@@ -1,3 +1,7 @@

+Fri Aug 14 14:37:21 CEST 2009 (tk)

+----------------------------------

+ * libclamav: improve handling of signature offsets

+

 Tue Aug 11 02:04:54 CEST 2009 (acab)

 ------------------------------------

  * libclamav/7z/Types.h: workaround "Byte" clash in lzma/7z (bb#805 - regression)

@@ -25,6 +25,11 @@

 #define CLI_DEFAULT_AC_MAXDEPTH	    3

 #define CLI_DEFAULT_AC_TRACKLEN	    8

+#define CLI_DEFAULT_MOVETOAC_LEN    8 /* all static sigs shorter than

+				       * this value will automatically

+				       * go to AC instead of BM

+				       */

+

 #define CLI_DEFAULT_LSIG_BUFSIZE    32768

 #define CLI_DEFAULT_DBIO_BUFSIZE    CLI_DEFAULT_LSIG_BUFSIZE + 1

@@ -176,7 +176,7 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 	if(cli_ac_initdata(&mdata, root->ac_partsigs, root->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN))

 	    return ret;

-	sret = cli_ac_scanbuff(buff, bread, NULL, NULL, NULL, engine->root[0], &mdata, 0, ret, desc, NULL, AC_SCAN_FT, NULL);

+	sret = cli_ac_scanbuff(buff, bread, NULL, NULL, NULL, engine->root[0], &mdata, 0, ret, NULL, AC_SCAN_FT, NULL);

 	cli_ac_freedata(&mdata);

@@ -188,7 +188,7 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 	    decoded = (unsigned char *) cli_utf16toascii((char *) buff, bread);

 	    if(decoded) {

-		sret = cli_ac_scanbuff(decoded, strlen((char *) decoded), NULL, NULL, NULL,  engine->root[0], &mdata, 0, CL_TYPE_TEXT_ASCII, desc, NULL, AC_SCAN_FT, NULL);

+		sret = cli_ac_scanbuff(decoded, strlen((char *) decoded), NULL, NULL, NULL,  engine->root[0], &mdata, 0, CL_TYPE_TEXT_ASCII, NULL, AC_SCAN_FT, NULL);

 		free(decoded);

 		if(sret == CL_TYPE_HTML)

 		    ret = CL_TYPE_HTML_UTF16;

@@ -221,7 +221,7 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 					    return ret;

 				    if(out_area.length > 0) {

-					    sret = cli_ac_scanbuff(decodedbuff, out_area.length, NULL, NULL, NULL, engine->root[0], &mdata, 0, 0, desc, NULL, AC_SCAN_FT, NULL); /* FIXME: can we use CL_TYPE_TEXT_ASCII instead of 0? */

+					    sret = cli_ac_scanbuff(decodedbuff, out_area.length, NULL, NULL, NULL, engine->root[0], &mdata, 0, 0, NULL, AC_SCAN_FT, NULL); /* FIXME: can we use CL_TYPE_TEXT_ASCII instead of 0? */

 					    if(sret == CL_TYPE_HTML) {

 						    cli_dbgmsg("cli_filetype2: detected HTML signature in Unicode file\n");

 						    /* htmlnorm is able to handle any unicode now, since it skips null chars */

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2007-2008 Sourcefire, Inc.

+ *  Copyright (C) 2007-2009 Sourcefire, Inc.

  *

  *  Authors: Tomasz Kojm

  *

@@ -386,8 +386,6 @@ void cli_ac_free(struct cli_matcher *root)

 	patt = root->ac_pattable[i];

 	mpool_free(root->mempool, patt->prefix ? patt->prefix : patt->pattern);

 	mpool_free(root->mempool, patt->virname);

-	if(patt->offset)

-	    mpool_free(root->mempool, patt->offset);

 	if(patt->alt)

 	    mpool_ac_free_alt(root->mempool, patt);

 	mpool_free(root->mempool, patt);

@@ -395,6 +393,9 @@ void cli_ac_free(struct cli_matcher *root)

     if(root->ac_pattable)

 	mpool_free(root->mempool, root->ac_pattable);

+    if(root->ac_reloff)

+	mpool_free(root->mempool, root->ac_reloff);

+

     for(i = 0; i < root->ac_nodes; i++) {

 	if(!IS_LEAF(root->ac_nodetable[i]))

 	    mpool_free(root->mempool, root->ac_nodetable[i]->trans);

@@ -812,6 +813,31 @@ int cli_ac_initdata(struct cli_ac_data *data, uint32_t partsigs, uint32_t lsigs,

     return CL_SUCCESS;

 }

+int cli_ac_caloff(struct cli_matcher *root, int fd)

+{

+	int ret;

+	unsigned int i;

+	struct cli_ac_patt *patt;

+	struct cli_target_info info;

+

+    memset(&info, 0, sizeof(info));

+    for(i = 0; i < root->ac_reloff_num; i++) {

+	patt = root->ac_reloff[i];

