e3aaff8e |
/* |
2023340a |
* Copyright (C) 2007-2008 Sourcefire, Inc.
*
* Authors: Nigel Horne |
e3aaff8e |
*
* This program is free software; you can redistribute it and/or modify |
2023340a |
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation. |
e3aaff8e |
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software |
48b7b4a7 |
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA. |
e3aaff8e |
*/ |
2023340a |
|
27395a6e |
static char const rcsid[] = "$Id: blob.c,v 1.64 2007/02/12 22:25:14 njh Exp $"; |
6d6e8271 |
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif |
e3aaff8e |
|
0e5a0129 |
#include <stdio.h> |
e3aaff8e |
#include <stdlib.h>
#include <string.h> |
0e5a0129 |
#include <errno.h> |
55e7a299 |
#include <fcntl.h> |
0e5a0129 |
|
f1861b5d |
#ifdef HAVE_SYS_PARAM_H |
7c5a7a47 |
#include <sys/param.h> /* for NAME_MAX */ |
bc6bbeff |
#endif |
0e5a0129 |
|
06a8e8ec |
#ifdef C_DARWIN |
e3aaff8e |
#include <sys/types.h>
#endif |
0e5a0129 |
|
09d26b44 |
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
|
0f7f7682 |
#include "others.h" |
e3aaff8e |
#include "mbox.h" |
0f7f7682 |
#include "matcher.h" |
a585329e |
#include "scanners.h" |
c7543866 |
#include "filetypes.h" |
e3aaff8e |
#include <assert.h>
|
86e209d6 |
/* Scehduled for rewite in 0.94 (bb#804). Disabling for now */
/* #define MAX_SCAN_SIZE 20*1024 /\* */
/* * The performance benefit of scanning */
/* * early disappears on medium and */
/* * large sized files */
/* *\/ */ |
01ff5174 |
|
18682e48 |
static const char *blobGetFilename(const blob *b);
|
e3aaff8e |
blob *
blobCreate(void)
{
#ifdef CL_DEBUG
blob *b = (blob *)cli_calloc(1, sizeof(blob)); |
79015e81 |
if(b) |
abc43816 |
b->magic = BLOBCLASS; |
0ae75a8d |
cli_dbgmsg("blobCreate\n"); |
e3aaff8e |
return b;
#else
return (blob *)cli_calloc(1, sizeof(blob));
#endif
}
void
blobDestroy(blob *b)
{ |
0ae75a8d |
#ifdef CL_DEBUG
cli_dbgmsg("blobDestroy %d\n", b->magic);
#else
cli_dbgmsg("blobDestroy\n");
#endif
|
e3aaff8e |
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
e3aaff8e |
if(b->name)
free(b->name);
if(b->data)
free(b->data);
#ifdef CL_DEBUG |
abc43816 |
b->magic = INVALIDCLASS; |
e3aaff8e |
#endif
free(b);
}
void
blobArrayDestroy(blob *blobList[], int n)
{ |
767f16ab |
assert(blobList != NULL);
|
0ae75a8d |
while(--n >= 0) {
cli_dbgmsg("blobArrayDestroy: %d\n", n);
if(blobList[n]) {
blobDestroy(blobList[n]);
blobList[n] = NULL;
}
} |
e3aaff8e |
}
|
9fe789f8 |
/*
* No longer needed to be growable, so turn into a normal memory area which
* the caller must free. The passed blob is destroyed
*/
void *
blobToMem(blob *b)
{
void *ret;
assert(b != NULL);
assert(b->magic == BLOBCLASS);
if(!b->isClosed)
blobClose(b);
if(b->name)
free(b->name);
#ifdef CL_DEBUG
b->magic = INVALIDCLASS;
#endif
ret = (void *)b->data;
free(b);
return ret;
}
|
78e302e1 |
/*ARGSUSED*/ |
e3aaff8e |
void |
78e302e1 |
blobSetFilename(blob *b, const char *dir, const char *filename) |
e3aaff8e |
{
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
e3aaff8e |
assert(filename != NULL);
|
bb3fdd1b |
cli_dbgmsg("blobSetFilename: %s\n", filename);
|
e3aaff8e |
if(b->name)
free(b->name);
|
8797c784 |
b->name = cli_strdup(filename); |
e3aaff8e |
|
bb3fdd1b |
if(b->name) |
11b50569 |
sanitiseName(b->name); |
e3aaff8e |
}
|
18682e48 |
static const char * |
e3aaff8e |
blobGetFilename(const blob *b)
{
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
e3aaff8e |
|
0e5a0129 |
return b->name; |
e3aaff8e |
}
|
ee1ecd46 |
/*
* Returns <0 for failure
*/ |
d73494ef |
int |
e3aaff8e |
blobAddData(blob *b, const unsigned char *data, size_t len)
{ |
86d59b24 |
#if HAVE_CLI_GETPAGESIZE |
e7aa5e3d |
static int pagesize;
int growth; |
767f16ab |
#endif
|
e3aaff8e |
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
e3aaff8e |
assert(data != NULL);
if(len == 0) |
d73494ef |
return 0; |
e3aaff8e |
|
8ef734d4 |
if(b->isClosed) {
/*
* Should be cli_dbgmsg, but I want to see them for now,
* and cli_dbgmsg doesn't support debug levels
*/
cli_warnmsg("Reopening closed blob\n");
b->isClosed = 0;
} |
767f16ab |
/*
* The payoff here is between reducing the number of calls to
* malloc/realloc and not overallocating memory. A lot of machines
* are more tight with memory than one may imagine which is why
* we don't just allocate a *huge* amount and be done with it. Closing
* the blob helps because that reclaims memory. If you know the maximum
* size of a blob before you start adding data, use blobGrow() that's
* the most optimum
*/ |
86d59b24 |
#if HAVE_CLI_GETPAGESIZE |
e7aa5e3d |
if(pagesize == 0) { |
86d59b24 |
pagesize = cli_getpagesize(); |
e7aa5e3d |
if(pagesize == 0)
pagesize = 4096;
}
growth = pagesize; |
355a5d3f |
if(len >= (size_t)pagesize) |
e7aa5e3d |
growth = ((len / pagesize) + 1) * pagesize;
|
2673dc74 |
/*cli_dbgmsg("blobGrow: b->size %lu, b->len %lu, len %lu, growth = %u\n",
b->size, b->len, len, growth);*/ |
e7aa5e3d |
|
767f16ab |
if(b->data == NULL) {
assert(b->len == 0);
assert(b->size == 0);
|
e7aa5e3d |
b->size = growth;
b->data = cli_malloc(growth); |
b02bab2b |
} else if(b->size < b->len + (off_t)len) { |
e7aa5e3d |
unsigned char *p = cli_realloc(b->data, b->size + growth); |
767f16ab |
if(p == NULL) |
d73494ef |
return -1; |
767f16ab |
|
e7aa5e3d |
b->size += growth; |
767f16ab |
b->data = p;
}
#else |
e3aaff8e |
if(b->data == NULL) {
assert(b->len == 0); |
c81143fc |
assert(b->size == 0);
|
a585329e |
b->size = (off_t)len * 4; |
e3aaff8e |
b->data = cli_malloc(b->size); |
ea49b0fc |
} else if(b->size < b->len + (off_t)len) { |
fbb3b454 |
unsigned char *p = cli_realloc(b->data, b->size + (len * 4));
if(p == NULL) |
d73494ef |
return -1; |
fbb3b454 |
|
a585329e |
b->size += (off_t)len * 4; |
fbb3b454 |
b->data = p; |
e3aaff8e |
} |
767f16ab |
#endif |
e3aaff8e |
|
79015e81 |
if(b->data) {
memcpy(&b->data[b->len], data, len); |
a585329e |
b->len += (off_t)len; |
79015e81 |
} |
d73494ef |
return 0; |
e3aaff8e |
}
|
2a4b5c6e |
unsigned char * |
e3aaff8e |
blobGetData(const blob *b)
{
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
e3aaff8e |
|
6dec41e1 |
if(b->len == 0)
return NULL; |
311286ab |
return b->data; |
e3aaff8e |
}
|
bc6bbeff |
size_t |
e3aaff8e |
blobGetDataSize(const blob *b)
{
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
e3aaff8e |
|
311286ab |
return b->len; |
e3aaff8e |
} |
8ef734d4 |
void
blobClose(blob *b)
{ |
767f16ab |
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
4b34df42 |
if(b->isClosed) { |
8386c723 |
cli_warnmsg("Attempt to close a previously closed blob\n"); |
4b34df42 |
return;
} |
767f16ab |
|
e2875303 |
/*
* Nothing more is going to be added to this blob. If it'll save more
* than a trivial amount (say 64 bytes) of memory, shrink the allocation
*/
if((b->size - b->len) >= 64) { |
767f16ab |
if(b->len == 0) { /* Not likely */
free(b->data);
b->data = NULL; |
b02bab2b |
cli_dbgmsg("blobClose: recovered all %lu bytes\n", |
95e11e5a |
(unsigned long)b->size); |
767f16ab |
b->size = 0;
} else {
unsigned char *ptr = cli_realloc(b->data, b->len);
if(ptr == NULL)
return;
|
b02bab2b |
cli_dbgmsg("blobClose: recovered %lu bytes from %lu\n", |
95e11e5a |
(unsigned long)(b->size - b->len),
(unsigned long)b->size); |
767f16ab |
b->size = b->len;
b->data = ptr;
} |
8ef734d4 |
} |
d1bd2547 |
b->isClosed = 1; |
8ef734d4 |
}
/*
* Returns 0 if the blobs are the same
*/
int
blobcmp(const blob *b1, const blob *b2)
{ |
bc6bbeff |
size_t s1, s2; |
8ef734d4 |
assert(b1 != NULL);
assert(b2 != NULL);
if(b1 == b2)
return 0;
s1 = blobGetDataSize(b1);
s2 = blobGetDataSize(b2);
if(s1 != s2)
return 1;
|
767f16ab |
if((s1 == 0) && (s2 == 0))
return 0;
|
8ef734d4 |
return memcmp(blobGetData(b1), blobGetData(b2), s1);
} |
c81143fc |
|
826864d6 |
/*
* Return clamav return code
*/
int |
c81143fc |
blobGrow(blob *b, size_t len)
{
assert(b != NULL); |
abc43816 |
assert(b->magic == BLOBCLASS); |
c81143fc |
if(len == 0) |
826864d6 |
return CL_SUCCESS; |
c81143fc |
if(b->isClosed) {
/*
* Should be cli_dbgmsg, but I want to see them for now,
* and cli_dbgmsg doesn't support debug levels
*/
cli_warnmsg("Growing closed blob\n");
b->isClosed = 0;
}
if(b->data == NULL) {
assert(b->len == 0);
assert(b->size == 0);
b->data = cli_malloc(len); |
d1bd2547 |
if(b->data) |
a585329e |
b->size = (off_t)len; |
c81143fc |
} else { |
d1bd2547 |
unsigned char *ptr = cli_realloc(b->data, b->size + len);
if(ptr) { |
a585329e |
b->size += (off_t)len; |
d1bd2547 |
b->data = ptr;
} |
c81143fc |
} |
826864d6 |
return (b->data) ? CL_SUCCESS : CL_EMEM; |
c81143fc |
} |
0e5a0129 |
fileblob *
fileblobCreate(void)
{
#ifdef CL_DEBUG
fileblob *fb = (fileblob *)cli_calloc(1, sizeof(fileblob));
if(fb) |
abc43816 |
fb->b.magic = BLOBCLASS; |
0e5a0129 |
cli_dbgmsg("blobCreate\n");
return fb;
#else
return (fileblob *)cli_calloc(1, sizeof(fileblob));
#endif
}
|
a585329e |
/*
* Returns CL_CLEAN or CL_VIRUS. Destroys the fileblob and removes the file
* if possible
*/
int
fileblobScanAndDestroy(fileblob *fb)
{ |
33068e09 |
if(fb->ctx && fb->ctx->engine->keeptmp) { |
25c836e3 |
/* Can't remove the file, the caller must scan */
fileblobDestroy(fb);
return CL_CLEAN;
}
|
a585329e |
switch(fileblobScan(fb)) {
case CL_VIRUS:
fileblobDestructiveDestroy(fb);
return CL_VIRUS;
case CL_BREAK:
fileblobDestructiveDestroy(fb);
return CL_CLEAN;
default:
fileblobDestroy(fb);
return CL_CLEAN;
}
}
/*
* Destroy the fileblob, and remove the file associated with it
*/
void
fileblobDestructiveDestroy(fileblob *fb)
{
if(fb->fp && fb->fullname) {
fclose(fb->fp);
cli_dbgmsg("fileblobDestructiveDestroy: %s\n", fb->fullname); |
6c06c7b3 |
cli_unlink(fb->fullname); |
a585329e |
free(fb->fullname);
fb->fp = NULL;
fb->fullname = NULL;
}
if(fb->b.name) {
free(fb->b.name);
fb->b.name = NULL;
}
fileblobDestroy(fb);
}
/*
* Destroy the fileblob, and remove the file associated with it if that file is
* empty
*/ |
0e5a0129 |
void
fileblobDestroy(fileblob *fb)
{
assert(fb != NULL); |
bd601898 |
assert(fb->b.magic == BLOBCLASS); |
0e5a0129 |
|
5a65084a |
if(fb->b.name && fb->fp) { |
bd601898 |
fclose(fb->fp); |
ea49b0fc |
if(fb->fullname) {
cli_dbgmsg("fileblobDestroy: %s\n", fb->fullname);
if(!fb->isNotEmpty) {
cli_dbgmsg("fileblobDestroy: not saving empty file\n"); |
6c06c7b3 |
cli_unlink(fb->fullname); |
ea49b0fc |
} |
767f16ab |
} |
0e5a0129 |
free(fb->b.name);
assert(fb->b.data == NULL);
} else if(fb->b.data) {
free(fb->b.data); |
21992fd1 |
if(fb->b.name) { |
8affc406 |
cli_errmsg("fileblobDestroy: %s not saved: report to http://bugs.clamav.net\n",
(fb->fullname) ? fb->fullname : fb->b.name); |
5a65084a |
free(fb->b.name); |
21992fd1 |
} else |
95e11e5a |
cli_errmsg("fileblobDestroy: file not saved (%lu bytes): report to http://bugs.clamav.net\n",
(unsigned long)fb->b.len); |
0e5a0129 |
} |
ea49b0fc |
if(fb->fullname)
free(fb->fullname); |
bd601898 |
#ifdef CL_DEBUG
fb->b.magic = INVALIDCLASS;
#endif |
0e5a0129 |
free(fb);
}
void |
4270f93b |
fileblobPartialSet(fileblob *fb, const char *fullname, const char *arg)
{
if(fb->b.name)
return;
assert(fullname != NULL);
cli_dbgmsg("fileblobPartialSet: saving to %s\n", fullname);
fb->fd = open(fullname, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY|O_EXCL, 0600);
if(fb->fd < 0) {
cli_errmsg("fileblobPartialSet: unable to create file: %s\n",fullname);
return;
}
fb->fp = fdopen(fb->fd, "wb");
if(fb->fp == NULL) { |
f2d79ab3 |
cli_errmsg("fileblobSetFilename: fdopen failed\n"); |
4270f93b |
close(fb->fd);
return;
} |
33068e09 |
blobSetFilename(&fb->b, fb->ctx ? fb->ctx->engine->tmpdir : NULL, fullname); |
4270f93b |
if(fb->b.data)
if(fileblobAddData(fb, fb->b.data, fb->b.len) == 0) {
free(fb->b.data);
fb->b.data = NULL;
fb->b.len = fb->b.size = 0;
fb->isNotEmpty = 1;
}
fb->fullname = cli_strdup(fullname);
}
void |
0e5a0129 |
fileblobSetFilename(fileblob *fb, const char *dir, const char *filename)
{ |
46ecb38d |
char *fullname; |
0e5a0129 |
if(fb->b.name)
return;
|
815e712f |
assert(filename != NULL);
assert(dir != NULL);
|
78e302e1 |
blobSetFilename(&fb->b, dir, filename); |
0e5a0129 |
/*
* Reload the filename, it may be different from the one we've
* asked for, e.g. '/'s taken out
*/
filename = blobGetFilename(&fb->b);
|
815e712f |
assert(filename != NULL); |
46ecb38d |
if (cli_gentempfd(dir, &fullname, &fb->fd)!=CL_SUCCESS) return; |
815e712f |
|
46ecb38d |
cli_dbgmsg("fileblobSetFilename: file %s saved to %s\n", filename, fullname); |
0e5a0129 |
|
46ecb38d |
fb->fp = fdopen(fb->fd, "wb"); |
0e5a0129 |
if(fb->fp == NULL) { |
f2d79ab3 |
cli_errmsg("fileblobSetFilename: fdopen failed\n"); |
46ecb38d |
close(fb->fd);
free(fullname); |
0e5a0129 |
return;
} |
4aeb921b |
if(fb->b.data)
if(fileblobAddData(fb, fb->b.data, fb->b.len) == 0) {
free(fb->b.data);
fb->b.data = NULL;
fb->b.len = fb->b.size = 0; |
ea49b0fc |
fb->isNotEmpty = 1; |
4aeb921b |
} |
46ecb38d |
fb->fullname = fullname; |
0e5a0129 |
}
|
d73494ef |
int |
0e5a0129 |
