[Forensics-changes] [yara] 296/407: Check function arguments for undefined values before calling the function.
Hilko Bengen
bengen at moszumanska.debian.org
Sat Jul 1 10:28:38 UTC 2017
This is an automated email from the git hooks/post-receive script.
bengen pushed a commit to annotated tag v3.3.0
in repository yara.
commit e275dcb6d5a8d7da0f9bce6a2137167866d94ec0
Author: Victor M. Alvarez <plusvic at gmail.com>
Date: Fri Jan 2 19:55:37 2015 +0100
Check function arguments for undefined values before calling the function.
If some argument was undefined the function is not called at all and the result is undefined.
---
libyara/exec.c | 15 +++++++++++++++
libyara/modules/hash.c | 30 ++----------------------------
libyara/modules/tests.c | 14 +++++---------
3 files changed, 22 insertions(+), 37 deletions(-)
diff --git a/libyara/exec.c b/libyara/exec.c
index 32820cf..1aff8bc 100644
--- a/libyara/exec.c
+++ b/libyara/exec.c
@@ -490,12 +490,17 @@ int yr_execute_code(
ip += sizeof(uint64_t);
i = strlen(args_fmt);
+ count = 0;
// pop arguments from stack and copy them to args array
while (i > 0)
{
pop(r1);
+
+ if (is_undef(r1)) // count the number of undefined args
+ count++;
+
args[i - 1] = r1.i;
i--;
}
@@ -503,6 +508,16 @@ int yr_execute_code(
pop(r2);
ensure_defined(r2);
+ if (count > 0)
+ {
+ // if there are undefined args, result for function call
+ // is undefined as well.
+
+ r1.i = UNDEFINED;
+ push(r1);
+ break;
+ }
+
function = UINT64_TO_PTR(YR_OBJECT_FUNCTION*, r2.i);
result = ERROR_INTERNAL_FATAL_ERROR;
diff --git a/libyara/modules/hash.c b/libyara/modules/hash.c
index 5b3213d..05d211c 100644
--- a/libyara/modules/hash.c
+++ b/libyara/modules/hash.c
@@ -45,10 +45,6 @@ void digest_to_ascii(
define_function(string_md5)
{
SIZED_STRING* s = sized_string_argument(1);
-
- if (IS_UNDEFINED(s))
- return_string(UNDEFINED);
-
MD5_CTX md5_context;
unsigned char digest[MD5_DIGEST_LENGTH];
@@ -67,11 +63,8 @@ define_function(string_md5)
define_function(string_sha256)
{
SIZED_STRING* s = sized_string_argument(1);
-
- if (IS_UNDEFINED(s))
- return_string(UNDEFINED);
-
SHA256_CTX sha256_context;
+
unsigned char digest[SHA256_DIGEST_LENGTH];
char digest_ascii[SHA256_DIGEST_LENGTH * 2 + 1];
@@ -88,11 +81,8 @@ define_function(string_sha256)
define_function(string_sha1)
{
SIZED_STRING* s = sized_string_argument(1);
-
- if (IS_UNDEFINED(s))
- return_string(UNDEFINED);
-
SHA_CTX sha_context;
+
unsigned char digest[SHA_DIGEST_LENGTH];
char digest_ascii[SHA_DIGEST_LENGTH * 2 + 1];
@@ -109,10 +99,6 @@ define_function(string_sha1)
define_function(string_checksum32)
{
SIZED_STRING* s = sized_string_argument(1);
-
- if (IS_UNDEFINED(s))
- return_integer(UNDEFINED);
-
uint32_t checksum = 0;
for (int i = 0; i < s->length; i++)
@@ -127,9 +113,6 @@ define_function(data_md5)
int64_t offset = integer_argument(1); // offset where to start
int64_t length = integer_argument(2); // length of bytes we want hash on
- if (IS_UNDEFINED(offset) || IS_UNDEFINED(length))
- return_string(UNDEFINED);
-
YR_SCAN_CONTEXT* context = scan_context();
YR_MEMORY_BLOCK* block = NULL;
@@ -194,9 +177,6 @@ define_function(data_sha1)
int64_t offset = integer_argument(1); // offset where to start
int64_t length = integer_argument(2); // length of bytes we want hash on
- if (IS_UNDEFINED(offset) || IS_UNDEFINED(length))
- return_string(UNDEFINED);
-
YR_SCAN_CONTEXT* context = scan_context();
YR_MEMORY_BLOCK* block = NULL;
@@ -260,9 +240,6 @@ define_function(data_sha256)
int64_t offset = integer_argument(1); // offset where to start
int64_t length = integer_argument(2); // length of bytes we want hash on
- if (IS_UNDEFINED(offset) || IS_UNDEFINED(length))
- return_string(UNDEFINED);
-
YR_SCAN_CONTEXT* context = scan_context();
YR_MEMORY_BLOCK* block = NULL;
@@ -326,9 +303,6 @@ define_function(data_checksum32)
int64_t offset = integer_argument(1); // offset where to start
int64_t length = integer_argument(2); // length of bytes we want hash on
- if (IS_UNDEFINED(offset) || IS_UNDEFINED(length))
- return_integer(UNDEFINED);
-
YR_SCAN_CONTEXT* context = scan_context();
YR_MEMORY_BLOCK* block = NULL;
diff --git a/libyara/modules/tests.c b/libyara/modules/tests.c
index 93b6ee6..9481e54 100644
--- a/libyara/modules/tests.c
+++ b/libyara/modules/tests.c
@@ -24,9 +24,6 @@ define_function(double_sum)
double a = double_argument(1);
double b = double_argument(2);
- if (a == UNDEFINED || b == UNDEFINED)
- return_double(UNDEFINED);
-
return_double(a + b);
}
@@ -35,9 +32,6 @@ define_function(sum_2)
int64_t a = integer_argument(1);
int64_t b = integer_argument(2);
- if (a == UNDEFINED || b == UNDEFINED)
- return_integer(UNDEFINED);
-
return_integer(a + b);
}
@@ -48,9 +42,6 @@ define_function(sum_3)
int64_t b = integer_argument(2);
int64_t c = integer_argument(3);
- if (a == UNDEFINED || b == UNDEFINED || c == UNDEFINED)
- return_integer(UNDEFINED);
-
return_integer(a + b + c);
}
@@ -70,6 +61,11 @@ begin_declarations;
declare_string("foo");
end_struct("constants");
+ begin_struct("undefined");
+ declare_integer("i");
+ declare_double("d");
+ end_struct("undefined");
+
declare_integer_array("integer_array");
declare_string_array("string_array");
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git
More information about the forensics-changes
mailing list