+	if(fd == -1) {

+	    patt->offset_min = CLI_OFF_NONE;

+	} else if((ret = cli_caloff(NULL, &info, fd, root->type, patt->offdata, &patt->offset_min, &patt->offset_max))) {

+	    cli_errmsg("cli_ac_caloff: Can't calculate relative offset in signature for %s\n", patt->virname);

+	    if(info.exeinfo.section)

+		free(info.exeinfo.section);

+	    return ret;

+	}

+    }

+    if(info.exeinfo.section)

+	free(info.exeinfo.section);

+

+    return CL_SUCCESS;

+}

+

 void cli_ac_freedata(struct cli_ac_data *data)

 {

 	uint32_t i;

@@ -867,7 +893,7 @@ inline static int ac_addtype(struct cli_matched_type **list, cli_file_t type, of

     return CL_SUCCESS;

 }

-int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, int fd, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx)

+int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx)

 {

 	struct cli_ac_node *current;

 	struct cli_ac_patt *patt, *pt;

@@ -875,11 +901,9 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 	uint16_t j;

 	int32_t **offmatrix;

 	uint8_t found;

-	struct cli_target_info info;

 	int type = CL_CLEAN;

 	struct cli_ac_result *newres;

-

     if(!root->ac_root)

 	return CL_CLEAN;

@@ -888,7 +912,6 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 	return CL_ENULLARG;

     }

-    memset(&info, 0, sizeof(info));

     current = root->ac_root;

     for(i = 0; i < length; i++)  {

@@ -902,24 +925,44 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 	    patt = current->list;

 	    while(patt) {

 		bp = i + 1 - patt->depth;

-		if(ac_findmatch(buffer, bp, length, patt, &matchend)) {

-		    pt = patt;

+		pt = patt;

+		/*

+		while(pt) {

+		    if((pt->type && !(mode & AC_SCAN_FT)) || (!pt->type && !(mode & AC_SCAN_VIR))) {

+			pt = pt->next_same;

+			continue;

+		    }

+		    if(pt->offset_min == CLI_OFF_NONE) {

+			pt = pt->next_same;

+			continue;

+		    }

+		    realoff = offset + bp - pt->prefix_length;

+		    if(pt->offset_min != CLI_OFF_ANY && (!pt->sigid || pt->partno == 1)) {

+			if(pt->offset_max > realoff || pt->offset_min < realoff) {

+			    pt = pt->next_same;

+			    continue;

+			}

+		    }

+		    break;

+		}

+		*/

+		if(pt && ac_findmatch(buffer, bp, length, patt, &matchend)) {

 		    while(pt) {

-

 			if((pt->type && !(mode & AC_SCAN_FT)) || (!pt->type && !(mode & AC_SCAN_VIR))) {

 			    pt = pt->next_same;

 			    continue;

 			}

-

+			if(pt->offset_min == CLI_OFF_NONE) {

+			    pt = pt->next_same;

+			    continue;

+			}

 			realoff = offset + bp - pt->prefix_length;

-

-			if(pt->offset && (!pt->sigid || pt->partno == 1)) {

-			    if(!cli_validatesig(ftype, pt->offset, realoff, &info, fd, pt->virname)) {

+			if(pt->offset_min != CLI_OFF_ANY && (!pt->sigid || pt->partno == 1)) {

+			    if(pt->offset_max > realoff || pt->offset_min < realoff) {

 				pt = pt->next_same;

 				continue;

 			    }

 			}

-

 			if(pt->sigid) { /* it's a partial signature */

 			    if(pt->partno != 1 && (!mdata->offmatrix[pt->sigid - 1] || !mdata->offmatrix[pt->sigid - 1][pt->partno - 2][0])) {

@@ -931,8 +974,6 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 				mdata->offmatrix[pt->sigid - 1] = cli_malloc(pt->parts * sizeof(int32_t *));

 				if(!mdata->offmatrix[pt->sigid - 1]) {

 				    cli_errmsg("cli_ac_scanbuff: Can't allocate memory for mdata->offmatrix[%u]\n", pt->sigid - 1);

-				    if(info.exeinfo.section)

-					free(info.exeinfo.section);

 				    return CL_EMEM;

 				}

@@ -941,8 +982,6 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 				    cli_errmsg("cli_ac_scanbuff: Can't allocate memory for mdata->offmatrix[%u][0]\n", pt->sigid - 1);

 				    free(mdata->offmatrix[pt->sigid - 1]);

 				    mdata->offmatrix[pt->sigid - 1] = NULL;

-				    if(info.exeinfo.section)

-					free(info.exeinfo.section);

 				    return CL_EMEM;

 				}

 				memset(mdata->offmatrix[pt->sigid - 1][0], -1, pt->parts * (CLI_DEFAULT_AC_TRACKLEN + 1) * sizeof(int32_t));

