Bug matching strings with when ( | ) follows a []

[GoogleCodeExporter]

If a string contains a jump operator [] and the next is a alternative operator 
( | ) the string never matches.

What steps will reproduce the problem?

That string:

$a = {3C [0-2] (69 | 49) (66 | 46) (72 | 52) (61 | 41) (6D | 4D) (65 | 45)}

Don't work.

But this:

$a = {3C (69 | 49) (66 | 46) (72 | 52) (61 | 41) (6D | 4D) (65 | 45)}

Worked.

the string that I tried to match is "<iframe" but i want to match also < iframe

What version of the product are you using? On what operating system?
Using yara 1.6 under windows 7 x64

Original issue reported on code.google.com by golgotr...@gmail.com on 22 May 2012 at 8:44

[GoogleCodeExporter]

Fixed in r151

Original comment by plus...@gmail.com on 22 May 2012 at 10:17

• Changed state: Fixed

[GoogleCodeExporter]

Thank you for the very quick fix of the problem :))

Original comment by golgotr...@gmail.com on 22 May 2012 at 12:16