/*

  *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  *  Copyright (C) 2007-2013 Sourcefire, Inc.

  *

  *  Authors: Trog, Török Edvin

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.

  */
 

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

 #endif

 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>

 #ifdef HAVE_UNISTD_H

 #include <unistd.h>

 #endif

 #include <string.h>

 #include <ctype.h>

 #ifndef _WIN32

 #include <netinet/in.h>

 #endif

 #include "clamav.h"
 #include "others.h"

 #include "special.h"

 #include "matcher.h"

 /* NOTE: Photoshop stores data in BIG ENDIAN format, this is the opposite
 	to virtually everything else */
 

 #define special_endian_convert_16(v) be16_to_host(v)
 #define special_endian_convert_32(v) be32_to_host(v)

 int cli_check_mydoom_log(cli_ctx *ctx)

 {

     const uint32_t *record;
     uint32_t check, key;
     fmap_t *map         = *ctx->fmap;
     unsigned int blocks = map->len / (8 * 4);

 
     cli_dbgmsg("in cli_check_mydoom_log()\n");

     if (blocks < 2)
         return CL_CLEAN;
     if (blocks > 5)
         blocks = 5;
 
     record = fmap_need_off_once(map, 0, 8 * 4 * blocks);
     if (!record)
         return CL_CLEAN;
     while (blocks) { /* This wasn't probably intended but that's what the current code does anyway */
         if (record[--blocks] == 0xffffffff)
             return CL_CLEAN;

     }
 

     key   = ~be32_to_host(record[0]);
     check = (be32_to_host(record[1]) ^ key) +
             (be32_to_host(record[2]) ^ key) +
             (be32_to_host(record[3]) ^ key) +
             (be32_to_host(record[4]) ^ key) +
             (be32_to_host(record[5]) ^ key) +
             (be32_to_host(record[6]) ^ key) +
             (be32_to_host(record[7]) ^ key);

     if ((~check) != key)

         return CL_CLEAN;
 
     key   = ~be32_to_host(record[8]);
     check = (be32_to_host(record[9]) ^ key) +
             (be32_to_host(record[10]) ^ key) +
             (be32_to_host(record[11]) ^ key) +
             (be32_to_host(record[12]) ^ key) +
             (be32_to_host(record[13]) ^ key) +
             (be32_to_host(record[14]) ^ key) +
             (be32_to_host(record[15]) ^ key);

     if ((~check) != key)

         return CL_CLEAN;

     return cli_append_virus(ctx, "Heuristics.Worm.Mydoom.M.log");

 }
 

 static int jpeg_check_photoshop_8bim(cli_ctx *ctx, off_t *off)

 {

     const unsigned char *buf;
     uint16_t ntmp;
     uint8_t nlength, id[2];
     uint32_t size;
     off_t offset = *off;
     int retval;
     fmap_t *map = *ctx->fmap;
 
     if (!(buf = fmap_need_off_once(map, offset, 4 + 2 + 1))) {
         cli_dbgmsg("read bim failed\n");
         return -1;
     }
     if (memcmp(buf, "8BIM", 4) != 0) {
         cli_dbgmsg("missed 8bim\n");
         return -1;
     }

     id[0] = (uint8_t)buf[4];
     id[1] = (uint8_t)buf[5];
     cli_dbgmsg("ID: 0x%.2x%.2x\n", id[0], id[1]);
     nlength = buf[6];
     ntmp    = nlength + ((((uint16_t)nlength) + 1) & 0x01);
     offset += 4 + 2 + 1 + ntmp;

     if (fmap_readn(map, &size, offset, 4) != 4) {
         return -1;
     }
     size = special_endian_convert_32(size);
     if (size == 0) {
         return -1;
     }
     if ((size & 0x01) == 1) {
         size++;
     }

     *off = offset + 4 + size;
     /* Is it a thumbnail image: 0x0409 or 0x040c */
     if ((id[0] == 0x04) && ((id[1] == 0x09) || (id[1] == 0x0c))) {
         /* Yes */
         cli_dbgmsg("found thumbnail\n");
     } else {
         /* No - Seek past record */
         return 0;
     }

