[Forensics-changes] [yara] 15/135: Fix issue #131

[Hilko Bengen]

This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.1.0
in repository yara.

commit 74a7e4e9c4b914c0f7157e59d1e61cf07a72934e
Author: Victor M. Alvarez <plusvic at gmail.com>
Date:   Mon Mar 31 12:01:45 2014 +0200

    Fix issue #131
---
 libyara/re.c         | 30 ++++++++++++++++++++++++++++--
 yara-python/tests.py | 12 ++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/libyara/re.c b/libyara/re.c
index cd8b282..bf042aa 100644
--- a/libyara/re.c
+++ b/libyara/re.c
@@ -1465,14 +1465,40 @@ int yr_re_exec(
 
         case RE_OPCODE_SPACE:
           prolog;
-          match = (*input == ' ' || *input == '\t');
+          switch(*input)
+          {
+            case ' ':
+            case '\t':
+            case '\r':
+            case '\n':
+            case '\v':
+            case '\f':
+              match = TRUE;
+              break;
+
+            default:
+              match = FALSE;
+          }
           action = match ? ACTION_NONE : ACTION_KILL;
           fiber->ip += 1;
           break;
 
         case RE_OPCODE_NON_SPACE:
           prolog;
-          match = (*input != ' ' && *input != '\t');
+          switch(*input)
+          {
+            case ' ':
+            case '\t':
+            case '\r':
+            case '\n':
+            case '\v':
+            case '\f':
+              match = FALSE;
+              break;
+
+            default:
+              match = TRUE;
+          }
           action = match ? ACTION_NONE : ACTION_KILL;
           fiber->ip += 1;
           break;
diff --git a/yara-python/tests.py b/yara-python/tests.py
index 34c238d..b8b83c7 100644
--- a/yara-python/tests.py
+++ b/yara-python/tests.py
@@ -160,6 +160,18 @@ RE_TESTS = [
   ('a[^]b]c', 'adc', SUCCEED, 'adc'),
   ('[^ab]*', 'cde', SUCCEED, 'cde'),
   (')(', '', SYNTAX_ERROR),
+  (r'a\sb', 'a b', SUCCEED, 'a b'),
+  (r'a\sb', 'a\tb', SUCCEED, 'a\tb'),
+  (r'a\sb', 'a\rb', SUCCEED, 'a\rb'),
+  (r'a\sb', 'a\nb', SUCCEED, 'a\nb'),
+  (r'a\sb', 'a\vb', SUCCEED, 'a\vb'),
+  (r'a\sb', 'a\fb', SUCCEED, 'a\fb'),
+  (r'a\Sb', 'a b', FAIL),
+  (r'a\Sb', 'a\tb', FAIL),
+  (r'a\Sb', 'a\rb', FAIL),
+  (r'a\Sb', 'a\nb', FAIL),
+  (r'a\Sb', 'a\vb', FAIL),
+  (r'a\Sb', 'a\fb', FAIL),
   (r'\n\r\t\f\a', '\n\r\t\f\a', SUCCEED, '\n\r\t\f\a'),
   (r'[\n][\r][\t][\f][\a]', '\n\r\t\f\a', SUCCEED, '\n\r\t\f\a'),
   (r'\x00\x01\x02', '\x00\x01\x02', SUCCEED, '\x00\x01\x02'),

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git