@@ -315,7 +315,7 @@ int cl_init(unsigned int initoptions)

 struct cl_engine *cl_engine_new(void)

 {

-	struct cl_engine *new;

+    struct cl_engine *new;

     cli_intel_t *intel;

     new = (struct cl_engine *) cli_calloc(1, sizeof(struct cl_engine));

@@ -436,6 +436,44 @@ struct cl_engine *cl_engine_new(void)

     new->pcre_recmatch_limit = CLI_DEFAULT_PCRE_RECMATCH_LIMIT;

     new->pcre_max_filesize = CLI_DEFAULT_PCRE_MAX_FILESIZE;

+    /* Initialize YARA */

+    if (ERROR_SUCCESS != yr_arena_create(1024, 0, &new->the_arena)) {

+        cli_errmsg("cli_engine_new: failed to create the YARA arena\n");

+        mpool_free(new->mempool, new->dconf);

+        mpool_free(new->mempool, new->root);

+#ifdef USE_MPOOL

+        mpool_destroy(new->mempool);

+#endif

+        free(new);

+        free(intel);

+        return NULL;

+    }    

+    if (ERROR_SUCCESS != yr_hash_table_create(10007, &new->rules_table)) {

+        cli_errmsg("cli_engine_new: failed to create the YARA rules table\n");

+        yr_arena_destroy(new->the_arena);

+        mpool_free(new->mempool, new->dconf);

+        mpool_free(new->mempool, new->root);

+#ifdef USE_MPOOL

+        mpool_destroy(new->mempool);

+#endif

+        free(new);

+        free(intel);

+        return NULL;

+    }

+    if (ERROR_SUCCESS != yr_hash_table_create(10007, &new->objects_table)) {

+        cli_errmsg("cli_engine_new: failed to create the YARA objects table\n");

+        yr_hash_table_destroy(new->rules_table, NULL);

+        yr_arena_destroy(new->the_arena);

+        mpool_free(new->mempool, new->dconf);

+        mpool_free(new->mempool, new->root);

+#ifdef USE_MPOOL

+        mpool_destroy(new->mempool);

+#endif

+        free(new);

+        free(intel);

+        return NULL;

+    }

+

     cli_dbgmsg("Initialized %s engine\n", cl_retver());

     return new;

 }

@@ -53,6 +53,7 @@

 #ifdef HAVE_JSON

 #include "json.h"

 #endif

+#include "yara_clam.h"

 #if HAVE_LIBXML2

 #define CLAMAV_MIN_XMLREADER_FLAGS (XML_PARSE_NOERROR | XML_PARSE_NONET)

@@ -356,6 +357,11 @@ struct cl_engine {

     uint64_t pcre_match_limit;

     uint64_t pcre_recmatch_limit;

     uint64_t pcre_max_filesize;

+

+    /* YARA */

+    YR_ARENA      * the_arena;

+    YR_HASH_TABLE * rules_table;

+    YR_HASH_TABLE * objects_table;

 };

 struct cl_settings {

@@ -3774,11 +3774,7 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,

     STAILQ_INIT(&compiler.rule_q);

     STAILQ_INIT(&compiler.current_rule_string_q);

-    rc = yr_hash_table_create(10007, &compiler.rules_table);

-    if (rc == ERROR_SUCCESS)

-        rc = yr_hash_table_create(10007, &compiler.objects_table);

-    if (rc == ERROR_SUCCESS)

-        rc = yr_arena_create(65536, 0, &compiler.sz_arena);

+    rc = yr_arena_create(65536, 0, &compiler.sz_arena);

     if (rc == ERROR_SUCCESS)

         rc = yr_arena_create(65536, 0, &compiler.rules_arena);

     if (rc == ERROR_SUCCESS)

@@ -3792,17 +3788,18 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,

     compiler.loop_for_of_mem_offset = -1;

     ns.name = "default";

     compiler.current_namespace = &ns;

+    compiler.the_arena = engine->the_arena;

+    compiler.rules_table = engine->rules_table;

+    compiler.objects_table = engine->objects_table;

     rc = yr_lex_parse_rules_file(fs, &compiler);

     if (rc > 0) { /* rc = number of errors */

         /* TODO - handle the various errors? */

         cli_errmsg("cli_loadyara: failed to parse rules file %s, error count %i\n", dbname, rc);

