@@ -17,6 +17,9 @@

  *

  * Change History:

  * $Log: mbox.c,v $

+ * Revision 1.203  2004/12/19 13:50:08  nigelhorne

+ * Tidy

+ *

  * Revision 1.202  2004/12/18 16:32:10  nigelhorne

  * Added parseEmailFile

  *

@@ -594,7 +597,7 @@

  * Compilable under SCO; removed duplicate code with message.c

  *

  */

-static	char	const	rcsid[] = "$Id: mbox.c,v 1.202 2004/12/18 16:32:10 nigelhorne Exp $";

+static	char	const	rcsid[] = "$Id: mbox.c,v 1.203 2004/12/19 13:50:08 nigelhorne Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

@@ -752,7 +755,7 @@ static	char	*rfc822comments(const char *in);

 static	int	rfc1341(message *m, const char *dir);

 #endif

 static	bool	usefulHeader(int commandNumber, const char *cmd);

-#ifdef	notdef

+#if	0

 static	const	char	*cli_pmemstr(const char *haystack, size_t hs, const char *needle, size_t ns);

 #endif

@@ -875,7 +878,7 @@ static	pthread_mutex_t	tables_mutex = PTHREAD_MUTEX_INITIALIZER;

 #define	O_BINARY	0

 #endif

-#ifdef	notdef

+#if	0

 #if HAVE_MMAP

 #if HAVE_SYS_MMAN_H

@@ -888,22 +891,28 @@ static	pthread_mutex_t	tables_mutex = PTHREAD_MUTEX_INITIALIZER;

 /*

  * This could be the future. Instead of parsing and decoding it just decodes.

  * Currently this code is about 50% *slower* than the full blown parser, but

- * that may improve with time.

+ * that may improve with time. To speed it up we only scan less than 10MB -

+ *	need access to the options structure to check StreamMaxLength

  * USE IT AT YOUR PERIL, a large number of viruses are not detected with this

  * method, possibly because the decoded files must be exact and not have

  * extra data at the start or end, which this code will produce.

+ *

+ * One big hole is that if there's two attachements of the same type it only

+ * extracts the first

  */

 int

 cli_mbox(const char *dir, int desc, unsigned int options)

 {

-	char *start, *ptr, *line, *buf, *p;

+	char *start, *ptr, *line, *p;

+	char *b64start, *quotedstart;

 	const char *last;

-	int decoder;

-	long bytesleft;

+	int decoder, length;

 	size_t size, headersize, bodysize;

+	long b64size, quotedsize;

 	struct stat statb;

 	message *m;

 	fileblob *fb;

+	int ret = 0;

 	if(fstat(desc, &statb) < 0)

 		return CL_EOPEN;

@@ -913,15 +922,12 @@ cli_mbox(const char *dir, int desc, unsigned int options)

 	if(size == 0)

 		return CL_CLEAN;

-	m = messageCreate();

-	if(m == NULL)

-		return CL_EMEM;

+	if(size > 10*1024*1024)

+		return CL_CLEAN;	/* should be StreamMaxLength, I guess */

 	start = ptr = mmap(NULL, size, PROT_READ, MAP_PRIVATE, desc, 0);

-	if(ptr == MAP_FAILED) {

-		messageDestroy(m);

+	if(ptr == MAP_FAILED)

 		return CL_EMEM;

-	}

 	cli_dbgmsg("mmap'ed mbox\n");

@@ -944,7 +950,6 @@ cli_mbox(const char *dir, int desc, unsigned int options)

 	}

 	if(ptr >= last) {

 		cli_dbgmsg("cli_mbox: can't determine the end of the headers\n");

-		messageDestroy(m);

 		munmap(start, size);

 		return cli_parse_mbox(dir, desc, options);

 	}

@@ -954,122 +959,214 @@ cli_mbox(const char *dir, int desc, unsigned int options)

 	cli_dbgmsg("cli_mbox: size=%u, headersize=%u, bodysize=%u\n", size, headersize, bodysize);

-	bytesleft = bodysize;

-	buf = ptr;

+	b64start = quotedstart = NULL;

+	b64size = quotedsize = 0;

 	decoder = 0;

