yara icon indicating copy to clipboard operation
yara copied to clipboard

Warn on always false integer reads and comparisons.

Open wxsBSD opened this issue 2 years ago • 1 comments

When reading an integer of a specific size and comparing it to an integer of a larger size where any of the upper bits are set we will now emit a warning because the comparison is always false.

These will always evaluate to false because the "extra" bytes are non-zero:

uint8(0) == 0x1100 uint16(0) == 0x110000 uint32(0) == 0x1100000000

While I'm here, move a test into a better place for it. I added it in the wrong place in ccbc405.

Fixes #1918.

wxsBSD avatar May 07 '23 03:05 wxsBSD

Do we really need EXPRESSION_TYPE_INTEGER_FUNCTION? I mean, as long as every EXPRESSION_TYPE_INTEGER has an associated field width indicating the number of bits in that integer we can check that operations between integers of different widths are ok, no matter if they come from uintXX or from somewhere else. Treating the result of a uintXX function as the rest of integers, instead of having a special case, simplifies things and allows to properly raise warnings in cases like uint8(0) & 1 == 0x1100. The expression uint8(0) & 1 would be EXPRESSION_TYPE_INTEGER as well as uint8(0), but uint8(0) & 1 could retain the with of uint8(0) and propagate it up to uint8(0) & 1 == 0x1100.

plusvic avatar May 19 '23 07:05 plusvic