-        yr_hash_table_destroy(compiler.rules_table, NULL);

-        yr_hash_table_destroy(compiler.objects_table, NULL);

-        //        yr_arena_destroy(compiler.sz_arena);

-        //        yr_arena_destroy(compiler.rules_arena);

+        yr_arena_destroy(compiler.sz_arena);

+        yr_arena_destroy(compiler.rules_arena);

         yr_arena_destroy(compiler.code_arena);

-        //        yr_arena_destroy(compiler.strings_arena);

+        yr_arena_destroy(compiler.strings_arena);

         yr_arena_destroy(compiler.metas_arena);

 #ifdef YARA_FINISHED

         return CL_EMALFDB;

@@ -3826,12 +3823,10 @@ static int cli_loadyara(FILE *fs, struct cl_engine *engine, unsigned int *signo,

         }

     }

-    yr_hash_table_destroy(compiler.rules_table, NULL);

-    yr_hash_table_destroy(compiler.objects_table, NULL);

-    //    yr_arena_destroy(compiler.sz_arena);

-    //    yr_arena_destroy(compiler.rules_arena);

+    yr_arena_append(engine->the_arena, compiler.sz_arena);

+    yr_arena_append(engine->the_arena, compiler.rules_arena);

+    yr_arena_append(engine->the_arena, compiler.strings_arena);

     yr_arena_destroy(compiler.code_arena);

-    //    yr_arena_destroy(compiler.strings_arena);

     yr_arena_destroy(compiler.metas_arena);

     if(rc)

@@ -4285,6 +4280,7 @@ int cl_load(const char *path, struct cl_engine *engine, unsigned int *signo, uns

 	    cli_errmsg("cl_load(%s): Not supported database file type\n", path);

 	    return CL_EOPEN;

     }

+

 #ifdef YARA_PROTO

     if (yara_total) {

         cli_yaramsg("$$$$$$$$$$$$ YARA $$$$$$$$$$$$\n");

@@ -4553,9 +4549,6 @@ int cl_engine_free(struct cl_engine *engine)

 		    for(j = 0; j < root->ac_lsigs; j++) {

 			if (root->ac_lsigtable[j]->type == CLI_LSIG_NORMAL)

 			    mpool_free(engine->mempool, root->ac_lsigtable[j]->u.logic);

-			else if (root->ac_lsigtable[j]->type == CLI_YARA_NORMAL ||

-                                 root->ac_lsigtable[j]->type == CLI_YARA_NORMAL)

-			    free(root->ac_lsigtable[j]->u.code_start);

 			FREE_TDB(root->ac_lsigtable[j]->tdb);

 			mpool_free(engine->mempool, root->ac_lsigtable[j]);

 		    }

@@ -4667,6 +4660,16 @@ int cl_engine_free(struct cl_engine *engine)

 #ifdef USE_MPOOL

     if(engine->mempool) mpool_destroy(engine->mempool);

 #endif

+

+    if (engine->rules_table)

+        yr_hash_table_destroy(engine->rules_table, NULL);

+

+    if (engine->objects_table)

+        yr_hash_table_destroy(engine->objects_table, NULL);

+

+    if (engine->the_arena)

+        yr_arena_destroy(engine->the_arena);

+

     free(engine);

     return CL_SUCCESS;

 }

@@ -4680,6 +4683,13 @@ int cl_engine_compile(struct cl_engine *engine)

     if(!engine)

 	return CL_ENULLARG;

+    /* Free YARA hash tables - only needed for parse and load */

+    if (engine->rules_table)

+        yr_hash_table_destroy(engine->rules_table, NULL);

+    if (engine->objects_table)

+        yr_hash_table_destroy(engine->objects_table, NULL);

+    engine->rules_table = engine->objects_table = NULL;

+

     if(!engine->ftypes)

 	if((ret = cli_loadftm(NULL, engine, 0, 1, NULL)))

 	    return ret;

@@ -31,8 +31,8 @@ from files.