-	/* Would be nice to have a case insensitive cli_memstr() */

-	if(cli_pmemstr(start, headersize, "base64", 6)) {

+	/*

+	 * Would be nice to have a case insensitive cli_memstr()

+	 *

+	 * This is v. slow especially on large files

+	 */

+	if((p = (char *)cli_pmemstr(ptr, bodysize, "base64", 6)) != NULL) {

 		cli_dbgmsg("Header base64\n");

 		decoder |= 1;

+		b64start = &p[6];

+		b64size = (size_t)(last - b64start) + 1;

 	}

-	if(cli_pmemstr(start, headersize, "quoted-printable", 16)) {

+	if((p = (char *)cli_pmemstr(ptr, bodysize, "quoted-printable", 16)) != NULL) {

 		cli_dbgmsg("Header quoted-printable\n");

 		decoder |= 2;

+		quotedstart = p;

+		quotedsize = (size_t)(last - quotedstart) + 1;

 	}

 	if(!(decoder&1))

 		if((p = (char *)cli_pmemstr(ptr, bodysize, "base64", 6)) != NULL) {

 			cli_dbgmsg("Body base64\n");

 			decoder |= 1;

-			buf = &p[6];

-			bytesleft = (unsigned long)(last - buf) + 1;

-			messageSetEncoding(m, "base64");

+			b64start = &p[6];

+			b64size = (unsigned long)(last - b64start) + 1;

 		}

 	if(!(decoder&2))

 		if((p = (char *)cli_pmemstr(ptr, bodysize, "quoted-printable", 16)) != NULL) {

 			cli_dbgmsg("Body quoted-printable\n");

 			decoder |= 2;

-			if((p < buf) || (buf == ptr)) {

-				buf = &p[16];

-				bytesleft = (unsigned long)(last - buf) + 1;

-			}

-			messageSetEncoding(m, "quoted-printable");

+			quotedstart = &p[16];

+			quotedsize = (unsigned long)(last - quotedstart) + 1;

 		}

 	if(decoder == 0) {

-		messageDestroy(m);

 		munmap(start, size);

 		cli_dbgmsg("cli_mbox: unknown encoder\n");

 		return cli_parse_mbox(dir, desc, options);

 	}

-	line = NULL;

+	if(b64start) {

+		while(*b64start != '\n') {

+			b64start++;

+			b64size--;

+		}

+		/*

+		 * Look for the end of the headers

+		 */

+		while(b64start < last) {

+			if(*b64start == ';') {

+				b64start++;

+				b64size--;

+			} else if(*b64start == '\n') {

+				b64start++;

+				b64size--;

+				if((*b64start == '\n') || (*b64start == '\r')) {

+					b64start++;

+					b64size--;

+					break;

+				}

+			}

+			b64start++;

+			b64size--;

+		}

-	while(*buf != '\n') {

-		buf++;

-		bytesleft--;

-	}

-	/*

-	 * Look for the end of the headers

-	 */

-	while(buf < last) {

-		if(*buf == ';') {

-			buf++;

-			bytesleft--;

-		} else if(*buf == '\n') {

-			buf++;

-			bytesleft--;

-			if((*buf == '\n') || (*buf == '\r')) {

-				buf++;

-				bytesleft--;

-				break;

+		while(!isalnum(*b64start)) {

+			b64start++;

+			b64size--;

+		}

+

+		if(b64size > 0L) {

+			cli_dbgmsg("cli_mbox: decoding %ld base64 bytes\n", b64size);

+

+			line = NULL;

+			length = 0;

+

+			m = messageCreate();

+			if(m == NULL)

+				return CL_EMEM;

+			messageSetEncoding(m, "base64");

+

+			while(b64size > 0L) {

+				length = 0;

+

+				/*printf("%ld: ", bytesleft); fflush(stdout);*/

+

+				for(ptr = b64start; b64size && (*ptr != '\n') && (*ptr != '\r'); ptr++) {

+					length++;

+					--b64size;

+				}

+

+				/*printf("%d: ", length); fflush(stdout);*/

+

+				line = cli_realloc(line, length + 1);

+

+				memcpy(line, b64start, length);

+				line[length] = '\0';

+

+				/*puts(line);*/

+

+				if(messageAddStr(m, line) < 0)

+					break;

+

+				if((b64size > 0) && (*ptr == '\r')) {

+					ptr++;

+					--b64size;

+				}

+				b64start = ++ptr;

+				--b64size;

+				if(strchr(line, '='))

+					break;

 			}

+			fb = messageToFileblob(m, dir);

+			messageDestroy(m);

+

+			if(fb)

+				fileblobDestroy(fb);

+			else

+				ret = -1;

 		}

-		buf++;

-		bytesleft--;

 	}

+	if(quotedstart) {

+		while(*quotedstart != '\n') {

+			quotedstart++;

+			quotedsize--;

+		}

+		/*

+		 * Look for the end of the headers

+		 */

+		while(quotedstart < last) {

+			if(*quotedstart == ';') {

+				quotedstart++;

+				quotedsize--;

+			} else if(*quotedstart == '\n') {

+				quotedstart++;

+				quotedsize--;

+				if((*quotedstart == '\n') || (*quotedstart == '\r')) {

+					quotedstart++;

+					quotedsize--;

+					break;

+				}

+			}

+			quotedstart++;

+			quotedsize--;

+		}

-	while(!isalnum(*buf)) {

-		buf++;

-		bytesleft--;

-	}

+		while(!isalnum(*quotedstart)) {

+			quotedstart++;

+			quotedsize--;

+		}

-	if(bytesleft > 1024*1024)

-		bytesleft = 1024*1024;	/* should be MaxStreamSize, I guess */

+		if(quotedsize > 0L) {

+			cli_dbgmsg("cli_mbox: decoding %ld quoted-printable bytes\n", quotedsize);

-	cli_dbgmsg("cli_mbox: decoding %ld bytes\n", bytesleft);

+			m = messageCreate();

+			if(m == NULL)

+				return CL_EMEM;

+			messageSetEncoding(m, "quoted-printable");

-	while(bytesleft > 0) {

-		int length = 0;

+			line = NULL;

+			length = 0;

-		/*printf("%ld: ", bytesleft); fflush(stdout);*/

+			while(quotedsize > 0L) {

+				length = 0;

-		for(ptr = buf; bytesleft && (*ptr != '\n') && (*ptr != '\r'); ptr++) {

-			length++;

-			--bytesleft;

-		}

+				/*printf("%ld: ", bytesleft); fflush(stdout);*/

-		/*printf("%d: ", length); fflush(stdout);*/

+				for(ptr = quotedstart; quotedsize && (*ptr != '\n') && (*ptr != '\r'); ptr++) {

+					length++;

+					--quotedsize;

+				}

-		line = cli_realloc(line, length + 1);

+				/*printf("%d: ", length); fflush(stdout);*/

-		memcpy(line, buf, length);

-		line[length] = '\0';

+				line = cli_realloc(line, length + 1);

-		/*puts(line);*/

+				memcpy(line, quotedstart, length);

+				line[length] = '\0';

-		if(messageAddStr(m, line) < 0)

-			break;

+				/*puts(line);*/

-		if((bytesleft > 0) && (*ptr == '\r')) {

-			ptr++;

-			bytesleft--;

+				if(messageAddStr(m, line) < 0)

+					break;

+

+				if((quotedsize > 0) && (*ptr == '\r')) {

+					ptr++;

+					--quotedsize;

+				}

+				quotedstart = ++ptr;

+				--quotedsize;

+			}

+			fb = messageToFileblob(m, dir);

+			messageDestroy(m);

+

+			if(fb)

+				fileblobDestroy(fb);

+			else

+				ret = -1;

 		}

-		buf = ++ptr;

-		bytesleft--;

 	}

-	if(line)

-		free(line);

 	munmap(start, size);

-	fb = messageToFileblob(m, dir);

-	messageDestroy(m);

-

-	if(fb) {

-		fileblobDestroy(fb);

+	if(ret == 0)

 		return CL_CLEAN;	/* a lie - but it gets things going */

-	}

+

 	return cli_parse_mbox(dir, desc, options);

 }

 #else

@@ -1151,6 +1248,20 @@ cli_parse_mbox(const char *dir, int desc, unsigned int options)

 		/*

 		 * Have been asked to check a UNIX style mbox file, which

 		 * may contain more than one e-mail message to decode

+		 *

+		 * It would be far better for scanners.c to do this splitting

+		 * and do this

+		 *	FOR EACH mail in the mailbox

+		 *	DO

+		 *		pass this mail to cli_mbox --

+		 *		scan this file

+		 *		IF this file has a virus quit

+		 *		THEN

+		 *			return CL_VIRUS

+		 *		FI

+		 *	END

+		 * This would remove a problem with this code that it can

+		 * fill up the tmp directory before it starts scanning

 		 */

 		bool lastLineWasEmpty;

 		int messagenumber;

@@ -3386,6 +3497,10 @@ rfc1341(message *m, const char *dir)

 	const char *tmpdir;

 	char pdir[NAME_MAX + 1];

+	id = (char *)messageFindArgument(m, "id");

+	if(id == NULL)

+		return -1;

+

 #ifdef  CYGWIN

 	if((tmpdir = getenv("TEMP")) == (char *)NULL)

 		if((tmpdir = getenv("TMP")) == (char *)NULL)

@@ -3419,9 +3534,6 @@ rfc1341(message *m, const char *dir)

 				pdir, statb.st_mode & 0777);

 	}

-	id = (char *)messageFindArgument(m, "id");

-	if(id == NULL)

-		return -1;

 	number = (char *)messageFindArgument(m, "number");

 	if(number == NULL) {

 		free(id);

@@ -3457,6 +3569,7 @@ rfc1341(message *m, const char *dir)

 		int t = atoi(total);

 		DIR *dd = NULL;

+		free(total);

 		/*

 		 * If it's the last one - reassemble it

 		 * FIXME: this assumes that we receive the parts in order

@@ -3473,7 +3586,6 @@ rfc1341(message *m, const char *dir)

 			if(fout == NULL) {

 				cli_errmsg("Can't open '%s' for writing", outname);

 				free(id);

-				free(total);

 				free(number);

 				closedir(dd);

 				return -1;

@@ -3498,7 +3610,6 @@ rfc1341(message *m, const char *dir)

 #else	/*!HAVE_READDIR_R*/

 				while((dent = readdir(dd))) {

 #endif

-					char fullname[NAME_MAX + 1];

 					FILE *fin;

 					char buffer[BUFSIZ];

 					int nblanks;

@@ -3510,14 +3621,13 @@ rfc1341(message *m, const char *dir)

 					if(strncmp(filename, dent->d_name, strlen(filename)) != 0)

 						continue;

-					sprintf(fullname, "%s/%s", pdir, dent->d_name);

-					fin = fopen(fullname, "rb");

+					sprintf(filename, "%s/%s", pdir, dent->d_name);

+					fin = fopen(filename, "rb");

 					if(fin == NULL) {

-						cli_errmsg("Can't open '%s' for reading", fullname);

+						cli_errmsg("Can't open '%s' for reading", filename);

 						fclose(fout);

 						unlink(outname);

 						free(id);

-						free(total);

 						free(number);

 						closedir(dd);

 						return -1;

@@ -3528,9 +3638,9 @@ rfc1341(message *m, const char *dir)

 						 * Ensure that trailing newlines

 						 * aren't copied

 						 */

-						if(buffer[0] == '\n') {

+						if(buffer[0] == '\n')

 							nblanks++;

-						} else {

+						else {

 							if(nblanks)

 								do

 									putc('\n', fout);

@@ -3541,7 +3651,7 @@ rfc1341(message *m, const char *dir)

 					/* don't unlink if leave temps */

 					if(!cli_leavetemps_flag)

-						unlink(fullname);

+						unlink(filename);

 					break;

 				}

 				rewinddir(dd);

@@ -3549,10 +3659,9 @@ rfc1341(message *m, const char *dir)

 			closedir(dd);

 			fclose(fout);

 		}

-		free(number);

 	}

+	free(number);

 	free(id);

-	free(total);

 	return 0;

 }

@@ -3899,7 +4008,7 @@ usefulHeader(int commandNumber, const char *cmd)

 	return FALSE;

 }

-#ifdef	notdef

+#if	0

 /*

  * like cli_memstr - but returns the location of the match

  */

@@ -17,6 +17,9 @@

  *

  * Change History:

  * $Log: message.c,v $

+ * Revision 1.133  2004/12/19 13:50:08  nigelhorne

+ * Tidy

+ *

  * Revision 1.132  2004/12/16 15:29:51  nigelhorne

  * Tidy

  *

@@ -393,7 +396,7 @@

  * uuencodebegin() no longer static

  *

  */

-static	char	const	rcsid[] = "$Id: message.c,v 1.132 2004/12/16 15:29:51 nigelhorne Exp $";

+static	char	const	rcsid[] = "$Id: message.c,v 1.133 2004/12/19 13:50:08 nigelhorne Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

@@ -441,6 +444,8 @@ static	char	const	rcsid[] = "$Id: message.c,v 1.132 2004/12/16 15:29:51 nigelhor

 #undef FALSE

 #endif

+#define	RFC2045LENGTH	76	/* maximum number of characters on a line */

+

 typedef enum { FALSE = 0, TRUE = 1 } bool;

 static	void	messageIsEncoding(message *m);

@@ -837,9 +842,7 @@ messageAddArguments(message *m, const char *s)

 			return;

 		}

-		string = data;

-

-		string++;

+		string = &data[1];

 		/*

 		 * Handle white space to the right of the equals sign

@@ -875,9 +878,7 @@ messageAddArguments(message *m, const char *s)

 				ptr = strchr(key, ':');

 			*ptr = '\0';

-			cptr++;

-

-			string = strchr(cptr, '"');

+			string = strchr(++cptr, '"');

 			if(string == NULL) {

 				cli_dbgmsg("Unbalanced quote character in \"%s\"\n", s);

@@ -1002,7 +1003,6 @@ messageFindArgument(const message *m, const char *variable)

 				if(ret == NULL)

 					return NULL;

-				ret[strlen(ret) - 1] = '\0';

 				/*

 				 * Thomas Lamy <Thomas.Lamy@in-online.net>:

 				 * fix un-quoting of boundary strings from

@@ -1013,8 +1013,10 @@ messageFindArgument(const message *m, const char *variable)

 				 * quoted argument

 				 * end string at next quote

 				 */

-				if((p = strchr(ret, '"')) != NULL)

+				if((p = strchr(ret, '"')) != NULL) {

+					ret[strlen(ret) - 1] = '\0';

 					*p = '\0';

+				}

 				return ret;

 			}

 			return strdup(ptr);

@@ -1052,16 +1054,37 @@ messageSetEncoding(message *m, const char *enctype)

 		int highestSimil = 0;

 		const char *closest = NULL;

-		for(e = encoding_map; e->string; e++)

-			if(strcasecmp(type, e->string) == 0) {

+		for(e = encoding_map; e->string; e++) {

+			int sim;

+			const char lowertype = tolower(type[0]);

+			

+			if((lowertype != tolower(e->string[0])) && (lowertype != 'x'))

+				/*

+				 * simil is expensive, I'm yet to encounter only

+				 * one example of a missent encoding when the

+				 * first character was wrong, so lets assume no

+				 * match to save the call.

+				 *

+				 * That example was quoted-printable sent as

+				 * X-quoted-printable.

+				 */

+				continue;

+

+			sim = simil(type, e->string);

+

+			if(sim == 100) {

 				int j;

 				encoding_type *et;

 				for(j = 0; j < m->numberOfEncTypes; j++)

-					if(m->encodingTypes[j] == e->type) {

-						cli_dbgmsg("Ignoring duplicate encoding mechanism\n");

+					if(m->encodingTypes[j] == e->type)

 						break;

-					}

+

+				if(j < m->numberOfEncTypes) {

+					cli_dbgmsg("Ignoring duplicate encoding mechanism '%s'\n",

+						type);

+					break;

+				}

 				et = (encoding_type *)cli_realloc(m->encodingTypes, (m->numberOfEncTypes + 1) * sizeof(encoding_type));

 				if(et == NULL)

