* Decide better detection * * @param a first detection * @param b second detection * @return @c true if first detection is better, @c false otherwise * * Warning: sort function requires strict weak ordering! */
| 83 | * Warning: sort function requires strict weak ordering! |
| 84 | */ |
| 85 | bool compareForSort(const DetectResult &a, const DetectResult &b) |
| 86 | { |
| 87 | if (a.strength == b.strength) |
| 88 | { |
| 89 | if (a.source == DetectionMethod::SIGNATURE && a.source == b.source) |
| 90 | { |
| 91 | // Equaly strong signature detections - check nibble counts |
| 92 | const auto aRatio = static_cast<double>(a.agreeCount) / a.impCount; |
| 93 | const auto bRatio = static_cast<double>(b.agreeCount) / b.impCount; |
| 94 | if (areEqual(aRatio, bRatio)) |
| 95 | { |
| 96 | if (isShorterPrefixOfCaseInsensitive(a.name, b.name) |
| 97 | && a.impCount == b.impCount) |
| 98 | { |
| 99 | // Decide by version or extra information |
| 100 | bool compRes = false; |
| 101 | return compareExtraInfo(a, b, compRes) ? compRes : false; |
| 102 | } |
| 103 | else |
| 104 | { |
| 105 | // Prefer bigger signature |
| 106 | return a.impCount > b.impCount; |
| 107 | } |
| 108 | } |
| 109 | else |
| 110 | { |
| 111 | // Prefer better match |
| 112 | return aRatio > bRatio; |
| 113 | } |
| 114 | } |
| 115 | |
| 116 | // Everything is better than incomplete signature detection |
| 117 | if (b.source == DetectionMethod::SIGNATURE |
| 118 | && b.agreeCount != b.impCount) |
| 119 | { |
| 120 | return true; |
| 121 | } |
| 122 | else if (a.source == DetectionMethod::SIGNATURE |
| 123 | && a.agreeCount != a.impCount) |
| 124 | { |
| 125 | return false; |
| 126 | } |
| 127 | |
| 128 | // If both are same compilers with same detection strength |
| 129 | if (isShorterPrefixOfCaseInsensitive(a.name, b.name)) |
| 130 | { |
| 131 | // Decide by version or extra information |
| 132 | bool compRes = false; |
| 133 | if (compareExtraInfo(a, b, compRes)) |
| 134 | { |
| 135 | return compRes; |
| 136 | } |
| 137 | } |
| 138 | |
| 139 | // Prefer heuristic |
| 140 | return b.source == DetectionMethod::SIGNATURE; |
| 141 | } |
| 142 |
nothing calls this directly
no test coverage detected