diff --git a/boreal/src/compiler/variable.rs b/boreal/src/compiler/variable.rs index fc888552..a8a33004 100644 --- a/boreal/src/compiler/variable.rs +++ b/boreal/src/compiler/variable.rs @@ -321,8 +321,8 @@ impl Variable { mem.len(), mat.start.saturating_add(MAX_SPLIT_MATCH_LENGTH), ); - match validator.as_regex().find(&mem[mat.start..end]) { - Some(m) => mat.start + m.end(), + match validator.find(&mem[mat.start..end]) { + Some(m) => mat.start + m.end, None => return AcMatchStatus::None, } } @@ -348,8 +348,8 @@ impl Variable { start_position, mat.end.saturating_sub(MAX_SPLIT_MATCH_LENGTH), ); - while let Some(m) = validator.as_regex().find(&mem[start..mat.end]) { - let m = (m.start() + start)..end; + while let Some(m) = validator.find(&mem[start..mat.end]) { + let m = (m.start + start)..end; start = m.start + 1; if let Some(m) = self.validate_and_update_match(mem, m) { matches.push(m); @@ -466,11 +466,11 @@ fn apply_wide_word_boundaries( #[allow(clippy::bool_to_int_with_if)] let expected_start = if start < mat.start { 1 } else { 0 }; - match regex.as_regex().find(&unwiden_mem) { - Some(m) if m.start() == expected_start => { + match regex.find(&unwiden_mem) { + Some(m) if m.start == expected_start => { // Modify the match end. This is needed because the application of word boundary // may modify the match. Since we matched on non wide mem though, double the size. - mat.end = mat.start + 2 * (m.end() - m.start()); + mat.end = mat.start + 2 * (m.end - m.start); Some(mat) } _ => None, diff --git a/boreal/src/evaluator/mod.rs b/boreal/src/evaluator/mod.rs index 6e0993b3..c0f3be26 100644 --- a/boreal/src/evaluator/mod.rs +++ b/boreal/src/evaluator/mod.rs @@ -601,7 +601,7 @@ impl Evaluator<'_, '_, '_, '_, '_> { } Expression::Matches(expr, regex) => { let s = self.evaluate_expr(expr)?.unwrap_bytes()?; - Ok(Value::Boolean(regex.as_regex().is_match(&s))) + Ok(Value::Boolean(regex.is_match(&s))) } Expression::Defined(expr) => match self.evaluate_expr(expr) { Ok(_) => Ok(Value::Boolean(true)), diff --git a/boreal/src/module/pe.rs b/boreal/src/module/pe.rs index 85846b63..9d3a1058 100644 --- a/boreal/src/module/pe.rs +++ b/boreal/src/module/pe.rs @@ -2012,7 +2012,7 @@ impl Pe { export .name .as_ref() - .map_or(false, |name| function_name_regex.as_regex().is_match(name)) + .map_or(false, |name| function_name_regex.is_match(name)) }), _ => return None, }; @@ -2051,7 +2051,7 @@ impl Pe { export .name .as_ref() - .map_or(false, |name| function_name_regex.as_regex().is_match(name)) + .map_or(false, |name| function_name_regex.is_match(name)) })?, _ => return None, }; @@ -2417,11 +2417,11 @@ impl Data { let mut nb_matches = 0; for imp in self.get_imports(delayed) { - if !dll_regex.as_regex().is_match(&imp.dll_name) { + if !dll_regex.is_match(&imp.dll_name) { continue; } for fun in &imp.functions { - if fun_regex.as_regex().is_match(&fun.name) { + if fun_regex.is_match(&fun.name) { nb_matches += 1; } } diff --git a/boreal/src/regex.rs b/boreal/src/regex.rs index 25bc0335..6cc67036 100644 --- a/boreal/src/regex.rs +++ b/boreal/src/regex.rs @@ -60,19 +60,30 @@ impl Regex { Ok(Regex { meta, expr }) } - /// Return the regex as a [`regex::bytes::Regex`]. + /// Find a match in the given haystack. #[must_use] - pub fn as_regex(&self) -> &meta::Regex { - &self.meta + pub fn find(&self, haystack: &[u8]) -> Option> { + self.find_in_input(Input::new(haystack)) } - /// Find a match on the given haystack starting at the given offset. + /// Find a match in the given haystack starting at the given offset. #[must_use] pub fn find_at(&self, haystack: &[u8], offset: usize) -> Option> { - let input = Input::new(haystack).span(offset..haystack.len()); + self.find_in_input(Input::new(haystack).span(offset..haystack.len())) + } + + /// Find a match on the given haystack in the given range + #[must_use] + fn find_in_input(&self, input: Input) -> Option> { self.meta.find(input).map(|m| m.range()) } + /// Returns true if and only if this regex matches the given haystack. + #[must_use] + pub fn is_match(&self, mem: &[u8]) -> bool { + self.meta.is_match(mem) + } + /// Returns the original string of this regex. #[must_use] pub fn as_str(&self) -> &str { diff --git a/boreal/tests/it/module_tests.rs b/boreal/tests/it/module_tests.rs index c73dda51..4ddeb0c6 100644 --- a/boreal/tests/it/module_tests.rs +++ b/boreal/tests/it/module_tests.rs @@ -369,8 +369,8 @@ impl Tests { let regex: Regex = args.next()?.try_into().ok()?; let s: Vec = args.next()?.try_into().ok()?; - Some(Value::Integer(match regex.as_regex().find(&s) { - Some(m) => m.range().len() as i64, + Some(Value::Integer(match regex.find(&s) { + Some(m) => m.len() as i64, None => -1, })) }