@@ -1072,15 +1095,11 @@ messageSetEncoding(message *m, const char *enctype)

 				cli_dbgmsg("Encoding type %d is \"%s\"\n", m->numberOfEncTypes, type);

 				break;

-

-			} else {

-				const int sim = simil(type, e->string);

-

-				if(sim > highestSimil) {

-					closest = e->string;

-					highestSimil = sim;

-				}

+			} else if(sim > highestSimil) {

+				closest = e->string;

+				highestSimil = sim;

 			}

+		}

 		if(e->string == NULL) {

 			/*

@@ -2196,6 +2215,7 @@ decodeLine(message *m, encoding_type et, const char *line, unsigned char *buf, s

 	bool softbreak;

 	char *p2;

 	char *copy;

+	char base64buf[RFC2045LENGTH + 1];

 	/*printf("decodeLine(et = %d buflen = %u)\n", (int)et, buflen);*/

@@ -2222,70 +2242,6 @@ decodeLine(message *m, encoding_type et, const char *line, unsigned char *buf, s

 				break;

 			}

-#if	0

-			/*

-			 * Section 5.1 of RFC2045 states that any number of white

-			 * space characters may appear on the end of the line

-			 * before the final '=' which indicates a soft break.

-			 *

-			 * Section 6.7.(3) of RFC2045 is no clearer.

-			 *

-			 * This means that we have to do a look ahead here.

-			 *

-			 * This is a real pain because not everyone is

-			 * aware of the implication of the above sentence,

-			 * namely that you must encode any white space before

-			 * the final '=' to ensure it is correctly transfered

-			 * otherwise it is dropped.

-			 * This code adheres to the RFC, but I don't think most

-			 * other software does so I may have to change it

-			 */

-			p2 = strchr(line, '\0');

-			if(p2 == line) {	/* empty line */

-				*buf++ = '\n';

-				break;

-			}

-			if(*--p2 == '=') {

-				softbreak = TRUE;

-				do

-					--p2;

-				while(isspace(*p2) && (p2 > line));

-			} else

-				softbreak = FALSE;

-

-			/*

-			 * p2 now points to the last significant character on the line

-			 */

-			while(line <= p2) {

-				if(*line == '=') {

-					unsigned char byte;

-

-					if((*++line == '\0') || (*line == '\n')) {

-						/* soft line break detected */

-						if(!softbreak)

-							cli_warnmsg("Unexpected soft line break\n");

-						break;

-					}

-

-					byte = hex(*line);

-

-					if((*++line == '\0') || (*line == '\n')) {

-						/*

-						 * broken e-mail, not

-						 * adhering to RFC2045

-						 */

-						*buf++ = byte;

-						break;

-					}

-

-					byte <<= 4;

-					byte += hex(*line);

-					*buf++ = byte;

-				} else

-					*buf++ = *line;

-				line++;

-			}

-#else

 			softbreak = FALSE;

 			while((line < (char *)&buf[buflen]) && *line) {

 				if(*line == '=') {

@@ -2315,7 +2271,6 @@ decodeLine(message *m, encoding_type et, const char *line, unsigned char *buf, s

 					*buf++ = *line;

 				line++;

 			}

-#endif

 			if(!softbreak)

 				/* Put the new line back in */

 				*buf++ = '\n';

@@ -2328,9 +2283,14 @@ decodeLine(message *m, encoding_type et, const char *line, unsigned char *buf, s

 			 * RFC2045 sets the maximum length to 76 bytes

 			 * but many e-mail clients ignore that

 			 */

-			copy = strdup(line);

-			if(copy == NULL)

-				break;

+			if(strlen(line) < sizeof(base64buf)) {

+				strcpy(base64buf, line);

+				copy = base64buf;

+			} else {

+				copy = strdup(line);

+				if(copy == NULL)

+					break;

+			}

 			p2 = strchr(copy, '=');

 			if(p2)

@@ -2343,7 +2303,8 @@ decodeLine(message *m, encoding_type et, const char *line, unsigned char *buf, s

 			 */

 			buf = decode(m, copy, buf, base64, (p2 == NULL) && ((strlen(copy) & 3) == 0));

-			free(copy);

+			if(copy != base64buf)

+				free(copy);

 			break;

 		case UUENCODE: