search

VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.13k stars 1.42k forks source link

Warn on always false integer reads and comparisons. #1919

Open wxsBSD opened 1 year ago

wxsBSD commented 1 year ago

When reading an integer of a specific size and comparing it to an integer of a larger size where any of the upper bits are set we will now emit a warning because the comparison is always false.

These will always evaluate to false because the "extra" bytes are non-zero:

uint8(0) == 0x1100 uint16(0) == 0x110000 uint32(0) == 0x1100000000

While I'm here, move a test into a better place for it. I added it in the wrong place in ccbc405.

Fixes #1918.

plusvic commented 1 year ago

Do we really need EXPRESSION_TYPE_INTEGER_FUNCTION? I mean, as long as every EXPRESSION_TYPE_INTEGER has an associated field width indicating the number of bits in that integer we can check that operations between integers of different widths are ok, no matter if they come from uintXX or from somewhere else. Treating the result of a uintXX function as the rest of integers, instead of having a special case, simplifies things and allows to properly raise warnings in cases like uint8(0) & 1 == 0x1100. The expression uint8(0) & 1 would be EXPRESSION_TYPE_INTEGER as well as uint8(0), but uint8(0) & 1 could retain the with of uint8(0) and propagate it up to uint8(0) & 1 == 0x1100.