@@ -1,3 +1,7 @@

+Mon Nov 14 21:59:56 CET 2005 (tk)

+---------------------------------

+  * libclamav: add support for CryptFF, thanks to Arnaud Jacques

+

 Mon Nov 14 00:32:27 CET 2005 (tk)

 ---------------------------------

   * libclamav: add support for CL_DB_NOPHISHING (disables phishing signatures)

@@ -52,6 +52,7 @@ static const struct cli_magic_s cli_magic[] = {

     {0,  "MZ",				2,  "DOS/W32 executable/library/driver", CL_TYPE_MSEXE},

     {0,	 "\177ELF",			4,  "ELF",		CL_TYPE_ELF},

+

     /* Archives */

     {0,	    "Rar!",			4,  "RAR",		CL_TYPE_RAR},

@@ -111,6 +112,7 @@ static const struct cli_magic_s cli_magic[] = {

     {0,  "\320\317\021\340\241\261\032\341", 8, "OLE2 container", CL_TYPE_MSOLE2},

     {0,  "\%PDF-",			 5, "PDF document", CL_TYPE_PDF},

+    {0,  "\266\271\254\256\376\377\377\377", 8, "CryptFF", CL_TYPE_CRYPTFF},

     /* Ignored types */

@@ -44,6 +44,7 @@ typedef enum {

     CL_TYPE_RIFF,

     CL_TYPE_BINHEX,

     CL_TYPE_TNEF,

+    CL_TYPE_CRYPTFF,

     CL_TYPE_PDF,

     /* bigger numbers have higher priority (in o-t-f detection) */

@@ -1302,6 +1302,94 @@ static int cli_scanjpeg(int desc, const char **virname)

     return ret;

 }

+static int cli_scancryptff(int desc, const char **virname, unsigned long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec)

+{

+	int ret = CL_CLEAN, i, ndesc;

+	unsigned int length;

+	unsigned char *src = NULL, *dest = NULL;

+	char *tempfile;

+	struct stat sb;

+

+

+    if(fstat(desc, &sb) == -1) {

+	cli_errmsg("CryptFF: Can's fstat descriptor %d\n", desc);

+	return CL_EIO;

+    }

+

+    /* Skip the CryptFF file header */

+    if(lseek(desc, 0x10, SEEK_SET) < 0) {

+	cli_errmsg("CryptFF: Can's fstat descriptor %d\n", desc);

+	return ret;

+    }

+

+    length = sb.st_size  - 0x10;

+ 

+    if((dest = (char *) cli_malloc(length)) == NULL) {

+	cli_dbgmsg("CryptFF: Can't allocate memory\n");

+        return CL_EMEM;

+    }

+

+    if((src = (char *) cli_malloc(length)) == NULL) {

+	cli_dbgmsg("CryptFF: Can't allocate memory\n");

+	free(dest);

+        return CL_EMEM;

+    }

+

+    if((unsigned int) read(desc, src, length) != length) {

+	cli_dbgmsg("CryptFF: Can't read from descriptor %d\n", desc);

+	free(dest);

+	free(src);

+	return CL_EIO;

+    }

+

+    for(i = 0; i < length; i++)

+	dest[i] = src[i] ^ (unsigned char) 0xff;

+

+    free(src);

+

+    tempfile = cli_gentemp(NULL);

+    if((ndesc = open(tempfile, O_RDWR|O_CREAT|O_TRUNC, S_IRWXU)) < 0) {

+	cli_errmsg("CryptFF: Can't create file %s\n", tempfile);

+	free(dest);

+	free(tempfile);

+	return CL_EIO;

+    }

+

+    if(write(ndesc, dest, length) == -1) {

+	cli_dbgmsg("CryptFF: Can't write to descriptor %d\n", ndesc);

+	free(dest);

+	close(ndesc);

+	free(tempfile);

+	return CL_EIO;

+    }

+

+    free(dest);

+

+    if(fsync(ndesc) == -1) {

+	cli_errmsg("CryptFF: Can't fsync descriptor %d\n", ndesc);

+	close(ndesc);

+	free(tempfile);

+	return CL_EIO;

+    }

+

+    lseek(ndesc, 0, SEEK_SET);

+

+    cli_dbgmsg("CryptFF: Scanning decrypted data\n");

+

+    if((ret = cli_magic_scandesc(ndesc, virname, scanned, engine, limits, options, arec, mrec)) == CL_VIRUS)

+	cli_dbgmsg("CryptFF: Infected with %s\n", *virname);

+

+    close(ndesc);

+

+    if(cli_leavetemps_flag)

+	cli_dbgmsg("CryptFF: Decompressed data saved in %s\n", tempfile);

+    else

+	unlink(tempfile);

+

+    free(tempfile);

+    return ret;

+}

+

 static int cli_scanpdf(int desc, const char **virname, long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec)

 {

 	int ret;

@@ -1523,6 +1611,10 @@ int cli_magic_scandesc(int desc, const char **virname, long int *scanned, const

 		ret = cli_scanpdf(desc, virname, scanned, engine, limits, options, arec, mrec);

 	    break;

+	case CL_TYPE_CRYPTFF:

+	    ret = cli_scancryptff(desc, virname, scanned, engine, limits, options, arec, mrec);

+	    break;

+

 	case CL_TYPE_ELF: /* TODO: Add ScanELF option */

 		ret = cli_scanelf(desc, virname, scanned, engine, limits, options, arec, mrec);

 	    break;