perf: reduce the number of atoms generated for patterns that end in a…

… wildcard

For example, for pattern `{01 02 ??}` generate a two-bytes atom `01 02` instead of 256 3-bytes atoms.

yara-x/src/compiler/atoms/quality.rs

@@ -88,7 +88,7 @@ where
         // bytes_present corresponds to that unique byte.
         match bytes_present.first_one().unwrap() {
             0x00 | 0x20 | 0x90 | 0xcc | 0xff => {
-                q -= 10 * atom_len as i32;
+                q -= 10 * atom_len;
             }
             _ => {
                 q += 2;

yara-x/src/re/compiler.rs

@@ -1035,7 +1035,9 @@ fn concat_seq(seqs: &[Seq]) -> Option<Seq> {
         }
     }
 
-    for seq in seqs.iter().take(DESIRED_ATOM_SIZE) {
+    let mut it = seqs.iter().take(DESIRED_ATOM_SIZE).peekable();
+
+    while let Some(seq) = it.next() {
         // If the cross product of `result` with `seq` produces too many
         // literals, stop trying to add more sequences to the result and
         // return what we have so far.
@@ -1045,6 +1047,19 @@ fn concat_seq(seqs: &[Seq]) -> Option<Seq> {
             _ => {}
         }
 
+        // If this is the last sequence, and it is a sequence of exactly
+        // 256 bytes, we better ignore it because the last byte is actually
+        // useless. This is the case with a pattern like { 01 02 ?? }, where
+        // the ?? at the end triggers this condition. In a case like this one
+        // don't want 256 3-bytes literals, we better have a single 2-bytes
+        // literal.
+        if it.peek().is_none()
+            && matches!(seq.len(), Some(256))
+            && matches!(seq.max_literal_len(), Some(1))
+        {
+            break;
+        }
+
         // If every element in the sequence is inexact, then a cross
         // product will always be a no-op. Thus, there is nothing else we
         // can add to it and can quit early. Note that this also includes