACK (yylen);
4079 
+  YY_STACK_PRINT (yyss, yyssp);
4080 
+  while (yyssp != yyss)
4081 
+    {
4082 
+      yydestruct ("Cleanup: popping",
4083 
+		  yystos[*yyssp], yyvsp, yyscanner, compiler);
4084 
+      YYPOPSTACK (1);
4085 
+    }
4086 
+#ifndef yyoverflow
4087 
+  if (yyss != yyssa)
4088 
+    YYSTACK_FREE (yyss);
4089 
+#endif
4090 
+#if YYERROR_VERBOSE
4091 
+  if (yymsg != yymsgbuf)
4092 
+    YYSTACK_FREE (yymsg);
4093 
+#endif
4094 
+  /* Make sure YYID is used.  */
4095 
+  return YYID (yyresult);
4096 
+}
4097 
+
4098 
+
4099 
+
4100 
+/* Line 2067 of yacc.c  */
4101 
+#line 1809 "yara_grammar.y"
4102 
+
4103 
+
libclamav/yara_grammar.h
History View file @ b897e2e
0 4104 
new file mode 100644
... ... 
@@ -0,0 +1,176 @@
0 
+/* A Bison parser, made by GNU Bison 2.5.  */
1 
+
2 
+/* Bison interface for Yacc-like parsers in C
3 
+
4 
+      Copyright (C) 1984, 1989-1990, 2000-2011 Free Software Foundation, Inc.
5 
+
6 
+   This program is free software: you can redistribute it and/or modify
7 
+   it under the terms of the GNU General Public License as published by
8 
+   the Free Software Foundation, either version 3 of the License, or
9 
+   (at your option) any later version.
10 
+
11 
+   This program is distributed in the hope that it will be useful,
12 
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
13 
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 
+   GNU General Public License for more details.
15 
+
16 
+   You should have received a copy of the GNU General Public License
17 
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
18 
+
19 
+/* As a special exception, you may create a larger work that contains
20 
+   part or all of the Bison parser skeleton and distribute that work
21 
+   under terms of your choice, so long as that work isn't itself a
22 
+   parser generator using the skeleton or a modified version thereof
23 
+   as a parser skeleton.  Alternatively, if you modify or redistribute
24 
+   the parser skeleton itself, you may (at your option) remove this
25 
+   special exception, which will cause the skeleton and the resulting
26 
+   Bison output files to be licensed under the GNU General Public
27 
+   License without this special exception.
28 
+
29 
+   This special exception was added by the Free Software Foundation in
30 
+   version 2.2 of Bison.  */
31 
+
32 
+
33 
+/* Tokens.  */
34 
+#ifndef YYTOKENTYPE
35 
+# define YYTOKENTYPE
36 
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
37 
+      know about them.  */
38 
+   enum yytokentype {
39 
+     _RULE_ = 258,
40 
+     _PRIVATE_ = 259,
41 
+     _GLOBAL_ = 260,
42 
+     _META_ = 261,
43 
+     _STRINGS_ = 262,
44 
+     _CONDITION_ = 263,
45 
+     _IDENTIFIER_ = 264,
46 
+     _STRING_IDENTIFIER_ = 265,
47 
+     _STRING_COUNT_ = 266,
48 
+     _STRING_OFFSET_ = 267,
49 
+     _STRING_IDENTIFIER_WITH_WILDCARD_ = 268,
50 
+     _NUMBER_ = 269,
51 
+     _TEXT_STRING_ = 270,
52 
+     _HEX_STRING_ = 271,
53 
+     _REGEXP_ = 272,
54 
+     _ASCII_ = 273,
55 
+     _WIDE_ = 274,
56 
+     _NOCASE_ = 275,
57 
+     _FULLWORD_ = 276,
58 
+     _AT_ = 277,
59 
+     _FILESIZE_ = 278,
60 
+     _ENTRYPOINT_ = 279,
61 
+     _ALL_ = 280,
62 
+     _ANY_ = 281,
63 
+     _IN_ = 282,
64 
+     _OF_ = 283,
65 
+     _FOR_ = 284,
66 
+     _THEM_ = 285,
67 
+     _INT8_ = 286,
68 
+     _INT16_ = 287,
69 
+     _INT32_ = 288,
70 
+     _UINT8_ = 289,
71 
+     _UINT16_ = 290,
72 
+     _UINT32_ = 291,
73 
+     _MATCHES_ = 292,
74 
+     _CONTAINS_ = 293,
75 
+     _IMPORT_ = 294,
76 
+     _TRUE_ = 295,
77 
+     _FALSE_ = 296,
78 
+     _OR_ = 297,
79 
+     _AND_ = 298,
80 
+     _IS_ = 299,
81 
+     _NEQ_ = 300,
82 
+     _EQ_ = 301,
83 
+     _GE_ = 302,
84 
+     _GT_ = 303,
85 
+     _LE_ = 304,
86 
+     _LT_ = 305,
87 
+     _SHIFT_RIGHT_ = 306,
88 
+     _SHIFT_LEFT_ = 307,
89 
+     _NOT_ = 308
90 
+   };
91 
+#endif
92 
+/* Tokens.  */
93 
+#define _RULE_ 258
94 
+#define _PRIVATE_ 259
95 
+#define _GLOBAL_ 260
96 
+#define _META_ 261
97 
+#define _STRINGS_ 262
98 
+#define _CONDITION_ 263
99 
+#define _IDENTIFIER_ 264
100 
+#define _STRING_IDENTIFIER_ 265
101 
+#define _STRING_COUNT_ 266
102 
+#define _STRING_OFFSET_ 267
103 
+#define _STRING_IDENTIFIER_WITH_WILDCARD_ 268
104 
+#define _NUMBER_ 269
105 
+#define _TEXT_STRING_ 270
106 
+#define _HEX_STRING_ 271
107 
+#define _REGEXP_ 272
108 
+#define _ASCII_ 273
109 
+#define _WIDE_ 274
110 
+#define _NOCASE_ 275
111 
+#define _FULLWORD_ 276
112 
+#define _AT_ 277
113 
+#define _FILESIZE_ 278
114 
+#define _ENTRYPOINT_ 279
115 
+#define _ALL_ 280
116 
+#define _ANY_ 281
117 
+#define _IN_ 282
118 
+#define _OF_ 283
119 
+#define _FOR_ 284
120 
+#define _THEM_ 285
121 
+#define _INT8_ 286
122 
+#define _INT16_ 287
123 
+#define _INT32_ 288
124 
+#define _UINT8_ 289
125 
+#define _UINT16_ 290
126 
+#define _UINT32_ 291
127 
+#define _MATCHES_ 292
128 
+#define _CONTAINS_ 293
129 
+#define _IMPORT_ 294
130 
+#define _TRUE_ 295
131 
+#define _FALSE_ 296
132 
+#define _OR_ 297
133 
+#define _AND_ 298
134 
+#define _IS_ 299
135 
+#define _NEQ_ 300
136 
+#define _EQ_ 301
137 
+#define _GE_ 302
138 
+#define _GT_ 303
139 
+#define _LE_ 304
140 
+#define _LT_ 305
141 
+#define _SHIFT_RIGHT_ 306
142 
+#define _SHIFT_LEFT_ 307
143 
+#define _NOT_ 308
144 
+
145 
+
146 
+
147 
+
148 
+#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
149 
+typedef union YYSTYPE
150 
+{
151 
+
152 
+/* Line 2068 of yacc.c  */
153 
+#line 213 "yara_grammar.y"
154 
+
155 
+  SIZED_STRING*   sized_string;
156 
+  char*           c_string;
157 
+  int8_t          expression_type;
158 
+  int64_t         integer;
159 
+  YR_STRING*      string;
160 
+  YR_META*        meta;
161 
+  YR_OBJECT*      object;
162 
+
163 
+
164 
+
165 
+/* Line 2068 of yacc.c  */
166 
+#line 168 "yara_grammar.h"
167 
+} YYSTYPE;
168 
+# define YYSTYPE_IS_TRIVIAL 1
169 
+# define yystype YYSTYPE /* obsolescent; will be withdrawn */
170 
+# define YYSTYPE_IS_DECLARED 1
171 
+#endif
172 
+
173 
+
174 
+
175 
+
libclamav/yara_lexer.c
History View file @ b897e2e
0 176 
new file mode 100644
... ... 
@@ -0,0 +1,3119 @@
0 
+#line 2 "yara_lexer.c"
1 
+
2 
+#line 4 "yara_lexer.c"
3 
+
4 
+#define  YY_INT_ALIGNED short int
5 
+
6 
+/* A lexical scanner generated by flex */
7 
+
8 
+#define FLEX_SCANNER
9 
+#define YY_FLEX_MAJOR_VERSION 2
10 
+#define YY_FLEX_MINOR_VERSION 5
11 
+#define YY_FLEX_SUBMINOR_VERSION 35
12 
+#if YY_FLEX_SUBMINOR_VERSION > 0
13 
+#define FLEX_BETA
14 
+#endif
15 
+
16 
+/* First, we deal with  platform-specific or compiler-specific issues. */
17 
+
18 
+/* begin standard C headers. */
19 
+#include <stdio.h>
20 
+#include <string.h>
21 
+#include <errno.h>
22 
+#include <stdlib.h>
23 
+
24 
+/* end standard C headers. */
25 
+
26 
+/* flex integer type definitions */
27 
+
28 
+#ifndef FLEXINT_H
29 
+#define FLEXINT_H
30 
+
31 
+/* C99 systems have <inttypes.h>. Non-C99 systems may or may not. */
32 
+
33 
+#if defined (__STDC_VERSION__) && __STDC_VERSION__ >= 199901L
34 
+
35 
+/* C99 says to define __STDC_LIMIT_MACROS before including stdint.h,
36 
+ * if you want the limit (max/min) macros for int types.
37 
+ */
38 
+#ifndef __STDC_LIMIT_MACROS
39 
+#define __STDC_LIMIT_MACROS 1
40 
+#endif
41 
+
42 
+#include <inttypes.h>
43 
+typedef int8_t flex_int8_t;
44 
+typedef uint8_t flex_uint8_t;
45 
+typedef int16_t flex_int16_t;
46 
+typedef uint16_t flex_uint16_t;
47 
+typedef int32_t flex_int32_t;
48 
+typedef uint32_t flex_uint32_t;
49 
+#else
50 
+typedef signed char flex_int8_t;
51 
+typedef short int flex_int16_t;
52 
+typedef int flex_int32_t;
53 
+typedef unsigned char flex_uint8_t;
54 
+typedef unsigned short int flex_uint16_t;
55 
+typedef unsigned int flex_uint32_t;
56 
+
57 
+/* Limits of integral types. */
58 
+#ifndef INT8_MIN
59 
+#define INT8_MIN               (-128)
60 
+#endif
61 
+#ifndef INT16_MIN
62 
+#define INT16_MIN              (-32767-1)
63 
+#endif
64 
+#ifndef INT32_MIN
65 
+#define INT32_MIN              (-2147483647-1)
66 
+#endif
67 
+#ifndef INT8_MAX
68 
+#define INT8_MAX               (127)
69 
+#endif
70 
+#ifndef INT16_MAX
71 
+#define INT16_MAX              (32767)
72 
+#endif
73 
+#ifndef INT32_MAX
74 
+#define INT32_MAX              (2147483647)
75 
+#endif
76 
+#ifndef UINT8_MAX
77 
+#define UINT8_MAX              (255U)
78 
+#endif
79 
+#ifndef UINT16_MAX
80 
+#define UINT16_MAX             (65535U)
81 
+#endif
82 
+#ifndef UINT32_MAX
83 
+#define UINT32_MAX             (4294967295U)
84 
+#endif
85 
+
86 
+#endif /* ! C99 */
87 
+
88 
+#endif /* ! FLEXINT_H */
89 
+
90 
+#ifdef __cplusplus
91 
+
92 
+/* The "const" storage-class-modifier is valid. */
93 
+#define YY_USE_CONST
94 
+
95 
+#else	/* ! __cplusplus */
96 
+
97 
+/* C99 requires __STDC__ to be defined as 1. */
98 
+#if defined (__STDC__)
99 
+
100 
+#define YY_USE_CONST
101 
+
102 
+#endif	/* defined (__STDC__) */
103 
+#endif	/* ! __cplusplus */
104 
+
105 
+#ifdef YY_USE_CONST
106 
+#define yyconst const
107 
+#else
108 
+#define yyconst
109 
+#endif
110 
+
111 
+/* Returned upon end-of-file. */
112 
+#define YY_NULL 0
113 
+
114 
+/* Promotes a possibly negative, possibly signed char to an unsigned
115 
+ * integer for use as an array index.  If the signed char is negative,
116 
+ * we want to instead treat it as an 8-bit unsigned char, hence the
117 
+ * double cast.
118 
+ */
119 
+#define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c)
120 
+
121 
+/* An opaque pointer. */
122 
+#ifndef YY_TYPEDEF_YY_SCANNER_T
123 
+#define YY_TYPEDEF_YY_SCANNER_T
124 
+typedef void* yyscan_t;
125 
+#endif
126 
+
127 
+/* For convenience, these vars (plus the bison vars far below)
128 
+   are macros in the reentrant scanner. */
129 
+#define yyin yyg->yyin_r
130 
+#define yyout yyg->yyout_r
131 
+#define yyextra yyg->yyextra_r
132 
+#define yyleng yyg->yyleng_r
133 
+#define yytext yyg->yytext_r
134 
+#define yylineno (YY_CURRENT_BUFFER_LVALUE->yy_bs_lineno)
135 
+#define yycolumn (YY_CURRENT_BUFFER_LVALUE->yy_bs_column)
136 
+#define yy_flex_debug yyg->yy_flex_debug_r
137 
+
138 
+/* Enter a start condition.  This macro really ought to take a parameter,
139 
+ * but we do it the disgusting crufty way forced on us by the ()-less
140 
+ * definition of BEGIN.
141 
+ */
142 
+#define BEGIN yyg->yy_start = 1 + 2 *
143 
+
144 
+/* Translate the current start state into a value that can be later handed
145 
+ * to BEGIN to return to the state.  The YYSTATE alias is for lex
146 
+ * compatibility.
147 
+ */
148 
+#define YY_START ((yyg->yy_start - 1) / 2)
149 
+#define YYSTATE YY_START
150 
+
151 
+/* Action number for EOF rule of a given start state. */
152 
+#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1)
153 
+
154 
+/* Special action meaning "start processing a new file". */
155 
+#define YY_NEW_FILE yara_yyrestart(yyin ,yyscanner )
156 
+
157 
+#define YY_END_OF_BUFFER_CHAR 0
158 
+
159 
+/* Size of default input buffer. */
160 
+#ifndef YY_BUF_SIZE
161 
+#ifdef __ia64__
162 
+/* On IA-64, the buffer size is 16k, not 8k.
163 
+ * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case.
164 
+ * Ditto for the __ia64__ case accordingly.
165 
+ */
166 
+#define YY_BUF_SIZE 32768
167 
+#else
168 
+#define YY_BUF_SIZE 16384
169 
+#endif /* __ia64__ */
170 
+#endif
171 
+
172 
+/* The state buf must be large enough to hold one state per character in the main buffer.
173 
+ */
174 
+#define YY_STATE_BUF_SIZE   ((YY_BUF_SIZE + 2) * sizeof(yy_state_type))
175 
+
176 
+#ifndef YY_TYPEDEF_YY_BUFFER_STATE
177 
+#define YY_TYPEDEF_YY_BUFFER_STATE
178 
+typedef struct yy_buffer_state *YY_BUFFER_STATE;
179 
+#endif
180 
+
181 
+#define EOB_ACT_CONTINUE_SCAN 0
182 
+#define EOB_ACT_END_OF_FILE 1
183 
+#define EOB_ACT_LAST_MATCH 2
184 
+
185 
+    /* Note: We specifically omit the test for yy_rule_can_match_eol because it requires
186 
+     *       access to the local variable yy_act. Since yyless() is a macro, it would break
187 
+     *       existing scanners that call yyless() from OUTSIDE yara_yylex.
188 
+     *       One obvious solution it to make yy_act a global. I tried that, and saw
189 
+     *       a 5% performance hit in a non-yylineno scanner, because yy_act is
190 
+     *       normally declared as a register variable-- so it is not worth it.
191 
+     */
192 
+    #define  YY_LESS_LINENO(n) \
193 
+            do { \
194 
+                int yyl;\
195 
+                for ( yyl = n; yyl < yyleng; ++yyl )\
196 
+                    if ( yytext[yyl] == '\n' )\
197 
+                        --yylineno;\
198 
+            }while(0)
199 
+
200 
+/* Return all but the first "n" matched characters back to the input stream. */
201 
+#define yyless(n) \
202 
+	do \
203 
+		{ \
204 
+		/* Undo effects of setting up yytext. */ \
205 
+        int yyless_macro_arg = (n); \
206 
+        YY_LESS_LINENO(yyless_macro_arg);\
207 
+		*yy_cp = yyg->yy_hold_char; \
208 
+		YY_RESTORE_YY_MORE_OFFSET \
209 
+		yyg->yy_c_buf_p = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \
210 
+		YY_DO_BEFORE_ACTION; /* set up yytext again */ \
211 
+		} \
212 
+	while ( 0 )
213 
+
214 
+#define unput(c) yyunput( c, yyg->yytext_ptr , yyscanner )
215 
+
216 
+#ifndef YY_TYPEDEF_YY_SIZE_T
217 
+#define YY_TYPEDEF_YY_SIZE_T
218 
+typedef size_t yy_size_t;
219 
+#endif
220 
+
221 
+#ifndef YY_STRUCT_YY_BUFFER_STATE
222 
+#define YY_STRUCT_YY_BUFFER_STATE
223 
+struct yy_buffer_state
224 
+	{
225 
+	FILE *yy_input_file;
226 
+
227 
+	char *yy_ch_buf;		/* input buffer */
228 
+	char *yy_buf_pos;		/* current position in input buffer */
229 
+
230 
+	/* Size of input buffer in bytes, not including room for EOB
231 
+	 * characters.
