Revert commit 330bc74 and fix #2007 in the way suggested in #2010

VirusTotal · Dec 29, 2023 · c63cbf3 · c63cbf3
1 parent 5b6f0f6
commit c63cbf3
Show file tree

Hide file tree

Showing 9 changed files with 180 additions and 160 deletions.
diff --git a/libyara/hex_lexer.c b/libyara/hex_lexer.c
@@ -1038,7 +1038,7 @@ YY_DECL
 		}
 
 	{
-#line 96 "libyara/hex_lexer.l"
+#line 95 "libyara/hex_lexer.l"
 
 
 
@@ -1109,7 +1109,7 @@ YY_DECL
 
 case 1:
 YY_RULE_SETUP
-#line 99 "libyara/hex_lexer.l"
+#line 98 "libyara/hex_lexer.l"
 {
 
   yylval->integer = xtoi(yytext);
@@ -1118,7 +1118,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 2:
 YY_RULE_SETUP
-#line 105 "libyara/hex_lexer.l"
+#line 104 "libyara/hex_lexer.l"
 {
 
   yytext[1] = '0'; // replace ? by 0
@@ -1128,7 +1128,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 3:
 YY_RULE_SETUP
-#line 112 "libyara/hex_lexer.l"
+#line 111 "libyara/hex_lexer.l"
 {
 
   yylval->integer = xtoi(&(yytext[1]));
@@ -1137,7 +1137,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 4:
 YY_RULE_SETUP
-#line 118 "libyara/hex_lexer.l"
+#line 117 "libyara/hex_lexer.l"
 {
 
   yytext[0] = '0'; // replace ? by 0
@@ -1147,7 +1147,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 5:
 YY_RULE_SETUP
-#line 125 "libyara/hex_lexer.l"
+#line 124 "libyara/hex_lexer.l"
 {
 
   yylval->integer = 0x0000;
@@ -1156,7 +1156,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 6:
 YY_RULE_SETUP
-#line 131 "libyara/hex_lexer.l"
+#line 130 "libyara/hex_lexer.l"
 {
 
   yytext[2] = '0'; // replace ? by 0
@@ -1166,7 +1166,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 7:
 YY_RULE_SETUP
-#line 138 "libyara/hex_lexer.l"
+#line 137 "libyara/hex_lexer.l"
 {
 
   yytext[1] = '0'; // replace ? by 0
@@ -1176,7 +1176,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 8:
 YY_RULE_SETUP
-#line 145 "libyara/hex_lexer.l"
+#line 144 "libyara/hex_lexer.l"
 {
 
   yyerror(yyscanner, lex_env, "uneven number of digits in hex string");
@@ -1185,7 +1185,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 9:
 YY_RULE_SETUP
-#line 151 "libyara/hex_lexer.l"
+#line 150 "libyara/hex_lexer.l"
 {
 
   yyerror(yyscanner, lex_env, "invalid not operator (~) in hex string");
@@ -1194,7 +1194,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 10:
 YY_RULE_SETUP
-#line 158 "libyara/hex_lexer.l"
+#line 157 "libyara/hex_lexer.l"
 {
 
   BEGIN(range);
@@ -1203,15 +1203,15 @@ YY_RULE_SETUP
 	YY_BREAK
 case 11:
 YY_RULE_SETUP
-#line 164 "libyara/hex_lexer.l"
+#line 163 "libyara/hex_lexer.l"
 {
 
   BEGIN(comment);
 }
 	YY_BREAK
 case 12:
 YY_RULE_SETUP
-#line 169 "libyara/hex_lexer.l"
+#line 168 "libyara/hex_lexer.l"
 {
 
   BEGIN(INITIAL);
@@ -1220,25 +1220,25 @@ YY_RULE_SETUP
 case 13:
 /* rule 13 can match eol */
 YY_RULE_SETUP
-#line 174 "libyara/hex_lexer.l"
+#line 173 "libyara/hex_lexer.l"
 // skip comments
 	YY_BREAK
 case 14:
 YY_RULE_SETUP
-#line 176 "libyara/hex_lexer.l"
+#line 175 "libyara/hex_lexer.l"
 // skip single-line comments
 	YY_BREAK
 case 15:
 YY_RULE_SETUP
-#line 178 "libyara/hex_lexer.l"
+#line 177 "libyara/hex_lexer.l"
 {
 
   return yytext[0];
 }
 	YY_BREAK
 case 16:
 YY_RULE_SETUP
-#line 183 "libyara/hex_lexer.l"
+#line 182 "libyara/hex_lexer.l"
 {
 
   yylval->integer = atoi(yytext);
@@ -1247,7 +1247,7 @@ YY_RULE_SETUP
 	YY_BREAK
 case 17:
 YY_RULE_SETUP
-#line 189 "libyara/hex_lexer.l"
+#line 188 "libyara/hex_lexer.l"
 {
 
   BEGIN(INITIAL);
@@ -1257,12 +1257,12 @@ YY_RULE_SETUP
 case 18:
 /* rule 18 can match eol */
 YY_RULE_SETUP
-#line 195 "libyara/hex_lexer.l"
+#line 194 "libyara/hex_lexer.l"
 // skip whitespaces
 	YY_BREAK
 case 19:
 YY_RULE_SETUP
-#line 197 "libyara/hex_lexer.l"
+#line 196 "libyara/hex_lexer.l"
 {
 
   yyerror(yyscanner, lex_env, "invalid character in hex string jump");
@@ -1272,20 +1272,20 @@ YY_RULE_SETUP
 case 20:
 /* rule 20 can match eol */
 YY_RULE_SETUP
-#line 203 "libyara/hex_lexer.l"
+#line 202 "libyara/hex_lexer.l"
 // skip whitespaces
 	YY_BREAK
 case 21:
 YY_RULE_SETUP
-#line 205 "libyara/hex_lexer.l"
+#line 204 "libyara/hex_lexer.l"
 {        // pass valid characters to the parser
 
