[Forensics-changes] [yara] 152/192: Fix issue #647

[Hilko Bengen]

This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to annotated tag v3.6.0
in repository yara.

commit bbbb712cc68d6f126ec72d87b27a2e22e63db1d9
Author: plusvic <plusvic at gmail.com>
Date:   Wed Apr 26 14:04:01 2017 +0200

    Fix issue #647
---
 libyara/re.c       | 6 +++---
 tests/test-rules.c | 7 +++++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/libyara/re.c b/libyara/re.c
index 8237506..a5e4b86 100644
--- a/libyara/re.c
+++ b/libyara/re.c
@@ -2056,9 +2056,9 @@ int yr_re_exec(
           break;
 
         case RE_OPCODE_MATCH_AT_END:
-          action = input_size > (size_t) bytes_matched ?
-              ACTION_KILL :
-              ACTION_CONTINUE;
+          kill = flags & RE_FLAGS_BACKWARDS ||
+                 input_size > (size_t) bytes_matched;
+          action = kill ? ACTION_KILL : ACTION_CONTINUE;
           fiber->ip += 1;
           break;
 
diff --git a/tests/test-rules.c b/tests/test-rules.c
index 56aacf4..c26a25f 100644
--- a/tests/test-rules.c
+++ b/tests/test-rules.c
@@ -1111,7 +1111,14 @@ void test_re()
   assert_false_regexp("^abc$", "abcc");
   assert_true_regexp("^abc", "abcc", "abc");
   assert_false_regexp("^abc$", "aabc");
+  assert_false_regexp("abc^", "abc");
+  assert_false_regexp("ab^c", "abc");
+  assert_false_regexp("a^bcdef", "abcdef")
   assert_true_regexp("abc$", "aabc", "abc");
+  assert_false_regexp("$abc", "abc");
+  assert_true_regexp("(a|a$)bcd", "abcd", "abcd");
+  assert_false_regexp("(a$|a$)bcd", "abcd");
+  assert_false_regexp("(abc$|ab$)", "abcd");
   assert_true_regexp("^a(bc+|b[eh])g|.h$", "abhg", "abhg");
   assert_true_regexp("(bc+d$|ef*g.|h?i(j|k))", "effgz", "effgz");
   assert_true_regexp("(bc+d$|ef*g.|h?i(j|k))", "ij", "ij");

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git