intel / intel/hyperscan

BUG: `NOT` logical operation fails when `data` length is lower than the `pattern` length.

Open
#335 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
5.5k
Forks
816
Avg merge
4d 21h
Merged PRs (30d)
2

Description

Hi team,

I wanted to express the following (to not match the given pattern) by using logical combination operator `NOT`.

`NOT (/foo/)`

But looks there is a problem when the data to be scanned is smaller than the pattern to match against, it exits soon due to:

https://github.com/intel/hyperscan/blob/64a995bf445d86b74eb0f375624ffc85682eadfe/src/runtime.c#L346

> Removing that check fixes the problem, however, I'm unsure what's supposed to be guarded by that check (apart from the obvious)

I created a POC to reproduce this issue. PTAL in case I'm doing something wrong.

```C
#include "hs.h"
#include

int match_handler(unsigned int id,
unsigned long long from,
unsigned long long to,
unsigned int flags,
void *context) {
printf("[match_handler] id: %d from: %d to: %d flags: %d", id, from, to, flags);
return 0;
}

int main() {
hs_error_t err;

// content to be scanned (size 3)
const std::string content("foo");

// patterns
const char *expr[] = {"bars", "!101"};

unsigned flags[] = {HS_FLAG_QUIET, HS_FLAG_COMBINATION};
unsigned ids[] = {101, 102};

printf("[*] execute_hyperscan_test()");

// build a database
hs_database_t *db = nullptr;
hs_compile_error_t *compile_err = nullptr;

err = hs_compile_multi(expr, flags, ids, 2, HS_MODE_NOSTREAM,
nullptr, &db, &compile_err);

if (err != HS_SUCCESS) {
printf("Failed to compile");
return;
}

// alloc some scratch
hs_scratch_t *scratch = nullptr;
err = hs_alloc_scratch(db, &scratch);

if (err != HS_SUCCESS || scratch == nullptr) {
printf("Failed to allocate scratch");
return;
}

err = hs_scan(db, content.c_str(), content.size(), 0, scratch, match_handler, nullptr);

if (err != HS_SUCCESS) {
printf("hyperscan can failed: 0x%08X", err);
return;
}

err = hs_free_scratch(scratch);

if (err != HS_SUCCESS) {
printf("failed freeing scratch");
return;
}

hs_free_database(db);
}
```

Despite the data length isn't enough, I'd expect to return a match regardless of the pattern size in this case.

Let me know if you require further details/clarifications.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.