Browse code

pe_plus return moved up

git-svn: trunk@2478

aCaB authored on 2006/11/05 02:54:53
Showing 2 changed files
... ...
@@ -1,3 +1,7 @@
1
+Sat Nov  4 18:52:36 CET 2006 (acab)
2
+-----------------------------------
3
+  * libclamav/pe.c:	Move pe_plus return to a more convenient location
4
+
1 5
 Fri Nov  3 21:28:13 GMT 2006 (njh)
2 6
 ----------------------------------
3 7
   * clamav-milter:	Fix compilation error in session mode, bug 115
... ...
@@ -678,6 +678,11 @@ int cli_scanpe(int desc, cli_ctx *ctx)
678 678
 
679 679
     cli_dbgmsg("EntryPoint offset: 0x%x (%d)\n", ep, ep);
680 680
 
681
+    if(pe_plus) { /* Do not continue for PE32+ files */
682
+	free(section_hdr);
683
+	return CL_CLEAN;
684
+    }
685
+
681 686
     /* Attempt to detect some popular polymorphic viruses */
682 687
 
683 688
     /* W32.Parite.B */
... ...
@@ -793,7 +798,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)
793 793
     }
794 794
 
795 795
     /* W32.Polipos.A */
796
-   if(polipos && !dll && !pe_plus && nsections > 2 && nsections < 13 && e_lfanew <= 0x800 && (EC16(optional_hdr32.Subsystem) == 2 || EC16(optional_hdr32.Subsystem) == 3) && EC16(file_hdr.Machine) == 0x14c && optional_hdr32.SizeOfStackReserve >= 0x80000) {
796
+   if(polipos && !dll && nsections > 2 && nsections < 13 && e_lfanew <= 0x800 && (EC16(optional_hdr32.Subsystem) == 2 || EC16(optional_hdr32.Subsystem) == 3) && EC16(file_hdr.Machine) == 0x14c && optional_hdr32.SizeOfStackReserve >= 0x80000) {
797 797
 		uint32_t remaining = EC32(section_hdr[0].SizeOfRawData);
798 798
 		uint32_t chunk = sizeof(buff);
799 799
 		uint32_t val, shift, raddr, total = 0;
... ...
@@ -889,12 +894,6 @@ int cli_scanpe(int desc, cli_ctx *ctx)
889 889
 	return CL_CLEAN;
890 890
     }
891 891
 
892
-    if(pe_plus) { /* Do not continue for PE32+ files */
893
-	free(section_hdr);
894
-	return CL_CLEAN;
895
-    }
896
-
897
-
898 892
 #ifdef CL_EXPERIMENTAL
899 893
     /* SUE */
900 894