     /* Jump past header */
     offset += 4 + 28;

     retval = cli_check_jpeg_exploit(ctx, offset);
     if (retval == 1) {
         cli_dbgmsg("Exploit found in thumbnail\n");
     }
     return retval;

 }
 

 static int jpeg_check_photoshop(cli_ctx *ctx, off_t offset)

 {

     int retval;
     const unsigned char *buffer;
     off_t old;
     fmap_t *map = *ctx->fmap;

     if (!(buffer = fmap_need_off_once(map, offset, 14))) {
         return 0;
     }

     if (memcmp(buffer, "Photoshop 3.0", 14) != 0) {
         return 0;
     }
     offset += 14;
 
     cli_dbgmsg("Found Photoshop segment\n");
     do {
         old    = offset;
         retval = jpeg_check_photoshop_8bim(ctx, &offset);
         if (offset <= old)
             break;
     } while (retval == 0);
 
     if (retval == -1) {
         retval = 0;
     }
     return retval;

 }
 

 int cli_check_jpeg_exploit(cli_ctx *ctx, off_t offset)

 {

     const unsigned char *buffer;
     int retval;
     fmap_t *map = *ctx->fmap;
 
     cli_dbgmsg("in cli_check_jpeg_exploit()\n");
     if (ctx->recursion > ctx->engine->maxreclevel)
         return CL_EMAXREC;
 
     if (!(buffer = fmap_need_off_once(map, offset, 2)))
         return 0;
     if ((buffer[0] != 0xff) || (buffer[1] != 0xd8)) {
         return 0;
     }
     offset += 2;
     for (;;) {
         off_t new_off;
         if (!(buffer = fmap_need_off_once(map, offset, 4))) {
             return 0;
         }
         /* Check for multiple 0xFF values, we need to skip them */
         if ((buffer[0] == 0xff) && (buffer[1] == 0xff)) {
             offset++;
             continue;
         }
         offset += 4;
         if ((buffer[0] == 0xff) && (buffer[1] == 0xfe)) {
             if (buffer[2] == 0x00) {
                 if ((buffer[3] == 0x00) || (buffer[3] == 0x01)) {
                     return 1;
                 }
             }
         }
         if (buffer[0] != 0xff) {
             return -1;
         }
         if (buffer[1] == 0xda) {
             /* End of Image marker */
             return 0;
         }
 
         new_off = ((unsigned int)buffer[2] << 8) + buffer[3];
         if (new_off < 2) {
             return -1;
         }
         new_off -= 2;
         new_off += offset;
 
         if (buffer[1] == 0xed) {
             /* Possible Photoshop file */
             ctx->recursion++;
             retval = jpeg_check_photoshop(ctx, offset);
             ctx->recursion--;
             if (retval != 0)
                 return retval;
         }
         offset = new_off;
     }

 }

 static uint32_t riff_endian_convert_32(uint32_t value, int big_endian)
 {

     if (big_endian)
         return be32_to_host(value);
     else
         return le32_to_host(value);

 }

 static int riff_read_chunk(fmap_t *map, off_t *offset, int big_endian, int rec_level)

 {

     uint32_t cache_buf;
     char *buffer;
     const uint32_t *buf;
     uint32_t chunk_size;
     off_t cur_offset = *offset;
 
     if (rec_level > 1000) {
         cli_dbgmsg("riff_read_chunk: recursion level exceeded\n");
         return 0;
     }

     if (!(buf = fmap_need_off_once(map, cur_offset, 4 * 2)))
         return 0;
     cur_offset += 4 * 2;

     buffer = (char *)buf;
     memcpy(&cache_buf, buffer + sizeof(cache_buf),
            sizeof(cache_buf));
     chunk_size = riff_endian_convert_32(cache_buf, big_endian);

     if (!memcmp(buf, "anih", 4) && chunk_size != 36)
         return 2;

     if (memcmp(buf, "RIFF", 4) == 0) {
         return 0;
     } else if (memcmp(buf, "RIFX", 4) == 0) {
         return 0;
     }
 
     if ((memcmp(buf, "LIST", 4) == 0) ||
         (memcmp(buf, "PROP", 4) == 0) ||
         (memcmp(buf, "FORM", 4) == 0) ||
         (memcmp(buf, "CAT ", 4) == 0)) {
         if (!fmap_need_ptr_once(map, buf + 2, 4)) {
             cli_dbgmsg("riff_read_chunk: read list type failed\n");
             return 0;
         }
         *offset = cur_offset + 4;
         return riff_read_chunk(map, offset, big_endian, ++rec_level);
     }
 
     *offset = cur_offset + chunk_size + (chunk_size & 1);
     if (*offset < cur_offset) {
         return 0;
     }
     /* FIXME: WTF!?

 	if (lseek(fd, offset, SEEK_SET) != offset) {
 		return 2;
 	}

 	*/

     return 1;

 }
 

 int cli_check_riff_exploit(cli_ctx *ctx)

 {

     const uint32_t *buf;
     int big_endian, retval;
     off_t offset;
     fmap_t *map = *ctx->fmap;
 
     cli_dbgmsg("in cli_check_riff_exploit()\n");
 
     if (!(buf = fmap_need_off_once(map, 0, 4 * 3)))
         return 0;
 
     if (memcmp(buf, "RIFF", 4) == 0) {
         big_endian = FALSE;
     } else if (memcmp(buf, "RIFX", 4) == 0) {
         big_endian = TRUE;
     } else {
         /* Not a RIFF file */
         return 0;
     }

     if (memcmp(&buf[2], "ACON", 4) != 0) {
         /* Only scan MS animated icon files */
         /* There is a *lot* of broken software out there that produces bad RIFF files */
         return 0;
     }

     offset = 4 * 3;
     do {
         retval = riff_read_chunk(map, &offset, big_endian, 1);
     } while (retval == 1);

     return retval;

 }

 
 static inline int swizz_j48(const uint16_t n[])
 {

     cli_dbgmsg("swizz_j48: %u, %u, %u\n", n[0], n[1], n[2]);
     /* rules based on J48 tree */
     if (n[0] <= 961 || !n[1])
         return 0;
     if (n[0] <= 1006)
         return (n[2] > 0 && n[2] <= 6);
     else
         return n[1] <= 10 && n[2];

 }
 
 void cli_detect_swizz_str(const unsigned char *str, uint32_t len, struct swizz_stats *stats, int blob)
 {

     unsigned char stri[4096];
     size_t i, j = 0;
     int bad       = 0;
     int lastalnum = 0;
     uint8_t ngrams[17576];
     uint16_t all = 0;
     uint16_t ngram_cnts[3];
     uint16_t words = 0;
     int ret;
 
     stats->entries++;
     for (i = 0; (i < (size_t)len - 1) && (j < sizeof(stri) - 2); i += 2) {
         unsigned char c = str[i];
         if (str[i + 1] || !c) {
             bad++;
             continue;
         }
         if (!isalnum(c)) {
             if (!lastalnum)
                 continue;
             lastalnum = 0;
             c         = ' ';
         } else {
             lastalnum = 1;
             if (isdigit(c))
                 continue;
         }
         stri[j++] = tolower(c);
     }
     stri[j++] = '\0';
     if ((!blob && (bad >= 8)) || j < 4)
         return;
     memset(ngrams, 0, sizeof(ngrams));
     memset(ngram_cnts, 0, sizeof(ngram_cnts));
     for (i = 0; i < j - 2; i++) {
         if (stri[i] != ' ' && stri[i + 1] != ' ' && stri[i + 2] != ' ') {
             uint16_t idx = (stri[i] - 'a') * 676 + (stri[i + 1] - 'a') * 26 + (stri[i + 2] - 'a');
             if (idx < sizeof(ngrams)) {
                 ngrams[idx]++;
                 stats->gngrams[idx]++;
             }
         } else if (stri[i] == ' ')
             words++;
     }
     for (i = 0; i < sizeof(ngrams); i++) {
         uint8_t v = ngrams[i];
         if (v > 3) v = 3;
         if (v) {
             ngram_cnts[v - 1]++;
             all++;
         }
     }
     if (!all)
         return;
     cli_dbgmsg("cli_detect_swizz_str: %u, %u, %u\n", ngram_cnts[0], ngram_cnts[1], ngram_cnts[2]);
     /* normalize */
     for (i = 0; i < sizeof(ngram_cnts) / sizeof(ngram_cnts[0]); i++) {
         uint32_t v    = ngram_cnts[i];
         ngram_cnts[i] = (v << 10) / all;
     }
     ret = swizz_j48(ngram_cnts) ? CL_VIRUS : CL_CLEAN;
     if (words < 3) ret = CL_CLEAN;
     cli_dbgmsg("cli_detect_swizz_str: %s, %u words\n", ret == CL_VIRUS ? "suspicious" : "ok", words);
     if (ret == CL_VIRUS) {
         stats->suspicious += j;
         cli_dbgmsg("cli_detect_swizz_str: %s\n", stri);
     }
     stats->total += j;

 }
 

 static inline int swizz_j48_global(const uint32_t gn[])

 {

     if (gn[0] <= 24185) {
         return gn[0] > 22980 && gn[8] > 0 && gn[8] <= 97;
     }
     if (!gn[8]) {
         if (gn[4] <= 311) {
             if (!gn[4]) {
                 return gn[1] > 0 &&
                        ((gn[0] <= 26579 && gn[3] > 0) ||
                         (gn[0] > 28672 && gn[0] <= 30506));
             }
             if (gn[5] <= 616) {
                 if (gn[6] <= 104) {
                     return gn[9] <= 167;
                 }
                 return gn[6] <= 286;
             }
         }
         return 0;
     }
     return 1;

 }
 

 int cli_detect_swizz(struct swizz_stats *stats)
 {

     uint32_t gn[10];
     uint32_t all = 0;
     size_t i;
     int global_swizz = CL_CLEAN;
 
     cli_dbgmsg("cli_detect_swizz: %lu/%lu, version:%d, manifest: %d \n",
                (unsigned long)stats->suspicious, (unsigned long)stats->total,
                stats->has_version, stats->has_manifest);
     memset(gn, 0, sizeof(gn));
     for (i = 0; i < 17576; i++) {
         uint8_t v = stats->gngrams[i];
         if (v > 10) v = 10;
         if (v) {
             gn[v - 1]++;
             all++;
         }
     }
     if (all) {
         /* normalize */
         cli_dbgmsg("cli_detect_swizz: gn: ");
         for (i = 0; i < sizeof(gn) / sizeof(gn[0]); i++) {
             uint32_t v = gn[i];
             gn[i]      = (v << 15) / all;
             if (cli_debug_flag)
                 fprintf(stderr, "%lu, ", (unsigned long)gn[i]);
         }
         global_swizz = swizz_j48_global(gn) ? CL_VIRUS : CL_CLEAN;
         if (cli_debug_flag) {
             fprintf(stderr, "\n");
             cli_dbgmsg("cli_detect_swizz: global: %s\n", global_swizz ? "suspicious" : "clean");
         }
     }

     if (stats->errors > stats->entries || stats->errors >= SWIZZ_MAXERRORS) {
         cli_dbgmsg("cli_detect_swizz: resources broken, ignoring\n");
         return CL_CLEAN;
     }
     if (stats->total <= 337)
         return CL_CLEAN;
     if (stats->suspicious << 10 > 40 * stats->total)
         return CL_VIRUS;
     if (!stats->suspicious)
         return CL_CLEAN;
     return global_swizz;

 }