 #include <time.h>

 #include <stdint.h>

-#include "yara_clam.h"

 #include <yara_arena.h>

+#include "yara_clam.h"

 #if REAL_YARA

 #include <yara/mem.h>

 #include <yara/error.h>

@@ -750,7 +750,7 @@ int yr_arena_write_string(

       (void**) written_string);

 }

-#if REAL_YARA

+

 //

 // yr_arena_append

 //

@@ -777,7 +777,7 @@ int yr_arena_append(

   return ERROR_SUCCESS;

 }

-#endif

+

 #if REAL_YARA

 //

@@ -41,9 +41,9 @@ limitations under the License.

 #define _YARA_CLAM_H_

 #include "shared/queue.h"

-#include "others.h"

 #include "yara_arena.h"

 #include "yara_hash.h"

+#include "others.h"

 /* From libyara/include/yara/types.h            */

 #define DECLARE_REFERENCE(type, name) \

@@ -313,95 +313,6 @@ typedef struct _SIZED_STRING

 #define RE_FLAGS_DOT_ALL                  0x80

 #define RE_FLAGS_NOT_AT_START            0x100

-/* From libyara/include/yara/exec.h            */

-

-#define UNDEFINED           0xFFFABADAFABADAFFLL

-#define IS_UNDEFINED(x)     ((x) == UNDEFINED)

-

-#define OP_HALT           255

-

-#define OP_AND            1

-#define OP_OR             2

-#define OP_XOR            3

-#define OP_NOT            4

-#define OP_LT             5

-#define OP_GT             6

-#define OP_LE             7

-#define OP_GE             8

-#define OP_EQ             9

-#define OP_NEQ            10

-#define OP_SZ_EQ          11

-#define OP_SZ_NEQ         12

-#define OP_SZ_TO_BOOL     13

-#define OP_ADD            14

-#define OP_SUB            15

-#define OP_MUL            16

-#define OP_DIV            17

-#define OP_MOD            18

-#define OP_NEG            19

-#define OP_SHL            20

-#define OP_SHR            21

-#define OP_PUSH           22

-#define OP_POP            23

-#define OP_CALL           24

-#define OP_OBJ_LOAD       25

-#define OP_OBJ_VALUE      26

-#define OP_OBJ_FIELD      27

-#define OP_INDEX_ARRAY    28

-#define OP_STR_COUNT      29

-#define OP_STR_FOUND      30

-#define OP_STR_FOUND_AT   31

-#define OP_STR_FOUND_IN   32

-#define OP_STR_OFFSET     33

-#define OP_OF             34

-#define OP_PUSH_RULE      35

-#define OP_MATCH_RULE     36

-#define OP_INCR_M         37

-#define OP_CLEAR_M        38

-#define OP_ADD_M          39

-#define OP_POP_M          40

-#define OP_PUSH_M         41

-#define OP_SWAPUNDEF      42

-#define OP_JNUNDEF        43

-#define OP_JLE            44

-#define OP_FILESIZE       45

-#define OP_ENTRYPOINT     46

-#define OP_INT8           47

-#define OP_INT16          48

-#define OP_INT32          49

-#define OP_UINT8          50

-#define OP_UINT16         51

-#define OP_UINT32         52

-#define OP_CONTAINS       53

-#define OP_MATCHES        54

-#define OP_IMPORT         55

-

-/*

-typedef struct _YR_MATCH

-{

-  int64_t offset;

-  int32_t length;

-

-  union {

-    uint8_t* data;            // Confirmed matches use "data",

-    int32_t chain_length;    // unconfirmed ones use "chain_length"

-  };

-

-  struct _YR_MATCH*  prev;

-  struct _YR_MATCH*  next;

-

-} YR_MATCH;

-

-typedef struct _YR_MATCHES

-{

-  int32_t count;

-

-  DECLARE_REFERENCE(YR_MATCH*, head);

-  DECLARE_REFERENCE(YR_MATCH*, tail);

-

-} YR_MATCHES;

-*/

-

 typedef struct _YR_META

 {

   int32_t type;

@@ -564,30 +475,31 @@ typedef struct _yc_compiler {

     int                 last_error_line;

     int                 last_result;

-    YR_ARENA*           sz_arena;