232 
+	 */
233 
+	yy_size_t yy_buf_size;
234 
+
235 
+	/* Number of characters read into yy_ch_buf, not including EOB
236 
+	 * characters.
237 
+	 */
238 
+	int yy_n_chars;
239 
+
240 
+	/* Whether we "own" the buffer - i.e., we know we created it,
241 
+	 * and can realloc() it to grow it, and should free() it to
242 
+	 * delete it.
243 
+	 */
244 
+	int yy_is_our_buffer;
245 
+
246 
+	/* Whether this is an "interactive" input source; if so, and
247 
+	 * if we're using stdio for input, then we want to use getc()
248 
+	 * instead of fread(), to make sure we stop fetching input after
249 
+	 * each newline.
250 
+	 */
251 
+	int yy_is_interactive;
252 
+
253 
+	/* Whether we're considered to be at the beginning of a line.
254 
+	 * If so, '^' rules will be active on the next match, otherwise
255 
+	 * not.
256 
+	 */
257 
+	int yy_at_bol;
258 
+
259 
+    int yy_bs_lineno; /**< The line count. */
260 
+    int yy_bs_column; /**< The column count. */
261 
+
262 
+	/* Whether to try to fill the input buffer when we reach the
263 
+	 * end of it.
264 
+	 */
265 
+	int yy_fill_buffer;
266 
+
267 
+	int yy_buffer_status;
268 
+
269 
+#define YY_BUFFER_NEW 0
270 
+#define YY_BUFFER_NORMAL 1
271 
+	/* When an EOF's been seen but there's still some text to process
272 
+	 * then we mark the buffer as YY_EOF_PENDING, to indicate that we
273 
+	 * shouldn't try reading from the input source any more.  We might
274 
+	 * still have a bunch of tokens to match, though, because of
275 
+	 * possible backing-up.
276 
+	 *
277 
+	 * When we actually see the EOF, we change the status to "new"
278 
+	 * (via yara_yyrestart()), so that the user can continue scanning by
279 
+	 * just pointing yyin at a new input file.
280 
+	 */
281 
+#define YY_BUFFER_EOF_PENDING 2
282 
+
283 
+	};
284 
+#endif /* !YY_STRUCT_YY_BUFFER_STATE */
285 
+
286 
+/* We provide macros for accessing buffer states in case in the
287 
+ * future we want to put the buffer states in a more general
288 
+ * "scanner state".
289 
+ *
290 
+ * Returns the top of the stack, or NULL.
291 
+ */
292 
+#define YY_CURRENT_BUFFER ( yyg->yy_buffer_stack \
293 
+                          ? yyg->yy_buffer_stack[yyg->yy_buffer_stack_top] \
294 
+                          : NULL)
295 
+
296 
+/* Same as previous macro, but useful when we know that the buffer stack is not
297 
+ * NULL or when we need an lvalue. For internal use only.
298 
+ */
299 
+#define YY_CURRENT_BUFFER_LVALUE yyg->yy_buffer_stack[yyg->yy_buffer_stack_top]
300 
+
301 
+void yara_yyrestart (FILE *input_file ,yyscan_t yyscanner );
302 
+void yara_yy_switch_to_buffer (YY_BUFFER_STATE new_buffer ,yyscan_t yyscanner );
303 
+YY_BUFFER_STATE yara_yy_create_buffer (FILE *file,int size ,yyscan_t yyscanner );
304 
+void yara_yy_delete_buffer (YY_BUFFER_STATE b ,yyscan_t yyscanner );
305 
+void yara_yy_flush_buffer (YY_BUFFER_STATE b ,yyscan_t yyscanner );
306 
+void yara_yypush_buffer_state (YY_BUFFER_STATE new_buffer ,yyscan_t yyscanner );
307 
+void yara_yypop_buffer_state (yyscan_t yyscanner );
308 
+
309 
+static void yara_yyensure_buffer_stack (yyscan_t yyscanner );
310 
+static void yara_yy_load_buffer_state (yyscan_t yyscanner );
311 
+static void yara_yy_init_buffer (YY_BUFFER_STATE b,FILE *file ,yyscan_t yyscanner );
312 
+
313 
+#define YY_FLUSH_BUFFER yara_yy_flush_buffer(YY_CURRENT_BUFFER ,yyscanner)
314 
+
315 
+YY_BUFFER_STATE yara_yy_scan_buffer (char *base,yy_size_t size ,yyscan_t yyscanner );
316 
+YY_BUFFER_STATE yara_yy_scan_string (yyconst char *yy_str ,yyscan_t yyscanner );
317 
+YY_BUFFER_STATE yara_yy_scan_bytes (yyconst char *bytes,int len ,yyscan_t yyscanner );
318 
+
319 
+void *yara_yyalloc (yy_size_t ,yyscan_t yyscanner );
320 
+void *yara_yyrealloc (void *,yy_size_t ,yyscan_t yyscanner );
321 
+void yara_yyfree (void * ,yyscan_t yyscanner );
322 
+
323 
+#define yy_new_buffer yara_yy_create_buffer
324 
+
325 
+#define yy_set_interactive(is_interactive) \
326 
+	{ \
327 
+	if ( ! YY_CURRENT_BUFFER ){ \
328 
+        yara_yyensure_buffer_stack (yyscanner); \
329 
+		YY_CURRENT_BUFFER_LVALUE =    \
330 
+            yara_yy_create_buffer(yyin,YY_BUF_SIZE ,yyscanner); \
331 
+	} \
332 
+	YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \
333 
+	}
334 
+
335 
+#define yy_set_bol(at_bol) \
336 
+	{ \
337 
+	if ( ! YY_CURRENT_BUFFER ){\
338 
+        yara_yyensure_buffer_stack (yyscanner); \
339 
+		YY_CURRENT_BUFFER_LVALUE =    \
340 
+            yara_yy_create_buffer(yyin,YY_BUF_SIZE ,yyscanner); \
341 
+	} \
342 
+	YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \
343 
+	}
344 
+
345 
+#define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol)
346 
+
347 
+/* Begin user sect3 */
348 
+
349 
+#define yara_yywrap(n) 1
350 
+#define YY_SKIP_YYWRAP
351 
+
352 
+typedef unsigned char YY_CHAR;
353 
+
354 
+typedef int yy_state_type;
355 
+
356 
+#define yytext_ptr yytext_r
357 
+
358 
+static yy_state_type yy_get_previous_state (yyscan_t yyscanner );
359 
+static yy_state_type yy_try_NUL_trans (yy_state_type current_state  ,yyscan_t yyscanner);
360 
+static int yy_get_next_buffer (yyscan_t yyscanner );
361 
+static void yy_fatal_error (yyconst char msg[] ,yyscan_t yyscanner );
362 
+
363 
+/* Done after the current pattern has been matched and before the
364 
+ * corresponding action - sets up yytext.
365 
+ */
366 
+#define YY_DO_BEFORE_ACTION \
367 
+	yyg->yytext_ptr = yy_bp; \
368 
+	yyleng = (size_t) (yy_cp - yy_bp); \
369 
+	yyg->yy_hold_char = *yy_cp; \
370 
+	*yy_cp = '\0'; \
371 
+	yyg->yy_c_buf_p = yy_cp;
372 
+
373 
+#define YY_NUM_RULES 75
374 
+#define YY_END_OF_BUFFER 76
375 
+/* This struct is not used in this scanner,
376 
+   but its presence is necessary. */
377 
+struct yy_trans_info
378 
+	{
379 
+	flex_int32_t yy_verify;
380 
+	flex_int32_t yy_nxt;
381 
+	};
382 
+static yyconst flex_int16_t yy_accept[219] =
383 
+    {   0,
384 
+        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
385 
+       76,   74,   73,   73,   74,   70,   51,   50,   71,   54,
386 
+       54,    1,   74,    2,   52,   53,   53,   53,   53,   53,
387 
+       53,   53,   53,   53,   53,   53,   53,   53,   53,   53,
388 
+       53,   74,   62,   63,   56,   75,   68,   69,   65,   75,
389 
+       47,   48,   44,   44,    6,   51,   49,   50,   42,   45,
390 
+       54,    0,    0,    0,    7,    3,    5,    4,    8,   52,
391 
+       53,   53,   53,   53,   24,   53,   53,   53,   53,   53,
392 
+       53,   53,   53,   25,   53,   53,   53,   26,   23,   53,
393 
+       53,   53,   53,   53,   53,   53,    0,   62,   64,   59,
394 
+
395 
+       60,   58,   57,   64,   68,   65,   65,   67,   66,   47,
396 
+       43,   45,   54,   55,   29,   22,   30,   53,   53,   53,
397 
+       53,   53,   28,   53,   53,   53,   53,   53,   53,   53,
398 
+       53,   21,   53,   53,   53,   53,   53,   53,   53,   72,
399 
+        0,   53,   53,   53,   53,   53,   53,   53,   53,   53,
400 
+       53,   53,   53,   36,   53,   12,   53,   53,   11,   53,
401 
+       27,   19,   53,   15,   61,   14,   53,   53,   53,   20,
402 
+       53,   53,   53,   53,   53,   37,   38,   53,   53,   53,
403 
+       53,   53,   53,   33,   53,   53,   53,   53,   53,   10,
404 
+       41,   53,   53,   17,   53,   53,   34,   35,   53,   53,
405 
+
406 
+       53,   53,   53,   53,   39,    9,   13,   53,   40,   53,
407 
+       32,   16,    0,   18,   53,   46,   31,    0
408 
+    } ;
409 
+
410 
+static yyconst flex_int32_t yy_ec[256] =
411 
+    {   0,
412 
+        1,    1,    1,    1,    1,    1,    1,    1,    2,    3,
413 
+        1,    1,    4,    1,    1,    1,    1,    1,    1,    1,
414 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
415 
+        1,    2,    5,    6,    7,    8,    1,    1,    1,    9,
416 
+        9,   10,    1,    1,    9,    1,   11,   12,   13,   14,
417 
+       15,   16,   16,   17,   16,   18,   16,    1,    1,   19,
418 
+       20,   21,    9,   22,   23,   24,   23,   23,   23,   23,
419 
+       25,   25,   25,   25,   26,   25,   27,   25,   25,   25,
420 
+       25,   25,   25,   25,   25,   25,   25,   25,   25,   25,
421 
+        9,   28,    9,    1,   29,    1,   30,   31,   32,   33,
422 
+
423 
+       34,   35,   36,   37,   38,   25,   25,   39,   40,   41,
424 
+       42,   43,   25,   44,   45,   46,   47,   48,   49,   50,
425 
+       51,   52,   53,    9,   54,    1,    1,    1,    1,    1,
426 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
427 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
428 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
429 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
430 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
431 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
432 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
433 
+
434 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
435 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
436 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
437 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
438 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
439 
+        1,    1,    1,    1,    1
440 
+    } ;
441 
+
442 
+static yyconst flex_int32_t yy_meta[55] =
443 
+    {   0,
444 
+        1,    2,    3,    1,    1,    4,    1,    1,    2,    5,
445 
+        6,    7,    7,    7,    7,    7,    7,    7,    1,    1,
446 
+        1,    1,    8,    8,    9,   10,   10,   11,    9,    8,
447 
+        8,    8,    8,    8,    8,    9,    9,    9,    9,    9,
448 
+        9,    9,    9,    9,    9,    9,    9,    9,    9,   10,
449 
+        9,    9,    1,    1
450 
+    } ;
451 
+
452 
+static yyconst flex_int16_t yy_base[238] =
453 
+    {   0,
454 
+        0,    0,   52,   53,   54,   57,  350,  349,  344,  343,
455 
+      352,  357,  357,  357,  331,  357,    0,  340,   51,   37,
456 
+       40,   50,  329,   51,    0,    0,   38,  306,  306,   56,
457 
+      307,   33,   58,  303,   56,  300,  296,  296,   52,  303,
458 
+      302,    0,    0,  357,  357,   69,    0,  357,   57,  328,
459 
+        0,  357,  357,  327,  357,    0,  357,  327,  357,    0,
460 
+        0,  312,  311,    0,  357,  357,  357,  357,  357,    0,
461 
+        0,  295,   60,  301,    0,  291,  285,  291,  290,  284,
462 
+      288,  284,  282,   67,  278,  277,   72,    0,    0,  284,
463 
+      282,  276,  285,  271,  276,  283,  261,    0,  357,  357,
464 
+
465 
+      357,  357,  357,    0,    0,  269,  357,  357,  357,    0,
466 
+      357,    0,  357,    0,    0,    0,    0,  275,   68,  268,
467 
+      266,  276,    0,  270,  277,  265,  267,   94,  273,  274,
468 
+      273,    0,  254,  267,  262,  259,  264,  251,  262,  357,
469 
+        0,  257,  256,  263,  241,  257,  245,  240,  258,  243,
470 
+      239,  268,  270,    0,  246,    0,  237,  251,    0,  239,
471 
+        0,    0,  107,    0,  357,    0,  233,  240,  234,    0,
472 
+      238,  233,  235,  227,  239,    0,    0,  237,  236,  223,
473 
+      218,  227,  218,    0,  187,  181,  160,  149,  152,    0,
474 
+        0,  161,  149,    0,  148,  136,    0,    0,  133,   79,
475 
+
476 
+       85,   82,   75,  104,    0,    0,    0,   64,    0,   37,
477 
+        0,    0,  115,    0,   30,  357,    0,  357,  125,  136,
478 
+      147,  158,  163,  169,  173,  177,  181,  190,  198,  208,
479 
+      219,  229,  240,  251,  256,  258,  260
480 
+    } ;
481 
+
482 
+static yyconst flex_int16_t yy_def[238] =
483 
+    {   0,
484 
+      218,    1,  219,  219,  220,  220,  221,  221,  222,  222,
485 
+      218,  218,  218,  218,  218,  218,  223,  224,  218,  225,
486 
+      225,  218,  218,  218,  226,  227,  227,  227,  227,  227,
487 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
488 
+      227,  228,  229,  218,  218,  230,  231,  218,  218,  232,
489 
+      233,  218,  218,  218,  218,  223,  218,  224,  218,  234,
490 
+       21,  218,  218,  235,  218,  218,  218,  218,  218,  226,
491 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
492 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
493 
+      227,  227,  227,  227,  227,  227,  228,  229,  218,  218,
494 
+
495 
+      218,  218,  218,  236,  231,  218,  218,  218,  218,  233,
496 
+      218,  234,  218,  235,  227,  227,  227,  227,  227,  227,
497 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
498 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  218,
499 
+      237,  227,  227,  227,  227,  227,  227,  227,  227,  227,
500 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
501 
+      227,  227,  227,  227,  218,  227,  227,  227,  227,  227,
502 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
503 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
504 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
505 
+
506 
+      227,  227,  227,  227,  227,  227,  227,  227,  227,  227,
507 
+      227,  227,  218,  227,  227,  218,  227,    0,  218,  218,
508 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
509 
+      218,  218,  218,  218,  218,  218,  218
510 
+    } ;
511 
+
512 
+static yyconst flex_int16_t yy_nxt[412] =
513 
+    {   0,
514 
+       12,   13,   14,   13,   15,   16,   17,   18,   12,   12,
515 
+       19,   20,   21,   21,   21,   21,   21,   21,   22,   23,
516 
+       24,   25,   26,   26,   26,   26,   26,   12,   26,   27,
517 
+       26,   28,   26,   29,   30,   31,   26,   32,   26,   33,
518 
+       34,   35,   36,   37,   38,   39,   40,   26,   41,   26,
519 
+       26,   26,   42,   12,   44,   44,   48,   45,   45,   48,
520 
+       59,   60,   62,   63,   49,   62,   63,   49,   65,   66,
521 
+       68,   69,   83,   84,  100,  217,   72,  215,   73,   46,
522 
+       46,   50,   74,   75,   50,   78,   64,   85,   93,  218,
523 
+       88,   86,  116,   79,  106,   94,  101,   80,  127,   89,
524 
+
525 
+      143,  107,   81,  131,  214,  213,  152,  212,  153,  102,
526 
+      117,  154,  128,  144,  103,  211,  213,  132,  104,  182,
527 
+      216,  183,  210,  209,  184,   43,   43,   43,   43,   43,
528 
+       43,   43,   43,   43,   43,   43,   47,   47,   47,   47,
529 
+       47,   47,   47,   47,   47,   47,   47,   51,   51,   51,
530 
+       51,   51,   51,   51,   51,   51,   51,   51,   53,   53,
531 
+       53,   53,   53,   53,   53,   53,   53,   53,   53,   56,
532 
+       56,   56,   56,   58,  208,   58,   58,   58,   58,   61,
533 
+      207,  206,   61,   70,   70,   70,   70,   71,   71,   71,
534 
+       71,   97,   97,  205,  204,  203,   97,   97,   98,   98,
535 
+
536 
+      202,  201,   98,   98,   98,   98,   98,   98,   99,   99,
537 
+       99,   99,   99,   99,   99,   99,   99,   99,   99,  105,
538 
+      105,  200,  105,  105,  199,  105,  105,  105,  105,  108,
539 
+      108,  198,  108,  108,  108,  108,  108,  108,  108,  108,
540 
+      110,  110,  110,  197,  110,  110,  110,  110,  110,  110,
541 
+      110,  112,  112,  196,  112,  112,  112,  112,  112,  112,
542 
+      112,  112,  114,  114,  141,  141,  165,  165,  195,  194,
543 
+      193,  192,  191,  190,  189,  188,  187,  186,  185,  181,
544 
+      180,  179,  178,  177,  176,  175,  174,  173,  172,  171,
545 
+      170,  169,  168,  167,  166,  164,  163,  162,  161,  160,
546 
+
547 
+      159,  158,  157,  156,  155,  151,  150,  149,  148,  147,
548 
+      146,  145,  142,  107,  140,  139,  138,  137,  136,  135,
549 
+      134,  133,  130,  129,  126,  125,  124,  123,  122,  121,
550 
+      120,  119,  118,  115,  113,  113,   57,  111,  109,   96,
551 
+       95,   92,   91,   90,   87,   82,   77,   76,   67,   57,
552 
+       55,  218,   54,   54,   52,   52,   11,  218,  218,  218,
553 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
554 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
555 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
556 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
557 
+
558 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
559 
+      218
560 
+    } ;
561 
+
562 
+static yyconst flex_int16_t yy_chk[412] =
563 
+    {   0,
564 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
565 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
566 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
567 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
568 
+        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
569 
+        1,    1,    1,    1,    3,    4,    5,    3,    4,    6,
570 
+       19,   19,   20,   20,    5,   21,   21,    6,   22,   22,
571 
+       24,   24,   32,   32,   46,  215,   27,  210,   27,    3,
572 
+        4,    5,   27,   27,    6,   30,   20,   33,   39,   21,
573 
+       35,   33,   73,   30,   49,   39,   46,   30,   84,   35,
574 
+
575 
+      119,   49,   30,   87,  208,  204,  128,  203,  128,   46,
576 
+       73,  128,   84,  119,   46,  202,  213,   87,   46,  163,
577 
+      213,  163,  201,  200,  163,  219,  219,  219,  219,  219,
578 
+      219,  219,  219,  219,  219,  219,  220,  220,  220,  220,
579 
+      220,  220,  220,  220,  220,  220,  220,  221,  221,  221,
580 
+      221,  221,  221,  221,  221,  221,  221,  221,  222,  222,
581 
+      222,  222,  222,  222,  222,  222,  222,  222,  222,  223,
582 
+      223,  223,  223,  224,  199,  224,  224,  224,  224,  225,
583 
+      196,  195,  225,  226,  226,  226,  226,  227,  227,  227,
584 
+      227,  228,  228,  193,  192,  189,  228,  228,  229,  229,
585 
+
586 
+      188,  187,  229,  229,  229,  229,  229,  229,  230,  230,
587 
+      230,  230,  230,  230,  230,  230,  230,  230,  230,  231,
588 
+      231,  186,  231,  231,  185,  231,  231,  231,  231,  232,
589 
+      232,  183,  232,  232,  232,  232,  232,  232,  232,  232,
590 
+      233,  233,  233,  182,  233,  233,  233,  233,  233,  233,
591 
+      233,  234,  234,  181,  234,  234,  234,  234,  234,  234,
592 
+      234,  234,  235,  235,  236,  236,  237,  237,  180,  179,
593 
+      178,  175,  174,  173,  172,  171,  169,  168,  167,  160,
594 
+      158,  157,  155,  153,  152,  151,  150,  149,  148,  147,
595 
+      146,  145,  144,  143,  142,  139,  138,  137,  136,  135,
596 
+
597 
+      134,  133,  131,  130,  129,  127,  126,  125,  124,  122,
598 
+      121,  120,  118,  106,   97,   96,   95,   94,   93,   92,
599 
+       91,   90,   86,   85,   83,   82,   81,   80,   79,   78,
600 
+       77,   76,   74,   72,   63,   62,   58,   54,   50,   41,
601 
+       40,   38,   37,   36,   34,   31,   29,   28,   23,   18,
602 
+       15,   11,   10,    9,    8,    7,  218,  218,  218,  218,
603 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
604 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
605 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
606 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
607 
+
608 
+      218,  218,  218,  218,  218,  218,  218,  218,  218,  218,
609 
+      218
610 
+    } ;
611 
+
612 
+/* Table of booleans, true if rule could match eol. */
613 
+static yyconst flex_int32_t yy_rule_can_match_eol[76] =
614 
+    {   0,
615 
+0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
616 
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
617 
+    0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
618 
+    0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0,     };
619 
+
620 
+/* The intent behind this definition is that it'll catch
621 
+ * any uses of REJECT which flex missed.
622 
+ */
623 
+#define REJECT reject_used_but_not_detected
624 
+#define yymore() yymore_used_but_not_detected
625 
+#define YY_MORE_ADJ 0
626 
+#define YY_RESTORE_YY_MORE_OFFSET
627 
+#line 1 "yara_lexer.l"
628 
+/*
629 
+ * YARA rule lexer for ClamAV
630 
+ *
631 
+ * Copyright (C) 2014 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
632 
+ *
633 
+ * Authors: Steven Morgan
634 
+ *
635 
+ * This program is free software; you can redistribute it and/or modify it under
636 
+ * the terms of the GNU General Public License version 2 as published by the
637 
+ * Free Software Foundation.
638 
+ *
639 
+ * This program is distributed in the hope that it will be useful, but WITHOUT
640 
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
641 
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
642 
+ * more details.
643 
+ *
644 
+ * You should have received a copy of the GNU General Public License along with
645 
+ * this program; if not, write to the Free Software Foundation, Inc., 51
646 
+ * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
647 
+ */
648 
+/* This file was originally derived from yara 3.1.0 libyara/lexer.l and is
649 
+   revised for running YARA rules in ClamAV. Following is the YARA copyright. */
650 
+/*
651 
+Copyright (c) 2007-2013. The YARA Authors. All Rights Reserved.
652 
+
653 
+Licensed under the Apache License, Version 2.0 (the "License");
654 
+you may not use this file except in compliance with the License.
655 
+You may obtain a copy of the License at
656 
+
657 
+   http://www.apache.org/licenses/LICENSE-2.0
658 
+
659 
+Unless required by applicable law or agreed to in writing, software
660 
+distributed under the License is distributed on an "AS IS" BASIS,
661 
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
662 
+See the License for the specific language governing permissions and
663 
+limitations under the License.
664 
+*/
665 
+/* Lexical analyzer for YARA */
666 
+#line 42 "yara_lexer.l"
667 
+
668 
+#include <math.h>
669 
+#include <stdio.h>
670 
+#include <stdint.h>
671 
+#include <string.h>
672 
+#include <setjmp.h>
673 
+
674 
+#ifdef REAL_YARA
675 
+#include <yara/lexer.h>
676 
+#include <yara/rules.h>
677 
+#include <yara/sizedstr.h>
678 
+#include <yara/error.h>
679 
+#include <yara/mem.h>
680 
+#include <yara/utils.h>
681 
+
682 
+#include "grammar.h"
683 
+#else
684 
+#include "others.h"
685 
+#include "yara_clam.h"
686 
+#include "yara_grammar.h"
687 
+#include "yara_lexer.h"
688 
+#endif
689 
+
690 
+#define LEX_CHECK_SPACE_OK(data, current_size, max_length) \
691 
+    if (strlen(data) + current_size >= max_length - 1) \
692 
+    { \
693 
+      yyerror(yyscanner, compiler, "out of space in lex_buf"); \
694 
+      yyterminate(); \
695 
+    }
696 
+
697 
+#define YYTEXT_TO_BUFFER \
698 
+    { \
699 
+      char *yptr = yytext; \
700 
+      LEX_CHECK_SPACE_OK(yptr, yyextra->lex_buf_len, LEX_BUF_SIZE); \
701 
+      while(*yptr) \
702 
+      { \
703 
+        *yyextra->lex_buf_ptr++ = *yptr++; \
704 
+        yyextra->lex_buf_len++; \
705 
+      } \
706 
+    }
707 
+
708 
+#ifdef _WIN32
709 
+#define snprintf _snprintf
710 
+#endif
711 
+
712 
+#define YY_NO_UNISTD_H 1
713 
+#define YY_NO_INPUT 1
714 
+
715 
+
716 
+
717 
+
718 
+#line 720 "yara_lexer.c"
719 
+
720 
+#define INITIAL 0
721 
+#define str 1
722 
+#define regexp 2
723 
+#define include 3
724 
+#define comment 4
725 
+
726 
+#ifndef YY_NO_UNISTD_H
727 
+/* Special case for "unistd.h", since it is non-ANSI. We include it way
728 
+ * down here because we want the user's section 1 to have been scanned first.
729 
+ * The user has a chance to override it with an option.
730 
+ */
731 
+#include <unistd.h>
732 
+#endif
733 
+
734 
+#ifndef YY_EXTRA_TYPE
735 
+#define YY_EXTRA_TYPE void *
736 
+#endif
737 
+
738 
+/* Holds the entire state of the reentrant scanner. */
739 
+struct yyguts_t
740 
+    {
741 
+
742 
+    /* User-defined. Not touched by flex. */
743 
+    YY_EXTRA_TYPE yyextra_r;
744 
+
745 
+    /* The rest are the same as the globals declared in the non-reentrant scanner. */
746 
+    FILE *yyin_r, *yyout_r;
747 
+    size_t yy_buffer_stack_top; /**< index of top of stack. */
748 
+    size_t yy_buffer_stack_max; /**< capacity of stack. */
749 
+    YY_BUFFER_STATE * yy_buffer_stack; /**< Stack as an array. */
750 
+    char yy_hold_char;
751 
+    int yy_n_chars;
752 
+    int yyleng_r;
753 
+    char *yy_c_buf_p;
754 
+    int yy_init;
755 
+    int yy_start;
756 
+    int yy_did_buffer_switch_on_eof;
757 
+    int yy_start_stack_ptr;
758 
+    int yy_start_stack_depth;
759 
+    int *yy_start_stack;
760 
+    yy_state_type yy_last_accepting_state;
761 
+    char* yy_last_accepting_cpos;
762 
+
763 
+    int yylineno_r;
764 
+    int yy_flex_debug_r;
765 
+
766 
+    char *yytext_r;
767 
+    int yy_more_flag;
768 
+    int yy_more_len;
769 
+
770 
+    YYSTYPE * yylval_r;
771 
+
772 
+    }; /* end struct yyguts_t */
773 
+
774 
+static int yy_init_globals (yyscan_t yyscanner );
775 
+
776 
+    /* This must go here because YYSTYPE and YYLTYPE are included
777 
+     * from bison output in section 1.*/
778 
+    #    define yylval yyg->yylval_r
779 
+
780 
+int yara_yylex_init (yyscan_t* scanner);
781 
+
782 
+int yara_yylex_init_extra (YY_EXTRA_TYPE user_defined,yyscan_t* scanner);
783 
+
784 
+/* Accessor methods to globals.
785 
+   These are made visible to non-reentrant scanners for convenience. */
786 
+
787 
+int yara_yylex_destroy (yyscan_t yyscanner );
788 
+
789 
+int yara_yyget_debug (yyscan_t yyscanner );
790 
+
791 
+void yara_yyset_debug (int debug_flag ,yyscan_t yyscanner );
792 
+
793 
+YY_EXTRA_TYPE yara_yyget_extra (yyscan_t yyscanner );
794 
+
795 
+void yara_yyset_extra (YY_EXTRA_TYPE user_defined ,yyscan_t yyscanner );
796 
+
797 
+FILE *yara_yyget_in (yyscan_t yyscanner );
798 
+
799 
+void yara_yyset_in  (FILE * in_str ,yyscan_t yyscanner );
800 
+
801 
+FILE *yara_yyget_out (yyscan_t yyscanner );
802 
+
803 
+void yara_yyset_out  (FILE * out_str ,yyscan_t yyscanner );
804 
+
805 
+int yara_yyget_leng (yyscan_t yyscanner );
806 
+
807 
+char *yara_yyget_text (yyscan_t yyscanner );
808 
+
809 
+int yara_yyget_lineno (yyscan_t yyscanner );
810 
+
811 
+void yara_yyset_lineno (int line_number ,yyscan_t yyscanner );
812 
+
813 
+YYSTYPE * yara_yyget_lval (yyscan_t yyscanner );
814 
+
815 
+void yara_yyset_lval (YYSTYPE * yylval_param ,yyscan_t yyscanner );
816 
+
817 
+/* Macros after this point can all be overridden by user definitions in
818 
+ * section 1.
819 
+ */
820 
+
821 
+#ifndef YY_SKIP_YYWRAP
822 
+#ifdef __cplusplus
823 
+extern "C" int yara_yywrap (yyscan_t yyscanner );
824 
+#else
825 
+extern int yara_yywrap (yyscan_t yyscanner );
826 
+#endif
827 
+#endif
828 
+
829 
+#ifndef yytext_ptr
830 
+static void yy_flex_strncpy (char *,yyconst char *,int ,yyscan_t yyscanner);
831 
+#endif
832 
+
833 
+#ifdef YY_NEED_STRLEN
834 
+static int yy_flex_strlen (yyconst char * ,yyscan_t yyscanner);
835 
+#endif
836 
+
837 
+#ifndef YY_NO_INPUT
838 
+
839 
+#ifdef __cplusplus
840 
+static int yyinput (yyscan_t yyscanner );
841 
+#else
842 
+static int input (yyscan_t yyscanner );
843 
+#endif
844 
+
845 
+#endif
846 
+
847 
+/* Amount of stuff to slurp up with each read. */
848 
+#ifndef YY_READ_BUF_SIZE
849 
+#ifdef __ia64__
850 
+/* On IA-64, the buffer size is 16k, not 8k */
851 
+#define YY_READ_BUF_SIZE 16384
852 
+#else
853 
+#define YY_READ_BUF_SIZE 8192
854 
+#endif /* __ia64__ */
855 
+#endif
856 
+
857 
+/* Copy whatever the last rule matched to the standard output. */
858 
+#ifndef ECHO
859 
+/* This used to be an fputs(), but since the string might contain NUL's,
860 
+ * we now use fwrite().
861 
+ */
862 
+#define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
863 
+#endif
864 
+
865 
+/* Gets input and stuffs it into "buf".  number of characters read, or YY_NULL,
866 
+ * is returned in "result".
867 
+ */
868 
+#ifndef YY_INPUT
869 
+#define YY_INPUT(buf,result,max_size) \
870 
+	if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \
871 
+		{ \
872 
+		int c = '*'; \
873 
+		size_t n; \
874 
+		for ( n = 0; n < max_size && \
875 
+			     (c = getc( yyin )) != EOF && c != '\n'; ++n ) \
876 
+			buf[n] = (char) c; \
877 
+		if ( c == '\n' ) \
878 
+			buf[n++] = (char) c; \
879 
+		if ( c == EOF && ferror( yyin ) ) \
880 
+			YY_FATAL_ERROR( "input in flex scanner failed" ); \
881 
+		result = n; \
882 
+		} \
883 
+	else \
884 
+		{ \
885 
+		errno=0; \
886 
+		while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \
887 
+			{ \
888 
+			if( errno != EINTR) \
889 
+				{ \
890 
+				YY_FATAL_ERROR( "input in flex scanner failed" ); \
891 
+				break; \
892 
+				} \
893 
+			errno=0; \
894 
+			clearerr(yyin); \
895 
+			} \
896 
+		}\
897 
+\
898 
+
899 
+#endif
900 
+
901 
+/* No semi-colon after return; correct usage is to write "yyterminate();" -
902 
+ * we don't want an extra ';' after the "return" because that will cause
903 
+ * some compilers to complain about unreachable statements.
904 
+ */
905 
+#ifndef yyterminate
906 
+#define yyterminate() return YY_NULL
907 
+#endif
908 
+
909 
+/* Number of entries by which start-condition stack grows. */
910 
+#ifndef YY_START_STACK_INCR
911 
+#define YY_START_STACK_INCR 25
912 
+#endif
913 
+
914 
+/* Report a fatal error. */
915 
+#ifndef YY_FATAL_ERROR
916 
+#define YY_FATAL_ERROR(msg) yy_fatal_error( msg , yyscanner)
917 
+#endif
918 
+
919 
+/* end tables serialization structures and prototypes */
920 
+
921 
+/* Default declaration of generated scanner - a define so the user can
922 
+ * easily add parameters.
923 
+ */
924 
+#ifndef YY_DECL
925 
+#define YY_DECL_IS_OURS 1
926 
+
927 
+extern int yara_yylex \
928 
+               (YYSTYPE * yylval_param ,yyscan_t yyscanner);
929 
+
930 
+#define YY_DECL int yara_yylex \
931 
+               (YYSTYPE * yylval_param , yyscan_t yyscanner)
932 
+#endif /* !YY_DECL */
933 
+
934 
+/* Code executed at the beginning of each rule, after yytext and yyleng
935 
+ * have been set up.
936 
+ */
937 
+#ifndef YY_USER_ACTION
938 
+#define YY_USER_ACTION
939 
+#endif
940 
+
941 
+/* Code executed at the end of each rule. */
942 
+#ifndef YY_BREAK
943 
+#define YY_BREAK break;
944 
+#endif
945 
+
946 
+#define YY_RULE_SETUP \
947 
+	YY_USER_ACTION
948 
+
949 
+/** The main scanner function which does all the work.
950 
+ */
951 
+YY_DECL
952 
+{
953 
+	register yy_state_type yy_current_state;
954 
+	register char *yy_cp, *yy_bp;
955 
+	register int yy_act;
956 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
957 
+
958 
+#line 110 "yara_lexer.l"
959 
+
960 
+
961 
+#line 963 "yara_lexer.c"
962 
+
963 
+    yylval = yylval_param;
964 
+
965 
+	if ( !yyg->yy_init )
966 
+		{
967 
+		yyg->yy_init = 1;
968 
+
969 
+#ifdef YY_USER_INIT
970 
+		YY_USER_INIT;
971 
+#endif
972 
+
973 
+		if ( ! yyg->yy_start )
974 
+			yyg->yy_start = 1;	/* first start state */
975 
+
976 
+		if ( ! yyin )
977 
+			yyin = stdin;
978 
+
979 
+		if ( ! yyout )
980 
+			yyout = stdout;
981 
+
982 
+		if ( ! YY_CURRENT_BUFFER ) {
983 
+			yara_yyensure_buffer_stack (yyscanner);
984 
+			YY_CURRENT_BUFFER_LVALUE =
985 
+				yara_yy_create_buffer(yyin,YY_BUF_SIZE ,yyscanner);
986 
+		}
987 
+
988 
+		yara_yy_load_buffer_state(yyscanner );
989 
+		}
990 
+
991 
+	while ( 1 )		/* loops until end-of-file is reached */
992 
+		{
993 
+		yy_cp = yyg->yy_c_buf_p;
994 
+
995 
+		/* Support of yytext. */
996 
+		*yy_cp = yyg->yy_hold_char;
997 
+
998 
+		/* yy_bp points to the position in yy_ch_buf of the start of
999 
+		 * the current run.
1000 
+		 */
1001 
+		yy_bp = yy_cp;
1002 
+
1003 
+		yy_current_state = yyg->yy_start;
1004 
+yy_match:
1005 
+		do
1006 
+			{
1007 
+			register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)];
1008 
+			if ( yy_accept[yy_current_state] )
1009 
+				{
1010 
+				yyg->yy_last_accepting_state = yy_current_state;
1011 
+				yyg->yy_last_accepting_cpos = yy_cp;
1012 
+				}
1013 
+			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
1014 
+				{
1015 
+				yy_current_state = (int) yy_def[yy_current_state];
1016 
+				if ( yy_current_state >= 219 )
1017 
+					yy_c = yy_meta[(unsigned int) yy_c];
1018 
+				}
1019 
+			yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
1020 
+			++yy_cp;
1021 
+			}
1022 
+		while ( yy_base[yy_current_state] != 357 );
1023 
+
1024 
+yy_find_action:
1025 
+		yy_act = yy_accept[yy_current_state];
1026 
+		if ( yy_act == 0 )
1027 
+			{ /* have to back up */
1028 
+			yy_cp = yyg->yy_last_accepting_cpos;
1029 
+			yy_current_state = yyg->yy_last_accepting_state;
1030 
+			yy_act = yy_accept[yy_current_state];
1031 
+			}
1032 
+
1033 
+		YY_DO_BEFORE_ACTION;
1034 
+
1035 
+		if ( yy_act != YY_END_OF_BUFFER && yy_rule_can_match_eol[yy_act] )
1036 
+			{
1037 
+			int yyl;
1038 
+			for ( yyl = 0; yyl < yyleng; ++yyl )
1039 
+				if ( yytext[yyl] == '\n' )
1040 
+
1041 
+    do{ yylineno++;
1042 
+        yycolumn=0;
1043 
+    }while(0)
1044 
+;
1045 
+			}
1046 
+
1047 
+do_action:	/* This label is used only to access EOF actions. */
1048 
+
1049 
+		switch ( yy_act )
1050 
+	{ /* beginning of action switch */
1051 
+			case 0: /* must back up */
1052 
+			/* undo the effects of YY_DO_BEFORE_ACTION */
1053 
+			*yy_cp = yyg->yy_hold_char;
1054 
+			yy_cp = yyg->yy_last_accepting_cpos;
1055 
+			yy_current_state = yyg->yy_last_accepting_state;
1056 
+			goto yy_find_action;
1057 
+
1058 
+case 1:
1059 
+YY_RULE_SETUP
1060 
+#line 112 "yara_lexer.l"
1061 
+{ return _LT_;          }
1062 
+	YY_BREAK
1063 
+case 2:
1064 
+YY_RULE_SETUP
1065 
+#line 113 "yara_lexer.l"
1066 
+{ return _GT_;          }
1067 
+	YY_BREAK
1068 
+case 3:
1069 
+YY_RULE_SETUP
1070 
+#line 114 "yara_lexer.l"
1071 
+{ return _LE_;          }
1072 
+	YY_BREAK
1073 
+case 4:
1074 
+YY_RULE_SETUP
1075 
+#line 115 "yara_lexer.l"
1076 
+{ return _GE_;          }
1077 
+	YY_BREAK
1078 
+case 5:
1079 
+YY_RULE_SETUP
1080 
+#line 116 "yara_lexer.l"
1081 
+{ return _EQ_;          }
1082 
+	YY_BREAK
1083 
+case 6:
1084 
+YY_RULE_SETUP
1085 
+#line 117 "yara_lexer.l"
1086 
+{ return _NEQ_;         }
1087 
+	YY_BREAK
1088 
+case 7:
1089 
+YY_RULE_SETUP
1090 
+#line 118 "yara_lexer.l"
1091 
+{ return _SHIFT_LEFT_;  }
1092 
+	YY_BREAK
1093 
+case 8:
1094 
+YY_RULE_SETUP
1095 
+#line 119 "yara_lexer.l"
1096 
+{ return _SHIFT_RIGHT_; }
1097 
+	YY_BREAK
1098 
+case 9:
1099 
+YY_RULE_SETUP
1100 
+#line 120 "yara_lexer.l"
1101 
+{ return _PRIVATE_;     }
1102 
+	YY_BREAK
1103 
+case 10:
1104 
+YY_RULE_SETUP
1105 
+#line 121 "yara_lexer.l"
1106 
+{ return _GLOBAL_;      }
1107 
+	YY_BREAK
1108 
+case 11:
1109 
+YY_RULE_SETUP
1110 
+#line 122 "yara_lexer.l"
1111 
+{ return _RULE_;        }
1112 
+	YY_BREAK
1113 
+case 12:
1114 
+YY_RULE_SETUP
1115 
+#line 123 "yara_lexer.l"
1116 
+{ return _META_;        }
1117 
+	YY_BREAK
1118 
+case 13:
1119 
+YY_RULE_SETUP
1120 
+#line 124 "yara_lexer.l"
1121 
+{ return _STRINGS_;     }
1122 
+	YY_BREAK
1123 
+case 14:
1124 
+YY_RULE_SETUP
1125 
+#line 125 "yara_lexer.l"
1126 
+{ return _ASCII_;       }
1127 
+	YY_BREAK
1128 
+case 15:
1129 
+YY_RULE_SETUP
1130 
+#line 126 "yara_lexer.l"
1131 
+{ return _WIDE_;        }
1132 
+	YY_BREAK
1133 
+case 16:
1134 
+YY_RULE_SETUP
1135 
+#line 127 "yara_lexer.l"
1136 
+{ return _FULLWORD_;    }
1137 
+	YY_BREAK
1138 
+case 17:
1139 
+YY_RULE_SETUP
1140 
+#line 128 "yara_lexer.l"
1141 
+{ return _NOCASE_;      }
1142 
+	YY_BREAK
1143 
+case 18:
1144 
+YY_RULE_SETUP
1145 
+#line 129 "yara_lexer.l"
1146 
+{ return _CONDITION_;   }
1147 
+	YY_BREAK
1148 
+case 19:
1149 
+YY_RULE_SETUP
1150 
+#line 130 "yara_lexer.l"
1151 
+{ return _TRUE_;        }
1152 
+	YY_BREAK
1153 
+case 20:
1154 
+YY_RULE_SETUP
1155 
+#line 131 "yara_lexer.l"
1156 
+{ return _FALSE_;       }
1157 
+	YY_BREAK
1158 
+case 21:
1159 
+YY_RULE_SETUP
1160 
+#line 132 "yara_lexer.l"
1161 
+{ return _NOT_;         }
1162 
+	YY_BREAK
1163 
+case 22:
1164 
+YY_RULE_SETUP
1165 
+#line 133 "yara_lexer.l"
1166 
+{ return _AND_;         }
1167 
+	YY_BREAK
1168 
+case 23:
1169 
+YY_RULE_SETUP
1170 
+#line 134 "yara_lexer.l"
1171 
+{ return _OR_;          }
1172 
+	YY_BREAK
1173 
+case 24:
1174 
+YY_RULE_SETUP
1175 
+#line 135 "yara_lexer.l"
1176 
+{ return _AT_;          }
1177 
+	YY_BREAK
1178 
+case 25:
1179 
+YY_RULE_SETUP
1180 
+#line 136 "yara_lexer.l"
1181 
+{ return _IN_;          }
1182 
+	YY_BREAK
1183 
+case 26:
1184 
+YY_RULE_SETUP
1185 
+#line 137 "yara_lexer.l"
1186 
+{ return _OF_;          }
1187 
+	YY_BREAK
1188 
+case 27:
1189 
+YY_RULE_SETUP
1190 
+#line 138 "yara_lexer.l"
1191 
+{ return _THEM_;        }
1192 
+	YY_BREAK
1193 
+case 28:
1194 
+YY_RULE_SETUP
1195 
+#line 139 "yara_lexer.l"
1196 
+{ return _FOR_;         }
1197 
+	YY_BREAK
1198 
+case 29:
1199 
+YY_RULE_SETUP
1200 
+#line 140 "yara_lexer.l"
1201 
+{ return _ALL_;         }
1202 
+	YY_BREAK
1203 
+case 30:
1204 
+YY_RULE_SETUP
1205 
+#line 141 "yara_lexer.l"
1206 
+{ return _ANY_;         }
1207 
+	YY_BREAK
1208 
+case 31:
1209 
+YY_RULE_SETUP
1210 
+#line 142 "yara_lexer.l"
1211 
+{ return _ENTRYPOINT_;  }
1212 
+	YY_BREAK
1213 
+case 32:
1214 
+YY_RULE_SETUP
1215 
+#line 143 "yara_lexer.l"
1216 
+{ return _FILESIZE_;    }
1217 
+	YY_BREAK
1218 
+case 33:
1219 
+YY_RULE_SETUP
1220 
+#line 144 "yara_lexer.l"
1221 
+{ return _UINT8_;       }
1222 
+	YY_BREAK
1223 
+case 34:
1224 
+YY_RULE_SETUP
1225 
+#line 145 "yara_lexer.l"
1226 
+{ return _UINT16_;      }
1227 
+	YY_BREAK
1228 
+case 35:
1229 
+YY_RULE_SETUP
1230 
+#line 146 "yara_lexer.l"
1231 
+{ return _UINT32_;      }
1232 
+	YY_BREAK
1233 
+case 36:
1234 
+YY_RULE_SETUP
1235 
+#line 147 "yara_lexer.l"
1236 
+{ return _INT8_;        }
1237 
+	YY_BREAK
1238 
+case 37:
1239 
+YY_RULE_SETUP
1240 
+#line 148 "yara_lexer.l"
1241 
+{ return _INT16_;       }
1242 
+	YY_BREAK
1243 
+case 38:
1244 
+YY_RULE_SETUP
1245 
+#line 149 "yara_lexer.l"
1246 
+{ return _INT32_;       }
1247 
+	YY_BREAK
1248 
+case 39:
1249 
+YY_RULE_SETUP
1250 
+#line 150 "yara_lexer.l"
1251 
+{ return _MATCHES_;     }
1252 
+	YY_BREAK
1253 
+case 40:
1254 
+YY_RULE_SETUP
1255 
+#line 151 "yara_lexer.l"
1256 
+{ return _CONTAINS_;    }
1257 
+	YY_BREAK
1258 
+case 41:
1259 
+YY_RULE_SETUP
1260 
+#line 152 "yara_lexer.l"
1261 
+{ return _IMPORT_;      }
1262 
+	YY_BREAK
1263 
+case 42:
1264 
+YY_RULE_SETUP
1265 
+#line 155 "yara_lexer.l"
1266 
+{ BEGIN(comment);       }
1267 
+	YY_BREAK
1268 
+case 43:
1269 
+YY_RULE_SETUP
1270 
+#line 156 "yara_lexer.l"
1271 
+{ BEGIN(INITIAL);       }
1272 
+	YY_BREAK
1273 
+case 44:
1274 
+/* rule 44 can match eol */
1275 
+YY_RULE_SETUP
1276 
+#line 157 "yara_lexer.l"
1277 
+{ /* skip comments */   }
1278 
+	YY_BREAK
1279 
+case 45:
1280 
+YY_RULE_SETUP
1281 
+#line 160 "yara_lexer.l"
1282 
+{ /* skip single-line comments */ }
1283 
+	YY_BREAK
1284 
+case 46:
1285 
+YY_RULE_SETUP
1286 
+#line 163 "yara_lexer.l"
1287 
+{
1288 
+                          yyextra->lex_buf_ptr = yyextra->lex_buf;
1289 
+                          yyextra->lex_buf_len = 0;
1290 
+                          BEGIN(include);
1291 
+                        }
1292 
+	YY_BREAK
1293 
+case 47:
1294 
+/* rule 47 can match eol */
1295 
+YY_RULE_SETUP
1296 
+#line 170 "yara_lexer.l"
1297 
+{ YYTEXT_TO_BUFFER; }
1298 
+	YY_BREAK
1299 
+case 48:
1300 
+YY_RULE_SETUP
1301 
+#line 173 "yara_lexer.l"
1302 
+{
1303 
+#ifdef REAL_YARA
1304 
+
1305 
+  char            buffer[1024];
1306 
+  char            *current_file_name;
1307 
+  char            *s = NULL;
1308 
+  char            *b = NULL;
1309 
+  char            *f;
1310 
+  FILE*           fh;
1311 
+
1312 
+  if (compiler->allow_includes)
1313 
+  {
1314 
+    *yyextra->lex_buf_ptr = '\0'; // null-terminate included file path
1315 
+
1316 
+    // move path of current source file into buffer
1317 
+    current_file_name = yr_compiler_get_current_file_name(compiler);
1318 
+
1319 
+    if (current_file_name != NULL)
1320 
+    {
1321 
+      strlcpy(buffer, current_file_name, sizeof(buffer));
1322 
+    }
1323 
+    else
1324 
+    {
1325 
+      buffer[0] = '\0';
1326 
+    }
1327 
+
1328 
+    // make included file path relative to current source file
1329 
+    s = strrchr(buffer, '/');
1330 
+
1331 
+    #ifdef _WIN32
1332 
+    b = strrchr(buffer, '\\'); // in Windows both path delimiters are accepted
1333 
+    #endif
1334 
+
1335 
+    if (s != NULL || b != NULL)
1336 
+    {
1337 
+      f = (b > s)? (b + 1): (s + 1);
1338 
+
1339 
+      strlcpy(f, yyextra->lex_buf, sizeof(buffer) - (f - buffer));
1340 
+
1341 
+      f = buffer;
1342 
+
1343 
+      // SECURITY: Potential for directory traversal here.
1344 
+      fh = fopen(buffer, "r");
1345 
+
1346 
+      // if include file was not found relative to current source file,
1347 
+      // try to open it with path as specified by user (maybe user wrote
1348 
+      // a full path)
1349 
+
1350 
+      if (fh == NULL)
1351 
+      {
1352 
+        f = yyextra->lex_buf;
1353 
+
1354 
+        // SECURITY: Potential for directory traversal here.
1355 
+        fh = fopen(yyextra->lex_buf, "r");
1356 
+      }
1357 
+    }
1358 
+    else
1359 
+    {
1360 
+      f = yyextra->lex_buf;
1361 
+
1362 
+      // SECURITY: Potential for directory traversal here.
1363 
+      fh = fopen(yyextra->lex_buf, "r");
1364 
+    }
1365 
+
1366 
+    if (fh != NULL)
1367 
+    {
1368 
+      int error_code = _yr_compiler_push_file_name(compiler, f);
1369 
+
1370 
+      if (error_code != ERROR_SUCCESS)
1371 
+      {
1372 
+        if (error_code == ERROR_INCLUDES_CIRCULAR_REFERENCE)
1373 
+        {
1374 
+          yyerror(yyscanner, compiler, "includes circular reference");
1375 
+        }
1376 
+        else if (error_code == ERROR_INCLUDE_DEPTH_EXCEEDED)
1377 
+        {
1378 
+          yyerror(yyscanner, compiler, "includes depth exceeded");
1379 
+        }
1380 
+
1381 
+        yyterminate();
1382 
+      }
1383 
+
1384 
+      _yr_compiler_push_file(compiler, fh);
1385 
+      yara_yypush_buffer_state(yara_yy_create_buffer(fh,YY_BUF_SIZE,yyscanner),yyscanner);
1386 
+    }
1387 
+    else
1388 
+    {
1389 
+      snprintf(buffer, sizeof(buffer),
1390 
+               "can't open include file: %s", yyextra->lex_buf);
1391 
+      yyerror(yyscanner, compiler, buffer);
1392 
+    }
1393 
+  }
1394 
+  else // not allowing includes
1395 
+  {
1396 
+    yyerror(yyscanner, compiler, "includes are disabled");
1397 
+    yyterminate();
1398 
+  }
1399 
+
1400 
+  BEGIN(INITIAL);
1401 
+#else
1402 
+  yyerror(yyscanner, compiler, "includes are disabled");
1403 
+  yyterminate();
1404 
+#endif
1405 
+}
1406 
+	YY_BREAK
1407 
+case YY_STATE_EOF(INITIAL):
1408 
+case YY_STATE_EOF(str):
1409 
+case YY_STATE_EOF(regexp):
1410 
+case YY_STATE_EOF(include):
1411 
+case YY_STATE_EOF(comment):
1412 
+#line 280 "yara_lexer.l"
1413 
+{
1414 
+#ifdef REAL_YARA
1415 
+
1416 
+  YR_COMPILER* compiler = yara_yyget_extra(yyscanner);
1417 
+  FILE* file = _yr_compiler_pop_file(compiler);
1418 
+
1419 
+  if (file != NULL)
1420 
+  {
1421 
+    fclose(file);
1422 
+  }
1423 
+
1424 
+  _yr_compiler_pop_file_name(compiler);
1425 
+  yara_yypop_buffer_state(yyscanner);
1426 
+
1427 
+  if (!YY_CURRENT_BUFFER)
1428 
+  {
1429 
+    yyterminate();
1430 
+  }
1431 
+#endif
1432 
+  yara_yypop_buffer_state(yyscanner);
1433 
+
1434 
+  if (!YY_CURRENT_BUFFER)
1435 
+  {
1436 
+    yyterminate();
1437 
+  }
1438 
+}
1439 
+	YY_BREAK
1440 
+case 49:
1441 
+YY_RULE_SETUP
1442 
+#line 308 "yara_lexer.l"
1443 
+{
1444 
+
1445 
+  yylval->c_string = yr_strdup(yytext);
1446 
+
1447 
+  if (yylval->c_string == NULL)
1448 
+  {
1449 
+    yyerror(yyscanner, compiler, "not enough memory");
1450 
+    yyterminate();
1451 
+  }
1452 
+
1453 
+  return _STRING_IDENTIFIER_WITH_WILDCARD_;
1454 
+}
1455 
+	YY_BREAK
1456 
+case 50:
1457 
+YY_RULE_SETUP
1458 
+#line 322 "yara_lexer.l"
1459 
+{
1460 
+
1461 
+  yylval->c_string = yr_strdup(yytext);
1462 
+
1463 
+  if (yylval->c_string == NULL)
1464 
+  {
1465 
+    yyerror(yyscanner, compiler, "not enough memory");
1466 
+    yyterminate();
1467 
+  }
1468 
+
1469 
+  return _STRING_IDENTIFIER_;
1470 
+}
1471 
+	YY_BREAK
1472 
+case 51:
1473 
+YY_RULE_SETUP
1474 
+#line 336 "yara_lexer.l"
1475 
+{
1476 
+
1477 
+  yylval->c_string = yr_strdup(yytext);
1478 
+
1479 
+  if (yylval->c_string == NULL)
1480 
+  {
1481 
+    yyerror(yyscanner, compiler, "not enough memory");
1482 
+    yyterminate();
1483 
+  }
1484 
+
1485 
+  yylval->c_string[0] = '$'; /* replace # by $*/
1486 
+  return _STRING_COUNT_;
1487 
+}
1488 
+	YY_BREAK
1489 
+case 52:
1490 
+YY_RULE_SETUP
1491 
+#line 351 "yara_lexer.l"
1492 
+{
1493 
+
1494 
+  yylval->c_string = yr_strdup(yytext);
1495 
+
1496 
+  if (yylval->c_string == NULL)
1497 
+  {
1498 
+    yyerror(yyscanner, compiler, "not enough memory");
1499 
+    yyterminate();
1500 
+  }
1501 
+
1502 
+  yylval->c_string[0] = '$'; /* replace @ by $*/
1503 
+  return _STRING_OFFSET_;
1504 
+}
1505 
+	YY_BREAK
1506 
+case 53:
1507 
+YY_RULE_SETUP
1508 
+#line 366 "yara_lexer.l"
1509 
+{
1510 
+
1511 
+  if (strlen(yytext) > 128)
1512 
+  {
1513 
+    yyerror(yyscanner, compiler, "indentifier too long");
1514 
+  }
1515 
+
1516 
+  yylval->c_string = yr_strdup(yytext);
1517 
+
1518 
+  if (yylval->c_string == NULL)
1519 
+  {
1520 
+    yyerror(yyscanner, compiler, "not enough memory");
1521 
+    yyterminate();
1522 
+  }
1523 
+  return _IDENTIFIER_;
1524 
+}
1525 
+	YY_BREAK
1526 
+case 54:
1527 
+YY_RULE_SETUP
1528 
+#line 384 "yara_lexer.l"
1529 
+{
1530 
+
1531 
+  yylval->integer = (size_t) atol(yytext);
1532 
+
1533 
+  if (strstr(yytext, "KB") != NULL)
1534 
+  {
1535 
+     yylval->integer *= 1024;
1536 
+  }
1537 
+  else if (strstr(yytext, "MB") != NULL)
1538 
+  {
1539 
+     yylval->integer *= 1048576;
1540 
+  }
1541 
+  return _NUMBER_;
1542 
+}
1543 
+	YY_BREAK
1544 
+case 55:
1545 
+YY_RULE_SETUP
1546 
+#line 400 "yara_lexer.l"
1547 
+{
1548 
+
1549 
+  yylval->integer = xtoi(yytext + 2);
1550 
+  return _NUMBER_;
1551 
+}
1552 
+	YY_BREAK
1553 
+case 56:
1554 
+YY_RULE_SETUP
1555 
+#line 407 "yara_lexer.l"
1556 
+{     /* saw closing quote - all done */
1557 
+
1558 
+  SIZED_STRING* s;
1559 
+
1560 
+  if (yyextra->lex_buf_len == 0)
1561 
+  {
1562 
+    yyerror(yyscanner, compiler, "empty string");
1563 
+  }
1564 
+
1565 
+  *yyextra->lex_buf_ptr = '\0';
1566 
+
1567 
+  BEGIN(INITIAL);
1568 
+
1569 
+  s = (SIZED_STRING*) yr_malloc(yyextra->lex_buf_len + sizeof(SIZED_STRING));
1570 
+  s->length = yyextra->lex_buf_len;
1571 
+  s->flags = 0;
1572 
+
1573 
+  memcpy(s->c_string, yyextra->lex_buf, yyextra->lex_buf_len + 1);
1574 
+  yylval->sized_string = s;
1575 
+
1576 
+  return _TEXT_STRING_;
1577 
+}
1578 
+	YY_BREAK
1579 
+case 57:
1580 
+YY_RULE_SETUP
1581 
+#line 431 "yara_lexer.l"
1582 
+{
1583 
+
1584 
+  LEX_CHECK_SPACE_OK("\t", yyextra->lex_buf_len, LEX_BUF_SIZE);
1585 
+  *yyextra->lex_buf_ptr++ = '\t';
1586 
+  yyextra->lex_buf_len++;
1587 
+}
1588 
+	YY_BREAK
1589 
+case 58:
1590 
+YY_RULE_SETUP
1591 
+#line 439 "yara_lexer.l"
1592 
+{
1593 
+
1594 
+  LEX_CHECK_SPACE_OK("\n", yyextra->lex_buf_len, LEX_BUF_SIZE);
1595 
+  *yyextra->lex_buf_ptr++ = '\n';
1596 
+  yyextra->lex_buf_len++;
1597 
+}
1598 
+	YY_BREAK
1599 
+case 59:
1600 
+YY_RULE_SETUP
1601 
+#line 447 "yara_lexer.l"
1602 
+{
1603 
+
1604 
+  LEX_CHECK_SPACE_OK("\"", yyextra->lex_buf_len, LEX_BUF_SIZE);
1605 
+  *yyextra->lex_buf_ptr++ = '\"';
1606 
+  yyextra->lex_buf_len++;
1607 
+}
1608 
+	YY_BREAK
1609 
+case 60:
1610 
+YY_RULE_SETUP
1611 
+#line 455 "yara_lexer.l"
1612 
+{
1613 
+
1614 
+  LEX_CHECK_SPACE_OK("\\", yyextra->lex_buf_len, LEX_BUF_SIZE);
1615 
+  *yyextra->lex_buf_ptr++ = '\\';
1616 
+  yyextra->lex_buf_len++;
1617 
+}
1618 
+	YY_BREAK
1619 
+case 61:
1620 
+YY_RULE_SETUP
1621 
+#line 463 "yara_lexer.l"
1622 
+{
1623 
+
1624 
+   int result;
1625 
+
1626 
+   sscanf( yytext + 2, "%x", &result );
1627 
+   LEX_CHECK_SPACE_OK("X", yyextra->lex_buf_len, LEX_BUF_SIZE);
1628 
+   *yyextra->lex_buf_ptr++ = result;
1629 
+   yyextra->lex_buf_len++;
1630 
+}
1631 
+	YY_BREAK
1632 
+case 62:
1633 
+YY_RULE_SETUP
1634 
+#line 474 "yara_lexer.l"
1635 
+{ YYTEXT_TO_BUFFER; }
1636 
+	YY_BREAK
1637 
+case 63:
1638 
+/* rule 63 can match eol */
1639 
+YY_RULE_SETUP
1640 
+#line 477 "yara_lexer.l"
1641 
+{
1642 
+
1643 
+  yyerror(yyscanner, compiler, "unterminated string");
1644 
+  yyterminate();
1645 
+}
1646 
+	YY_BREAK
1647 
+case 64:
1648 
+/* rule 64 can match eol */
1649 
+YY_RULE_SETUP
1650 
+#line 483 "yara_lexer.l"
1651 
+{
1652 
+
1653 
+  yyerror(yyscanner, compiler, "illegal escape sequence");
1654 
+}
1655 
+	YY_BREAK
1656 
+case 65:
1657 
+YY_RULE_SETUP
1658 
+#line 489 "yara_lexer.l"
1659 
+{
1660 
+
1661 
+  SIZED_STRING* s;
1662 
+
1663 
+  if (yyextra->lex_buf_len == 0)
1664 
+  {
1665 
+    yyerror(yyscanner, compiler, "empty regular expression");
1666 
+  }
1667 
+
1668 
+  *yyextra->lex_buf_ptr = '\0';
1669 
+
1670 
+  BEGIN(INITIAL);
1671 
+
1672 
+  s = (SIZED_STRING*) yr_malloc(yyextra->lex_buf_len + sizeof(SIZED_STRING));
1673 
+  s->flags = 0;
1674 
+
1675 
+  if (yytext[1] == 'i')
1676 
+    s->flags |= SIZED_STRING_FLAGS_NO_CASE;
1677 
+
1678 
+  if (yytext[1] == 's' || yytext[2] == 's')
1679 
+    s->flags |= SIZED_STRING_FLAGS_DOT_ALL;
1680 
+
1681 
+  s->length = yyextra->lex_buf_len;
1682 
+  strlcpy(s->c_string, yyextra->lex_buf, s->length + 1);
1683 
+
1684 
+  yylval->sized_string = s;
1685 
+
1686 
+  return _REGEXP_;
1687 
+}
1688 
+	YY_BREAK
1689 
+case 66:
1690 
+YY_RULE_SETUP
1691 
+#line 520 "yara_lexer.l"
1692 
+{
1693 
+
1694 
+  LEX_CHECK_SPACE_OK("/", yyextra->lex_buf_len, LEX_BUF_SIZE);
1695 
+  *yyextra->lex_buf_ptr++ = '/';
1696 
+  yyextra->lex_buf_len++ ;
1697 
+}
1698 
+	YY_BREAK
1699 
+case 67:
1700 
+YY_RULE_SETUP
1701 
+#line 528 "yara_lexer.l"
1702 
+{
1703 
+
1704 
+  LEX_CHECK_SPACE_OK("\\.", yyextra->lex_buf_len, LEX_BUF_SIZE);
1705 
+  *yyextra->lex_buf_ptr++ = yytext[0];
1706 
+  *yyextra->lex_buf_ptr++ = yytext[1];
1707 
+  yyextra->lex_buf_len += 2;
1708 
+}
1709 
+	YY_BREAK
1710 
+case 68:
1711 
+YY_RULE_SETUP
1712 
+#line 537 "yara_lexer.l"
1713 
+{ YYTEXT_TO_BUFFER; }
1714 
+	YY_BREAK
1715 
+case 69:
1716 
+/* rule 69 can match eol */
1717 
+YY_RULE_SETUP
1718 
+#line 540 "yara_lexer.l"
1719 
+{
1720 
+
1721 
+  yyerror(yyscanner, compiler, "unterminated regular expression");
1722 
+  yyterminate();
1723 
+}
1724 
+	YY_BREAK
1725 
+case 70:
1726 
+YY_RULE_SETUP
1727 
+#line 547 "yara_lexer.l"
1728 
+{
1729 
+
1730 
+  yyextra->lex_buf_ptr = yyextra->lex_buf;
1731 
+  yyextra->lex_buf_len = 0;
1732 
+  BEGIN(str);
1733 
+}
1734 
+	YY_BREAK
1735 
+case 71:
1736 
+YY_RULE_SETUP
1737 
+#line 555 "yara_lexer.l"
1738 
+{
1739 
+
1740 
+  yyextra->lex_buf_ptr = yyextra->lex_buf;
1741 
+  yyextra->lex_buf_len = 0;
1742 
+  BEGIN(regexp);
1743 
+}
1744 
+	YY_BREAK
1745 
+case 72:
1746 
+/* rule 72 can match eol */
1747 
+YY_RULE_SETUP
1748 
+#line 563 "yara_lexer.l"
1749 
+{
1750 
+
1751 
+  int len = strlen(yytext);
1752 
+  SIZED_STRING* s = (SIZED_STRING*) yr_malloc(len + sizeof(SIZED_STRING));
1753 
+
1754 
+  s->length = len;
1755 
+  s->flags = 0;
1756 
+
1757 
+  strlcpy(s->c_string, yytext, s->length + 1);
1758 
+  yylval->sized_string = s;
1759 
+
1760 
+  return _HEX_STRING_;
1761 
+}
1762 
+	YY_BREAK
1763 
+case 73:
1764 
+/* rule 73 can match eol */
1765 
+YY_RULE_SETUP
1766 
+#line 578 "yara_lexer.l"
1767 
+/* skip whitespace */
1768 
+	YY_BREAK
1769 
+case 74:
1770 
+YY_RULE_SETUP
1771 
+#line 580 "yara_lexer.l"
1772 
+{
1773 
+
1774 
+  if (yytext[0] >= 32 && yytext[0] < 127)
1775 
+  {
1776 
+    return yytext[0];
1777 
+  }
1778 
+  else
1779 
+  {
1780 
+    yyerror(yyscanner, compiler, "non-ascii character");
1781 
+    yyterminate();
1782 
+  }
1783 
+}
1784 
+	YY_BREAK
1785 
+case 75:
1786 
+YY_RULE_SETUP
1787 
+#line 593 "yara_lexer.l"
1788 
+ECHO;
1789 
+	YY_BREAK
1790 
+#line 1792 "yara_lexer.c"
1791 
+
1792 
+	case YY_END_OF_BUFFER:
1793 
+		{
1794 
+		/* Amount of text matched not including the EOB char. */
1795 
+		int yy_amount_of_matched_text = (int) (yy_cp - yyg->yytext_ptr) - 1;
1796 
+
1797 
+		/* Undo the effects of YY_DO_BEFORE_ACTION. */
1798 
+		*yy_cp = yyg->yy_hold_char;
1799 
+		YY_RESTORE_YY_MORE_OFFSET
1800 
+
1801 
+		if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW )
1802 
+			{
1803 
+			/* We're scanning a new file or input source.  It's
1804 
+			 * possible that this happened because the user
1805 
+			 * just pointed yyin at a new source and called
1806 
+			 * yara_yylex().  If so, then we have to assure
1807 
+			 * consistency between YY_CURRENT_BUFFER and our
1808 
+			 * globals.  Here is the right place to do so, because
1809 
+			 * this is the first action (other than possibly a
1810 
+			 * back-up) that will match for the new input source.
1811 
+			 */
1812 
+			yyg->yy_n_chars = YY_CURRENT_BUFFER_LVALUE->yy_n_chars;
1813 
+			YY_CURRENT_BUFFER_LVALUE->yy_input_file = yyin;
1814 
+			YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL;
1815 
+			}
1816 
+
1817 
+		/* Note that here we test for yy_c_buf_p "<=" to the position
1818 
+		 * of the first EOB in the buffer, since yy_c_buf_p will
1819 
+		 * already have been incremented past the NUL character
1820 
+		 * (since all states make transitions on EOB to the
1821 
+		 * end-of-buffer state).  Contrast this with the test
1822 
+		 * in input().
1823 
+		 */
1824 
+		if ( yyg->yy_c_buf_p <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars] )
1825 
+			{ /* This was really a NUL. */
1826 
+			yy_state_type yy_next_state;
1827 
+
1828 
+			yyg->yy_c_buf_p = yyg->yytext_ptr + yy_amount_of_matched_text;
1829 
+
1830 
+			yy_current_state = yy_get_previous_state( yyscanner );
1831 
+
1832 
+			/* Okay, we're now positioned to make the NUL
1833 
+			 * transition.  We couldn't have
1834 
+			 * yy_get_previous_state() go ahead and do it
1835 
+			 * for us because it doesn't know how to deal
1836 
+			 * with the possibility of jamming (and we don't
1837 
+			 * want to build jamming into it because then it
1838 
+			 * will run more slowly).
1839 
+			 */
1840 
+
1841 
+			yy_next_state = yy_try_NUL_trans( yy_current_state , yyscanner);
1842 
+
1843 
+			yy_bp = yyg->yytext_ptr + YY_MORE_ADJ;
1844 
+
1845 
+			if ( yy_next_state )
1846 
+				{
1847 
+				/* Consume the NUL. */
1848 
+				yy_cp = ++yyg->yy_c_buf_p;
1849 
+				yy_current_state = yy_next_state;
1850 
+				goto yy_match;
1851 
+				}
1852 
+
1853 
+			else
1854 
+				{
1855 
+				yy_cp = yyg->yy_c_buf_p;
1856 
+				goto yy_find_action;
1857 
+				}
1858 
+			}
1859 
+
1860 
+		else switch ( yy_get_next_buffer( yyscanner ) )
1861 
+			{
1862 
+			case EOB_ACT_END_OF_FILE:
1863 
+				{
1864 
+				yyg->yy_did_buffer_switch_on_eof = 0;
1865 
+
1866 
+				if ( yara_yywrap(yyscanner ) )
1867 
+					{
1868 
+					/* Note: because we've taken care in
1869 
+					 * yy_get_next_buffer() to have set up
1870 
+					 * yytext, we can now set up
1871 
+					 * yy_c_buf_p so that if some total
1872 
+					 * hoser (like flex itself) wants to
1873 
+					 * call the scanner after we return the
1874 
+					 * YY_NULL, it'll still work - another
1875 
+					 * YY_NULL will get returned.
1876 
+					 */
1877 
+					yyg->yy_c_buf_p = yyg->yytext_ptr + YY_MORE_ADJ;
1878 
+
1879 
+					yy_act = YY_STATE_EOF(YY_START);
1880 
+					goto do_action;
1881 
+					}
1882 
+
1883 
+				else
1884 
+					{
1885 
+					if ( ! yyg->yy_did_buffer_switch_on_eof )
1886 
+						YY_NEW_FILE;
1887 
+					}
1888 
+				break;
1889 
+				}
1890 
+
1891 
+			case EOB_ACT_CONTINUE_SCAN:
1892 
+				yyg->yy_c_buf_p =
1893 
+					yyg->yytext_ptr + yy_amount_of_matched_text;
1894 
+
1895 
+				yy_current_state = yy_get_previous_state( yyscanner );
1896 
+
1897 
+				yy_cp = yyg->yy_c_buf_p;
1898 
+				yy_bp = yyg->yytext_ptr + YY_MORE_ADJ;
1899 
+				goto yy_match;
1900 
+
1901 
+			case EOB_ACT_LAST_MATCH:
1902 
+				yyg->yy_c_buf_p =
1903 
+				&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars];
1904 
+
1905 
+				yy_current_state = yy_get_previous_state( yyscanner );
1906 
+
1907 
+				yy_cp = yyg->yy_c_buf_p;
1908 
+				yy_bp = yyg->yytext_ptr + YY_MORE_ADJ;
1909 
+				goto yy_find_action;
1910 
+			}
1911 
+		break;
1912 
+		}
1913 
+
1914 
+	default:
1915 
+		YY_FATAL_ERROR(
1916 
+			"fatal flex scanner internal error--no action found" );
1917 
+	} /* end of action switch */
1918 
+		} /* end of scanning one token */
1919 
+} /* end of yara_yylex */
1920 
+
1921 
+/* yy_get_next_buffer - try to read in a new buffer
1922 
+ *
1923 
+ * Returns a code representing an action:
1924 
+ *	EOB_ACT_LAST_MATCH -
1925 
+ *	EOB_ACT_CONTINUE_SCAN - continue scanning from current position
1926 
+ *	EOB_ACT_END_OF_FILE - end of file
1927 
+ */
1928 
+static int yy_get_next_buffer (yyscan_t yyscanner)
1929 
+{
1930 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
1931 
+	register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf;
1932 
+	register char *source = yyg->yytext_ptr;
1933 
+	register int number_to_move, i;
1934 
+	int ret_val;
1935 
+
1936 
+	if ( yyg->yy_c_buf_p > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars + 1] )
1937 
+		YY_FATAL_ERROR(
1938 
+		"fatal flex scanner internal error--end of buffer missed" );
1939 
+
1940 
+	if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 )
1941 
+		{ /* Don't try to fill the buffer, so this is an EOF. */
1942 
+		if ( yyg->yy_c_buf_p - yyg->yytext_ptr - YY_MORE_ADJ == 1 )
1943 
+			{
1944 
+			/* We matched a single character, the EOB, so
1945 
+			 * treat this as a final EOF.
1946 
+			 */
1947 
+			return EOB_ACT_END_OF_FILE;
1948 
+			}
1949 
+
1950 
+		else
1951 
+			{
1952 
+			/* We matched some text prior to the EOB, first
1953 
+			 * process it.
1954 
+			 */
1955 
+			return EOB_ACT_LAST_MATCH;
1956 
+			}
1957 
+		}
1958 
+
1959 
+	/* Try to read more data. */
1960 
+
1961 
+	/* First move last chars to start of buffer. */
1962 
+	number_to_move = (int) (yyg->yy_c_buf_p - yyg->yytext_ptr) - 1;
1963 
+
1964 
+	for ( i = 0; i < number_to_move; ++i )
1965 
+		*(dest++) = *(source++);
1966 
+
1967 
+	if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING )
1968 
+		/* don't do the read, it's not guaranteed to return an EOF,
1969 
+		 * just force an EOF
1970 
+		 */
1971 
+		YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars = 0;
1972 
+
1973 
+	else
1974 
+		{
1975 
+			int num_to_read =
1976 
+			YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1;
1977 
+
1978 
+		while ( num_to_read <= 0 )
1979 
+			{ /* Not enough room in the buffer - grow it. */
1980 
+
1981 
+			/* just a shorter name for the current buffer */
1982 
+			YY_BUFFER_STATE b = YY_CURRENT_BUFFER;
1983 
+
1984 
+			int yy_c_buf_p_offset =
1985 
+				(int) (yyg->yy_c_buf_p - b->yy_ch_buf);
1986 
+
1987 
+			if ( b->yy_is_our_buffer )
1988 
+				{
1989 
+				int new_size = b->yy_buf_size * 2;
1990 
+
1991 
+				if ( new_size <= 0 )
1992 
+					b->yy_buf_size += b->yy_buf_size / 8;
1993 
+				else
1994 
+					b->yy_buf_size *= 2;
1995 
+
1996 
+				b->yy_ch_buf = (char *)
1997 
+					/* Include room in for 2 EOB chars. */
1998 
+					yara_yyrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2 ,yyscanner );
1999 
+				}
2000 
+			else
2001 
+				/* Can't grow it, we don't own it. */
2002 
+				b->yy_ch_buf = 0;
2003 
+
2004 
+			if ( ! b->yy_ch_buf )
2005 
+				YY_FATAL_ERROR(
2006 
+				"fatal error - scanner input buffer overflow" );
2007 
+
2008 
+			yyg->yy_c_buf_p = &b->yy_ch_buf[yy_c_buf_p_offset];
2009 
+
2010 
+			num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size -
2011 
+						number_to_move - 1;
2012 
+
2013 
+			}
2014 
+
2015 
+		if ( num_to_read > YY_READ_BUF_SIZE )
2016 
+			num_to_read = YY_READ_BUF_SIZE;
2017 
+
2018 
+		/* Read in more data. */
2019 
+		YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
2020 
+			yyg->yy_n_chars, (size_t) num_to_read );
2021 
+
2022 
+		YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars;
2023 
+		}
2024 
+
2025 
+	if ( yyg->yy_n_chars == 0 )
2026 
+		{
2027 
+		if ( number_to_move == YY_MORE_ADJ )
2028 
+			{
2029 
+			ret_val = EOB_ACT_END_OF_FILE;
2030 
+			yara_yyrestart(yyin  ,yyscanner);
2031 
+			}
2032 
+
2033 
+		else
2034 
+			{
2035 
+			ret_val = EOB_ACT_LAST_MATCH;
2036 
+			YY_CURRENT_BUFFER_LVALUE->yy_buffer_status =
2037 
+				YY_BUFFER_EOF_PENDING;
2038 
+			}
2039 
+		}
2040 
+
2041 
+	else
2042 
+		ret_val = EOB_ACT_CONTINUE_SCAN;
2043 
+
2044 
+	if ((yy_size_t) (yyg->yy_n_chars + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) {
2045 
+		/* Extend the array by 50%, plus the number we really need. */
2046 
+		yy_size_t new_size = yyg->yy_n_chars + number_to_move + (yyg->yy_n_chars >> 1);
2047 
+		YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yara_yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ,yyscanner );
2048 
+		if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf )
2049 
+			YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" );
2050 
+	}
2051 
+
2052 
+	yyg->yy_n_chars += number_to_move;
2053 
+	YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars] = YY_END_OF_BUFFER_CHAR;
2054 
+	YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars + 1] = YY_END_OF_BUFFER_CHAR;
2055 
+
2056 
+	yyg->yytext_ptr = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0];
2057 
+
2058 
+	return ret_val;
2059 
+}
2060 
+
2061 
+/* yy_get_previous_state - get the state just before the EOB char was reached */
2062 
+
2063 
+    static yy_state_type yy_get_previous_state (yyscan_t yyscanner)
2064 
+{
2065 
+	register yy_state_type yy_current_state;
2066 
+	register char *yy_cp;
2067 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2068 
+
2069 
+	yy_current_state = yyg->yy_start;
2070 
+
2071 
+	for ( yy_cp = yyg->yytext_ptr + YY_MORE_ADJ; yy_cp < yyg->yy_c_buf_p; ++yy_cp )
2072 
+		{
2073 
+		register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1);
2074 
+		if ( yy_accept[yy_current_state] )
2075 
+			{
2076 
+			yyg->yy_last_accepting_state = yy_current_state;
2077 
+			yyg->yy_last_accepting_cpos = yy_cp;
2078 
+			}
2079 
+		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
2080 
+			{
2081 
+			yy_current_state = (int) yy_def[yy_current_state];
2082 
+			if ( yy_current_state >= 219 )
2083 
+				yy_c = yy_meta[(unsigned int) yy_c];
2084 
+			}
2085 
+		yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
2086 
+		}
2087 
+
2088 
+	return yy_current_state;
2089 
+}
2090 
+
2091 
+/* yy_try_NUL_trans - try to make a transition on the NUL character
2092 
+ *
2093 
+ * synopsis
2094 
+ *	next_state = yy_try_NUL_trans( current_state );
2095 
+ */
2096 
+    static yy_state_type yy_try_NUL_trans  (yy_state_type yy_current_state , yyscan_t yyscanner)
2097 
+{
2098 
+	register int yy_is_jam;
2099 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner; /* This var may be unused depending upon options. */
2100 
+	register char *yy_cp = yyg->yy_c_buf_p;
2101 
+
2102 
+	register YY_CHAR yy_c = 1;
2103 
+	if ( yy_accept[yy_current_state] )
2104 
+		{
2105 
+		yyg->yy_last_accepting_state = yy_current_state;
2106 
+		yyg->yy_last_accepting_cpos = yy_cp;
2107 
+		}
2108 
+	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
2109 
+		{
2110 
+		yy_current_state = (int) yy_def[yy_current_state];
2111 
+		if ( yy_current_state >= 219 )
2112 
+			yy_c = yy_meta[(unsigned int) yy_c];
2113 
+		}
2114 
+	yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
2115 
+	yy_is_jam = (yy_current_state == 218);
2116 
+
2117 
+	return yy_is_jam ? 0 : yy_current_state;
2118 
+}
2119 
+
2120 
+#ifndef YY_NO_INPUT
2121 
+#ifdef __cplusplus
2122 
+    static int yyinput (yyscan_t yyscanner)
2123 
+#else
2124 
+    static int input  (yyscan_t yyscanner)
2125 
+#endif
2126 
+
2127 
+{
2128 
+	int c;
2129 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2130 
+
2131 
+	*yyg->yy_c_buf_p = yyg->yy_hold_char;
2132 
+
2133 
+	if ( *yyg->yy_c_buf_p == YY_END_OF_BUFFER_CHAR )
2134 
+		{
2135 
+		/* yy_c_buf_p now points to the character we want to return.
2136 
+		 * If this occurs *before* the EOB characters, then it's a
2137 
+		 * valid NUL; if not, then we've hit the end of the buffer.
2138 
+		 */
2139 
+		if ( yyg->yy_c_buf_p < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[yyg->yy_n_chars] )
2140 
+			/* This was really a NUL. */
2141 
+			*yyg->yy_c_buf_p = '\0';
2142 
+
2143 
+		else
2144 
+			{ /* need more input */
2145 
+			int offset = yyg->yy_c_buf_p - yyg->yytext_ptr;
2146 
+			++yyg->yy_c_buf_p;
2147 
+
2148 
+			switch ( yy_get_next_buffer( yyscanner ) )
2149 
+				{
2150 
+				case EOB_ACT_LAST_MATCH:
2151 
+					/* This happens because yy_g_n_b()
2152 
+					 * sees that we've accumulated a
2153 
+					 * token and flags that we need to
2154 
+					 * try matching the token before
2155 
+					 * proceeding.  But for input(),
2156 
+					 * there's no matching to consider.
2157 
+					 * So convert the EOB_ACT_LAST_MATCH
2158 
+					 * to EOB_ACT_END_OF_FILE.
2159 
+					 */
2160 
+
2161 
+					/* Reset buffer status. */
2162 
+					yara_yyrestart(yyin ,yyscanner);
2163 
+
2164 
+					/*FALLTHROUGH*/
2165 
+
2166 
+				case EOB_ACT_END_OF_FILE:
2167 
+					{
2168 
+					if ( yara_yywrap(yyscanner ) )
2169 
+						return EOF;
2170 
+
2171 
+					if ( ! yyg->yy_did_buffer_switch_on_eof )
2172 
+						YY_NEW_FILE;
2173 
+#ifdef __cplusplus
2174 
+					return yyinput(yyscanner);
2175 
+#else
2176 
+					return input(yyscanner);
2177 
+#endif
2178 
+					}
2179 
+
2180 
+				case EOB_ACT_CONTINUE_SCAN:
2181 
+					yyg->yy_c_buf_p = yyg->yytext_ptr + offset;
2182 
+					break;
2183 
+				}
2184 
+			}
2185 
+		}
2186 
+
2187 
+	c = *(unsigned char *) yyg->yy_c_buf_p;	/* cast for 8-bit char's */
2188 
+	*yyg->yy_c_buf_p = '\0';	/* preserve yytext */
2189 
+	yyg->yy_hold_char = *++yyg->yy_c_buf_p;
2190 
+
2191 
+	if ( c == '\n' )
2192 
+
2193 
+    do{ yylineno++;
2194 
+        yycolumn=0;
2195 
+    }while(0)
2196 
+;
2197 
+
2198 
+	return c;
2199 
+}
2200 
+#endif	/* ifndef YY_NO_INPUT */
2201 
+
2202 
+/** Immediately switch to a different input stream.
2203 
+ * @param input_file A readable stream.
2204 
+ * @param yyscanner The scanner object.
2205 
+ * @note This function does not reset the start condition to @c INITIAL .
2206 
+ */
2207 
+    void yara_yyrestart  (FILE * input_file , yyscan_t yyscanner)
2208 
+{
2209 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2210 
+
2211 
+	if ( ! YY_CURRENT_BUFFER ){
2212 
+        yara_yyensure_buffer_stack (yyscanner);
2213 
+		YY_CURRENT_BUFFER_LVALUE =
2214 
+            yara_yy_create_buffer(yyin,YY_BUF_SIZE ,yyscanner);
2215 
+	}
2216 
+
2217 
+	yara_yy_init_buffer(YY_CURRENT_BUFFER,input_file ,yyscanner);
2218 
+	yara_yy_load_buffer_state(yyscanner );
2219 
+}
2220 
+
2221 
+/** Switch to a different input buffer.
2222 
+ * @param new_buffer The new input buffer.
2223 
+ * @param yyscanner The scanner object.
2224 
+ */
2225 
+    void yara_yy_switch_to_buffer  (YY_BUFFER_STATE  new_buffer , yyscan_t yyscanner)
2226 
+{
2227 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2228 
+
2229 
+	/* TODO. We should be able to replace this entire function body
2230 
+	 * with
2231 
+	 *		yara_yypop_buffer_state();
2232 
+	 *		yara_yypush_buffer_state(new_buffer);
2233 
+     */
2234 
+	yara_yyensure_buffer_stack (yyscanner);
2235 
+	if ( YY_CURRENT_BUFFER == new_buffer )
2236 
+		return;
2237 
+
2238 
+	if ( YY_CURRENT_BUFFER )
2239 
+		{
2240 
+		/* Flush out information for old buffer. */
2241 
+		*yyg->yy_c_buf_p = yyg->yy_hold_char;
2242 
+		YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = yyg->yy_c_buf_p;
2243 
+		YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars;
2244 
+		}
2245 
+
2246 
+	YY_CURRENT_BUFFER_LVALUE = new_buffer;
2247 
+	yara_yy_load_buffer_state(yyscanner );
2248 
+
2249 
+	/* We don't actually know whether we did this switch during
2250 
+	 * EOF (yara_yywrap()) processing, but the only time this flag
2251 
+	 * is looked at is after yara_yywrap() is called, so it's safe
2252 
+	 * to go ahead and always set it.
2253 
+	 */
2254 
+	yyg->yy_did_buffer_switch_on_eof = 1;
2255 
+}
2256 
+
2257 
+static void yara_yy_load_buffer_state  (yyscan_t yyscanner)
2258 
+{
2259 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2260 
+	yyg->yy_n_chars = YY_CURRENT_BUFFER_LVALUE->yy_n_chars;
2261 
+	yyg->yytext_ptr = yyg->yy_c_buf_p = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos;
2262 
+	yyin = YY_CURRENT_BUFFER_LVALUE->yy_input_file;
2263 
+	yyg->yy_hold_char = *yyg->yy_c_buf_p;
2264 
+}
2265 
+
2266 
+/** Allocate and initialize an input buffer state.
2267 
+ * @param file A readable stream.
2268 
+ * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE.
2269 
+ * @param yyscanner The scanner object.
2270 
+ * @return the allocated buffer state.
2271 
+ */
2272 
+    YY_BUFFER_STATE yara_yy_create_buffer  (FILE * file, int  size , yyscan_t yyscanner)
2273 
+{
2274 
+	YY_BUFFER_STATE b;
2275 
+
2276 
+	b = (YY_BUFFER_STATE) yara_yyalloc(sizeof( struct yy_buffer_state ) ,yyscanner );
2277 
+	if ( ! b )
2278 
+		YY_FATAL_ERROR( "out of dynamic memory in yara_yy_create_buffer()" );
2279 
+
2280 
+	b->yy_buf_size = size;
2281 
+
2282 
+	/* yy_ch_buf has to be 2 characters longer than the size given because
2283 
+	 * we need to put in 2 end-of-buffer characters.
