VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.14k stars 1.43k forks source link

Compiler error at the end of file reports file name as (null) #928

Closed metthal closed 6 years ago

metthal commented 6 years ago

Steps to reproduce:

$ echo "rule AlwaysHit { condition: true" > /tmp/rule.yar
$ yara /tmp/rule.yar /tmp/rule.yar
(null)(0): error: syntax error, unexpected $end, expecting '}'

Description:

I've also tried to figure our where's the problem and I found the source of it, but I don't have much time right now to find the best way of solving it without introducing any hacks. My notes:

File names are pushed onto the file_name_stack. This happens in yr_compiler_add_file so each time new file is added to the compiler, new file name gets pushed onto the stack. This happens for the input file specified through command-line, but then also happens for every included file. Whenever lexer runs into <<EOF>> it pops the file name from the stack (while also popping input buffer to the previously included file). The problem is that action for <<EOF>> in lexer happens before grammar action, where the mentioned error is produced. Therefore, file name is already lost.

The proper way to handle this would mean postponing popping of file name from the file name stack until the parser action happens. From that nature of bison and flex, I hardly believe this is going to be possible. We can try moving semantic action for <<EOF>> from lexer to grammar but I haven't tried it and I don't really know if it would work. I'll get back to this when I have more time. Until then, I'll just leave it here.

plusvic commented 6 years ago

I stumbled upon this issue long ago, but then forgot about it. Thanks for the detailed report!