@@ -981,25 +1020,17 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 			    } else if(found && pt->partno == pt->parts) {

 				if(pt->type) {

-				    if(pt->type == CL_TYPE_IGNORED && (!pt->rtype || ftype == pt->rtype)) {

-					if(info.exeinfo.section)

-					    free(info.exeinfo.section);

-

+				    if(pt->type == CL_TYPE_IGNORED && (!pt->rtype || ftype == pt->rtype))

 					return CL_TYPE_IGNORED;

-				    }

 				    if((pt->type > type || pt->type >= CL_TYPE_SFX || pt->type == CL_TYPE_MSEXE) && (!pt->rtype || ftype == pt->rtype)) {

 					cli_dbgmsg("Matched signature for file type %s\n", pt->virname);

 					type = pt->type;

 					if(ftoffset && (!*ftoffset || (*ftoffset)->cnt < MAX_EMBEDDED_OBJ || type == CL_TYPE_ZIPSFX) && (type >= CL_TYPE_SFX || ((ftype == CL_TYPE_MSEXE || ftype == CL_TYPE_ZIP || ftype == CL_TYPE_MSOLE2) && type == CL_TYPE_MSEXE)))  {

 					    /* FIXME: we don't know which offset of the first part is the correct one */

-					    for(j = 1; j <= CLI_DEFAULT_AC_TRACKLEN && offmatrix[0][j] != -1; j++) {

-						if(ac_addtype(ftoffset, type, offmatrix[pt->parts - 1][j], ctx)) {

-						    if(info.exeinfo.section)

-							free(info.exeinfo.section);

+					    for(j = 1; j <= CLI_DEFAULT_AC_TRACKLEN && offmatrix[0][j] != -1; j++)

+						if(ac_addtype(ftoffset, type, offmatrix[pt->parts - 1][j], ctx))

 						    return CL_EMEM;

-						}

-					    }

 					}

 					memset(offmatrix[0], -1, pt->parts * (CLI_DEFAULT_AC_TRACKLEN + 1) * sizeof(int32_t));

@@ -1016,11 +1047,8 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 				    if(res) {

 					newres = (struct cli_ac_result *) malloc(sizeof(struct cli_ac_result));

-					if(!newres) {

-					    if(info.exeinfo.section)

-						free(info.exeinfo.section);

+					if(!newres)

 					    return CL_EMEM;

-					}

 					newres->virname = pt->virname;

 					newres->customdata = pt->customdata;

 					newres->next = *res;

@@ -1033,10 +1061,6 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 					    *virname = pt->virname;

 					if(customdata)

 					    *customdata = pt->customdata;

-

-					if(info.exeinfo.section)

-					    free(info.exeinfo.section);

-

 					return CL_VIRUS;

 				    }

 				}

@@ -1044,22 +1068,16 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 			} else { /* old type signature */

 			    if(pt->type) {

-				if(pt->type == CL_TYPE_IGNORED && (!pt->rtype || ftype == pt->rtype)) {

-				    if(info.exeinfo.section)

-					free(info.exeinfo.section);

-

+				if(pt->type == CL_TYPE_IGNORED && (!pt->rtype || ftype == pt->rtype))

 				    return CL_TYPE_IGNORED;

-				}

+

 				if((pt->type > type || pt->type >= CL_TYPE_SFX || pt->type == CL_TYPE_MSEXE) && (!pt->rtype || ftype == pt->rtype)) {

 				    cli_dbgmsg("Matched signature for file type %s at %u\n", pt->virname, realoff);

 				    type = pt->type;

 				    if(ftoffset && (!*ftoffset || (*ftoffset)->cnt < MAX_EMBEDDED_OBJ || type == CL_TYPE_ZIPSFX) && (type >= CL_TYPE_SFX || ((ftype == CL_TYPE_MSEXE || ftype == CL_TYPE_ZIP || ftype == CL_TYPE_MSOLE2) && type == CL_TYPE_MSEXE)))  {

-					if(ac_addtype(ftoffset, type, realoff, ctx)) {

-					    if(info.exeinfo.section)

-						free(info.exeinfo.section);

+					if(ac_addtype(ftoffset, type, realoff, ctx))

 					    return CL_EMEM;

-					}

 				    }

 				}

 			    } else {

@@ -1071,11 +1089,8 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 				if(res) {

 				    newres = (struct cli_ac_result *) malloc(sizeof(struct cli_ac_result));

-				    if(!newres) {

-					if(info.exeinfo.section)

-					    free(info.exeinfo.section);

+				    if(!newres)

 					return CL_EMEM;

-				    }

 				    newres->virname = pt->virname;

 				    newres->customdata = pt->customdata;

 				    newres->next = *res;

@@ -1088,10 +1103,6 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 					*virname = pt->virname;

 				    if(customdata)

 					*customdata = pt->customdata;

-

-				    if(info.exeinfo.section)

-					free(info.exeinfo.section);

-

 				    return CL_VIRUS;

