math.percentage returns undefined value when the passed value is ou…

…tside the 0-255 range.
VirusTotal · Dec 28, 2023 · a1015aa · a1015aa
1 parent c6cc331
commit a1015aa
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 2 deletions.
diff --git a/libyara/modules/math/math.c b/libyara/modules/math/math.c
@@ -658,10 +658,13 @@ define_function(count_global)
 
 define_function(percentage_range)
 {
-  uint8_t byte = (uint8_t) integer_argument(1);
+  int64_t byte = integer_argument(1);
   int64_t offset = integer_argument(2);
   int64_t length = integer_argument(3);
 
+  if (byte < 0 || byte > 255)
+    return_float(YR_UNDEFINED);
+
   YR_SCAN_CONTEXT* context = yr_scan_context();
 
   uint32_t* distribution = get_distribution(offset, length, context);
@@ -681,7 +684,10 @@ define_function(percentage_range)
 
 define_function(percentage_global)
 {
-  uint8_t byte = (uint8_t) integer_argument(1);
+  int64_t byte = integer_argument(1);
+
+  if (byte < 0 || byte > 255)
+    return_float(YR_UNDEFINED);
 
   YR_SCAN_CONTEXT* context = yr_scan_context();
 

diff --git a/tests/test-math.c b/tests/test-math.c
@@ -127,6 +127,38 @@ int main(int argc, char** argv)
       }",
       "ABABCDEF");
 
+  assert_true_rule_blob(
+      "import \"math\" \
+      rule test { \
+        condition: \
+          not defined math.percentage(0x41, 0, 0) \
+      }",
+      "AABAAB");
+
+  assert_true_rule_blob(
+      "import \"math\" \
+      rule test { \
+        condition: \
+          not defined math.percentage(0x41, 10, 3)  \
+      }",
+      "AABAAB");
+
+  assert_true_rule_blob(
+      "import \"math\" \
+      rule test { \
+        condition: \
+          not defined math.percentage(0x41, 0, -3)  \
+      }",
+      "AABAAB");
+
+  assert_true_rule_blob(
+      "import \"math\" \
+      rule test { \
+        condition: \
+          not defined math.percentage(-1)  \
+      }",
+      "AABAAB");
+
   assert_true_rule_blob(
       "import \"math\" \
       rule test { \