Improve parsing of string count expressions
Your checklist for this pull request
- [x] I've read the contributing guideline.
- [x] I've tested my changes by building and running mquery, and testing changed functionality (if applicable)
- [x] I've added automated tests for my change (if applicable, optional)
- [ ] I've updated documentation to reflect my change (if applicable)
What is the current behaviour?
The bug was discovered by running something equivalent to:
rule rule_name
{
meta:
description = "description"
author = "author"
date = "2022-04-05"
reference = "reference"
hash = "hash"
strings:
$name = "string"
condition:
#name >=3
}
>= operator was not supported well enough. I've also found many other cases of similar problems.
What is the new behaviour?
I fix some of the problems. There are still many ways to improve this (for example, handle #x != 0)
Test plan
I've tried to avoid any bugs, but due to the nature of the code (explicitly checking types of operators and parameters) it's bug-prone and there may be obscure combinations of operators that will be broken by this. I've taken moderate care to avoid this, but consulting https://yara.readthedocs.io/en/stable/writingrules.html for any edge cases may be helpful in review.
Closing issues
Submitted privately, no github issue.