 				}

 			    }

@@ -1104,9 +1115,6 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 	}

     }

-    if(info.exeinfo.section)

-	free(info.exeinfo.section);

-

     return (mode & AC_SCAN_FT) ? type : CL_CLEAN;

 }

@@ -1445,26 +1453,32 @@ int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hex

     if(new->lsigid[0])

 	root->ac_lsigtable[new->lsigid[1]]->virname = new->virname;

-    if(offset) {

-	new->offset = cli_mpool_strdup(root->mempool, offset);

-	if(!new->offset) {

-	    mpool_free(root->mempool, new->prefix ? new->prefix : new->pattern);

-	    mpool_ac_free_alt(root->mempool, new);

-	    mpool_free(root->mempool, new->virname);

-	    mpool_free(root->mempool, new);

-	    return CL_EMEM;

-	}

+    ret = cli_caloff(offset, NULL, -1, root->type, new->offdata, &new->offset_min, &new->offset_max);

+    if(ret != CL_SUCCESS) {

+	mpool_free(root->mempool, new->prefix ? new->prefix : new->pattern);

+	mpool_ac_free_alt(root->mempool, new);

+	mpool_free(root->mempool, new->virname);

+	mpool_free(root->mempool, new);

+	return ret;

     }

     if((ret = cli_ac_addpatt(root, new))) {

 	mpool_free(root->mempool, new->prefix ? new->prefix : new->pattern);

 	mpool_free(root->mempool, new->virname);

 	mpool_ac_free_alt(root->mempool, new);

-	if(new->offset)

-	    mpool_free(root->mempool, new->offset);

 	mpool_free(root->mempool, new);

 	return ret;

     }

+    if(new->offdata[0] != CLI_OFF_ANY && new->offdata[0] != CLI_OFF_ABSOLUTE) {

+	root->ac_reloff = (struct cli_ac_patt **) mpool_realloc2(root->mempool, root->ac_reloff, (root->ac_reloff_num + 1) * sizeof(struct cli_ac_patt *));

+	if(!root->ac_reloff) {

+	    cli_errmsg("cli_ac_addsig: Can't allocate memory for root->ac_reloff\n");

+	    return CL_EMEM;

+	}

+	root->ac_reloff[root->ac_reloff_num] = new;

+	root->ac_reloff_num++;

+    }

+

     return CL_SUCCESS;

 }

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2007-2008 Sourcefire, Inc.

+ *  Copyright (C) 2007-2009 Sourcefire, Inc.

  *

  *  Authors: Tomasz Kojm

  *

@@ -50,7 +50,7 @@ struct cli_ac_patt {

     uint32_t sigid;

     uint32_t lsigid[3];

     uint16_t ch[2];

-    char *virname, *offset;

+    char *virname;

     void *customdata;

     uint16_t ch_mindist[2];

     uint16_t ch_maxdist[2];

@@ -59,6 +59,7 @@ struct cli_ac_patt {

     struct cli_ac_patt *next, *next_same;

     uint8_t depth;

     uint16_t rtype, type;

+    uint32_t offdata[4], offset_min, offset_max;

 };

 struct cli_ac_node {

@@ -81,9 +82,10 @@ int cli_ac_addpatt(struct cli_matcher *root, struct cli_ac_patt *pattern);

 int cli_ac_initdata(struct cli_ac_data *data, uint32_t partsigs, uint32_t lsigs, uint8_t tracklen);

 int cli_ac_chklsig(const char *expr, const char *end, uint32_t *lsigcnt, unsigned int *cnt, uint64_t *ids, unsigned int parse_only);

 void cli_ac_freedata(struct cli_ac_data *data);

-int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, int fd, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx);

+int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx);

 int cli_ac_buildtrie(struct cli_matcher *root);

 int cli_ac_init(struct cli_matcher *root, uint8_t mindepth, uint8_t maxdepth);

+int cli_ac_caloff(struct cli_matcher *root, int fd);

 void cli_ac_free(struct cli_matcher *root);

 int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hexsig, uint32_t sigid, uint16_t parts, uint16_t partno, uint16_t rtype, uint16_t type, uint32_t mindist, uint32_t maxdist, const char *offset, const uint32_t *lsigid, unsigned int options);

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2007-2008 Sourcefire, Inc.

+ *  Copyright (C) 2007-2009 Sourcefire, Inc.

  *

  *  Authors: Tomasz Kojm

  *

@@ -38,11 +38,12 @@

 #define BM_BLOCK_SIZE	3

 #define HASH(a,b,c) (211 * a + 37 * b + c)

-int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern)

+int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern, const char *offset)

 {

 	uint16_t idx, i;

 	const unsigned char *pt = pattern->pattern;

 	struct cli_bm_patt *prev, *next = NULL;

+	int ret;

     if(pattern->length < BM_MIN_LENGTH) {

@@ -50,6 +51,13 @@ int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern)

 	return CL_EMALFDB;

     }

+    if((ret = cli_caloff(offset, NULL, -1, root->type, pattern->offdata, &pattern->offset_min, &pattern->offset_max))) {

+	cli_errmsg("cli_bm_addpatt: Can't calculate offset for signature %s\n", pattern->virname);

+	return ret;

+    }

+    if(pattern->offdata[0] != CLI_OFF_ANY && pattern->offdata[0] != CLI_OFF_ABSOLUTE)

+	root->bm_reloff_num++;

+

 #if BM_MIN_LENGTH == BM_BLOCK_SIZE

     /* try to load balance bm_suffix (at the cost of bm_shift) */

     for(i = 0; i < pattern->length - BM_BLOCK_SIZE + 1; i++) {

@@ -137,8 +145,6 @@ void cli_bm_free(struct cli_matcher *root)

 		    mpool_free(root->mempool, prev->pattern);

 		if(prev->virname)

 		    mpool_free(root->mempool, prev->virname);

-		if(prev->offset)

-		    mpool_free(root->mempool, prev->offset);

 		mpool_free(root->mempool, prev);

 	    }

 	}

@@ -146,7 +152,7 @@ void cli_bm_free(struct cli_matcher *root)

     }

 }

-int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_matcher *root, uint32_t offset, cli_file_t ftype, int fd)

+int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_matcher *root, uint32_t offset, int fd)

 {

 	uint32_t i, j, off;

 	uint8_t found, pchain, shift;

@@ -154,7 +160,8 @@ int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 	struct cli_bm_patt *p;

 	const unsigned char *bp, *pt;

 	unsigned char prefix;

-	struct cli_target_info info;

+        struct cli_target_info info;

+        int ret;

     if(!root || !root->bm_shift)

@@ -164,7 +171,6 @@ int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 	return CL_CLEAN;

     memset(&info, 0, sizeof(info));

-

     for(i = BM_MIN_LENGTH - BM_BLOCK_SIZE; i < length - BM_BLOCK_SIZE + 1; ) {

 	idx = HASH(buffer[i], buffer[i + 1], buffer[i + 2]);

 	shift = root->bm_shift[idx];

@@ -214,21 +220,26 @@ int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 		}

 		if(found && p->length + p->prefix_length == j) {

-

-		    if(p->offset) {

+		    if(p->offset_min != CLI_OFF_ANY) {

+			if(p->offdata[0] != CLI_OFF_ABSOLUTE) {

+			    ret = cli_caloff(NULL, &info, fd, root->type, p->offdata, &p->offset_min, &p->offset_max);

+			    if(ret != CL_SUCCESS) {

+				cli_errmsg("cli_bm_scanbuff: Can't calculate relative offset in signature for %s\n", p->virname);

+				if(info.exeinfo.section)

+				    free(info.exeinfo.section);

+				return ret;

+			    }

+			}

 			off = offset + i - p->prefix_length - BM_MIN_LENGTH + BM_BLOCK_SIZE;

-			if(!cli_validatesig(ftype, p->offset, off, &info, fd, p->virname)) {

+			if(p->offset_max > off || p->offset_min < off) {

 			    p = p->next;

 			    continue;

 			}

 		    }

-

 		    if(virname)

 			*virname = p->virname;

-

 		    if(info.exeinfo.section)

 			free(info.exeinfo.section);

-

 		    return CL_VIRUS;

 		}

@@ -243,6 +254,5 @@ int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

     if(info.exeinfo.section)

 	free(info.exeinfo.section);

-

     return CL_CLEAN;

 }

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2007-2008 Sourcefire, Inc.

+ *  Copyright (C) 2007-2009 Sourcefire, Inc.

  *

  *  Authors: Tomasz Kojm

  *

@@ -27,17 +27,17 @@

 struct cli_bm_patt {

     unsigned char *pattern, *prefix;

-    char *virname, *offset;

+    char *virname;

+    uint32_t offdata[4], offset_min, offset_max;

     struct cli_bm_patt *next;

     uint16_t length, prefix_length;

     uint16_t cnt;

     unsigned char pattern0;

-    uint8_t target;

 };

-int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern);

+int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern, const char *offset);

 int cli_bm_init(struct cli_matcher *root);

-int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_matcher *root, uint32_t offset, cli_file_t ftype, int fd);

+int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_matcher *root, uint32_t offset, int fd);

 void cli_bm_free(struct cli_matcher *root);

 #endif

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2007-2008 Sourcefire, Inc.

+ *  Copyright (C) 2007-2009 Sourcefire, Inc.

  *

  *  Authors: Tomasz Kojm

  *

@@ -76,8 +76,8 @@ int cli_scanbuff(const unsigned char *buffer, uint32_t length, uint32_t offset,

 	if(!acdata && (ret = cli_ac_initdata(&mdata, troot->ac_partsigs, troot->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN)))

 	    return ret;

-	if(troot->ac_only || (ret = cli_bm_scanbuff(buffer, length, virname, troot, offset, ftype, -1)) != CL_VIRUS)

-	    ret = cli_ac_scanbuff(buffer, length, virname, NULL, NULL, troot, acdata ? (acdata[0]) : (&mdata), offset, ftype, -1, NULL, AC_SCAN_VIR, NULL);

+	if(troot->ac_only || (ret = cli_bm_scanbuff(buffer, length, virname, troot, offset, -1)) != CL_VIRUS)

+	    ret = cli_ac_scanbuff(buffer, length, virname, NULL, NULL, troot, acdata ? (acdata[0]) : (&mdata), offset, ftype, NULL, AC_SCAN_VIR, NULL);

 	if(!acdata)

 	    cli_ac_freedata(&mdata);

@@ -89,8 +89,8 @@ int cli_scanbuff(const unsigned char *buffer, uint32_t length, uint32_t offset,

     if(!acdata && (ret = cli_ac_initdata(&mdata, groot->ac_partsigs, groot->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN)))

 	return ret;

-    if(groot->ac_only || (ret = cli_bm_scanbuff(buffer, length, virname, groot, offset, ftype, -1)) != CL_VIRUS)

-	ret = cli_ac_scanbuff(buffer, length, virname, NULL, NULL, groot, acdata ? (acdata[1]) : (&mdata), offset, ftype, -1, NULL, AC_SCAN_VIR, NULL);

+    if(groot->ac_only || (ret = cli_bm_scanbuff(buffer, length, virname, groot, offset, -1)) != CL_VIRUS)

+	ret = cli_ac_scanbuff(buffer, length, virname, NULL, NULL, groot, acdata ? (acdata[1]) : (&mdata), offset, ftype, NULL, AC_SCAN_VIR, NULL);

     if(!acdata)

 	cli_ac_freedata(&mdata);

@@ -98,112 +98,188 @@ int cli_scanbuff(const unsigned char *buffer, uint32_t length, uint32_t offset,

     return ret;

 }

-off_t cli_caloff(const char *offstr, struct cli_target_info *info, int fd, cli_file_t ftype, int *ret, unsigned int *maxshift)

+/*

+ * offdata[0]: type

+ * offdata[1]: offset value

+ * offdata[2]: max shift

+ * offdata[3]: section number

+ */

+int cli_caloff(const char *offstr, struct cli_target_info *info, int fd, unsigned int target, uint32_t *offdata, uint32_t *offset_min, uint32_t *offset_max)

 {

 	int (*einfo)(int, struct cli_exe_info *) = NULL;

+	char offcpy[65];

 	unsigned int n, val;

-	const char *pt;

-	off_t pos, offset;

-

-

-    *ret = 0;

+	char *pt;

+	off_t pos;

+	struct stat sb;

-    if((pt = strchr(offstr, ',')))

-	*maxshift = atoi(++pt);

-    if(isdigit(offstr[0]))

-	return atoi(offstr);

+    if(!info) { /* decode offset string */

+	if(!offstr) {

+	    cli_errmsg("cli_caloff: offstr == NULL\n");

+	    return CL_ENULLARG;

+	}

-    if(fd == -1) {

-	*ret = -1;

-	return 0;

-    }

+	if(!strcmp(offstr, "*")) {

+	    offdata[0] = *offset_max = *offset_min = CLI_OFF_ANY;

+	    return CL_SUCCESS;

+	}

-    if(!strncmp(offstr, "EP", 2) || offstr[0] == 'S') {

+	if(strlen(offstr) > 64) {

+	    cli_errmsg("cli_caloff: Offset string too long\n");

+	    return CL_EMALFDB;

+	}

+	strcpy(offcpy, offstr);

-	if(info->status == -1) {

-	    *ret = -1;

-	    return 0;

+	if((pt = strchr(offcpy, ','))) {

+	    if(!cli_isnumber(pt + 1)) {

+		cli_errmsg("cli_caloff: Invalid offset shift value\n");

+		return CL_EMALFDB;

+	    }

+	    offdata[2] = atoi(pt + 1);

+	    *pt = 0;

+	} else {

+	    offdata[2] = 0;

+	}

-	} else if(!info->status) {

+	*offset_max = *offset_min = CLI_OFF_NONE;

-	    if(ftype == CL_TYPE_MSEXE)

-		einfo = cli_peheader;

-	    else if(ftype == CL_TYPE_ELF)

-		einfo = cli_elfheader;

-	    else if(ftype == CL_TYPE_MACHO)

-		einfo = cli_machoheader;

+	if(!strncmp(offcpy, "EP+", 3) || !strncmp(offcpy, "EP-", 3)) {

+	    if(offcpy[2] == '+')

+		offdata[0] = CLI_OFF_EP_PLUS;

+	    else

+		offdata[0] = CLI_OFF_EP_MINUS;

-	    if(einfo) {

-		if((pos = lseek(fd, 0, SEEK_CUR)) == -1) {

-		    cli_dbgmsg("Invalid descriptor\n");

-		    info->status = *ret = -1;

-		    return 0;

+	    if(!cli_isnumber(&offcpy[3])) {

+		cli_errmsg("cli_caloff: Invalid offset value\n");

+		return CL_EMALFDB;

+	    }

+	    offdata[1] = atoi(&offcpy[3]);

+

+	} else if(offcpy[0] == 'S') {

+	    if(!strncmp(offstr, "SL+", 3)) {

+		offdata[0] = CLI_OFF_SL_PLUS;

+		if(!cli_isnumber(&offcpy[3])) {

+		    cli_errmsg("cli_caloff: Invalid offset value\n");

+		    return CL_EMALFDB;

 		}

+		offdata[1] = atoi(&offcpy[3]);

+

+	    } else if(sscanf(offcpy, "S%u+%u", &n, &val) == 2) {

+		offdata[0] = CLI_OFF_SX_PLUS;

+		offdata[1] = val;

+		offdata[3] = n;

+	    } else {

+		cli_errmsg("cli_caloff: Invalid offset string\n");

+		return CL_EMALFDB;

+	    }

-		lseek(fd, 0, SEEK_SET);

-		if(einfo(fd, &info->exeinfo)) {

-		    lseek(fd, pos, SEEK_SET);

-		    info->status = *ret = -1;

-		    return 0;

-		}

-		lseek(fd, pos, SEEK_SET);

-		info->status = 1;

+	} else if(!strncmp(offcpy, "EOF-", 4)) {

+	    offdata[0] = CLI_OFF_EOF_MINUS;

+	    if(!cli_isnumber(&offcpy[4])) {

+		cli_errmsg("cli_caloff: Invalid offset value\n");

+		return CL_EMALFDB;

 	    }

+	    offdata[1] = atoi(&offcpy[4]);

+	} else {

+	    offdata[0] = CLI_OFF_ABSOLUTE;

+	    if(!cli_isnumber(offcpy)) {

+		cli_errmsg("cli_caloff: Invalid offset value\n");

+		return CL_EMALFDB;

+	    }

+	    *offset_min = offdata[1] = atoi(offcpy);

+	    *offset_max = *offset_min + offdata[2];

 	}

-    }

-

-    if(info->status == 1 && (!strncmp(offstr, "EP+", 3) || !strncmp(offstr, "EP-", 3))) {

-

-	if(offstr[2] == '+')

-	    return info->exeinfo.ep + atoi(offstr + 3);

-	else

-	    return info->exeinfo.ep - atoi(offstr + 3);

-    } else if(info->status == 1 && offstr[0] == 'S') {

+	if(offdata[0] != CLI_OFF_ANY && offdata[0] != CLI_OFF_ABSOLUTE && offdata[0] != CLI_OFF_EOF_MINUS) {

+	    if(target != 1 && target != 6 && target != 9) {

+		cli_errmsg("cli_caloff: Invalid offset type for target %u\n", target);

+		return CL_EMALFDB;

+	    }

+	}

-	if(!strncmp(offstr, "SL", 2) && info->exeinfo.section[info->exeinfo.nsections - 1].rsz) {

+    } else {

+	/* calculate relative offsets */

+	if(info->status == -1) {

+	    *offset_min = *offset_max = 0;

+	    return CL_SUCCESS;

+	}

-	    if(sscanf(offstr, "SL+%u", &val) != 1) {

-		*ret = -1;

-		return 0;

+	if((offdata[0] == CLI_OFF_EOF_MINUS)) {

+	    if(!info->fsize) {

+		if(fstat(fd, &sb) == -1) {

+		    cli_errmsg("cli_caloff: fstat(%d) failed\n", fd);

+		    return CL_ESTAT;

+		}

+		info->fsize = sb.st_size;

 	    }

-	    offset = val + info->exeinfo.section[info->exeinfo.nsections - 1].raw;

-

-	} else {

+	} else if(!info->status) {

+	    if(target == 1)

+		einfo = cli_peheader;

+	    else if(target == 6)

+		einfo = cli_elfheader;

+	    else if(target == 9)

+		einfo = cli_machoheader;

-	    if(sscanf(offstr, "S%u+%u", &n, &val) != 2) {

-		*ret = -1;

-		return 0;

+	    if(!einfo) {

+		cli_errmsg("cli_caloff: Invalid offset/filetype\n");

+		return CL_EMALFDB;

 	    }

-	    if(n >= info->exeinfo.nsections || !info->exeinfo.section[n].rsz) {

-		*ret = -1;

-		return 0;

+	    if((pos = lseek(fd, 0, SEEK_CUR)) == -1) {

+		cli_errmsg("cli_caloff: lseek(%d) failed\n", fd);

+		return CL_ESEEK;

 	    }

-	    offset = val + info->exeinfo.section[n].raw;

