@@ -1,3 +1,8 @@

+Fri Oct 24 11:45:41 CEST 2008 (tk)

+----------------------------------

+ * libclamav: fix detection of Worm.Mydoom.M.log and control it with

+	      CL_SCAN_ALGORITHMIC and dconf (bb#1241)

+

 Thu Oct 23 23:01:10 EEST 2008 (edwin)

 -------------------------------------

  * clamd/scanner.c: fix leak on rare error path (bb #1254)

@@ -101,6 +101,7 @@ static struct dconf_module modules[] = {

     { "OTHER",	    "JPEG",	    OTHER_CONF_JPEG,	    1 },

     { "OTHER",	    "CRYPTFF",	    OTHER_CONF_CRYPTFF,	    1 },

     { "OTHER",	    "DLP",	    OTHER_CONF_DLP,	    1 },

+    { "OTHER",	    "MYDOOMLOG",    OTHER_CONF_MYDOOMLOG,   1 },

     { "PHISHING",   "ENGINE",       PHISHING_CONF_ENGINE,   1 },

     { "PHISHING",   "ENTCONV",      PHISHING_CONF_ENTCONV,  1 },

@@ -92,6 +92,7 @@ struct cli_dconf {

 #define OTHER_CONF_JPEG	    0x8

 #define OTHER_CONF_CRYPTFF  0x10

 #define OTHER_CONF_DLP	    0x20

+#define OTHER_CONF_MYDOOMLOG	0x40

 /* Phishing flags */

 #define PHISHING_CONF_ENGINE   0x1

@@ -2044,7 +2044,8 @@ int cli_magic_scandesc(int desc, cli_ctx *ctx)

 	    break;

 	case CL_TYPE_BINARY_DATA:

-	    ret = cli_check_mydoom_log(desc, ctx->virname);

+	    if(SCAN_ALGO && (DCONF_OTHER & OTHER_CONF_MYDOOMLOG))

+		ret = cli_check_mydoom_log(desc, ctx->virname);

 	    break;

 	case CL_TYPE_TEXT_ASCII:

@@ -58,6 +58,8 @@ int cli_check_mydoom_log(int desc, const char **virname)

 	if (cli_readn(desc, &record, 32) != 32) {

 	    break;

 	}

+	if(!j && record[0] == 0xffffffff) /* bb#1241 */

+	    return CL_CLEAN;

 	/* Decode the key */

 	record[0] = ~ntohl(record[0]);