Add test case for uppercase atoms.

Related to VirusTotal#1716.
seonar22 · May 28, 2022 · 25f576a · 25f576a
1 parent 1fe26dc
commit 25f576a
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/tests/test-atoms.c b/tests/test-atoms.c
@@ -167,6 +167,12 @@ void test_heuristic_quality()
       .bytes = {0x61, 0x62, 0x63, 0x64},
       .mask = {0xFF, 0xFF, 0xFF, 0xFF}};
 
+  // ABCD
+  YR_ATOM a41424344 = {
+      .length = 4,
+      .bytes = {0x41, 0x42, 0x43, 0x44},
+      .mask = {0xFF, 0xFF, 0xFF, 0xFF}};
+
   // abc.
   YR_ATOM a6162632E = {
       .length = 4,
@@ -195,6 +201,8 @@ void test_heuristic_quality()
   int qCCCCCCCC = yr_atoms_heuristic_quality(&c, &aCCCCCCCC);
   int qFFFFFFFF = yr_atoms_heuristic_quality(&c, &aFFFFFFFF);
   int q61626364 = yr_atoms_heuristic_quality(&c, &a61626364);
+  int q41424344 = yr_atoms_heuristic_quality(&c, &a41424344);
+
   int q6162632E = yr_atoms_heuristic_quality(&c, &a6162632E);
 
   a010203.mask[1] = 0x00;
@@ -239,6 +247,7 @@ void test_heuristic_quality()
   assert_true_expr(q01020102 > q010203);
   assert_true_expr(q01020304 > q61626364);
   assert_true_expr(q010203 < q61626364);
+  assert_true_expr(q41424344 == q61626364);
   assert_true_expr(q6162632E > q61626364);
 
   // Byte sequences like 90 90 90 90 and CC CC CC CC are using as function