fix: issue while matching wide regular expression with FastVM

VirusTotal · Mar 7, 2024 · 449cb03 · 449cb03
1 parent 013b539
commit 449cb03
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 16 deletions.
diff --git a/lib/src/modules/pe/rva2off.rs b/lib/src/modules/pe/rva2off.rs
@@ -42,7 +42,7 @@ pub(crate) fn rva_to_offset(
     // Find the section that contains the target RVA. If there are multiple
     // sections that may contain the RVA, the last one is used.
     for s in sections.iter() {
-        // In theory we should use the section's virtual size while
+        // In theory, we should use the section's virtual size while
         // checking if some RVA is within the section. In most cases
         // the virtual size is greater than the raw data size, but that's
         // not always the case. So we use the larger of the two values.

diff --git a/lib/src/re/fast/fastvm.rs b/lib/src/re/fast/fastvm.rs
@@ -497,12 +497,12 @@ impl FastVM<'_> {
                 return false;
             }
 
-            let wide_error = Cell::new(None);
+            let error_pos = Cell::new(None);
 
             // Iterate the input in chunks of two bytes, where the first one
             // must match a byte in the literal, and the second one is the
             // interleaved zero.
-            let input = WideIter::zero_first(input.iter().rev(), &wide_error);
+            let input = WideIter::zero_first(input.iter().rev(), &error_pos);
 
             for (input, byte, mask) in
                 izip!(input, literal.iter().rev(), mask.iter().rev())
@@ -512,8 +512,10 @@ impl FastVM<'_> {
                 }
             }
 
-            if wide_error.get().is_some() {
-                return false;
+            if let Some(pos) = error_pos.get() {
+                if pos < literal.len() {
+                    return false;
+                }
             }
         } else {
             if input.len() < literal.len() {

diff --git a/lib/src/tests/mod.rs b/lib/src/tests/mod.rs
@@ -1322,11 +1322,6 @@ fn regexp_patterns_4() {
     */
 }
 
-#[test]
-fn issue() {
-    pattern_match!(r"/foo.{1,3}\n/", b"foobar\x0a", b"foobar\x0a");
-}
-
 #[test]
 fn regexp_patterns_5() {
     rule_true!(
@@ -1506,18 +1501,18 @@ fn regexp_wide() {
         b"f\x00o\x00o\x00b\x00a\x00r\x00b\x00a\x00z\x00"
     );
 
-    pattern_match!(
-        r"/(http|https):\/\// wide nocase",
-        b"\x00h\x00t\x00t\x00p\x00s\x00:\x00/\x00/\x00",
-        b"h\x00t\x00t\x00p\x00s\x00:\x00/\x00/\x00"
-    );
-
     pattern_match!(
         r"/foobar/ wide nocase",
         b"f\x00o\x00o\x00b\x00a\x00r\x00x\x01",
         b"f\x00o\x00o\x00b\x00a\x00r\x00"
     );
 
+    pattern_match!(
+        r#"/(baz|qux)foobar/ nocase wide"#,
+        b"x\x01b\x00a\x00z\x00f\x00o\x00o\x00b\x00a\x00r\x00",
+        b"b\x00a\x00z\x00f\x00o\x00o\x00b\x00a\x00r\x00"
+    );
+
     pattern_match!(
         r"/https?:\/\/.{5,128}\.png/ wide",
         b"\xcc\xcch\x00t\x00t\x00p\x00s\x00:\x00/\x00/\x00f\x00o\x00o\x00b\x00a\x00r\x00/\x00b\x00a\x00z\x00.\x00p\x00n\x00g\x00\xcc\xcc",