forked from VirusTotal/yara
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement notebook data structure and use it in Aho-Corasick automaton.
- Loading branch information
Showing
8 changed files
with
207 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| // | ||
| // Created by Victor Manuel Alvarez on 3/4/20. | ||
| // | ||
|
|
||
| #ifndef YR_NOTEBOOK_H | ||
| #define YR_NOTEBOOK_H | ||
|
|
||
| #include <stdlib.h> | ||
|
|
||
| typedef struct YR_NOTEBOOK YR_NOTEBOOK; | ||
|
|
||
|
|
||
| int yr_notebook_create( | ||
| size_t page_size, | ||
| YR_NOTEBOOK** pool); | ||
|
|
||
|
|
||
| int yr_notebook_destroy( | ||
| YR_NOTEBOOK* pool); | ||
|
|
||
|
|
||
| void* yr_notebook_alloc( | ||
| YR_NOTEBOOK* notebook, | ||
| size_t size); | ||
|
|
||
|
|
||
| #endif // YR_NOTEBOOK_H |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,154 @@ | ||
| #include <stdint.h> | ||
|
|
||
| /* | ||
| Copyright (c) 2020. The YARA Authors. All Rights Reserved. | ||
| Redistribution and use in source and binary forms, with or without modification, | ||
| are permitted provided that the following conditions are met: | ||
| 1. Redistributions of source code must retain the above copyright notice, this | ||
| list of conditions and the following disclaimer. | ||
| 2. Redistributions in binary form must reproduce the above copyright notice, | ||
| this list of conditions and the following disclaimer in the documentation and/or | ||
| other materials provided with the distribution. | ||
| 3. Neither the name of the copyright holder nor the names of its contributors | ||
| may be used to endorse or promote products derived from this software without | ||
| specific prior written permission. | ||
| THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND | ||
| ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED | ||
| WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | ||
| DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR | ||
| ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES | ||
| (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON | ||
| ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
| (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS | ||
| SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| #include <assert.h> | ||
|
|
||
| #include <yara/error.h> | ||
| #include <yara/mem.h> | ||
| #include <yara/notebook.h> | ||
|
|
||
|
|
||
| // Forward declaration of YR_NOTEBOOK_PAGE. | ||
| typedef struct YR_NOTEBOOK_PAGE YR_NOTEBOOK_PAGE; | ||
|
|
||
|
|
||
| // A notebook is a data structure that can be used for allocating memory | ||
| // space in the same way malloc() would do. However, the buffers returned | ||
| // by yr_notebook_alloc() are backed by a larger buffer reserved by the notebook | ||
| // beforehand called a "page". The notebook fulfills the allocations performed | ||
| // via yr_notebook_alloc() with space taken from the current page, or creates | ||
| // a new page when necessary. It's recommended that the page size is at least | ||
| // 4x the size of the buffers you plan to allocate with yr_notebook_alloc(). | ||
|
|
||
| // Once the notebook is destroyed all the pages are freed, and consequently | ||
| // all the buffers allocated via yr_notebook_alloc(). | ||
| struct YR_NOTEBOOK | ||
| { | ||
| // Size of each page in the notebook. | ||
| size_t page_size; | ||
| // Pointer to the first page in the notebook. | ||
| YR_NOTEBOOK_PAGE* page_list_head; | ||
| // Pointer to the page that is being filled. | ||
| YR_NOTEBOOK_PAGE* current_page; | ||
| }; | ||
|
|
||
|
|
||
| // YR_NOTEBOOK_PAGE | ||
| struct YR_NOTEBOOK_PAGE | ||
| { | ||
| // Amount of bytes in the page that are actually used. | ||
| size_t used; | ||
| // Pointer to next page. | ||
| YR_NOTEBOOK_PAGE* next; | ||
| // Page's data. | ||
| uint8_t data[0]; | ||
| }; | ||
|
|
||
|
|
||
|
|
||
| // Creates a new notebook. The notebook initially has a single page of the | ||
| // specified size, but more pages are created if needed. | ||
| int yr_notebook_create( | ||
| size_t page_size, | ||
| YR_NOTEBOOK** pool) | ||
| { | ||
| YR_NOTEBOOK* new_notebook = yr_malloc(sizeof(YR_NOTEBOOK)); | ||
|
|
||
| if (new_notebook == NULL) | ||
| return ERROR_INSUFFICIENT_MEMORY; | ||
|
|
||
| new_notebook->page_list_head = yr_malloc( | ||
| sizeof(YR_NOTEBOOK_PAGE) + page_size); | ||
|
|
||
| if (new_notebook->page_list_head == NULL) | ||
| { | ||
| yr_free(new_notebook); | ||
| return ERROR_INSUFFICIENT_MEMORY; | ||
| } | ||
|
|
||
| new_notebook->page_size = page_size; | ||
| new_notebook->current_page = new_notebook->page_list_head; | ||
| new_notebook->current_page->used = 0; | ||
| new_notebook->current_page->next = NULL; | ||
|
|
||
| *pool = new_notebook; | ||
|
|
||
| return ERROR_SUCCESS; | ||
| } | ||
|
|
||
|
|
||
| // Destroys a notebook and frees all the notebook's pages. | ||
| int yr_notebook_destroy( | ||
| YR_NOTEBOOK* pool) | ||
| { | ||
| YR_NOTEBOOK_PAGE* page = pool->page_list_head; | ||
|
|
||
| while (page != NULL) | ||
| { | ||
| YR_NOTEBOOK_PAGE* next = page->next; | ||
| yr_free(page); | ||
| page = next; | ||
| } | ||
|
|
||
| yr_free(pool); | ||
|
|
||
| return ERROR_SUCCESS; | ||
| } | ||
|
|
||
|
|
||
| void* yr_notebook_alloc( | ||
| YR_NOTEBOOK* notebook, | ||
| size_t size) | ||
| { | ||
| // The requested memory size can't be larger than a notebook's page. | ||
| assert(size <= notebook->page_size); | ||
|
|
||
| // If the requested size doesn't fit in current page's free space, allocate | ||
| // a new page. | ||
| if (notebook->page_size - notebook->current_page->used < size) | ||
| { | ||
| YR_NOTEBOOK_PAGE* new_page = yr_malloc( | ||
| sizeof(YR_NOTEBOOK_PAGE) + notebook->page_size); | ||
|
|
||
| if (new_page == NULL) | ||
| return NULL; | ||
|
|
||
| new_page->used = 0; | ||
| new_page->next = notebook->current_page; | ||
| notebook->current_page = new_page; | ||
| } | ||
|
|
||
| void *ptr = notebook->current_page->data + notebook->current_page->used; | ||
|
|
||
| notebook->current_page->used += size; | ||
|
|
||
| return ptr; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters