@@ -2572,7 +2572,7 @@ int cli_scanpe(cli_ctx *ctx)

             cli_dbgmsg("%d,%d,%d,%d\n", nsections-1, e_lfanew, ecx, offset);

             CLI_UNPTEMP("yC",(spinned,exe_sections,0));

-            CLI_UNPRESULTS("yC",(yc_decrypt(spinned, fsize, exe_sections, nsections-1, e_lfanew, ndesc, ecx, offset)),0,(spinned,0));

+            CLI_UNPRESULTS("yC",(yc_decrypt(ctx, spinned, fsize, exe_sections, nsections-1, e_lfanew, ndesc, ecx, offset)),0,(spinned,0));

         }

     }

@@ -39,10 +39,26 @@

 #define EC16(x) le16_to_host(x) /* Convert little endian to host */

+#define DO_HEURISTIC 1

+

+static int yc_bounds_check(cli_ctx *ctx, char *base, unsigned int filesize, char *offset, unsigned int bound)

+{

+      if ((unsigned int)((offset+bound)-base) > filesize) {

+          cli_errmsg("yC: Attempted out of bounds. Bailing.\n");

+#if DO_HEURISTIC

+          cli_append_virus(ctx, "Heuristics.BoundsCheck");

+#endif

+          return 1;

+      }

+

+      return 0;

+}

+

+

 /* ========================================================================== */

 /* "Emulates" the poly decryptors */

-static int yc_poly_emulator(char* decryptor_offset, char* code, unsigned int ecx, uint32_t max_emu)

+static int yc_poly_emulator(cli_ctx *ctx, char *base, unsigned int filesize, char* decryptor_offset, char* code, unsigned int ecx, uint32_t max_emu)

 {

   /* 

@@ -68,15 +84,25 @@ static int yc_poly_emulator(char* decryptor_offset, char* code, unsigned int ecx

   for(i=0;i<ecx&&i<max_emu;i++) /* Byte looper - Decrypts every byte and write it back */

     {

+        if (yc_bounds_check(ctx, base, filesize, code, i)) {

+            return 1;

+        }

       al = code[i];

       for(j=0;j<0x30;j++)   /* Poly Decryptor "Emulator" */

 	{

+        if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+            return 1;

+        }

+

 	  switch(decryptor_offset[j])

 	    {

 	    case '\xEB':	/* JMP short */

 	      j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      j = j + decryptor_offset[j];

 	      break;

@@ -102,36 +128,57 @@ static int yc_poly_emulator(char* decryptor_offset, char* code, unsigned int ecx

 	      ;

 	    case '\x04':	/* ADD AL,num */

 	      j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      al = al + decryptor_offset[j];

 	      break;

 	      ;

 	    case '\x34':	/* XOR AL,num */

 	      j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      al = al ^ decryptor_offset[j];

 	      break;

 	    case '\x2C':	/* SUB AL,num */

 	      j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      al = al - decryptor_offset[j];

 	      break;

 	    case '\xC0':

 	      j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      if(decryptor_offset[j]=='\xC0') /* ROL AL,num */

 		{

 		  j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 		  CLI_ROL(al,decryptor_offset[j]);

 		}

 	      else			/* ROR AL,num */

 		{

 		  j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 		  CLI_ROR(al,decryptor_offset[j]);

 		}

 	      break;

 	    case '\xD2':

 	      j++;

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      if(decryptor_offset[j]=='\xC8') /* ROR AL,CL */

 		{

 		  j++;

@@ -150,11 +197,16 @@ static int yc_poly_emulator(char* decryptor_offset, char* code, unsigned int ecx

 	      break;

 	    default:

+            if (yc_bounds_check(ctx, base, filesize, decryptor_offset, j)) {

+                return 1;

+            }

 	      cli_dbgmsg("yC: Unhandled opcode %x\n", (unsigned char)decryptor_offset[j]);

 	      return 1;

 	    }

 	}

       cl--;

+            if (yc_bounds_check(ctx, base, filesize, code, i))

+                return 1;

       code[i] = al;

     }

   return 0;

@@ -165,7 +217,7 @@ static int yc_poly_emulator(char* decryptor_offset, char* code, unsigned int ecx

 /* ========================================================================== */

 /* Main routine which calls all others */

-int yc_decrypt(char *fbuf, unsigned int filesize, struct cli_exe_section *sections, unsigned int sectcount, uint32_t peoffset, int desc, uint32_t ecx,int16_t offset) {

+int yc_decrypt(cli_ctx *ctx, char *fbuf, unsigned int filesize, struct cli_exe_section *sections, unsigned int sectcount, uint32_t peoffset, int desc, uint32_t ecx,int16_t offset) {

   uint32_t ycsect = sections[sectcount].raw+offset;

   unsigned int i;

   struct pe_image_file_hdr *pe = (struct pe_image_file_hdr*) (fbuf + peoffset);

@@ -182,7 +234,7 @@ int yc_decrypt(char *fbuf, unsigned int filesize, struct cli_exe_section *sectio

   */

   cli_dbgmsg("yC: offset: %x, length: %x\n", offset, ecx);

   cli_dbgmsg("yC: decrypting decryptor on sect %d\n", sectcount);

-  if (yc_poly_emulator(fbuf + ycsect + 0x93, fbuf + ycsect + 0xc6, ecx, ecx))

+  if (yc_poly_emulator(ctx, fbuf, filesize, fbuf + ycsect + 0x93, fbuf + ycsect + 0xc6, ecx, ecx))

     return 1;

   filesize-=sections[sectcount].ursz;

@@ -218,7 +270,7 @@ int yc_decrypt(char *fbuf, unsigned int filesize, struct cli_exe_section *sectio

       cli_dbgmsg("yC: bad emulation length limit %u\n", max_emu);

       return 1;

     }

-    if (yc_poly_emulator(fbuf + ycsect + (offset == -0x18 ? 0x3ea : 0x457), 

+    if (yc_poly_emulator(ctx, fbuf, filesize, fbuf + ycsect + (offset == -0x18 ? 0x3ea : 0x457), 

 			 fbuf + sections[i].raw, 

 			 sections[i].ursz, 

 			 max_emu))

@@ -25,6 +25,6 @@

 #include "execs.h"

 #include "cltypes.h"

-int yc_decrypt(char *, unsigned int, struct cli_exe_section *, unsigned int, uint32_t, int,uint32_t,int16_t);

+int yc_decrypt(cli_ctx *, char *, unsigned int, struct cli_exe_section *, unsigned int, uint32_t, int,uint32_t,int16_t);

 #endif

Binary files a/test/.split/split.clam-yc.exeab and b/test/.split/split.clam-yc.exeab differ