+	    lseek(fd, 0, SEEK_SET);

+	    if(einfo(fd, &info->exeinfo)) {

+		/* einfo *may* fail */

+		lseek(fd, pos, SEEK_SET);

+		info->status = -1;

+		*offset_min = *offset_max = 0;

+		return CL_SUCCESS;

+	    }

+	    lseek(fd, pos, SEEK_SET);

+	    info->status = 1;

 	}

-	return offset;

+	switch(offdata[0]) {

+	    case CLI_OFF_EOF_MINUS:

+		*offset_min = info->fsize - offdata[1];

+		break;

-    } else if(!strncmp(offstr, "EOF-", 4)) {

-	    struct stat sb;

+	    case CLI_OFF_EP_PLUS:

+		*offset_min = info->exeinfo.ep + offdata[1];

+		break;

-	if(!info->fsize) {

-	    if(fstat(fd, &sb) == -1) {

-		info->status = *ret = -1;

-		return 0;

-	    }

-	    info->fsize = sb.st_size;

+	    case CLI_OFF_EP_MINUS:

+		*offset_min = info->exeinfo.ep - offdata[1];

+		break;

+

+	    case CLI_OFF_SL_PLUS:

+		*offset_min = info->exeinfo.section[info->exeinfo.nsections - 1].raw + offdata[1];

+		break;

+

+	    case CLI_OFF_SX_PLUS:

+		if(offdata[3] >= info->exeinfo.nsections)

+		    *offset_min = 0;

+		else

+		    *offset_min = info->exeinfo.section[offdata[3]].raw + offdata[1];

+		break;

+

+	    default:

+		cli_errmsg("cli_caloff: Not a relative offset (type: %u)\n", offdata[0]);

+		return CL_EARG;

 	}

-	return info->fsize - atoi(offstr + 4);

+	if(!*offset_min)

+	    *offset_max = 0;

+	else

+	    *offset_max = *offset_min + offdata[2];

     }

-    *ret = -1;

-    return 0;

+    return CL_SUCCESS;

 }

 int cli_checkfp(int fd, cli_ctx *ctx)

@@ -227,7 +303,7 @@ int cli_checkfp(int fd, cli_ctx *ctx)

 	    return 0;

 	}

-	if(cli_bm_scanbuff(digest, 16, &virname, ctx->engine->md5_fp, 0, 0, -1) == CL_VIRUS) {

+	if(cli_bm_scanbuff(digest, 16, &virname, ctx->engine->md5_fp, 0, -1) == CL_VIRUS) {

 	    cli_dbgmsg("cli_checkfp(): Found false positive detection (fp sig: %s)\n", virname);

 	    free(digest);

 	    lseek(fd, pos, SEEK_SET);

@@ -240,33 +316,6 @@ int cli_checkfp(int fd, cli_ctx *ctx)

     return 0;

 }

-int cli_validatesig(cli_file_t ftype, const char *offstr, off_t fileoff, struct cli_target_info *info, int desc, const char *virname)

-{

-	off_t offset;

-	int ret;

-	unsigned int maxshift = 0;

-

-

-    if(offstr) {

-	offset = cli_caloff(offstr, info, desc, ftype, &ret, &maxshift);

-

-	if(ret == -1)

-	    return 0;

-

-	if(maxshift) {

-	    if((fileoff < offset) || (fileoff > offset + (off_t) maxshift)) {

-		/* cli_dbgmsg("Signature offset: %lu, expected: [%lu..%lu] (%s)\n", (unsigned long int) fileoff, (unsigned long int) offset, (unsigned long int) (offset + maxshift), virname); */

-		return 0;

-	    }

-	} else if(fileoff != offset) {

-	    /* cli_dbgmsg("Signature offset: %lu, expected: %lu (%s)\n", (unsigned long int) fileoff, (unsigned long int) offset, virname); */

-	    return 0;

-	}

-    }

-

-    return 1;

-}

-

 int cli_scandesc(int desc, cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli_matched_type **ftoffset, unsigned int acmode)

 {

  	unsigned char *buffer, *buff, *endbl, *upt;

@@ -316,12 +365,16 @@ int cli_scandesc(int desc, cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struc

 	return CL_EMEM;

     }

-    if(!ftonly && (ret = cli_ac_initdata(&gdata, groot->ac_partsigs, groot->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN)))

-	return ret;

+    if(!ftonly)

+	if((ret = cli_ac_caloff(groot, desc)) || (ret = cli_ac_initdata(&gdata, groot->ac_partsigs, groot->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN)))

+	    return ret;

     if(troot) {

-	if((ret = cli_ac_initdata(&tdata, troot->ac_partsigs, troot->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN)))

+	if((ret = cli_ac_caloff(troot, desc)) || (ret = cli_ac_initdata(&tdata, troot->ac_partsigs, troot->ac_lsigs, CLI_DEFAULT_AC_TRACKLEN))) {

+	    if(!ftonly)