From 2e2e3c7708c1307b0b61e2fd3043885a0522a7d0 Mon Sep 17 00:00:00 2001 From: Mike Hunhoff Date: Tue, 19 May 2026 19:58:58 +0000 Subject: [PATCH 1/2] Optimize Some Statement Evaluation and Fix Correctness Mismatches --- capa/engine.py | 6 +++++- tests/test_engine.py | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/capa/engine.py b/capa/engine.py index e7be99706c..fbe2319929 100644 --- a/capa/engine.py +++ b/capa/engine.py @@ -197,8 +197,12 @@ def evaluate(self, features: FeatureSet, short_circuit=True): capa.perf.counters["evaluate.feature.some"] += 1 if short_circuit: - results = [] + results: list[Result] = [] satisfied_children_count = 0 + if satisfied_children_count >= self.count: + # short circuit immediately if threshold is already met (e.g. count <= 0) + return Result(True, self, results) + for child in self.children: result = child.evaluate(features, short_circuit=short_circuit) results.append(result) diff --git a/tests/test_engine.py b/tests/test_engine.py index 1d4ba1f2e0..ab388cc80c 100644 --- a/tests/test_engine.py +++ b/tests/test_engine.py @@ -105,6 +105,25 @@ def test_some(): assert bool(Some(0, [Number(1)]).evaluate({Number(0): {ADDR1}})) is True assert bool(Some(1, [Number(1)]).evaluate({Number(0): {ADDR1}})) is False + # Test Some(0, []) correctness (should evaluate to True in both short-circuit modes) + assert Some(0, []).evaluate({Number(0): {ADDR1}}, short_circuit=True).success is True + assert Some(0, []).evaluate({Number(0): {ADDR1}}, short_circuit=False).success is True + + # Test Some(0, [Child]) optimization (child must not be evaluated when short-circuit is True) + class TrackingFeature(Number): + def __init__(self, value): + super().__init__(value) + self.evaluated = False + + def evaluate(self, features, short_circuit=True): + self.evaluated = True + return super().evaluate(features, short_circuit) + + tracker = TrackingFeature(1) + res = Some(0, [tracker]).evaluate({Number(0): {ADDR1}}, short_circuit=True) + assert res.success is True + assert tracker.evaluated is False # Must not be evaluated! + assert bool(Some(2, [Number(1), Number(2), Number(3)]).evaluate({Number(0): {ADDR1}})) is False assert bool(Some(2, [Number(1), Number(2), Number(3)]).evaluate({Number(0): {ADDR1}, Number(1): {ADDR1}})) is False assert ( From ffa7eccc08247fb98143d5c6a7bf2f1f5128e92b Mon Sep 17 00:00:00 2001 From: Mike Hunhoff Date: Tue, 19 May 2026 20:04:34 +0000 Subject: [PATCH 2/2] update CHANGELOG --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 140a0a429a..6ef0ef1afa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -117,6 +117,7 @@ - fix: remove redundant code related to cli loading @mike-hunhoff #3076 - fix: optimize all_zeros using fast bytes comparison @mike-hunhoff #3078 - fix: duplicate rule candidate evaluation in optimized matching engine @mike-hunhoff #3080 +- fix: correct Some statement short-circuit logic and add tests @mike-hunhoff #3083 ### capa Explorer Web