Code: int read_escaped_char(
    yyscan_t yyscanner,
    uint8_t* escaped_char)
{
  char text[4] = {0, 0, 0, 0};

   text[0] = '\\';
   text[1] = RE_YY_INPUT(yyscanner);
 
  if (text[1] == EOF)
     return 0;
 
   if (text[1] == 'x')
   {
     text[2] = RE_YY_INPUT(yyscanner);
 
    if (text[2] == EOF)
       return 0;
 
     text[3] = RE_YY_INPUT(yyscanner);
 
    if (text[3] == EOF)
       return 0;
   }
 
  *escaped_char = escaped_char_value(text);

  return 1;
}

Vulnerability Type: DoS 
CWE ID: CWE-476
Summary: libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.
Commit Message: re_lexer: Make reading escape sequences more robust (#586)

* Add test for issue #503

* re_lexer: Make reading escape sequences more robust

This commit fixes parsing incomplete escape sequences at the end of a
regular expression and parsing things like \xxy (invalid hex digits)
which before were silently turned into (char)255.

Close #503

* Update re_lexer.c