@@ -1,3 +1,8 @@

+Wed Feb  7 18:11:32 CET 2007 (tk)

+---------------------------------

+  * libclamav: fix memory leaks in mew and unrar and use of uninitialized

+	       data in unrar, patch from Edwin

+

 Wed Feb  7 18:02:02 CET 2007 (tk)

 ---------------------------------

   * libclamav/scanners.c: fix metadata scan (bb#268), patch from Andy Fiddaman

@@ -868,8 +868,9 @@ int unmew11(int sectnum, char *src, int off, int ssize, int dsize, uint32_t base

 	if (!cli_rebuildpe(src, section, i, base, entry_point - base, 0, 0, filedesc))

 	{

 		cli_dbgmsg("MEW: Rebuilding failed\n");

+		free(section);

 		return -1;

 	}

-

+	free(section);

 	return 1;

 }

@@ -268,9 +268,14 @@ static int cli_scanrar(int desc, cli_ctx *ctx, off_t sfx_offset, uint32_t *sfx_c

 	    break;

 	ret = cli_unrar_checklimits(ctx, rar_state.metadata_tail, rar_state.file_count);

 	if(ret && ret != CL_VIRUS) {

+	    free(rar_state.file_header->filename);

+	    free(rar_state.file_header);

 	    ret = CL_CLEAN;

 	    continue;

 	} else if(ret == CL_VIRUS) {

+	    /* needed since we didn't reach unrar_extract_next to clean this up*/

+	    free(rar_state.file_header->filename);

+	    free(rar_state.file_header);	   

 	    break;

 	}

 	ret = cli_unrar_extract_next(&rar_state,dir);

@@ -435,7 +435,11 @@ int unp_read_buf(int fd, unpack_data_t *unpack_data)

 		unpack_data->pack_size -= retval;

 	}

 	unpack_data->read_border = unpack_data->read_top - 30;

-

+	if(unpack_data->read_border < unpack_data->in_addr) {

+		const ssize_t fill = unpack_data->read_top + 30 < MAX_BUF_SIZE ? 30 : MAX_BUF_SIZE - unpack_data->read_top;

+		if(fill)

+			memset(unpack_data->in_buf + unpack_data->read_top, 0, fill);

+	}

 	return (retval!=-1);

 }