@@ -1,7 +1,10 @@

+Tue Jul  6 16:37:34 CEST 2004 (tk)

+----------------------------------

+  * libclamav: pe: fix sanity check on uninitialised data (bug found by aCaB)

+

 Tue Jul  6 14:26:19 BST 2004 (trog)

 -----------------------------------

   * libclamav/vba_extract.c: remove unused PowerPoint functions.

-                                                                                                                                                 

   * libclamav/ole2_extract.c: cleanup some warnings. Apply patch for

 	clean 64bit compile (originally from Martin Brulisauer)

@@ -367,7 +367,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 	if(read(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

 	    cli_dbgmsg("Can't read section header\n");

-	    cli_warnmsg("Possibly broken PE file\n");

+	    cli_dbgmsg("Possibly broken PE file\n");

 	    free(section_hdr);

 	    return CL_CLEAN;

 	}

@@ -416,7 +416,8 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

     ep = cli_rawaddr(EC32(optional_hdr.AddressOfEntryPoint), section_hdr, nsections);

-    if(EC32(section_hdr[i].PointerToRawData) + EC32(section_hdr[i].SizeOfRawData) > sb.st_size || ep == -1) {

+    /* simple sanity check */

+    if(EC32(section_hdr[nsections - 1].PointerToRawData) + EC32(section_hdr[nsections - 1].SizeOfRawData) > sb.st_size || ep == -1) {

 	cli_dbgmsg("Possibly broken PE file\n");

 	free(section_hdr);

 	return CL_CLEAN;