fileblobAddData(fileblob *fb, const unsigned char *data, size_t len)
{
if(len == 0) |
d73494ef |
return 0; |
0e5a0129 |
|
bd601898 |
assert(data != NULL);
|
0e5a0129 |
if(fb->fp) { |
01ff5174 |
#if defined(MAX_SCAN_SIZE) && (MAX_SCAN_SIZE > 0)
const cli_ctx *ctx = fb->ctx;
|
a603478f |
if(fb->isInfected) /* pretend all was written */
return 0; |
01ff5174 |
if(ctx) {
int do_scan = 1;
|
86e209d6 |
if(cli_checklimits("fileblobAddData", ctx, fb->bytes_scanned, 0, 0)!=CL_CLEAN)
do_scan = 0; |
01ff5174 |
if(fb->bytes_scanned > MAX_SCAN_SIZE)
do_scan = 0;
if(do_scan) {
if(ctx->scanned)
*ctx->scanned += (unsigned long)len / CL_COUNT_PRECISION;
fb->bytes_scanned += (unsigned long)len; |
561b5297 |
|
e06afe8e |
if((len > 5) && cli_updatelimits(ctx, len)==CL_CLEAN && (cli_scanbuff(data, (unsigned int)len, 0, ctx->virname, ctx->engine, CL_TYPE_BINARY_DATA, NULL) == CL_VIRUS)) { |
01ff5174 |
cli_dbgmsg("fileblobAddData: found %s\n", *ctx->virname);
fb->isInfected = 1;
} |
0f7f7682 |
}
} |
01ff5174 |
#endif |
0f7f7682 |
|
d73494ef |
if(fwrite(data, len, 1, fb->fp) != 1) { |
f2d79ab3 |
cli_errmsg("fileblobAddData: Can't write %lu bytes to temporary file %s\n",
(unsigned long)len, fb->b.name); |
d73494ef |
return -1;
}
fb->isNotEmpty = 1;
return 0;
}
return blobAddData(&(fb->b), data, len); |
0e5a0129 |
}
const char *
fileblobGetFilename(const fileblob *fb)
{
return blobGetFilename(&(fb->b));
} |
bb3fdd1b |
|
a603478f |
void
fileblobSetCTX(fileblob *fb, cli_ctx *ctx)
{
fb->ctx = ctx;
}
|
a585329e |
/*
* Performs a full scan on the fileblob, returning ClamAV status:
* CL_BREAK means clean
* CL_CLEAN means unknown
* CL_VIRUS means infected
*/
int
fileblobScan(const fileblob *fb)
{ |
46ecb38d |
int rc; |
c7543866 |
cli_file_t ftype; |
a585329e |
if(fb->isInfected)
return CL_VIRUS; |
46ecb38d |
if(fb->fp == NULL || fb->fullname == NULL) { |
a585329e |
/* shouldn't happen, scan called before fileblobSetFilename */
cli_warnmsg("fileblobScan, fullname == NULL\n"); |
8affc406 |
return CL_ENULLARG; /* there is no CL_UNKNOWN */ |
a585329e |
}
if(fb->ctx == NULL) {
/* fileblobSetCTX hasn't been called */
cli_dbgmsg("fileblobScan, ctx == NULL\n");
return CL_CLEAN; /* there is no CL_UNKNOWN */
}
|
46ecb38d |
fflush(fb->fp);
lseek(fb->fd, 0, SEEK_SET); |
c7543866 |
|
cb680655 |
fb->ctx->container_type = CL_TYPE_MAIL;
rc = cli_magic_scandesc(fb->fd, fb->ctx);
fb->ctx->container_type = 0; |
c7543866 |
|
a585329e |
if(rc == CL_VIRUS) {
cli_dbgmsg("%s is infected\n", fb->fullname);
return CL_VIRUS;
}
cli_dbgmsg("%s is clean\n", fb->fullname);
return CL_BREAK;
}
/*
* Doesn't perform a full scan just lets the caller know if something suspicious has
* been seen yet
*/ |
a603478f |
int |
a585329e |
fileblobInfected(const fileblob *fb) |
a603478f |
{ |
a585329e |
return fb->isInfected; |
a603478f |
} |
11b50569 |
/*
* Different operating systems allow different characters in their filenames
* FIXME: What does QNX want? There is no #ifdef C_QNX, but if there were
* it may be best to treat it like MSDOS
*/
void
sanitiseName(char *name)
{ |
58481352 |
char c;
while((c = *name)) {
if(c!='.' && c!='_' && (c>'z' || c<'0' || (c>'9' && c<'A') || (c>'Z' && c<'a'))) |
11b50569 |
*name = '_';
name++;
}
} |