-    YR_ARENA*           rules_arena;

-    YR_ARENA*           strings_arena;

-    YR_ARENA*           code_arena;

-    YR_ARENA*           metas_arena;

-    YR_HASH_TABLE*      rules_table;

-    YR_HASH_TABLE*      objects_table;

-    YR_NAMESPACE*       current_namespace;

-    yc_string*          current_rule_strings;

+    YR_ARENA            *sz_arena;

+    YR_ARENA            *rules_arena;

+    YR_ARENA            *strings_arena;

+    YR_ARENA            *code_arena;

+    YR_ARENA            *metas_arena;

+    YR_ARENA            *the_arena;

+    YR_HASH_TABLE       *rules_table;

+    YR_HASH_TABLE       *objects_table;

+    YR_NAMESPACE        *current_namespace;

+    yc_string           *current_rule_strings;

     uint32_t            current_rule_flags;

     uint32_t            current_rule_clflags;

-    int8_t*             loop_address[MAX_LOOP_NESTING];

-    char*               loop_identifier[MAX_LOOP_NESTING];

+    int8_t              *loop_address[MAX_LOOP_NESTING];

+    char                *loop_identifier[MAX_LOOP_NESTING];

     int                 loop_depth;

     int                 loop_for_of_mem_offset;

     char                last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO];

     char                lex_buf[LEX_BUF_SIZE];

-    char*               lex_buf_ptr;

+    char                *lex_buf_ptr;

     unsigned short      lex_buf_len;

-    char *              error_msg;   

+    char                *error_msg;   

     STAILQ_HEAD(rq, _yc_rule) rule_q;

     STAILQ_HEAD(cs, _yc_string) current_rule_string_q;

@@ -165,7 +165,7 @@ int yr_execute_code(

   while(1)

   {

-      //    cli_errmsg("yara_exec: executing %i\n", *ip);

+    cli_dbgmsg("yara_exec: executing %i\n", *ip);

     switch(*ip)

     {

       case OP_HALT:

@@ -101,6 +101,7 @@

 #include "libclamav/yara_grammar.h"

 #include "libclamav/yara_lexer.h"

 #include "libclamav/yara_parser.h"

+#include "libclamav/yara_exec.h"

 #endif

 #define YYERROR_VERBOSE

@@ -150,7 +151,7 @@

 /* Line 268 of yacc.c  */

-#line 154 "yara_grammar.c"

+#line 155 "yara_grammar.c"

 /* Enabling traces.  */

 #ifndef YYDEBUG

@@ -291,7 +292,7 @@ typedef union YYSTYPE

 {

 /* Line 293 of yacc.c  */

-#line 213 "yara_grammar.y"

+#line 214 "yara_grammar.y"

   SIZED_STRING*   sized_string;

   char*           c_string;

@@ -304,7 +305,7 @@ typedef union YYSTYPE

 /* Line 293 of yacc.c  */

-#line 308 "yara_grammar.c"

+#line 309 "yara_grammar.c"

 } YYSTYPE;

 # define YYSTYPE_IS_TRIVIAL 1

 # define yystype YYSTYPE /* obsolescent; will be withdrawn */

@@ -316,7 +317,7 @@ typedef union YYSTYPE

 /* Line 343 of yacc.c  */

-#line 320 "yara_grammar.c"

+#line 321 "yara_grammar.c"

 #ifdef short

 # undef short

@@ -654,18 +655,18 @@ static const yytype_int8 yyrhs[] =

 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */

 static const yytype_uint16 yyrline[] =

 {

-       0,   226,   226,   228,   229,   230,   231,   236,   248,   267,

-     270,   300,   304,   332,   337,   338,   343,   344,   350,   353,

-     373,   390,   429,   430,   435,   451,   464,   477,   494,   495,

-     500,   514,   513,   530,   547,   548,   553,   554,   555,   556,

-     561,   646,   696,   719,   759,   762,   784,   817,   864,   882,

-     891,   900,   915,   929,   942,   959,   975,  1009,   974,  1120,

-    1119,  1195,  1201,  1207,  1213,  1221,  1230,  1239,  1248,  1257,

-    1284,  1311,  1338,  1342,  1350,  1351,  1356,  1378,  1390,  1406,

-    1405,  1411,  1423,  1424,  1429,  1434,  1443,  1444,  1451,  1462,

-    1466,  1475,  1490,  1501,  1512,  1523,  1534,  1545,  1556,  1565,

-    1590,  1603,  1618,  1640,  1675,  1684,  1693,  1702,  1711,  1720,

-    1729,  1738,  1747,  1755,  1764,  1773

+       0,   227,   227,   229,   230,   231,   232,   237,   249,   268,

+     271,   301,   305,   333,   338,   339,   344,   345,   351,   354,

+     374,   391,   430,   431,   436,   452,   465,   478,   495,   496,

+     501,   515,   514,   531,   548,   549,   554,   555,   556,   557,

+     562,   647,   697,   720,   760,   763,   785,   818,   865,   883,

+     892,   901,   916,   930,   943,   960,   976,  1010,   975,  1121,

+    1120,  1196,  1202,  1208,  1214,  1222,  1231,  1240,  1249,  1258,

+    1285,  1312,  1339,  1343,  1351,  1352,  1357,  1379,  1391,  1407,

+    1406,  1412,  1424,  1425,  1430,  1435,  1444,  1445,  1452,  1463,

+    1467,  1476,  1491,  1502,  1513,  1524,  1535,  1546,  1557,  1566,

+    1591,  1604,  1619,  1641,  1676,  1685,  1694,  1703,  1712,  1721,

+    1730,  1739,  1748,  1756,  1765,  1774

 };

 #endif

@@ -1505,74 +1506,74 @@ yydestruct (yymsg, yytype, yyvaluep, yyscanner, compiler)

       case 9: /* "_IDENTIFIER_" */

 /* Line 1391 of yacc.c  */

-#line 204 "yara_grammar.y"

+#line 205 "yara_grammar.y"

 	{ yr_free((yyvaluep->c_string)); };

 /* Line 1391 of yacc.c  */

-#line 1513 "yara_grammar.c"

+#line 1514 "yara_grammar.c"

 	break;

       case 10: /* "_STRING_IDENTIFIER_" */

 /* Line 1391 of yacc.c  */

-#line 205 "yara_grammar.y"

+#line 206 "yara_grammar.y"

 	{ yr_free((yyvaluep->c_string)); };

 /* Line 1391 of yacc.c  */

-#line 1522 "yara_grammar.c"

+#line 1523 "yara_grammar.c"

 	break;

       case 11: /* "_STRING_COUNT_" */

 /* Line 1391 of yacc.c  */

-#line 206 "yara_grammar.y"

+#line 207 "yara_grammar.y"

 	{ yr_free((yyvaluep->c_string)); };

 /* Line 1391 of yacc.c  */

-#line 1531 "yara_grammar.c"

+#line 1532 "yara_grammar.c"

 	break;

       case 12: /* "_STRING_OFFSET_" */

 /* Line 1391 of yacc.c  */

-#line 207 "yara_grammar.y"

+#line 208 "yara_grammar.y"

 	{ yr_free((yyvaluep->c_string)); };

 /* Line 1391 of yacc.c  */

-#line 1540 "yara_grammar.c"

+#line 1541 "yara_grammar.c"

 	break;

       case 13: /* "_STRING_IDENTIFIER_WITH_WILDCARD_" */

 /* Line 1391 of yacc.c  */

-#line 208 "yara_grammar.y"

+#line 209 "yara_grammar.y"

 	{ yr_free((yyvaluep->c_string)); };

 /* Line 1391 of yacc.c  */

-#line 1549 "yara_grammar.c"

+#line 1550 "yara_grammar.c"

 	break;

       case 15: /* "_TEXT_STRING_" */

 /* Line 1391 of yacc.c  */

-#line 209 "yara_grammar.y"

+#line 210 "yara_grammar.y"

 	{ yr_free((yyvaluep->sized_string)); };

 /* Line 1391 of yacc.c  */

-#line 1558 "yara_grammar.c"

+#line 1559 "yara_grammar.c"

 	break;

       case 16: /* "_HEX_STRING_" */

 /* Line 1391 of yacc.c  */

-#line 210 "yara_grammar.y"

+#line 211 "yara_grammar.y"

 	{ yr_free((yyvaluep->sized_string)); };

 /* Line 1391 of yacc.c  */

-#line 1567 "yara_grammar.c"

+#line 1568 "yara_grammar.c"

 	break;

       case 17: /* "_REGEXP_" */

 /* Line 1391 of yacc.c  */

-#line 211 "yara_grammar.y"

+#line 212 "yara_grammar.y"

 	{ yr_free((yyvaluep->sized_string)); };

 /* Line 1391 of yacc.c  */

-#line 1576 "yara_grammar.c"

+#line 1577 "yara_grammar.c"

 	break;

       default:

@@ -1875,7 +1876,7 @@ yyreduce:

         case 7:

 /* Line 1806 of yacc.c  */

-#line 237 "yara_grammar.y"

+#line 238 "yara_grammar.y"

     {

         int result = yr_parser_reduce_import(yyscanner, (yyvsp[(2) - (2)].sized_string));

@@ -1888,7 +1889,7 @@ yyreduce:

   case 8:

 /* Line 1806 of yacc.c  */

-#line 249 "yara_grammar.y"

+#line 250 "yara_grammar.y"

     {

         int result = yr_parser_reduce_rule_declaration(

             yyscanner,

@@ -1907,7 +1908,7 @@ yyreduce:

   case 9:

 /* Line 1806 of yacc.c  */

-#line 267 "yara_grammar.y"

+#line 268 "yara_grammar.y"

     {

         (yyval.meta) = NULL;

       }

@@ -1916,7 +1917,7 @@ yyreduce:

   case 10:

 /* Line 1806 of yacc.c  */

-#line 271 "yara_grammar.y"

+#line 272 "yara_grammar.y"

     {

 #if REAL_YARA //Meta not supported

         // Each rule have a list of meta-data info, consisting in a

@@ -1946,7 +1947,7 @@ yyreduce:

   case 11:

 /* Line 1806 of yacc.c  */

-#line 300 "yara_grammar.y"

+#line 301 "yara_grammar.y"

     {

         (yyval.string) = NULL;

         compiler->current_rule_strings = (yyval.string);

@@ -1956,7 +1957,7 @@ yyreduce:

   case 12:

 /* Line 1806 of yacc.c  */

-#line 305 "yara_grammar.y"

+#line 306 "yara_grammar.y"

     {

         // Each rule have a list of strings, consisting in a sequence

         // of YR_STRING structures. The last YR_STRING structure does not

@@ -1985,35 +1986,35 @@ yyreduce:

   case 14:

 /* Line 1806 of yacc.c  */

-#line 337 "yara_grammar.y"

+#line 338 "yara_grammar.y"

     { (yyval.integer) = 0;  }

     break;

   case 15:

 /* Line 1806 of yacc.c  */

-#line 338 "yara_grammar.y"

+#line 339 "yara_grammar.y"

     { (yyval.integer) = (yyvsp[(1) - (2)].integer) | (yyvsp[(2) - (2)].integer); }

     break;

   case 16:

 /* Line 1806 of yacc.c  */

-#line 343 "yara_grammar.y"

+#line 344 "yara_grammar.y"

     { (yyval.integer) = RULE_GFLAGS_PRIVATE; }

     break;

   case 17:

 /* Line 1806 of yacc.c  */

-#line 344 "yara_grammar.y"

+#line 345 "yara_grammar.y"

     { (yyval.integer) = RULE_GFLAGS_GLOBAL; }

     break;

   case 18:

 /* Line 1806 of yacc.c  */

-#line 350 "yara_grammar.y"

+#line 351 "yara_grammar.y"

     {

         (yyval.c_string) = NULL;

       }

@@ -2022,7 +2023,7 @@ yyreduce:

   case 19:

 /* Line 1806 of yacc.c  */

-#line 354 "yara_grammar.y"

+#line 355 "yara_grammar.y"

     {

 #if REAL_YARA //tags not supported

         // Tags list is represented in the arena as a sequence

@@ -2043,7 +2044,7 @@ yyreduce:

   case 20:

 /* Line 1806 of yacc.c  */

-#line 374 "yara_grammar.y"

+#line 375 "yara_grammar.y"

     {

 #if REAL_YARA //tags not supported

         char* identifier;

@@ -2065,7 +2066,7 @@ yyreduce:

   case 21:

 /* Line 1806 of yacc.c  */

-#line 391 "yara_grammar.y"

+#line 392 "yara_grammar.y"

     {

 #if REAL_YARA //tags not supported

         char* tag_name = (yyvsp[(1) - (2)].c_string);

@@ -2104,21 +2105,21 @@ yyreduce:

   case 22:

 /* Line 1806 of yacc.c  */

-#line 429 "yara_grammar.y"

+#line 430 "yara_grammar.y"

     {  (yyval.meta) = (yyvsp[(1) - (1)].meta); }

     break;

   case 23:

 /* Line 1806 of yacc.c  */

-#line 430 "yara_grammar.y"

+#line 431 "yara_grammar.y"

     {  (yyval.meta) = (yyvsp[(1) - (2)].meta); }

     break;

   case 24:

 /* Line 1806 of yacc.c  */

-#line 436 "yara_grammar.y"

+#line 437 "yara_grammar.y"

     {

         SIZED_STRING* sized_string = (yyvsp[(3) - (3)].sized_string);

@@ -2139,7 +2140,7 @@ yyreduce:

   case 25:

 /* Line 1806 of yacc.c  */

-#line 452 "yara_grammar.y"

+#line 453 "yara_grammar.y"

     {

         (yyval.meta) = yr_parser_reduce_meta_declaration(

             yyscanner,

@@ -2157,7 +2158,7 @@ yyreduce:

   case 26:

 /* Line 1806 of yacc.c  */

-#line 465 "yara_grammar.y"

+#line 466 "yara_grammar.y"

     {

         (yyval.meta) = yr_parser_reduce_meta_declaration(

             yyscanner,

@@ -2175,7 +2176,7 @@ yyreduce:

   case 27:

 /* Line 1806 of yacc.c  */

-#line 478 "yara_grammar.y"

+#line 479 "yara_grammar.y"

     {

         (yyval.meta) = yr_parser_reduce_meta_declaration(

             yyscanner,

@@ -2193,21 +2194,21 @@ yyreduce:

   case 28:

 /* Line 1806 of yacc.c  */

-#line 494 "yara_grammar.y"

+#line 495 "yara_grammar.y"

     { (yyval.string) = (yyvsp[(1) - (1)].string); }

     break;

   case 29:

 /* Line 1806 of yacc.c  */

-#line 495 "yara_grammar.y"

+#line 496 "yara_grammar.y"

     { (yyval.string) = (yyvsp[(1) - (2)].string); }

     break;

   case 30:

 /* Line 1806 of yacc.c  */

-#line 501 "yara_grammar.y"

+#line 502 "yara_grammar.y"

     {

         (yyval.string) = yr_parser_reduce_string_declaration(

             yyscanner,

@@ -2225,7 +2226,7 @@ yyreduce:

   case 31:

 /* Line 1806 of yacc.c  */

-#line 514 "yara_grammar.y"

+#line 515 "yara_grammar.y"

     {

         compiler->error_line = yyget_lineno(yyscanner);

       }

@@ -2234,7 +2235,7 @@ yyreduce:

   case 32:

 /* Line 1806 of yacc.c  */

-#line 518 "yara_grammar.y"

+#line 519 "yara_grammar.y"

     {

         (yyval.string) = yr_parser_reduce_string_declaration(

             yyscanner,

@@ -2252,7 +2253,7 @@ yyreduce:

   case 33:

 /* Line 1806 of yacc.c  */

-#line 531 "yara_grammar.y"

+#line 532 "yara_grammar.y"

     {

         (yyval.string) = yr_parser_reduce_string_declaration(

             yyscanner,

@@ -2270,49 +2271,49 @@ yyreduce:

   case 34:

 /* Line 1806 of yacc.c  */

-#line 547 "yara_grammar.y"

+#line 548 "yara_grammar.y"

     { (yyval.integer) = 0; }

     break;

   case 35:

 /* Line 1806 of yacc.c  */

-#line 548 "yara_grammar.y"

+#line 549 "yara_grammar.y"

     { (yyval.integer) = (yyvsp[(1) - (2)].integer) | (yyvsp[(2) - (2)].integer); }

     break;

   case 36:

 /* Line 1806 of yacc.c  */

-#line 553 "yara_grammar.y"

+#line 554 "yara_grammar.y"

     { (yyval.integer) = STRING_GFLAGS_WIDE; }

     break;

   case 37:

 /* Line 1806 of yacc.c  */

-#line 554 "yara_grammar.y"

+#line 555 "yara_grammar.y"

     { (yyval.integer) = STRING_GFLAGS_ASCII; }

     break;

   case 38:

 /* Line 1806 of yacc.c  */

-#line 555 "yara_grammar.y"

+#line 556 "yara_grammar.y"

     { (yyval.integer) = STRING_GFLAGS_NO_CASE; }

     break;

   case 39:

 /* Line 1806 of yacc.c  */

-#line 556 "yara_grammar.y"

+#line 557 "yara_grammar.y"

     { (yyval.integer) = STRING_GFLAGS_FULL_WORD; }

     break;

   case 40:

 /* Line 1806 of yacc.c  */

-#line 562 "yara_grammar.y"

+#line 563 "yara_grammar.y"

     {

         YR_OBJECT* object = NULL;

         YR_RULE* rule;

@@ -2402,7 +2403,7 @@ yyreduce:

   case 41:

 /* Line 1806 of yacc.c  */

-#line 647 "yara_grammar.y"

+#line 648 "yara_grammar.y"

     {

         YR_OBJECT* object = (yyvsp[(1) - (3)].object);

         YR_OBJECT* field = NULL;

@@ -2457,7 +2458,7 @@ yyreduce:

   case 42:

 /* Line 1806 of yacc.c  */

-#line 697 "yara_grammar.y"

+#line 698 "yara_grammar.y"

     {

         if ((yyvsp[(1) - (4)].object) != NULL && (yyvsp[(1) - (4)].object)->type == OBJECT_TYPE_ARRAY)

         {

@@ -2484,7 +2485,7 @@ yyreduce:

   case 43:

 /* Line 1806 of yacc.c  */

-#line 720 "yara_grammar.y"

+#line 721 "yara_grammar.y"

     {

         int args_count;

@@ -2524,7 +2525,7 @@ yyreduce:

   case 44:

 /* Line 1806 of yacc.c  */

-#line 759 "yara_grammar.y"

+#line 760 "yara_grammar.y"

     {

         (yyval.c_string) = yr_strdup("");

       }

@@ -2533,7 +2534,7 @@ yyreduce:

   case 45:

 /* Line 1806 of yacc.c  */

-#line 763 "yara_grammar.y"

+#line 764 "yara_grammar.y"

     {

         (yyval.c_string) = yr_malloc(MAX_FUNCTION_ARGS + 1);

@@ -2560,7 +2561,7 @@ yyreduce:

   case 46:

 /* Line 1806 of yacc.c  */

-#line 785 "yara_grammar.y"

+#line 786 "yara_grammar.y"

     {

         if (strlen((yyvsp[(1) - (3)].c_string)) == MAX_FUNCTION_ARGS)

         {

@@ -2594,7 +2595,7 @@ yyreduce:

   case 47:

 /* Line 1806 of yacc.c  */

-#line 818 "yara_grammar.y"

+#line 819 "yara_grammar.y"

     {

 #ifdef REAL_YARA

         SIZED_STRING* sized_string = (yyvsp[(1) - (1)].sized_string);

@@ -2642,7 +2643,7 @@ yyreduce:

   case 48:

 /* Line 1806 of yacc.c  */

-#line 865 "yara_grammar.y"

+#line 866 "yara_grammar.y"

     {

         if ((yyvsp[(1) - (1)].expression_type) == EXPRESSION_TYPE_STRING)

         {

@@ -2662,7 +2663,7 @@ yyreduce:

   case 49:

 /* Line 1806 of yacc.c  */

-#line 883 "yara_grammar.y"

+#line 884 "yara_grammar.y"