@@ -377,9 +377,21 @@ struct cl_engine *cl_engine_new(void)

 	return NULL;

     }

+    new->pwdbs = mpool_calloc(new->mempool, CLI_PWDB_COUNT, sizeof(struct cli_pwdb *));

+    if (!new->pwdbs) {

+	cli_errmsg("cl_engine_new: Can't initialize password databases\n");

+	mpool_free(new->mempool, new->dconf);

+	mpool_free(new->mempool, new->root);

+#ifdef USE_MPOOL

+        mpool_destroy(new->mempool);

+#endif

+	free(new);

+    }

+

     crtmgr_init(&(new->cmgr));

     if(crtmgr_add_roots(new, &(new->cmgr)))  {

 	cli_errmsg("cl_engine_new: Can't initialize root certificates\n");

+	mpool_free(new->mempool, new->pwdbs);

 	mpool_free(new->mempool, new->dconf);

 	mpool_free(new->mempool, new->root);

 #ifdef USE_MPOOL

@@ -395,6 +407,7 @@ struct cl_engine *cl_engine_new(void)

 #ifdef CL_THREAD_SAFE

         if (pthread_mutex_init(&(intel->mutex), NULL)) {

             cli_errmsg("cli_engine_new: Cannot initialize stats gathering mutex\n");

+	    mpool_free(new->mempool, new->pwdbs);

             mpool_free(new->mempool, new->dconf);

             mpool_free(new->mempool, new->root);

 #ifdef USE_MPOOL

@@ -440,6 +453,7 @@ struct cl_engine *cl_engine_new(void)

     /* YARA */

     if (cli_yara_init(new) != CL_SUCCESS) {

         cli_errmsg("cli_engine_new: failed to initialize YARA\n");

+	mpool_free(new->mempool, new->pwdbs);

         mpool_free(new->mempool, new->dconf);

         mpool_free(new->mempool, new->root);

 #ifdef USE_MPOOL

@@ -230,12 +230,18 @@ struct cli_dbinfo {

     struct cli_dbinfo *next;

 };

-struct cli_pwdict {

+#define CLI_PWDB_COUNT 3

+typedef enum {

+    CLI_PWDB_ANY = 0,

+    CLI_PWDB_ZIP = 1,

+    CLI_PWDB_RAR = 2

+} cl_pwdb_t;

+

+struct cli_pwdb {

     char *name;

     unsigned char *passwd;

     uint16_t length;

-    cli_file_t container;

-    struct cli_pwdict *next;

+    struct cli_pwdb *next;

 };

 struct cl_engine {

@@ -295,7 +301,7 @@ struct cl_engine {

     struct cli_ftype *ptypes;

     /* Container password storage */

-    struct cli_pwdict *pw_dict;

+    struct cli_pwdb **pwdbs;

     /* Ignored signatures */

     struct cli_matcher *ignored;

@@ -4096,7 +4096,8 @@ static int cli_loadpwdb(FILE *fs, struct cl_engine *engine, unsigned int options

     char *attribs;

     char buffer[FILEBUFF];

     unsigned int line = 0, skip = 0, pwcnt = 0, tokens_count;

-    struct cli_pwdict *new, *ins;

+    struct cli_pwdb *new, *ins;

+    cl_pwdb_t container;

     struct cli_lsig_tdb tdb;

     int ret = CL_SUCCESS, pwstype;

@@ -4152,20 +4153,39 @@ static int cli_loadpwdb(FILE *fs, struct cl_engine *engine, unsigned int options

                 break;

         }

+	/* check container type */

+	if (!tdb.container) {

+	    container = CLI_PWDB_ANY;

+	} else {

+	    switch (*(tdb.container)) {

+	    case CL_TYPE_ANY:

+		container = CLI_PWDB_ANY;

+		break;

+	    case CL_TYPE_ZIP:

+		container = CLI_PWDB_ZIP;

+		break;

+	    case CL_TYPE_RAR:

+		container = CLI_PWDB_RAR;

+		break;

+	    default:

+		cli_errmsg("cli_loadpwdb: Invalid conatiner specified to .pwdb signature\n");

+		return CL_EMALFDB;

+	    }

+	}

+	FREE_TDB(tdb);

+

         /* check the PWStorageType */

         if(!cli_isnumber(tokens[2])) {

             cli_errmsg("cli_loadpwdb: Invalid value for PWStorageType (third entry)\n");

             ret = CL_EMALFDB;

-            FREE_TDB(tdb);

             break;

         }

         pwstype = atoi(tokens[2]);

         if((pwstype == 0) || (pwstype == 1)) {

-            new = (struct cli_pwdict *) mpool_calloc(engine->mempool, 1, sizeof(struct cli_pwdict));

+            new = (struct cli_pwdb *) mpool_calloc(engine->mempool, 1, sizeof(struct cli_pwdb));

             if(!new) {

                 ret = CL_EMEM;

-                FREE_TDB(tdb);

                 break;

             }

@@ -4173,7 +4193,6 @@ static int cli_loadpwdb(FILE *fs, struct cl_engine *engine, unsigned int options

             new->name = cli_mpool_strdup(engine->mempool, tokens[0]);

             if (!new->name) {

                 ret = CL_EMEM;

-                FREE_TDB(tdb);

                 mpool_free(engine->mempool, new);

                 break;

             }

@@ -4191,33 +4210,14 @@ static int cli_loadpwdb(FILE *fs, struct cl_engine *engine, unsigned int options

                     ret = CL_EMEM;

                 else

                     ret = CL_EMALFDB;

-                FREE_TDB(tdb);

-                mpool_free(engine->mempool, new);

                 mpool_free(engine->mempool, new->name);

+                mpool_free(engine->mempool, new);

                 break;

             }

-            /* TODO: copy containers in the tdb */

-            if (!tdb.container) {

-                new->container = CL_TYPE_ANY;

-            } else {

-                new->container = *(tdb.container);

-            }

-            FREE_TDB(tdb);

-

             /* add to the engine list, sorted by target type */

-            if(!engine->pw_dict) {

-                engine->pw_dict = new;

-            } else if(new->container < engine->pw_dict->container) {

-                new->next = engine->pw_dict;

-                engine->pw_dict = new;

-            } else {

-                ins = engine->pw_dict;

-                while(ins->next && (ins->next->container < new->container))

-                    ins = ins->next;

-                new->next = ins->next;

-                ins->next = new;

-            }

+	    new->next = engine->pwdbs[container];

+	    engine->pwdbs[container] = new;

         } else {

             cli_dbgmsg("cli_loadpwdb: Unsupported PWStorageType %u\n", pwstype);

             continue;

@@ -4846,15 +4846,19 @@ int cl_statchkdir(const struct cl_stat *dbstat)

     return CL_SUCCESS;

 }

-void cli_pwfree(const struct cl_engine *engine)

+void cli_pwdb_list_free(struct cl_engine *engine, struct cli_pwdb *pwdb)

 {

-    struct cli_pwdict *pw = engine->pw_dict, *pt;

+    struct cli_pwdb *thiz, *that;

-    while(pw) {

-	pt = pw;

-	pw = pw->next;

-	mpool_free(engine->mempool, pt->passwd);

-	mpool_free(engine->mempool, pt);

+    thiz = pwdb;

+    while (thiz) {

+	that = thiz->next;

+

+	mpool_free(engine->mempool, thiz->name);

+	mpool_free(engine->mempool, thiz->passwd);

+	mpool_free(engine->mempool, thiz);

+

+	thiz = that;

     }

 }

@@ -5014,6 +5018,13 @@ int cl_engine_free(struct cl_engine *engine)

         mpool_free(engine->mempool, engine->dconf);

     }

+    if(engine->pwdbs) {

+        for(i = 0; i < CLI_PWDB_COUNT; i++)

+            if(engine->pwdbs[i])

+                cli_pwdb_list_free(engine, engine->pwdbs[i]);

+	mpool_free(engine->mempool, engine->pwdbs);

+    }

+

     if(engine->pua_cats)

 	mpool_free(engine->mempool, engine->pua_cats);

@@ -5053,8 +5064,6 @@ int cl_engine_free(struct cl_engine *engine)

 	mpool_free(engine->mempool, engine->ignored);

     }

-   cli_pwfree(engine);

-

 #ifdef USE_MPOOL

     if(engine->mempool) mpool_destroy(engine->mempool);

 #endif

@@ -5088,7 +5097,7 @@ int cl_engine_compile(struct cl_engine *engine)

 	    return ret;

     /* handle default passwords */

-    if(!engine->pw_dict)

+    if(!engine->pwdbs[0] && !engine->pwdbs[1] && !engine->pwdbs[2])

 	if((ret = cli_loadpwdb(NULL, engine, 0, 1, NULL)))

 	    return ret;

@@ -328,7 +328,7 @@ static inline void zupdatekey(uint32_t key[3], unsigned char input)

 }

 /* zip init keys */

-static inline void zinitkey(uint32_t key[3], struct cli_pwdict *password)

+static inline void zinitkey(uint32_t key[3], struct cli_pwdb *password)

 {

     int i;

@@ -357,7 +357,7 @@ static inline int zdecrypt(const uint8_t *src, uint32_t csize, uint32_t usize, c

     int i, ret, v = 0;

     uint32_t key[3];

     uint8_t eh[12]; /* encryption header buffer */

-    struct cli_pwdict *password;

+    struct cli_pwdb *password, *pass_any, *pass_zip;

     if (!ctx || !ctx->engine)

 	return CL_ENULLARG;

@@ -368,15 +368,11 @@ static inline int zdecrypt(const uint8_t *src, uint32_t csize, uint32_t usize, c

 	return CL_SUCCESS;

     }

-    password = ctx->engine->pw_dict;

+    pass_any = ctx->engine->pwdbs[CLI_PWDB_ANY];

+    pass_zip = ctx->engine->pwdbs[CLI_PWDB_ZIP];

-    while (password) {

-	if ((password->container != CL_TYPE_ANY) && (password->container != CL_TYPE_ZIP)) {

-	    if ((password->container > CL_TYPE_ZIP) && (password->container > CL_TYPE_ANY))

-		break;

-	    password = password->next;

-	    continue;

-	}

+    while (pass_any || pass_zip) {

+	password = pass_zip ? pass_zip : pass_any;

 	zinitkey(key, password);

@@ -490,7 +486,10 @@ static inline int zdecrypt(const uint8_t *src, uint32_t csize, uint32_t usize, c

 	    return ret;

 	}

-	password = password->next;

+	if (pass_zip)

+	    pass_zip = pass_zip->next;

+	else

+	    pass_any = pass_any->next;	    

     }

     cli_dbgmsg("cli_unzip: decrypt - skipping encrypted file, no valid passwords\n");