Skip to content

fix: Properly cast RangeExpression#286

Merged
metthal merged 2 commits intoavast:masterfrom
AnetaKvapilova:fix-range-expression
Jan 14, 2026
Merged

fix: Properly cast RangeExpression#286
metthal merged 2 commits intoavast:masterfrom
AnetaKvapilova:fix-range-expression

Conversation

@AnetaKvapilova
Copy link
Contributor

@AnetaKvapilova AnetaKvapilova commented Jan 13, 2026

Issue: The YARA parser crashed when using a for ... in loop with an integer range expression like (0 .. 0x1500).

Root cause: The code in parser_driver.cpp assumed that for_expression_set was always a SetExpression and used static_pointer_cast to cast it. However, it can also be a RangeExpression (e.g., (0 .. 0x1500)), which caused the cast to fail.

Fix:

  • Changed from static_pointer_cast to dynamic_pointer_cast
  • Added a check: if it's a SetExpression, derive the iterator type from the first element; if it's a RangeExpression, default to Int type (since ranges are always over integers)

@AnetaKvapilova AnetaKvapilova marked this pull request as ready for review January 13, 2026 13:40
@metthal metthal self-requested a review January 14, 2026 17:01
auto symbol = std::make_shared<ValueSymbol>(args[2].getTokenIt()->getString(), !iterSet->getElements().empty() ? iterSet->getElements()[0]->getType() : Expression::Type::Int);
// for_expression_set can be either SetExpression (enumeration) or RangeExpression (range)
auto iterType = Expression::Type::Int;
if (auto iterSet = std::dynamic_pointer_cast<const SetExpression>(args[4].getExpression()))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd just use as<T> instead of dynamic pointer cast directly since we are using as in other places already.

@metthal metthal merged commit 52675fc into avast:master Jan 14, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments