@@ -1,3 +1,31 @@

+Sat May 21 02:17:08 CEST 2005 (tk)

+----------------------------------

+  * Remove the use of tmpfile(). Patch by Mark Pizzolato

+    <clamav-devel@subscriptions.pizzolato.net>, full list of changes:

+

+  * libclamav/others.c

+    - in cli_gentempname call cli_rndnum with 256 instead of 255 to get the

+      full range of possible byte values

+    - new functions: cli_gentempdir, cli_gentempdesc, and cli_gentempstream

+      which generate the appropriate type of object (and return its name)

+    - fix bug in memory error path of cli_gentemp (now cli_gentempname)

+      which printed the wrong (possibly null) value for the directory name

+

+  * libclamav/scanners.c

+    - use cli_gentempstream instead of tmpfile()

+    - fix file descriptor leak in error path in cli_scangzip()

+    - fix file descriptor leaks if cli_msexpand returns an error in cli_scanszdd

+

+  * clamd/scanner.c

+    - use cli_gentempstream instead of tmpfile() and remove the old tmpfile()

+      logic

+    - add port number to log messages for stream connections (helps

+      interpreting log data when multiple sessions are active)

+    - fix error path for a read timeout which logged messages indicating

+      that both a timeout and a poll error occurred.

+    - support configuration option LeaveTemporaryFiles for stream scanned

+      temporary files.

+

 Fri May 20 09:16:36 BST 2005 (njh)

 ----------------------------------

   * libclamav/pdf.c:	Ignore leading NL in FlateDecode messages

@@ -306,7 +306,7 @@ int scanstream(int odesc, unsigned long int *scanned, const struct cl_node *root

 	struct sockaddr_in server;

 	struct hostent *he;

 	struct cfgstruct *cpt;

-	FILE *tmp = NULL;

+	char *tmpname;

     /* get min port */

@@ -386,12 +386,12 @@ int scanstream(int odesc, unsigned long int *scanned, const struct cl_node *root

     switch(retval = poll_fd(sockfd, timeout)) {

 	case 0: /* timeout */

 	    mdprintf(odesc, "Accept timeout. ERROR\n");

-	    logg("!ScanStream: accept timeout.\n");

+	    logg("!ScanStream %d: accept timeout.\n", port);

 	    close(sockfd);

 	    return -1;

 	case -1:

 	    mdprintf(odesc, "Accept poll. ERROR\n");

-	    logg("!ScanStream: accept poll failed.\n");

+	    logg("!ScanStream %d: accept poll failed.\n", port);

 	    close(sockfd);

 	    return -1;

     }

@@ -399,21 +399,20 @@ int scanstream(int odesc, unsigned long int *scanned, const struct cl_node *root

     if((acceptd = accept(sockfd, NULL, NULL)) == -1) {

 	close(sockfd);

 	mdprintf(odesc, "accept() ERROR\n");

-	logg("!ScanStream: accept() failed.\n");

+	logg("!ScanStream %d: accept() failed.\n", port);

 	return -1;

     }

     logg("*Accepted connection on port %d, fd %d\n", port, acceptd);

-    if((tmp = tmpfile()) == NULL) {

+    if ((tmpname = cli_gentempdesc(NULL, &tmpd)) == NULL) {

 	shutdown(sockfd, 2);

 	close(sockfd);

 	close(acceptd);

 	mdprintf(odesc, "tempfile() failed. ERROR\n");

-	logg("!ScanStream: Can't create temporary file.\n");

+	logg("!ScanStream %d: Can't create temporary file.\n", port);

 	return -1;

     }

-    tmpd = fileno(tmp);

     if((cpt = cfgopt(copt, "StreamMaxLength")))

 	maxsize = cpt->numarg;

@@ -434,9 +433,11 @@ int scanstream(int odesc, unsigned long int *scanned, const struct cl_node *root

 	    close(sockfd);

 	    close(acceptd);

 	    mdprintf(odesc, "Temporary file -> write ERROR\n");

-	    logg("!ScanStream: Can't write to temporary file.\n");

-	    if(tmp)

-		fclose(tmp);

+	    logg("!ScanStream %d: Can't write to temporary file.\n", port);

+	    close(tmpd);

+	    if(!cfgopt(copt, "LeaveTemporaryFiles"))

+		unlink(tmpname);

+	    free(tmpname);

 	    return -1;

 	}

@@ -444,7 +445,7 @@ int scanstream(int odesc, unsigned long int *scanned, const struct cl_node *root

 	    btread = (maxsize - size); /* only read up to max */

 	    if(btread <= 0) {

-		logg("^ScanStream: Size limit reached ( max: %d)\n", maxsize);

+		logg("^ScanStream %d: Size limit reached (max: %d)\n", port, maxsize);

 	    	break; /* Scan what we have */

 	    }

 	}

@@ -453,23 +454,27 @@ int scanstream(int odesc, unsigned long int *scanned, const struct cl_node *root

     switch(retval) {

 	case 0: /* timeout */

 	    mdprintf(odesc, "read timeout ERROR\n");

-	    logg("!ScanStream: read timeout.\n");

+	    logg("!ScanStream %d: read timeout.\n", port);

+	    break;

 	case -1:

 	    mdprintf(odesc, "read poll ERROR\n");

-	    logg("!ScanStream: read poll failed.\n");

+	    logg("!ScanStream %d: read poll failed.\n", port);

+	    break;

     }

     lseek(tmpd, 0, SEEK_SET);

     ret = cl_scandesc(tmpd, &virname, scanned, root, limits, options);

-    if(tmp)

-	fclose(tmp);

+    close(tmpd);

+    if(!cfgopt(copt, "LeaveTemporaryFiles"))

+	unlink(tmpname);

+    free(tmpname);

     close(acceptd);

     close(sockfd);

     if(ret == CL_VIRUS) {

 	mdprintf(odesc, "stream: %s FOUND\n", virname);

-	logg("stream: %s FOUND\n", virname);

+	logg("stream %d: %s FOUND\n", port, virname);

 	virusaction("stream", virname, copt);

     } else if(ret != CL_CLEAN) {

 	mdprintf(odesc, "stream: %s ERROR\n", cl_strerror(ret));

@@ -370,7 +370,7 @@ void cl_settempdir(const char *dir, short leavetemps)

     cli_leavetemps_flag = leavetemps;

 }

-char *cli_gentemp(const char *dir)

+static char *cli_gentempname(const char *dir)

 {

 	char *name, *tmp;

         const char *mdir;

@@ -391,19 +391,15 @@ char *cli_gentemp(const char *dir)

     name = (char*) cli_calloc(strlen(mdir) + 1 + 16 + 1 + 7, sizeof(char));

     if(name == NULL) {

-	cli_dbgmsg("cli_gentemp('%s'): out of memory\n", dir);

+	cli_dbgmsg("cli_gentempname('%s'): out of memory\n", mdir);

 	return NULL;

     }

-#ifdef CL_THREAD_SAFE

-    pthread_mutex_lock(&cli_gentemp_mutex);

-#endif

-

     memcpy(salt, oldmd5buff, 16);

-    do {

+    do {	

 	for(i = 16; i < 48; i++)

-	    salt[i] = cli_rndnum(255);

+	    salt[i] = cli_rndnum(256);

 	tmp = cli_md5buff(( char* ) salt, 48);

 	sprintf(name, "%s/clamav-", mdir);

@@ -411,6 +407,19 @@ char *cli_gentemp(const char *dir)

 	free(tmp);

     } while(stat(name, &foo) != -1);

+    return(name);

+}

+

+char *cli_gentemp(const char *dir)

+{

+	char *name;

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_lock(&cli_gentemp_mutex);

+#endif

+

+    name = cli_gentempname(dir);

+

 #ifdef CL_THREAD_SAFE

     pthread_mutex_unlock(&cli_gentemp_mutex);

 #endif

@@ -418,6 +427,76 @@ char *cli_gentemp(const char *dir)

     return(name);

 }

+

+char *cli_gentempdir(const char *dir)

+{

+	char *name;

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_lock(&cli_gentemp_mutex);

+#endif

+

+    name = cli_gentempname(dir);

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_unlock(&cli_gentemp_mutex);

+#endif

+

+    if(name && mkdir(name, 0700)) {

+	cli_dbgmsg("cli_gentempdir(): can't create temp directory: %s\n", name);

+        free(name);

+        name = NULL;

+    }

+

+    return(name);

+}

+

+char *cli_gentempdesc(const char *dir, int *fd)

+{

+	char *name;

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_lock(&cli_gentemp_mutex);

+#endif

+

+    name = cli_gentempname(dir);

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_unlock(&cli_gentemp_mutex);

+#endif

+

+    if(name && ((*fd = open(name, O_RDWR|O_CREAT|O_TRUNC|O_BINARY, S_IRWXU)) < 0)) {

+	cli_dbgmsg("cli_gentempdesc(): can't create temp file: %s\n", name);

+        free(name);

+        name = NULL;

+    }

+

+    return(name);

+}

+

+char *cli_gentempstream(const char *dir, FILE **fs)

+{

+	char *name;

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_lock(&cli_gentemp_mutex);

+#endif

+

+    name = cli_gentempname(dir);

+

+#ifdef CL_THREAD_SAFE

+    pthread_mutex_unlock(&cli_gentemp_mutex);

+#endif

+

+    if(name && ((*fs = fopen(name, "wb+")) == NULL)) {

+	cli_dbgmsg("cli_gentempstream(): can't create temp file: %s\n", name);

+        free(name);

+        name = NULL;

+    }

+

+    return(name);

+}

+

 int cli_rmdirs(const char *dirname)

 {

 	DIR *dd;

@@ -38,6 +38,9 @@ int cli_writen(int fd, void *buff, unsigned int count);

 int32_t cli_readint32(const char *buff);

 void cli_writeint32(char *offset, uint32_t value);

 char *cli_gentemp(const char *dir);

+char *cli_gentempdir(const char *dir);

+char *cli_gentempdesc(const char *dir, int *fd);

+char *cli_gentempstream(const char *dir, FILE **fs);

 unsigned int cli_rndnum(unsigned int max);

 int cli_filecopy(const char *src, const char *dest);

@@ -268,6 +268,7 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	ZZIP_DIRENT zdirent;

 	ZZIP_FILE *zfp;

 	FILE *tmp = NULL;

+	char *tmpname;

 	char *buff;

 	int fd, bytes, ret = CL_CLEAN;

 	unsigned long int size = 0;

@@ -428,7 +429,7 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	}

 	/* generate temporary file and get its descriptor */

-	if((tmp = tmpfile()) == NULL) {

+	if((tmpname = cli_gentempstream(NULL, &tmp)) == NULL) {

 	    cli_dbgmsg("Zip: Can't generate tmpfile().\n");

 	    zzip_file_close(zfp);

 	    ret = CL_ETMPFILE;

@@ -443,6 +444,9 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 		zzip_file_close(zfp);

 		zzip_dir_close(zdir);

 		fclose(tmp);

+		if(!cli_leavetemps_flag)

+		    unlink(tmpname);

+		free(tmpname);

 		free(buff);

 		return CL_EIO;

 	    }

@@ -478,6 +482,9 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

 	if (tmp) {

 	    fclose(tmp);

+	    if(!cli_leavetemps_flag)

+		unlink(tmpname);

+	    free(tmpname);

 	    tmp = NULL;

 	}

     }

@@ -485,6 +492,9 @@ static int cli_scanzip(int desc, const char **virname, long int *scanned, const

     zzip_dir_close(zdir);

     if (tmp) {

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);

 	tmp = NULL;

     }

@@ -498,6 +508,7 @@ static int cli_scangzip(int desc, const char **virname, long int *scanned, const

 	unsigned long int size = 0;

 	char *buff;

 	FILE *tmp = NULL;

+	char *tmpname;

 	gzFile gd;

@@ -508,7 +519,7 @@ static int cli_scangzip(int desc, const char **virname, long int *scanned, const

 	return CL_EGZIP;

     }

-    if((tmp = tmpfile()) == NULL) {

+    if((tmpname = cli_gentempstream(NULL, &tmp)) == NULL) {

 	cli_dbgmsg("GZip: Can't generate temporary file.\n");

 	gzclose(gd);

 	return CL_ETMPFILE;

@@ -518,6 +529,10 @@ static int cli_scangzip(int desc, const char **virname, long int *scanned, const

     if(!(buff = (char *) cli_malloc(FILEBUFF))) {

 	cli_dbgmsg("GZip: Unable to malloc %d bytes.\n", FILEBUFF);

 	gzclose(gd);

+	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return CL_EMEM;

     }

@@ -537,6 +552,9 @@ static int cli_scangzip(int desc, const char **virname, long int *scanned, const

 	if(cli_writen(fd, buff, bytes) != bytes) {

 	    cli_dbgmsg("GZip: Can't write to file.\n");

 	    fclose(tmp);

+	    if(!cli_leavetemps_flag)

+		unlink(tmpname);

+	    free(tmpname);	

 	    gzclose(gd);

 	    free(buff);

 	    return CL_EGZIP;

@@ -548,12 +566,18 @@ static int cli_scangzip(int desc, const char **virname, long int *scanned, const

     if(ret == CL_VIRUS) {

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return ret;

     }

     if(fsync(fd) == -1) {

 	cli_dbgmsg("GZip: Can't synchronise descriptor %d\n", fd);

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return CL_EFSYNC;

     }

@@ -561,9 +585,15 @@ static int cli_scangzip(int desc, const char **virname, long int *scanned, const

     if((ret = cli_magic_scandesc(fd, virname, scanned, root, limits, options, arec, mrec)) == CL_VIRUS ) {

 	cli_dbgmsg("GZip: Infected with %s\n", *virname);

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return CL_VIRUS;

     }

     fclose(tmp);

+    if(!cli_leavetemps_flag)

+	unlink(tmpname);

+    free(tmpname);	

     return ret;

 }

@@ -584,6 +614,7 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

 	unsigned long int size = 0;

 	char *buff;

 	FILE *fs, *tmp = NULL;

+	char *tmpname;

 	BZFILE *bfd;

@@ -602,7 +633,7 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

 	return CL_EBZIP;

     }

-    if((tmp = tmpfile()) == NULL) {

+    if((tmpname = cli_gentempstream(NULL, &tmp)) == NULL) {

 	cli_dbgmsg("Bzip: Can't generate temporary file.\n");

 	BZ2_bzReadClose(&bzerror, bfd);

 	fclose(fs);

@@ -613,6 +644,9 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

     if(!(buff = (char *) malloc(FILEBUFF))) {

 	cli_dbgmsg("Bzip: Unable to malloc %d bytes.\n", FILEBUFF);

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	fclose(fs);

 	BZ2_bzReadClose(&bzerror, bfd);

 	return CL_EMEM;

@@ -635,6 +669,9 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

 	    cli_dbgmsg("Bzip: Can't write to file.\n");

 	    BZ2_bzReadClose(&bzerror, bfd);

 	    fclose(tmp);

+	    if(!cli_leavetemps_flag)

+		unlink(tmpname);

+	    free(tmpname);	

 	    free(buff);

 	    fclose(fs);

 	    return CL_EGZIP;

@@ -646,6 +683,9 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

     if(ret == CL_VIRUS) {

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	fclose(fs);

 	return ret;

     }

@@ -653,6 +693,9 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

     if(fsync(fd) == -1) {

 	cli_dbgmsg("Bzip: Synchronisation failed for descriptor %d\n", fd);

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	fclose(fs);

 	return CL_EFSYNC;

     }

@@ -662,6 +705,9 @@ static int cli_scanbzip(int desc, const char **virname, long int *scanned, const

 	cli_dbgmsg("Bzip: Infected with %s\n", *virname);

     }

     fclose(tmp);

+    if(!cli_leavetemps_flag)

+	unlink(tmpname);

+    free(tmpname);	

     fclose(fs);

     return ret;

@@ -672,6 +718,7 @@ static int cli_scanszdd(int desc, const char **virname, long int *scanned, const

 {

 	int fd, ret = CL_CLEAN;

 	FILE *tmp = NULL, *in;

+	char *tmpname;

     cli_dbgmsg("in cli_scanmscomp()\n");

@@ -681,7 +728,7 @@ static int cli_scanszdd(int desc, const char **virname, long int *scanned, const

 	return CL_EMSCOMP;

     }

-    if((tmp = tmpfile()) == NULL) {

+    if((tmpname = cli_gentempstream(NULL, &tmp)) == NULL) {

 	cli_dbgmsg("SZDD: Can't generate temporary file.\n");

 	fclose(in);

 	return CL_ETMPFILE;

@@ -689,6 +736,11 @@ static int cli_scanszdd(int desc, const char **virname, long int *scanned, const

     if(cli_msexpand(in, tmp) == -1) {

 	cli_dbgmsg("SZDD: msexpand failed.\n");

+	fclose(in);

+	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return CL_EMSCOMP;

     }

@@ -696,6 +748,9 @@ static int cli_scanszdd(int desc, const char **virname, long int *scanned, const

     if(fflush(tmp)) {

 	cli_dbgmsg("SZDD: fflush() failed.\n");

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return CL_EFSYNC;

     }

@@ -704,10 +759,16 @@ static int cli_scanszdd(int desc, const char **virname, long int *scanned, const

     if((ret = cli_magic_scandesc(fd, virname, scanned, root, limits, options, arec, mrec)) == CL_VIRUS) {

 	cli_dbgmsg("SZDD: Infected with %s\n", *virname);

 	fclose(tmp);

+	if(!cli_leavetemps_flag)

+	    unlink(tmpname);

+	free(tmpname);	

 	return CL_VIRUS;

     }

     fclose(tmp);

+    if(!cli_leavetemps_flag)

+	unlink(tmpname);

+    free(tmpname);	

     return ret;

 }