   return yytext[0];
 }
 	YY_BREAK
 case 22:
 YY_RULE_SETUP
-#line 210 "libyara/hex_lexer.l"
+#line 209 "libyara/hex_lexer.l"
 {               // reject all other characters
 
   yyerror(yyscanner, lex_env, "invalid character in hex string");
@@ -1294,8 +1294,8 @@ YY_RULE_SETUP
 	YY_BREAK
 case 23:
 YY_RULE_SETUP
-#line 216 "libyara/hex_lexer.l"
-YY_FATAL_ERROR( "flex scanner jammed" );
+#line 215 "libyara/hex_lexer.l"
+ECHO;
 	YY_BREAK
 #line 1300 "libyara/hex_lexer.c"
 case YY_STATE_EOF(INITIAL):
@@ -2450,7 +2450,7 @@ void yyfree (void * ptr , yyscan_t yyscanner)
 
 #define YYTABLES_NAME "yytables"
 
-#line 216 "libyara/hex_lexer.l"
+#line 215 "libyara/hex_lexer.l"
 
 
 //

diff --git a/libyara/hex_lexer.l b/libyara/hex_lexer.l
@@ -72,7 +72,6 @@ with noyywrap then we can remove this pragma.
 %}
 
 %option reentrant bison-bridge
-%option nodefault
 %option noyywrap
 %option nounistd
 %option noinput

diff --git a/libyara/include/yara/hex_lexer.h b/libyara/include/yara/hex_lexer.h
@@ -53,6 +53,12 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define yyget_extra  hex_yyget_extra
 #define yyget_lineno hex_yyget_lineno
 
+// Define the ECHO macro as an empty macro in order to avoid the default
+// implementation from being used. The default implementation of ECHO
+// prints to the console any byte that is not matched by the lexer. It's
+// not safe to print random bytes to the console as it may cause the calling
+// program to terminate. See: https://github.com/VirusTotal/yara/issues/2007
+#define ECHO
 
 #ifndef YY_TYPEDEF_YY_SCANNER_T
 #define YY_TYPEDEF_YY_SCANNER_T

diff --git a/libyara/include/yara/lexer.h b/libyara/include/yara/lexer.h
@@ -29,7 +29,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #include <yara/compiler.h>
 
-
 #undef yyparse
 #undef yylex
 #undef yyerror
@@ -55,6 +54,12 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define yyget_extra  yara_yyget_extra
 #define yyget_lineno yara_yyget_lineno
 
+// Define the ECHO macro as an empty macro in order to avoid the default
+// implementation from being used. The default implementation of ECHO
+// prints to the console any byte that is not matched by the lexer. It's
+// not safe to print random bytes to the console as it may cause the calling
+// program to terminate. See: https://github.com/VirusTotal/yara/issues/2007
+#define ECHO
 
 #ifndef YY_TYPEDEF_YY_SCANNER_T
 #define YY_TYPEDEF_YY_SCANNER_T
@@ -74,11 +79,9 @@ union YYSTYPE;
 // own function instead of the one provided by default.
 #define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg)
 
-
 #define YY_EXTRA_TYPE YR_COMPILER*
 #define YY_USE_CONST
 
-
 int yyget_lineno(yyscan_t yyscanner);
 
 int yylex(
@@ -100,7 +103,10 @@ void yyfatal(yyscan_t yyscanner, const char* error_message);
 
 YY_EXTRA_TYPE yyget_extra(yyscan_t yyscanner);
 
-int yr_lex_parse_rules_bytes(const void* rules_data, size_t rules_size, YR_COMPILER* compiler);
+int yr_lex_parse_rules_bytes(
+    const void* rules_data,
+    size_t rules_size,
+    YR_COMPILER* compiler);
 
 int yr_lex_parse_rules_string(const char* rules_string, YR_COMPILER* compiler);
 

diff --git a/libyara/include/yara/re_lexer.h b/libyara/include/yara/re_lexer.h
@@ -53,6 +53,13 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define yyget_extra  re_yyget_extra
 #define yyget_lineno re_yyget_lineno
 
+// Define the ECHO macro as an empty macro in order to avoid the default
+// implementation from being used. The default implementation of ECHO
+// prints to the console any byte that is not matched by the lexer. It's
+// not safe to print random bytes to the console as it may cause the calling
+// program to terminate. See: https://github.com/VirusTotal/yara/issues/2007
+#define ECHO
+
 #ifndef YY_TYPEDEF_YY_SCANNER_T
 #define YY_TYPEDEF_YY_SCANNER_T
 typedef void* yyscan_t;
@@ -61,8 +68,8 @@ typedef void* yyscan_t;
 #define YY_EXTRA_TYPE RE_AST*
 #define YY_USE_CONST
 
-#define VALID_ESCAPE_SEQUENCE     1
-#define UNKNOWN_ESCAPE_SEQUENCE   2
+#define VALID_ESCAPE_SEQUENCE   1
+#define UNKNOWN_ESCAPE_SEQUENCE 2
 
 typedef struct _RE_LEX_ENVIRONMENT
 {
@@ -109,4 +116,8 @@ void yyfatal(yyscan_t yyscanner, const char* error_message);
 
 int yyparse(void* yyscanner, RE_LEX_ENVIRONMENT* lex_env);
 
-int yr_parse_re_string(const char* re_string, RE_AST** re_ast, RE_ERROR* error, int flags);
+int yr_parse_re_string(
+    const char* re_string,
+    RE_AST** re_ast,
+    RE_ERROR* error,
+    int flags);