CVE-2017-9438: Uncontrolled Recursion (CWE-674)
value: libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 7.5
Published: 2017-06-05T17:29Z
Repository: https://github.com/VirusTotal/yara
Language: Other
Files changed: libyara/hex_grammar.c, libyara/hex_grammar.h, libyara/hex_grammar.y
Commit date: 2017-06-01 16:10:05 +0200
Commit message: Fix issue #674 for hex strings.

Diff: diff --git a/libyara/hex_grammar.c b/libyara/hex_grammar.c
index a6cfbf06..48f550a5 100644
--- a/libyara/hex_grammar.c
+++ b/libyara/hex_grammar.c
@@ -91,10 +91,17 @@
 #define YYFREE yr_free
 
 #define mark_as_not_fast_regexp() \
     ((RE_AST*) yyget_extra(yyscanner))->flags &= ~RE_FLAGS_FAST_REGEXP
 
+#define incr_ast_levels() \
+    if (((RE_AST*) yyget_extra(yyscanner))->levels++ > RE_MAX_AST_LEVELS) \
+    { \
+      lex_env->last_error_code = ERROR_INVALID_HEX_STRING; \
+      YYABORT; \
+    }
+
 #define ERROR_IF(x, error) \
     if (x) \
     { \
       lex_env->last_error_code = error; \
       YYABORT; \
@@ -105,11 +112,11 @@
     { \
       yr_re_node_destroy(node); \
     } \
 
 
-#line 111 "hex_grammar.c" /* yacc.c:339  */
+#line 118 "hex_grammar.c" /* yacc.c:339  */
 
 # ifndef YY_NULLPTR
 #  if defined __cplusplus && 201103L <= __cplusplus
 #   define YY_NULLPTR nullptr
 #  else
@@ -155,16 +162,16 @@ extern int hex_yydebug;
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 
 union YYSTYPE
 {
-#line 78 "hex_grammar.y" /* yacc.c:355  */
+#line 85 "hex_grammar.y" /* yacc.c:355  */
 
   int64_t integer;
   RE_NODE *re_node;
 
-#line 166 "hex_grammar.c" /* yacc.c:355  */
+#line 173 "hex_grammar.c" /* yacc.c:355  */
 };
 
 typedef union YYSTYPE YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define YYSTYPE_IS_DECLARED 1
@@ -176,11 +183,11 @@ int hex_yyparse (void *yyscanner, HEX_LEX_ENVIRONMENT *lex_env);
 
 #endif /* !YY_HEX_YY_HEX_GRAMMAR_H_INCLUDED  */
 
 /* Copy the second part of user declarations.  */
 
-#line 182 "hex_grammar.c" /* yacc.c:358  */
+#line 189 "hex_grammar.c" /* yacc.c:358  */
 
 #ifdef short
 # undef short
 #endif
 
@@ -474,13 +481,13 @@ static const yytype_uint8 yytranslate[] =
 
 #if YYDEBUG
   /* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   105,   105,   114,   118,   127,   189,   193,   206,   210,
-     219,   233,   232,   245,   268,   300,   322,   342,   346,   360,
-     368
+       0,   112,   112,   121,   125,   136,   200,   204,   219,   223,
+     232,   246,   245,   258,   281,   313,   335,   355,   359,   374,
+     382
 };
 #endif
 
 #if YYDEBUG || YYERROR_VERBOSE || 0
 /* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
@@ -1015,49 +1022,49 @@ yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep, void *yyscanner, H
 
   YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
   switch (yytype)
     {
           case 16: /* tokens  */
-#line 94 "hex_grammar.y" /* yacc.c:1257  */
+#line 101 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1023 "hex_grammar.c" /* yacc.c:1257  */
+#line 1030 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
     case 17: /* token_sequence  */
-#line 95 "hex_grammar.y" /* yacc.c:1257  */
+#line 102 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1029 "hex_grammar.c" /* yacc.c:1257  */
+#line 1036 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
     case 18: /* token_or_range  */
-#line 96 "hex_grammar.y" /* yacc.c:1257  */
+#line 103 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1035 "hex_grammar.c" /* yacc.c:1257  */
+#line 1042 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
     case 19: /* token  */
-#line 97 "hex_grammar.y" /* yacc.c:1257  */
+#line 104 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1041 "hex_grammar.c" /* yacc.c:1257  */
+#line 1048 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
     case 21: /* range  */
-#line 100 "hex_grammar.y" /* yacc.c:1257  */
+#line 107 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1047 "hex_grammar.c" /* yacc.c:1257  */
+#line 1054 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
     case 22: /* alternatives  */
-#line 99 "hex_grammar.y" /* yacc.c:1257  */
+#line 106 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1053 "hex_grammar.c" /* yacc.c:1257  */
+#line 1060 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
     case 23: /* byte  */
-#line 98 "hex_grammar.y" /* yacc.c:1257  */
+#line 105 "hex_grammar.y" /* yacc.c:1257  */
       { yr_re_node_destroy(((*yyvaluep).re_node)); }
-#line 1059 "hex_grammar.c" /* yacc.c:1257  */
+#line 1066 "hex_grammar.c" /* yacc.c:1257  */
         break;
 
 
       default:
         break;
@@ -1319,46 +1326,50 @@ yyreduce:
 
   YY_REDUCE_PRINT (yyn);
   switch (yyn)
     {
         case 2:
-#line 106 "hex_grammar.y" /* yacc.c:1646  */
+#line 113 "hex_grammar.y" /* yacc.c:1661  */
     {
         RE_AST* re_ast = yyget_extra(yyscanner);
         re_ast->root_node = (yyvsp[-1].re_node);
       }
-#line 1330 "hex_grammar.c" /* yacc.c:1646  */
+#line 1337 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 3:
-#line 115 "hex_grammar.y" /* yacc.c:1646  */
+#line 122 "hex_grammar.y" /* yacc.c:1661  */
     {
         (yyval.re_node) = (yyvsp[0].re_node);
       }
-#line 1338 "hex_grammar.c" /* yacc.c:1646  */
+#line 1345 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 4:
-#line 119 "hex_grammar.y" /* yacc.c:1646  */
+#line 126 "hex_grammar.y" /* yacc.c:1661  */
     {
+        incr_ast_levels();
+
         (yyval.re_node) = yr_re_node_create(RE_NODE_CONCAT, (yyvsp[-1].re_node), (yyvsp[0].re_node));
 
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[-1].re_node));
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[0].re_node));
 
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
       }
-#line 1351 "hex_grammar.c" /* yacc.c:1646  */
+#line 1360 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 5:
-#line 128 "hex_grammar.y" /* yacc.c:1646  */
+#line 137 "hex_grammar.y" /* yacc.c:1661  */
     {
         RE_NODE* new_concat;
         RE_NODE* leftmost_concat = NULL;
         RE_NODE* leftmost_node = (yyvsp[-1].re_node);
 
+        incr_ast_levels();
+
         (yyval.re_node) = NULL;
 
         /*
         Some portions of the code (i.e: yr_re_split_at_chaining_point)
         expect a left-unbalanced tree where the right child of a concat node
@@ -1407,53 +1418,55 @@ yyreduce:
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[-1].re_node));
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[0].re_node));
 
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
       }
-#line 1413 "hex_grammar.c" /* yacc.c:1646  */
+#line 1424 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 6:
-#line 190 "hex_grammar.y" /* yacc.c:1646  */
+#line 201 "hex_grammar.y" /* yacc.c:1661  */
     {
         (yyval.re_node) = (yyvsp[0].re_node);
       }
-#line 1421 "hex_grammar.c" /* yacc.c:1646  */
+#line 1432 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 7:
-#line 194 "hex_grammar.y" /* yacc.c:1646  */
+#line 205 "hex_grammar.y" /* yacc.c:1661  */
     {
+        incr_ast_levels();
+
         (yyval.re_node) = yr_re_node_create(RE_NODE_CONCAT, (yyvsp[-1].re_node), (yyvsp[0].re_node));
 
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[-1].re_node));
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[0].re_node));
 
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
       }
-#line 1434 "hex_grammar.c" /* yacc.c:1646  */
+#line 1447 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 8:
-#line 207 "hex_grammar.y" /* yacc.c:1646  */
+#line 220 "hex_grammar.y" /* yacc.c:1661  */
     {
         (yyval.re_node) = (yyvsp[0].re_node);
       }
-#line 1442 "hex_grammar.c" /* yacc.c:1646  */
+#line 1455 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 9:
-#line 211 "hex_grammar.y" /* yacc.c:1646  */
+#line 224 "hex_grammar.y" /* yacc.c:1661  */
     {
         (yyval.re_node) = (yyvsp[0].re_node);
         (yyval.re_node)->greedy = FALSE;
       }
-#line 1451 "hex_grammar.c" /* yacc.c:1646  */
+#line 1464 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 10:
-#line 220 "hex_grammar.y" /* yacc.c:1646  */
+#line 233 "hex_grammar.y" /* yacc.c:1661  */
     {
         lex_env->token_count++;
 
         if (lex_env->token_count > MAX_HEX_STRING_TOKENS)
         {
@@ -1462,32 +1475,32 @@ yyreduce:
           YYABORT;
         }
 
         (yyval.re_node) = (yyvsp[0].re_node);
       }
-#line 1468 "hex_grammar.c" /* yacc.c:1646  */
+#line 1481 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 11:
-#line 233 "hex_grammar.y" /* yacc.c:1646  */
+#line 246 "hex_grammar.y" /* yacc.c:1661  */
     {
         lex_env->inside_or++;
       }
-#line 1476 "hex_grammar.c" /* yacc.c:1646  */
+#line 1489 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 12:
-#line 237 "hex_grammar.y" /* yacc.c:1646  */
+#line 250 "hex_grammar.y" /* yacc.c:1661  */
     {
         (yyval.re_node) = (yyvsp[-1].re_node);
         lex_env->inside_or--;
       }
-#line 1485 "hex_grammar.c" /* yacc.c:1646  */
+#line 1498 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 13:
-#line 246 "hex_grammar.y" /* yacc.c:1646  */
+#line 259 "hex_grammar.y" /* yacc.c:1661  */
     {
         if ((yyvsp[-1].integer) <= 0)
         {
           yyerror(yyscanner, lex_env, "invalid jump length");
           YYABORT;
@@ -1506,15 +1519,15 @@ yyreduce:
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
 
         (yyval.re_node)->start = (int) (yyvsp[-1].integer);
         (yyval.re_node)->end = (int) (yyvsp[-1].integer);
       }
-#line 1512 "hex_grammar.c" /* yacc.c:1646  */
+#line 1525 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 14:
-#line 269 "hex_grammar.y" /* yacc.c:1646  */
+#line 282 "hex_grammar.y" /* yacc.c:1661  */
     {
         if (lex_env->inside_or &&
             ((yyvsp[-3].integer) > STRING_CHAINING_THRESHOLD ||
              (yyvsp[-1].integer) > STRING_CHAINING_THRESHOLD) )
         {
@@ -1542,15 +1555,15 @@ yyreduce:
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
 
         (yyval.re_node)->start = (int) (yyvsp[-3].integer);
         (yyval.re_node)->end = (int) (yyvsp[-1].integer);
       }
-#line 1548 "hex_grammar.c" /* yacc.c:1646  */
+#line 1561 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 15:
-#line 301 "hex_grammar.y" /* yacc.c:1646  */
+#line 314 "hex_grammar.y" /* yacc.c:1661  */
     {
         if (lex_env->inside_or)
         {
           yyerror(yyscanner, lex_env,
               "unbounded jumps not allowed inside alternation (|)");
@@ -1568,15 +1581,15 @@ yyreduce:
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
 
         (yyval.re_node)->start = (int) (yyvsp[-2].integer);
         (yyval.re_node)->end = INT_MAX;
       }
-#line 1574 "hex_grammar.c" /* yacc.c:1646  */
+#line 1587 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 16:
-#line 323 "hex_grammar.y" /* yacc.c:1646  */
+#line 336 "hex_grammar.y" /* yacc.c:1661  */
     {
         if (lex_env->inside_or)
         {
           yyerror(yyscanner, lex_env,
               "unbounded jumps not allowed inside alternation (|)");
@@ -1588,50 +1601,51 @@ yyreduce:
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
 
         (yyval.re_node)->start = 0;
         (yyval.re_node)->end = INT_MAX;
       }
-#line 1594 "hex_grammar.c" /* yacc.c:1646  */
+#line 1607 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 17:
-#line 343 "hex_grammar.y" /* yacc.c:1646  */
+#line 356 "hex_grammar.y" /* yacc.c:1661  */
     {
           (yyval.re_node) = (yyvsp[0].re_node);
       }
-#line 1602 "hex_grammar.c" /* yacc.c:1646  */
+#line 1615 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 18:
-#line 347 "hex_grammar.y" /* yacc.c:1646  */
+#line 360 "hex_grammar.y" /* yacc.c:1661  */
     {
         mark_as_not_fast_regexp();
+        incr_ast_levels();
 
         (yyval.re_node) = yr_re_node_create(RE_NODE_ALT, (yyvsp[-2].re_node), (yyvsp[0].re_node));
 
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[-2].re_node));
         DESTROY_NODE_IF((yyval.re_node) == NULL, (yyvsp[0].re_node));
 
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
       }
-#line 1617 "hex_grammar.c" /* yacc.c:1646  */
+#line 1631 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 19:
-#line 361 "hex_grammar.y" /* yacc.c:1646  */
+#line 375 "hex_grammar.y" /* yacc.c:1661  */
     {
         (yyval.re_node) = yr_re_node_create(RE_NODE_LITERAL, NULL, NULL);
 
         ERROR_IF((yyval.re_node) == NULL, ERROR_INSUFFICIENT_MEMORY);
 
         (yyval.re_node)->value = (int) (yyvsp[0].integer);
       }
-#line 1629 "hex_grammar.c" /* yacc.c:1646  */
+#line 1643 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
   case 20:
-#line 369 "hex_grammar.y" /* yacc.c:1646  */
+#line 383 "hex_grammar.y" /* yacc.c:1661  */
     {
         uint8_t mask = (uint8_t) ((yyvsp[0].integer) >> 8);
 
         if (mask == 0x00)
         {
@@ -1647,15 +1661,15 @@ yyreduce:
 
           (yyval.re_node)->value = (yyvsp[0].integer) & 0xFF;
           (yyval.re_node)->mask = mask;
         }
       }
-#line 1653 "hex_grammar.c" /* yacc.c:1646  */
+#line 1667 "hex_grammar.c" /* yacc.c:1661  */
     break;
 
 
-#line 1657 "hex_grammar.c" /* yacc.c:1646  */
+#line 1671 "hex_grammar.c" /* yacc.c:1661  */
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
      that yytoken be updated with the new translation.  We take the
      approach of translating immediately before every use of yytoken.
@@ -1879,7 +1893,7 @@ yyreturn:
   if (yymsg != yymsgbuf)
     YYSTACK_FREE (yymsg);
 #endif
   return yyresult;
 }
-#line 390 "hex_grammar.y" /* yacc.c:1906  */
+#line 404 "hex_grammar.y" /* yacc.c:1906  */
 
diff --git a/libyara/hex_grammar.h b/libyara/hex_grammar.h
index 31e7fe26..d37c1640 100644
--- a/libyara/hex_grammar.h
+++ b/libyara/hex_grammar.h
@@ -58,16 +58,16 @@ extern int hex_yydebug;
 /* Value type.  */
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 
 union YYSTYPE
 {
-#line 78 "hex_grammar.y" /* yacc.c:1909  */
+#line 85 "hex_grammar.y" /* yacc.c:1915  */
 
   int64_t integer;
   RE_NODE *re_node;
 
-#line 69 "hex_grammar.h" /* yacc.c:1909  */
+#line 69 "hex_grammar.h" /* yacc.c:1915  */
 };
 
 typedef union YYSTYPE YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define YYSTYPE_IS_DECLARED 1
diff --git a/libyara/hex_grammar.y b/libyara/hex_grammar.y
index f42e0b1c..bf907e93 100644
--- a/libyara/hex_grammar.y
+++ b/libyara/hex_grammar.y
@@ -49,10 +49,17 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define YYFREE yr_free
 
 #define mark_as_not_fast_regexp() \
     ((RE_AST*) yyget_extra(yyscanner))->flags &= ~RE_FLAGS_FAST_REGEXP
 
+#define incr_ast_levels() \
+    if (((RE_AST*) yyget_extra(yyscanner))->levels++ > RE_MAX_AST_LEVELS) \
+    { \
+      lex_env->last_error_code = ERROR_INVALID_HEX_STRING; \
+      YYABORT; \
+    }
+
 #define ERROR_IF(x, error) \
     if (x) \
     { \
       lex_env->last_error_code = error; \
       YYABORT; \
@@ -115,10 +122,12 @@ tokens
       {
         $$ = $1;
       }
     | token token
       {
+        incr_ast_levels();
+
         $$ = yr_re_node_create(RE_NODE_CONCAT, $1, $2);
 
         DESTROY_NODE_IF($$ == NULL, $1);
         DESTROY_NODE_IF($$ == NULL, $2);
 
@@ -128,10 +137,12 @@ tokens
       {
         RE_NODE* new_concat;
         RE_NODE* leftmost_concat = NULL;
         RE_NODE* leftmost_node = $2;
 
+        incr_ast_levels();
+
         $$ = NULL;
 
         /*
         Some portions of the code (i.e: yr_re_split_at_chaining_point)
         expect a left-unbalanced tree where the right child of a concat node
@@ -190,10 +201,12 @@ token_sequence
       {
         $$ = $1;
       }
     | token_sequence token_or_range
       {
+        incr_ast_levels();
+
         $$ = yr_re_node_create(RE_NODE_CONCAT, $1, $2);
 
         DESTROY_NODE_IF($$ == NULL, $1);
         DESTROY_NODE_IF($$ == NULL, $2);
 
@@ -344,10 +357,11 @@ alternatives
           $$ = $1;
       }
     | alternatives '|' tokens
       {
         mark_as_not_fast_regexp();
+        incr_ast_levels();
 
         $$ = yr_re_node_create(RE_NODE_ALT, $1, $3);
 
         DESTROY_NODE_IF($$ == NULL, $1);
         DESTROY_NODE_IF($$ == NULL, $3);

Vulnerable code: #line 111 "hex_grammar.c" /* yacc.c:339  */
#line 78 "hex_grammar.y" /* yacc.c:355  */
#line 166 "hex_grammar.c" /* yacc.c:355  */
#line 182 "hex_grammar.c" /* yacc.c:358  */
       0,   105,   105,   114,   118,   127,   189,   193,   206,   210,
     219,   233,   232,   245,   268,   300,   322,   342,   346,   360,
     368
#line 94 "hex_grammar.y" /* yacc.c:1257  */
#line 1023 "hex_grammar.c" /* yacc.c:1257  */
#line 95 "hex_grammar.y" /* yacc.c:1257  */
#line 1029 "hex_grammar.c" /* yacc.c:1257  */
#line 96 "hex_grammar.y" /* yacc.c:1257  */
#line 1035 "hex_grammar.c" /* yacc.c:1257  */
#line 97 "hex_grammar.y" /* yacc.c:1257  */
#line 1041 "hex_grammar.c" /* yacc.c:1257  */
#line 100 "hex_grammar.y" /* yacc.c:1257  */
#line 1047 "hex_grammar.c" /* yacc.c:1257  */
#line 99 "hex_grammar.y" /* yacc.c:1257  */
#line 1053 "hex_grammar.c" /* yacc.c:1257  */
#line 98 "hex_grammar.y" /* yacc.c:1257  */
#line 1059 "hex_grammar.c" /* yacc.c:1257  */
#line 106 "hex_grammar.y" /* yacc.c:1646  */
#line 1330 "hex_grammar.c" /* yacc.c:1646  */
#line 115 "hex_grammar.y" /* yacc.c:1646  */
#line 1338 "hex_grammar.c" /* yacc.c:1646  */
#line 119 "hex_grammar.y" /* yacc.c:1646  */
#line 1351 "hex_grammar.c" /* yacc.c:1646  */
#line 128 "hex_grammar.y" /* yacc.c:1646  */
#line 1413 "hex_grammar.c" /* yacc.c:1646  */
#line 190 "hex_grammar.y" /* yacc.c:1646  */
#line 1421 "hex_grammar.c" /* yacc.c:1646  */
#line 194 "hex_grammar.y" /* yacc.c:1646  */
#line 1434 "hex_grammar.c" /* yacc.c:1646  */
#line 207 "hex_grammar.y" /* yacc.c:1646  */
#line 1442 "hex_grammar.c" /* yacc.c:1646  */
#line 211 "hex_grammar.y" /* yacc.c:1646  */
#line 1451 "hex_grammar.c" /* yacc.c:1646  */
#line 220 "hex_grammar.y" /* yacc.c:1646  */
#line 1468 "hex_grammar.c" /* yacc.c:1646  */
#line 233 "hex_grammar.y" /* yacc.c:1646  */
#line 1476 "hex_grammar.c" /* yacc.c:1646  */
#line 237 "hex_grammar.y" /* yacc.c:1646  */
#line 1485 "hex_grammar.c" /* yacc.c:1646  */
#line 246 "hex_grammar.y" /* yacc.c:1646  */
#line 1512 "hex_grammar.c" /* yacc.c:1646  */
#line 269 "hex_grammar.y" /* yacc.c:1646  */
#line 1548 "hex_grammar.c" /* yacc.c:1646  */
#line 301 "hex_grammar.y" /* yacc.c:1646  */
#line 1574 "hex_grammar.c" /* yacc.c:1646  */
#line 323 "hex_grammar.y" /* yacc.c:1646  */
#line 1594 "hex_grammar.c" /* yacc.c:1646  */
#line 343 "hex_grammar.y" /* yacc.c:1646  */
#line 1602 "hex_grammar.c" /* yacc.c:1646  */
#line 347 "hex_grammar.y" /* yacc.c:1646  */
#line 1617 "hex_grammar.c" /* yacc.c:1646  */
#line 361 "hex_grammar.y" /* yacc.c:1646  */
#line 1629 "hex_grammar.c" /* yacc.c:1646  */
#line 369 "hex_grammar.y" /* yacc.c:1646  */
#line 1653 "hex_grammar.c" /* yacc.c:1646  */
#line 1657 "hex_grammar.c" /* yacc.c:1646  */
#line 390 "hex_grammar.y" /* yacc.c:1906  */
#line 78 "hex_grammar.y" /* yacc.c:1909  */
#line 69 "hex_grammar.h" /* yacc.c:1909  */
Fixed code: #define incr_ast_levels() \
    if (((RE_AST*) yyget_extra(yyscanner))->levels++ > RE_MAX_AST_LEVELS) \
    { \
      lex_env->last_error_code = ERROR_INVALID_HEX_STRING; \
      YYABORT; \
    }

#line 118 "hex_grammar.c" /* yacc.c:339  */
#line 85 "hex_grammar.y" /* yacc.c:355  */
#line 173 "hex_grammar.c" /* yacc.c:355  */
#line 189 "hex_grammar.c" /* yacc.c:358  */
       0,   112,   112,   121,   125,   136,   200,   204,   219,   223,
     232,   246,   245,   258,   281,   313,   335,   355,   359,   374,
     382
#line 101 "hex_grammar.y" /* yacc.c:1257  */
#line 1030 "hex_grammar.c" /* yacc.c:1257  */
#line 102 "hex_grammar.y" /* yacc.c:1257  */
#line 1036 "hex_grammar.c" /* yacc.c:1257  */
#line 103 "hex_grammar.y" /* yacc.c:1257  */
#line 1042 "hex_grammar.c" /* yacc.c:1257  */
#line 104 "hex_grammar.y" /* yacc.c:1257  */
#line 1048 "hex_grammar.c" /* yacc.c:1257  */
#line 107 "hex_grammar.y" /* yacc.c:1257  */
#line 1054 "hex_grammar.c" /* yacc.c:1257  */
#line 106 "hex_grammar.y" /* yacc.c:1257  */
#line 1060 "hex_grammar.c" /* yacc.c:1257  */
#line 105 "hex_grammar.y" /* yacc.c:1257  */
#line 1066 "hex_grammar.c" /* yacc.c:1257  */
#line 113 "hex_grammar.y" /* yacc.c:1661  */
#line 1337 "hex_grammar.c" /* yacc.c:1661  */
#line 122 "hex_grammar.y" /* yacc.c:1661  */
#line 1345 "hex_grammar.c" /* yacc.c:1661  */
#line 126 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();

#line 1360 "hex_grammar.c" /* yacc.c:1661  */
#line 137 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();

#line 1424 "hex_grammar.c" /* yacc.c:1661  */
#line 201 "hex_grammar.y" /* yacc.c:1661  */
#line 1432 "hex_grammar.c" /* yacc.c:1661  */
#line 205 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();

#line 1447 "hex_grammar.c" /* yacc.c:1661  */
#line 220 "hex_grammar.y" /* yacc.c:1661  */
#line 1455 "hex_grammar.c" /* yacc.c:1661  */
#line 224 "hex_grammar.y" /* yacc.c:1661  */
#line 1464 "hex_grammar.c" /* yacc.c:1661  */
#line 233 "hex_grammar.y" /* yacc.c:1661  */
#line 1481 "hex_grammar.c" /* yacc.c:1661  */
#line 246 "hex_grammar.y" /* yacc.c:1661  */
#line 1489 "hex_grammar.c" /* yacc.c:1661  */
#line 250 "hex_grammar.y" /* yacc.c:1661  */
#line 1498 "hex_grammar.c" /* yacc.c:1661  */
#line 259 "hex_grammar.y" /* yacc.c:1661  */
#line 1525 "hex_grammar.c" /* yacc.c:1661  */
#line 282 "hex_grammar.y" /* yacc.c:1661  */
#line 1561 "hex_grammar.c" /* yacc.c:1661  */
#line 314 "hex_grammar.y" /* yacc.c:1661  */
#line 1587 "hex_grammar.c" /* yacc.c:1661  */
#line 336 "hex_grammar.y" /* yacc.c:1661  */
#line 1607 "hex_grammar.c" /* yacc.c:1661  */
#line 356 "hex_grammar.y" /* yacc.c:1661  */
#line 1615 "hex_grammar.c" /* yacc.c:1661  */
#line 360 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();
#line 1631 "hex_grammar.c" /* yacc.c:1661  */
#line 375 "hex_grammar.y" /* yacc.c:1661  */
#line 1643 "hex_grammar.c" /* yacc.c:1661  */
#line 383 "hex_grammar.y" /* yacc.c:1661  */
#line 1667 "hex_grammar.c" /* yacc.c:1661  */
#line 1671 "hex_grammar.c" /* yacc.c:1661  */
#line 404 "hex_grammar.y" /* yacc.c:1906  */
#line 85 "hex_grammar.y" /* yacc.c:1915  */
#line 69 "hex_grammar.h" /* yacc.c:1915  */
#define incr_ast_levels() \
    if (((RE_AST*) yyget_extra(yyscanner))->levels++ > RE_MAX_AST_LEVELS) \
    { \
      lex_env->last_error_code = ERROR_INVALID_HEX_STRING; \
      YYABORT; \
    }

        incr_ast_levels();

        incr_ast_levels();

        incr_ast_levels();

        incr_ast_levels();