avast/yaramod

For expression allows negative count

MatejKastak opened this issue · 0 comments

Expressions like this are not valid, but we allow them:

for -1 i in (0 .. 1) : (true)
for -1 i in (0 .. 1): (true)
for -123 i in (0 .. 1): (true)
rule test {
    condition:
        for -1 i in (0): (true)
}
env λ ~/dev/yara/yara for.yar /dev/null
error: rule "test" in for.yar(3): invalid value in condition: "-1"
>>> ymod.parse_string('''rule test {
...     condition:
...         for -1 i in (0): (true)
... }
... ''')
<yaramod.YaraFile object at 0x7f4cebab9070>

Definition of done: Yaramod won't parse the negative numbers, which is the same behavior as current YARA parser.