Mistake with terms parsing in condition.

[rakovskij-stanislav]

Ruleset:

rule minus_bad{
	meta:
        author = "Rakovskij Stanislav / disasm.me"
        date = "22.08.2020"
        description = "test rule in which we have bad parsing of minus sign"
	strings:
	$str_after = "END_TAG"
        $str_before = "START_TAG"
	condition:
		 $str_before in (@str_after-512 .. @str_after)
}


rule minus_good{
	meta:
        author = "Rakovskij Stanislav / disasm.me"
        date = "22.08.2020"
        description = "test rule in which we have good parsing of minus sign"
	strings:
	$str_after = "END_TAG"
        $str_before = "START_TAG"
	condition:
		 $str_before in (@str_after - 512 .. @str_after)
}

Test file

START_TAG HELLO WORLD END_TAG

Test:

> yara64.exe bug_parsing.yar bug_parsing.txt
minus_bad bug_parsing.txt
minus_good bug_parsing.txt


>python
Python 3.7.8 (tags/v3.7.8:4b47a5b6ba, Jun 28 2020, 08:53:46) [MSC v.1916 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import plyara
>>> parser = plyara.Plyara()
>>> rules = parser.parse_string(open("bug_parsing.yar").read())
>>> rules[0]["condition_terms"]
['$str_before', 'in', '(', '@str_after-512', '..', '@str_after', ')'] #WRONG!
>>> rules[1]["condition_terms"]
['$str_before', 'in', '(', '@str_after', '-', '512', '..', '@str_after', ')'] #right

There is no problem with pluses:
Ruleset:

rule plus_pre_bad{
	meta:
        author = "Rakovskij Stanislav / disasm.me"
        date = "22.08.2020"
        description = "test rule in which we previously had bad parsing of minus sign"
	strings:
	$str_after = "END_TAG"
        $str_before = "START_TAG"
	condition:
		 $str_before in (@str_after+512 .. @str_after)
}


rule plus_pre_good{
	meta:
        author = "Rakovskij Stanislav / disasm.me"
        date = "22.08.2020"
        description = "test rule in which we have good parsing"
	strings:
	$str_after = "END_TAG"
        $str_before = "START_TAG"
	condition:
		 $str_before in (@str_after + 512 .. @str_after)
}

Test

>>> parser = plyara.Plyara()
>>> rules = parser.parse_string(open("bug_parsing_2.yar").read())
>>> rules[0]["condition_terms"]
['$str_before', 'in', '(', '@str_after', '+', '512', '..', '@str_after', ')']
>>> rules[1]["condition_terms"]
['$str_before', 'in', '(', '@str_after', '+', '512', '..', '@str_after', ')']
>>>

[utkonos]

Thanks for the report. I'll get this fixed.