2284 
+	 */
2285 
+	b->yy_ch_buf = (char *) yara_yyalloc(b->yy_buf_size + 2 ,yyscanner );
2286 
+	if ( ! b->yy_ch_buf )
2287 
+		YY_FATAL_ERROR( "out of dynamic memory in yara_yy_create_buffer()" );
2288 
+
2289 
+	b->yy_is_our_buffer = 1;
2290 
+
2291 
+	yara_yy_init_buffer(b,file ,yyscanner);
2292 
+
2293 
+	return b;
2294 
+}
2295 
+
2296 
+/** Destroy the buffer.
2297 
+ * @param b a buffer created with yara_yy_create_buffer()
2298 
+ * @param yyscanner The scanner object.
2299 
+ */
2300 
+    void yara_yy_delete_buffer (YY_BUFFER_STATE  b , yyscan_t yyscanner)
2301 
+{
2302 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2303 
+
2304 
+	if ( ! b )
2305 
+		return;
2306 
+
2307 
+	if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */
2308 
+		YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0;
2309 
+
2310 
+	if ( b->yy_is_our_buffer )
2311 
+		yara_yyfree((void *) b->yy_ch_buf ,yyscanner );
2312 
+
2313 
+	yara_yyfree((void *) b ,yyscanner );
2314 
+}
2315 
+
2316 
+#ifndef __cplusplus
2317 
+extern int isatty (int );
2318 
+#endif /* __cplusplus */
2319 
+
2320 
+/* Initializes or reinitializes a buffer.
2321 
+ * This function is sometimes called more than once on the same buffer,
2322 
+ * such as during a yara_yyrestart() or at EOF.
2323 
+ */
2324 
+    static void yara_yy_init_buffer  (YY_BUFFER_STATE  b, FILE * file , yyscan_t yyscanner)
2325 
+
2326 
+{
2327 
+	int oerrno = errno;
2328 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2329 
+
2330 
+	yara_yy_flush_buffer(b ,yyscanner);
2331 
+
2332 
+	b->yy_input_file = file;
2333 
+	b->yy_fill_buffer = 1;
2334 
+
2335 
+    /* If b is the current buffer, then yara_yy_init_buffer was _probably_
2336 
+     * called from yara_yyrestart() or through yy_get_next_buffer.
2337 
+     * In that case, we don't want to reset the lineno or column.
2338 
+     */
2339 
+    if (b != YY_CURRENT_BUFFER){
2340 
+        b->yy_bs_lineno = 1;
2341 
+        b->yy_bs_column = 0;
2342 
+    }
2343 
+
2344 
+        b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0;
2345 
+
2346 
+	errno = oerrno;
2347 
+}
2348 
+
2349 
+/** Discard all buffered characters. On the next scan, YY_INPUT will be called.
2350 
+ * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER.
2351 
+ * @param yyscanner The scanner object.
2352 
+ */
2353 
+    void yara_yy_flush_buffer (YY_BUFFER_STATE  b , yyscan_t yyscanner)
2354 
+{
2355 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2356 
+	if ( ! b )
2357 
+		return;
2358 
+
2359 
+	b->yy_n_chars = 0;
2360 
+
2361 
+	/* We always need two end-of-buffer characters.  The first causes
2362 
+	 * a transition to the end-of-buffer state.  The second causes
2363 
+	 * a jam in that state.
2364 
+	 */
2365 
+	b->yy_ch_buf[0] = YY_END_OF_BUFFER_CHAR;
2366 
+	b->yy_ch_buf[1] = YY_END_OF_BUFFER_CHAR;
2367 
+
2368 
+	b->yy_buf_pos = &b->yy_ch_buf[0];
2369 
+
2370 
+	b->yy_at_bol = 1;
2371 
+	b->yy_buffer_status = YY_BUFFER_NEW;
2372 
+
2373 
+	if ( b == YY_CURRENT_BUFFER )
2374 
+		yara_yy_load_buffer_state(yyscanner );
2375 
+}
2376 
+
2377 
+/** Pushes the new state onto the stack. The new state becomes
2378 
+ *  the current state. This function will allocate the stack
2379 
+ *  if necessary.
2380 
+ *  @param new_buffer The new state.
2381 
+ *  @param yyscanner The scanner object.
2382 
+ */
2383 
+void yara_yypush_buffer_state (YY_BUFFER_STATE new_buffer , yyscan_t yyscanner)
2384 
+{
2385 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2386 
+	if (new_buffer == NULL)
2387 
+		return;
2388 
+
2389 
+	yara_yyensure_buffer_stack(yyscanner);
2390 
+
2391 
+	/* This block is copied from yara_yy_switch_to_buffer. */
2392 
+	if ( YY_CURRENT_BUFFER )
2393 
+		{
2394 
+		/* Flush out information for old buffer. */
2395 
+		*yyg->yy_c_buf_p = yyg->yy_hold_char;
2396 
+		YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = yyg->yy_c_buf_p;
2397 
+		YY_CURRENT_BUFFER_LVALUE->yy_n_chars = yyg->yy_n_chars;
2398 
+		}
2399 
+
2400 
+	/* Only push if top exists. Otherwise, replace top. */
2401 
+	if (YY_CURRENT_BUFFER)
2402 
+		yyg->yy_buffer_stack_top++;
2403 
+	YY_CURRENT_BUFFER_LVALUE = new_buffer;
2404 
+
2405 
+	/* copied from yara_yy_switch_to_buffer. */
2406 
+	yara_yy_load_buffer_state(yyscanner );
2407 
+	yyg->yy_did_buffer_switch_on_eof = 1;
2408 
+}
2409 
+
2410 
+/** Removes and deletes the top of the stack, if present.
2411 
+ *  The next element becomes the new top.
2412 
+ *  @param yyscanner The scanner object.
2413 
+ */
2414 
+void yara_yypop_buffer_state (yyscan_t yyscanner)
2415 
+{
2416 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2417 
+	if (!YY_CURRENT_BUFFER)
2418 
+		return;
2419 
+
2420 
+	yara_yy_delete_buffer(YY_CURRENT_BUFFER ,yyscanner);
2421 
+	YY_CURRENT_BUFFER_LVALUE = NULL;
2422 
+	if (yyg->yy_buffer_stack_top > 0)
2423 
+		--yyg->yy_buffer_stack_top;
2424 
+
2425 
+	if (YY_CURRENT_BUFFER) {
2426 
+		yara_yy_load_buffer_state(yyscanner );
2427 
+		yyg->yy_did_buffer_switch_on_eof = 1;
2428 
+	}
2429 
+}
2430 
+
2431 
+/* Allocates the stack if it does not exist.
2432 
+ *  Guarantees space for at least one push.
2433 
+ */
2434 
+static void yara_yyensure_buffer_stack (yyscan_t yyscanner)
2435 
+{
2436 
+	int num_to_alloc;
2437 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2438 
+
2439 
+	if (!yyg->yy_buffer_stack) {
2440 
+
2441 
+		/* First allocation is just for 2 elements, since we don't know if this
2442 
+		 * scanner will even need a stack. We use 2 instead of 1 to avoid an
2443 
+		 * immediate realloc on the next call.
2444 
+         */
2445 
+		num_to_alloc = 1;
2446 
+		yyg->yy_buffer_stack = (struct yy_buffer_state**)yara_yyalloc
2447 
+								(num_to_alloc * sizeof(struct yy_buffer_state*)
2448 
+								, yyscanner);
2449 
+		if ( ! yyg->yy_buffer_stack )
2450 
+			YY_FATAL_ERROR( "out of dynamic memory in yara_yyensure_buffer_stack()" );
2451 
+
2452 
+		memset(yyg->yy_buffer_stack, 0, num_to_alloc * sizeof(struct yy_buffer_state*));
2453 
+
2454 
+		yyg->yy_buffer_stack_max = num_to_alloc;
2455 
+		yyg->yy_buffer_stack_top = 0;
2456 
+		return;
2457 
+	}
2458 
+
2459 
+	if (yyg->yy_buffer_stack_top >= (yyg->yy_buffer_stack_max) - 1){
2460 
+
2461 
+		/* Increase the buffer to prepare for a possible push. */
2462 
+		int grow_size = 8 /* arbitrary grow size */;
2463 
+
2464 
+		num_to_alloc = yyg->yy_buffer_stack_max + grow_size;
2465 
+		yyg->yy_buffer_stack = (struct yy_buffer_state**)yara_yyrealloc
2466 
+								(yyg->yy_buffer_stack,
2467 
+								num_to_alloc * sizeof(struct yy_buffer_state*)
2468 
+								, yyscanner);
2469 
+		if ( ! yyg->yy_buffer_stack )
2470 
+			YY_FATAL_ERROR( "out of dynamic memory in yara_yyensure_buffer_stack()" );
2471 
+
2472 
+		/* zero only the new slots.*/
2473 
+		memset(yyg->yy_buffer_stack + yyg->yy_buffer_stack_max, 0, grow_size * sizeof(struct yy_buffer_state*));
2474 
+		yyg->yy_buffer_stack_max = num_to_alloc;
2475 
+	}
2476 
+}
2477 
+
2478 
+/** Setup the input buffer state to scan directly from a user-specified character buffer.
2479 
+ * @param base the character buffer
2480 
+ * @param size the size in bytes of the character buffer
2481 
+ * @param yyscanner The scanner object.
2482 
+ * @return the newly allocated buffer state object.
2483 
+ */
2484 
+YY_BUFFER_STATE yara_yy_scan_buffer  (char * base, yy_size_t  size , yyscan_t yyscanner)
2485 
+{
2486 
+	YY_BUFFER_STATE b;
2487 
+
2488 
+	if ( size < 2 ||
2489 
+	     base[size-2] != YY_END_OF_BUFFER_CHAR ||
2490 
+	     base[size-1] != YY_END_OF_BUFFER_CHAR )
2491 
+		/* They forgot to leave room for the EOB's. */
2492 
+		return 0;
2493 
+
2494 
+	b = (YY_BUFFER_STATE) yara_yyalloc(sizeof( struct yy_buffer_state ) ,yyscanner );
2495 
+	if ( ! b )
2496 
+		YY_FATAL_ERROR( "out of dynamic memory in yara_yy_scan_buffer()" );
2497 
+
2498 
+	b->yy_buf_size = size - 2;	/* "- 2" to take care of EOB's */
2499 
+	b->yy_buf_pos = b->yy_ch_buf = base;
2500 
+	b->yy_is_our_buffer = 0;
2501 
+	b->yy_input_file = 0;
2502 
+	b->yy_n_chars = b->yy_buf_size;
2503 
+	b->yy_is_interactive = 0;
2504 
+	b->yy_at_bol = 1;
2505 
+	b->yy_fill_buffer = 0;
2506 
+	b->yy_buffer_status = YY_BUFFER_NEW;
2507 
+
2508 
+	yara_yy_switch_to_buffer(b ,yyscanner );
2509 
+
2510 
+	return b;
2511 
+}
2512 
+
2513 
+/** Setup the input buffer state to scan a string. The next call to yara_yylex() will
2514 
+ * scan from a @e copy of @a str.
2515 
+ * @param yystr a NUL-terminated string to scan
2516 
+ * @param yyscanner The scanner object.
2517 
+ * @return the newly allocated buffer state object.
2518 
+ * @note If you want to scan bytes that may contain NUL values, then use
2519 
+ *       yara_yy_scan_bytes() instead.
2520 
+ */
2521 
+YY_BUFFER_STATE yara_yy_scan_string (yyconst char * yystr , yyscan_t yyscanner)
2522 
+{
2523 
+
2524 
+	return yara_yy_scan_bytes(yystr,strlen(yystr) ,yyscanner);
2525 
+}
2526 
+
2527 
+/** Setup the input buffer state to scan the given bytes. The next call to yara_yylex() will
2528 
+ * scan from a @e copy of @a bytes.
2529 
+ * @param yybytes the byte buffer to scan
2530 
+ * @param _yybytes_len the number of bytes in the buffer pointed to by @a bytes.
2531 
+ * @param yyscanner The scanner object.
2532 
+ * @return the newly allocated buffer state object.
2533 
+ */
2534 
+YY_BUFFER_STATE yara_yy_scan_bytes  (yyconst char * yybytes, int  _yybytes_len , yyscan_t yyscanner)
2535 
+{
2536 
+	YY_BUFFER_STATE b;
2537 
+	char *buf;
2538 
+	yy_size_t n;
2539 
+	int i;
2540 
+
2541 
+	/* Get memory for full buffer, including space for trailing EOB's. */
2542 
+	n = _yybytes_len + 2;
2543 
+	buf = (char *) yara_yyalloc(n ,yyscanner );
2544 
+	if ( ! buf )
2545 
+		YY_FATAL_ERROR( "out of dynamic memory in yara_yy_scan_bytes()" );
2546 
+
2547 
+	for ( i = 0; i < _yybytes_len; ++i )
2548 
+		buf[i] = yybytes[i];
2549 
+
2550 
+	buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR;
2551 
+
2552 
+	b = yara_yy_scan_buffer(buf,n ,yyscanner);
2553 
+	if ( ! b )
2554 
+		YY_FATAL_ERROR( "bad buffer in yara_yy_scan_bytes()" );
2555 
+
2556 
+	/* It's okay to grow etc. this buffer, and we should throw it
2557 
+	 * away when we're done.
2558 
+	 */
2559 
+	b->yy_is_our_buffer = 1;
2560 
+
2561 
+	return b;
2562 
+}
2563 
+
2564 
+#ifndef YY_EXIT_FAILURE
2565 
+#define YY_EXIT_FAILURE 2
2566 
+#endif
2567 
+
2568 
+static void yy_fatal_error (yyconst char* msg , yyscan_t yyscanner)
2569 
+{
2570 
+    	(void) fprintf( stderr, "%s\n", msg );
2571 
+	exit( YY_EXIT_FAILURE );
2572 
+}
2573 
+
2574 
+/* Redefine yyless() so it works in section 3 code. */
2575 
+
2576 
+#undef yyless
2577 
+#define yyless(n) \
2578 
+	do \
2579 
+		{ \
2580 
+		/* Undo effects of setting up yytext. */ \
2581 
+        int yyless_macro_arg = (n); \
2582 
+        YY_LESS_LINENO(yyless_macro_arg);\
2583 
+		yytext[yyleng] = yyg->yy_hold_char; \
2584 
+		yyg->yy_c_buf_p = yytext + yyless_macro_arg; \
2585 
+		yyg->yy_hold_char = *yyg->yy_c_buf_p; \
2586 
+		*yyg->yy_c_buf_p = '\0'; \
2587 
+		yyleng = yyless_macro_arg; \
2588 
+		} \
2589 
+	while ( 0 )
2590 
+
2591 
+/* Accessor  methods (get/set functions) to struct members. */
2592 
+
2593 
+/** Get the user-defined data for this scanner.
2594 
+ * @param yyscanner The scanner object.
2595 
+ */
2596 
+YY_EXTRA_TYPE yara_yyget_extra  (yyscan_t yyscanner)
2597 
+{
2598 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2599 
+    return yyextra;
2600 
+}
2601 
+
2602 
+/** Get the current line number.
2603 
+ * @param yyscanner The scanner object.
2604 
+ */
2605 
+int yara_yyget_lineno  (yyscan_t yyscanner)
2606 
+{
2607 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2608 
+
2609 
+        if (! YY_CURRENT_BUFFER)
2610 
+            return 0;
2611 
+
2612 
+    return yylineno;
2613 
+}
2614 
+
2615 
+/** Get the current column number.
2616 
+ * @param yyscanner The scanner object.
2617 
+ */
2618 
+int yara_yyget_column  (yyscan_t yyscanner)
2619 
+{
2620 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2621 
+
2622 
+        if (! YY_CURRENT_BUFFER)
2623 
+            return 0;
2624 
+
2625 
+    return yycolumn;
2626 
+}
2627 
+
2628 
+/** Get the input stream.
2629 
+ * @param yyscanner The scanner object.
2630 
+ */
2631 
+FILE *yara_yyget_in  (yyscan_t yyscanner)
2632 
+{
2633 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2634 
+    return yyin;
2635 
+}
2636 
+
2637 
+/** Get the output stream.
2638 
+ * @param yyscanner The scanner object.
2639 
+ */
2640 
+FILE *yara_yyget_out  (yyscan_t yyscanner)
2641 
+{
2642 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2643 
+    return yyout;
2644 
+}
2645 
+
2646 
+/** Get the length of the current token.
2647 
+ * @param yyscanner The scanner object.
2648 
+ */
2649 
+int yara_yyget_leng  (yyscan_t yyscanner)
2650 
+{
2651 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2652 
+    return yyleng;
2653 
+}
2654 
+
2655 
+/** Get the current token.
2656 
+ * @param yyscanner The scanner object.
2657 
+ */
2658 
+
2659 
+char *yara_yyget_text  (yyscan_t yyscanner)
2660 
+{
2661 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2662 
+    return yytext;
2663 
+}
2664 
+
2665 
+/** Set the user-defined data. This data is never touched by the scanner.
2666 
+ * @param user_defined The data to be associated with this scanner.
2667 
+ * @param yyscanner The scanner object.
2668 
+ */
2669 
+void yara_yyset_extra (YY_EXTRA_TYPE  user_defined , yyscan_t yyscanner)
2670 
+{
2671 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2672 
+    yyextra = user_defined ;
2673 
+}
2674 
+
2675 
+/** Set the current line number.
2676 
+ * @param line_number
2677 
+ * @param yyscanner The scanner object.
2678 
+ */
2679 
+void yara_yyset_lineno (int  line_number , yyscan_t yyscanner)
2680 
+{
2681 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2682 
+
2683 
+        /* lineno is only valid if an input buffer exists. */
2684 
+        if (! YY_CURRENT_BUFFER )
2685 
+           yy_fatal_error( "yara_yyset_lineno called with no buffer" , yyscanner);
2686 
+
2687 
+    yylineno = line_number;
2688 
+}
2689 
+
2690 
+/** Set the current column.
2691 
+ * @param line_number
2692 
+ * @param yyscanner The scanner object.
2693 
+ */
2694 
+void yara_yyset_column (int  column_no , yyscan_t yyscanner)
2695 
+{
2696 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2697 
+
2698 
+        /* column is only valid if an input buffer exists. */
2699 
+        if (! YY_CURRENT_BUFFER )
2700 
+           yy_fatal_error( "yara_yyset_column called with no buffer" , yyscanner);
2701 
+
2702 
+    yycolumn = column_no;
2703 
+}
2704 
+
2705 
+/** Set the input stream. This does not discard the current
2706 
+ * input buffer.
2707 
+ * @param in_str A readable stream.
2708 
+ * @param yyscanner The scanner object.
2709 
+ * @see yara_yy_switch_to_buffer
2710 
+ */
2711 
+void yara_yyset_in (FILE *  in_str , yyscan_t yyscanner)
2712 
+{
2713 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2714 
+    yyin = in_str ;
2715 
+}
2716 
+
2717 
+void yara_yyset_out (FILE *  out_str , yyscan_t yyscanner)
2718 
+{
2719 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2720 
+    yyout = out_str ;
2721 
+}
2722 
+
2723 
+int yara_yyget_debug  (yyscan_t yyscanner)
2724 
+{
2725 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2726 
+    return yy_flex_debug;
2727 
+}
2728 
+
2729 
+void yara_yyset_debug (int  bdebug , yyscan_t yyscanner)
2730 
+{
2731 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2732 
+    yy_flex_debug = bdebug ;
2733 
+}
2734 
+
2735 
+/* Accessor methods for yylval and yylloc */
2736 
+
2737 
+YYSTYPE * yara_yyget_lval  (yyscan_t yyscanner)
2738 
+{
2739 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2740 
+    return yylval;
2741 
+}
2742 
+
2743 
+void yara_yyset_lval (YYSTYPE *  yylval_param , yyscan_t yyscanner)
2744 
+{
2745 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2746 
+    yylval = yylval_param;
2747 
+}
2748 
+
2749 
+/* User-visible API */
2750 
+
2751 
+/* yara_yylex_init is special because it creates the scanner itself, so it is
2752 
+ * the ONLY reentrant function that doesn't take the scanner as the last argument.
2753 
+ * That's why we explicitly handle the declaration, instead of using our macros.
2754 
+ */
2755 
+
2756 
+int yara_yylex_init(yyscan_t* ptr_yy_globals)
2757 
+
2758 
+{
2759 
+    if (ptr_yy_globals == NULL){
2760 
+        errno = EINVAL;
2761 
+        return 1;
2762 
+    }
2763 
+
2764 
+    *ptr_yy_globals = (yyscan_t) yara_yyalloc ( sizeof( struct yyguts_t ), NULL );
2765 
+
2766 
+    if (*ptr_yy_globals == NULL){
2767 
+        errno = ENOMEM;
2768 
+        return 1;
2769 
+    }
2770 
+
2771 
+    /* By setting to 0xAA, we expose bugs in yy_init_globals. Leave at 0x00 for releases. */
2772 
+    memset(*ptr_yy_globals,0x00,sizeof(struct yyguts_t));
2773 
+
2774 
+    return yy_init_globals ( *ptr_yy_globals );
2775 
+}
2776 
+
2777 
+/* yara_yylex_init_extra has the same functionality as yara_yylex_init, but follows the
2778 
+ * convention of taking the scanner as the last argument. Note however, that
2779 
+ * this is a *pointer* to a scanner, as it will be allocated by this call (and
2780 
+ * is the reason, too, why this function also must handle its own declaration).
2781 
+ * The user defined value in the first argument will be available to yara_yyalloc in
2782 
+ * the yyextra field.
2783 
+ */
2784 
+
2785 
+int yara_yylex_init_extra(YY_EXTRA_TYPE yy_user_defined,yyscan_t* ptr_yy_globals )
2786 
+
2787 
+{
2788 
+    struct yyguts_t dummy_yyguts;
2789 
+
2790 
+    yara_yyset_extra (yy_user_defined, &dummy_yyguts);
2791 
+
2792 
+    if (ptr_yy_globals == NULL){
2793 
+        errno = EINVAL;
2794 
+        return 1;
2795 
+    }
2796 
+
2797 
+    *ptr_yy_globals = (yyscan_t) yara_yyalloc ( sizeof( struct yyguts_t ), &dummy_yyguts );
2798 
+
2799 
+    if (*ptr_yy_globals == NULL){
2800 
+        errno = ENOMEM;
2801 
+        return 1;
2802 
+    }
2803 
+
2804 
+    /* By setting to 0xAA, we expose bugs in
2805 
+    yy_init_globals. Leave at 0x00 for releases. */
2806 
+    memset(*ptr_yy_globals,0x00,sizeof(struct yyguts_t));
2807 
+
2808 
+    yara_yyset_extra (yy_user_defined, *ptr_yy_globals);
2809 
+
2810 
+    return yy_init_globals ( *ptr_yy_globals );
2811 
+}
2812 
+
2813 
+static int yy_init_globals (yyscan_t yyscanner)
2814 
+{
2815 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2816 
+    /* Initialization is the same as for the non-reentrant scanner.
2817 
+     * This function is called from yara_yylex_destroy(), so don't allocate here.
2818 
+     */
2819 
+
2820 
+    yyg->yy_buffer_stack = 0;
2821 
+    yyg->yy_buffer_stack_top = 0;
2822 
+    yyg->yy_buffer_stack_max = 0;
2823 
+    yyg->yy_c_buf_p = (char *) 0;
2824 
+    yyg->yy_init = 0;
2825 
+    yyg->yy_start = 0;
2826 
+
2827 
+    yyg->yy_start_stack_ptr = 0;
2828 
+    yyg->yy_start_stack_depth = 0;
2829 
+    yyg->yy_start_stack =  NULL;
2830 
+
2831 
+/* Defined in main.c */
2832 
+#ifdef YY_STDINIT
2833 
+    yyin = stdin;
2834 
+    yyout = stdout;
2835 
+#else
2836 
+    yyin = (FILE *) 0;
2837 
+    yyout = (FILE *) 0;
2838 
+#endif
2839 
+
2840 
+    /* For future reference: Set errno on error, since we are called by
2841 
+     * yara_yylex_init()
2842 
+     */
2843 
+    return 0;
2844 
+}
2845 
+
2846 
+/* yara_yylex_destroy is for both reentrant and non-reentrant scanners. */
2847 
+int yara_yylex_destroy  (yyscan_t yyscanner)
2848 
+{
2849 
+    struct yyguts_t * yyg = (struct yyguts_t*)yyscanner;
2850 
+
2851 
+    /* Pop the buffer stack, destroying each element. */
2852 
+	while(YY_CURRENT_BUFFER){
2853 
+		yara_yy_delete_buffer(YY_CURRENT_BUFFER ,yyscanner );
2854 
+		YY_CURRENT_BUFFER_LVALUE = NULL;
2855 
+		yara_yypop_buffer_state(yyscanner);
2856 
+	}
2857 
+
2858 
+	/* Destroy the stack itself. */
2859 
+	yara_yyfree(yyg->yy_buffer_stack ,yyscanner);
2860 
+	yyg->yy_buffer_stack = NULL;
2861 
+
2862 
+    /* Destroy the start condition stack. */
2863 
+        yara_yyfree(yyg->yy_start_stack ,yyscanner );
2864 
+        yyg->yy_start_stack = NULL;
2865 
+
2866 
+    /* Reset the globals. This is important in a non-reentrant scanner so the next time
2867 
+     * yara_yylex() is called, initialization will occur. */
2868 
+    yy_init_globals( yyscanner);
2869 
+
2870 
+    /* Destroy the main struct (reentrant only). */
2871 
+    yara_yyfree ( yyscanner , yyscanner );
2872 
+    yyscanner = NULL;
2873 
+    return 0;
2874 
+}
2875 
+
2876 
+/*
2877 
+ * Internal utility routines.
2878 
+ */
2879 
+
2880 
+#ifndef yytext_ptr
2881 
+static void yy_flex_strncpy (char* s1, yyconst char * s2, int n , yyscan_t yyscanner)
2882 
+{
2883 
+	register int i;
2884 
+	for ( i = 0; i < n; ++i )
2885 
+		s1[i] = s2[i];
2886 
+}
2887 
+#endif
2888 
+
2889 
+#ifdef YY_NEED_STRLEN
2890 
+static int yy_flex_strlen (yyconst char * s , yyscan_t yyscanner)
2891 
+{
2892 
+	register int n;
2893 
+	for ( n = 0; s[n]; ++n )
2894 
+		;
2895 
+
2896 
+	return n;
2897 
+}
2898 
+#endif
2899 
+
2900 
+void *yara_yyalloc (yy_size_t  size , yyscan_t yyscanner)
2901 
+{
2902 
+	return (void *) malloc( size );
2903 
+}
2904 
+
2905 
+void *yara_yyrealloc  (void * ptr, yy_size_t  size , yyscan_t yyscanner)
2906 
+{
2907 
+	/* The cast to (char *) in the following accommodates both
2908 
+	 * implementations that use char* generic pointers, and those
2909 
+	 * that use void* generic pointers.  It works with the latter
2910 
+	 * because both ANSI C and C++ allow castless assignment from
2911 
+	 * any pointer type to void*, and deal with argument conversions
2912 
+	 * as though doing an assignment.
2913 
+	 */
2914 
+	return (void *) realloc( (char *) ptr, size );
2915 
+}
2916 
+
2917 
+void yara_yyfree (void * ptr , yyscan_t yyscanner)
2918 
+{
2919 
+	free( (char *) ptr );	/* see yara_yyrealloc() for (char *) cast */
2920 
+}
2921 
+
2922 
+#define YYTABLES_NAME "yytables"
2923 
+
2924 
+#line 593 "yara_lexer.l"
2925 
+
2926 
+
2927 
+
2928 
+
2929 
+void yywarning(
2930 
+    yyscan_t yyscanner,
2931 
+    const char *warning_message)
2932 
+{
2933 
+#ifdef REAL_YARA
2934 
+  YR_COMPILER* compiler = yara_yyget_extra(yyscanner);
2935 
+  char* file_name;
2936 
+
2937 
+  if (compiler->file_name_stack_ptr > 0)
2938 
+    file_name = compiler->file_name_stack[compiler->file_name_stack_ptr - 1];
2939 
+  else
2940 
+    file_name = NULL;
2941 
+
2942 
+  compiler->callback(
2943 
+      YARA_ERROR_LEVEL_WARNING,
2944 
+      file_name,
2945 
+      yara_yyget_lineno(yyscanner),
2946 
+      warning_message);
2947 
+#else
2948 
+  if (warning_message != NULL)
2949 
+    cli_errmsg("yara_lexer:yywarning() %s\n", warning_message);
2950 
+  else
2951 
+    cli_errmsg("yara_lexer:yywarning() unknown warning\n");
2952 
+#endif
2953 
+}
2954 
+
2955 
+
2956 
+void yyfatal(
2957 
+    yyscan_t yyscanner,
2958 
+    const char *error_message)
2959 
+{
2960 
+#ifdef REAL_YARA
2961 
+  YR_COMPILER* compiler = yara_yyget_extra(yyscanner);
2962 
+
2963 
+  yyerror(yyscanner, compiler, error_message);
2964 
+  longjmp(compiler->error_recovery, 1);
2965 
+#else
2966 
+  if (error_message != NULL)
2967 
+    cli_errmsg("yara_lexer:yyfatal() %s\n", error_message);
2968 
+  else
2969 
+    cli_errmsg("yara_lexer:yyfatal() unknown error\n");
2970 
+#endif
2971 
+}
2972 
+
2973 
+
2974 
+void yyerror(
2975 
+    yyscan_t yyscanner,
2976 
+    YR_COMPILER* compiler,
2977 
+    const char *error_message)
2978 
+{
2979 
+#ifdef REAL_YARA
2980 
+  char message[512] = {'\0'};
2981 
+  char* file_name = NULL;
2982 
+
2983 
+  /*
2984 
+    if error_message != NULL the error comes from yyparse internal code
2985 
+    else the error comes from my code and the error code is set in
2986 
+    compiler->last_result
2987 
+  */
2988 
+
2989 
+  compiler->errors++;
2990 
+
2991 
+  if (compiler->error_line != 0)
2992 
+    compiler->last_error_line = compiler->error_line;
2993 
+  else
2994 
+    compiler->last_error_line = yara_yyget_lineno(yyscanner);
2995 
+
2996 
+  compiler->error_line = 0;
2997 
+
2998 
+  if (compiler->file_name_stack_ptr > 0)
2999 
+  {
3000 
+    file_name = compiler->file_name_stack[compiler->file_name_stack_ptr - 1];
3001 
+  }
3002 
+  else
3003 
+  {
3004 
+    file_name = NULL;
3005 
+  }
3006 
+
3007 
+  if (error_message != NULL)
3008 
+  {
3009 
+    yr_compiler_set_error_extra_info(compiler, error_message);
3010 
+    compiler->last_error = ERROR_SYNTAX_ERROR;
3011 
+
3012 
+    if (compiler->callback != NULL)
3013 
+    {
3014 
+      compiler->callback(
3015 
+          YARA_ERROR_LEVEL_ERROR,
3016 
+          file_name,
3017 
+          compiler->last_error_line,
3018 
+          error_message);
3019 
+    }
3020 
+  }
3021 
+  else
3022 
+  {
3023 
+    compiler->last_error = compiler->last_result;
3024 
+
3025 
+    if (compiler->callback != NULL)
3026 
+    {
3027 
+      yr_compiler_get_error_message(compiler, message, sizeof(message));
3028 
+
3029 
+      compiler->callback(
3030 
+        YARA_ERROR_LEVEL_ERROR,
3031 
+        file_name,
3032 
+        compiler->last_error_line,
3033 
+        message);
3034 
+    }
3035 
+  }
3036 
+
3037 
+  compiler->last_result = ERROR_SUCCESS;
3038 
+#else
3039 
+  if (error_message != NULL)
3040 
+    cli_errmsg("yara_lexer:yyerror() %s\n", error_message);
3041 
+  else if (compiler->error_msg != NULL)
3042 
+    cli_errmsg("yara_lexer:yyerror() %s\n", compiler->error_msg);
3043 
+  else if (compiler->last_error_extra_info[0] != (char) 0)
3044 
+    cli_errmsg("yara_lexer:yyerror() %s\n", compiler->last_error_extra_info);
3045 
+  else
3046 
+    cli_errmsg("yara_lexer:yyerror() error unknown\n");
3047 
+  compiler->last_error_extra_info[0] = (char) 0;
3048 
+  compiler->error_msg = NULL;
3049 
+  compiler->last_result = ERROR_SUCCESS;
3050 
+#endif
3051 
+}
3052 
+
3053 
+
3054 
+int yr_lex_parse_rules_string(
3055 
+  const char* rules_string,
3056 
+  YR_COMPILER* compiler)
3057 
+{
3058 
+#ifdef REAL_YARA
3059 
+  yyscan_t yyscanner;
3060 
+
3061 
+  compiler->errors = 0;
3062 
+
3063 
+  if (setjmp(compiler->error_recovery) != 0)
3064 
+    return compiler->errors;
3065 
+
3066 
+  yara_yylex_init(&yyscanner);
3067 
+
3068 
+  yara_yyset_debug(1,yyscanner);
3069 
+
3070 
+  yara_yyset_extra(compiler,yyscanner);
3071 
+
3072 
+  yara_yy_scan_string(rules_string,yyscanner);
3073 
+
3074 
+  yara_yyset_lineno(1,yyscanner);
3075 
+  yyparse(yyscanner, compiler);
3076 
+  yara_yylex_destroy(yyscanner);
3077 
+
3078 
+  return compiler->errors;
3079 
+#else
3080 
+  cli_errmsg("yara_lexer:yr_lex_parse_rules_string() disabled\n");
3081 
+  return 0;
3082 
+#endif
3083 
+}
3084 
+
3085 
+
3086 
+int yr_lex_parse_rules_file(
3087 
+  FILE* rules_file,
3088 
+  YR_COMPILER* compiler)
3089 
+{
3090 
+  yyscan_t yyscanner;
3091 
+
3092 
+#ifdef REAL_YARA
3093 
+  compiler->errors = 0;
3094 
+
3095 
+  if (setjmp(compiler->error_recovery) != 0)
3096 
+    return compiler->errors;
3097 
+#endif
3098 
+
3099 
+  yara_yylex_init(&yyscanner);
3100 
+
3101 
+  #if YYDEBUG
3102 
+  printf("debug enabled");
3103 
+  #endif
3104 
+
3105 
+  yara_yyset_debug(1,yyscanner);
3106 
+
3107 
+  yara_yyset_in(rules_file,yyscanner);
3108 
+  yara_yyset_extra(compiler,yyscanner);
3109 
+  yyparse(yyscanner, compiler);
3110 
+  yara_yylex_destroy(yyscanner);
3111 
+
3112 
+#ifdef REAL_YARA
3113 
+  return compiler->errors;
3114 
+#else
3115 
+  return 0;
3116 
+#endif
3117 
+}
3118 
+