@@ -1,3 +1,23 @@

+Wed, 12 Nov 2014 14:30:39 EDT (swebb)

+-------------------------------------

+* bb11176 - Instruct OpenSSL to allow MD5 when in FIPS-compliant mode.

+  Patch submitted by Reinhard Max.

+

+Mon, 10 Nov 2014 11:03:29 EDT (swebb)

+-------------------------------------

+* bb11155 - Adjust the logic surrounding adjusting the PE section sizes

+  This fixes a crash with maliciously crafted yoda's crypter files and

+  also improves virus detections for PE files. 

+

+Thu, 6 Nov 2014 14:51:26 EDT (swebb)

+-------------------------------------

+* bb11088 - Merge in fixes for clamscan -a crash bug

+

+Mon, 20 Oct 2014 11:33:18 EDT (swebb)

+-------------------------------------

+* Revert "bb#10731 - Allow to specificy a group for the socket of which

+  the user is not a member"

+

 Thu, 31 Jul 2014 19:11:22 EDT (swebb)

 -------------------------------------

 * Add support for XDP PDF file format

@@ -3,20 +3,20 @@

 Welcome to ClamAV 0.98.5! ClamAV 0.98.5 includes important new features

 for collecting and analyzing file properties. Software developers and

-analysts may collect file properties using the ClamAV API and then

-analyze them with ClamAV bytecode programs. Using the new features will

-require that libjson-c is installed, but otherwise libjson-c will be

-optional.

+analysts may collect file property meta data using the ClamAV API for

+subsequent analysis by ClamAV bytecode programs. Using these features

+will require that libjson-c is installed, but otherwise libjson-c is not

+needed.

 Look for our upcoming series of blog posts to learn more about using the

 ClamAV API and bytecode facilities for collecting and analyzing file

 properties.

-ClamAV 0.98.5 also includes these new features:

+ClamAV 0.98.5 also includes these new features and bug fixes:

     - Support for the XDP file format and extracting, decoding, and

       scanning PDF files within XDP files.

-    - Addition of shared library support for LLVM verions 3.1 - 3.4

+    - Addition of shared library support for LLVM versions 3.1 - 3.5

       for the purpose of just-in-time(JIT) compilation of ClamAV

       bytecode signatures. Andreas Cadhalpun submitted the patch

       implementing this support.

@@ -24,6 +24,15 @@ ClamAV 0.98.5 also includes these new features:

       ClamAV bytecode signature authors by providing introspection

       into compiled bytecode programs.

     - Resolution of many of the warning messages from ClamAV compilation.

+    - Improved detection of malicious PE files.

+    - Security fix for ClamAV crash when using 'clamscan -a'. This issue

+      was identified by Kurt Siefried of Red Hat.

+    - Security fix for ClamAV crash when scanning maliciously crafted

+      yoda's crypter files. This issue, as well as several other bugs

+      fixed in this release, were identified by Damien Millescamp of

+      Oppida.

+    - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode.

+      Thanks to Reinhard Max for supplying the patch.

     - Bug fixes and other feature enhancements. See Changelog or

       git log for details.

@@ -32,6 +41,9 @@ and bug reporting included in ClamAV 0.98.5:

 Andreas Cadhalpun

 Sebastian Andrzej Siewior

+Damien Millescamp

+Reinhard Max

+Kurt Seifried

 --

 The ClamAV team (http://www.clamav.net/about.html#credits)

@@ -7,20 +7,20 @@ here may not be available in binary packages.

 Welcome to ClamAV 0.98.5! ClamAV 0.98.5 includes important new features

 for collecting and analyzing file properties. Software developers and

-analysts may collect file properties using the ClamAV API and then

-analyze them with ClamAV bytecode programs. Using the new features will

-require that libjson-c is installed, but otherwise libjson-c will be

-optional.

+analysts may collect file property meta data using the ClamAV API for

+subsequent analysis by ClamAV bytecode programs. Using these features

+will require that libjson-c is installed, but otherwise libjson-c is not

+needed.

 Look for our upcoming series of blog posts to learn more about using the

 ClamAV API and bytecode facilities for collecting and analyzing file

 properties.

-ClamAV 0.98.5 also includes these new features:

+ClamAV 0.98.5 also includes these new features and bug fixes:

     - Support for the XDP file format and extracting, decoding, and

       scanning PDF files within XDP files.

-    - Addition of shared library support for LLVM verions 3.1 - 3.4

+    - Addition of shared library support for LLVM versions 3.1 - 3.5

       for the purpose of just-in-time(JIT) compilation of ClamAV

       bytecode signatures. Andreas Cadhalpun submitted the patch

       implementing this support.

@@ -28,6 +28,15 @@ ClamAV 0.98.5 also includes these new features:

       ClamAV bytecode signature authors by providing introspection

       into compiled bytecode programs.

     - Resolution of many of the warning messages from ClamAV compilation.

+    - Improved detection of malicious PE files.

+    - Security fix for ClamAV crash when using 'clamscan -a'. This issue

+      was identified by Kurt Siefried of Red Hat.

+    - Security fix for ClamAV crash when scanning maliciously crafted

+      yoda's crypter files. This issue, as well as several other bugs

+      fixed in this release, were identified by Damien Millescamp of

+      Oppida.

+    - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode.

+      Thanks to Reinhard Max for supplying the patch.

     - Bug fixes and other feature enhancements. See Changelog or

       git log for details.

@@ -36,6 +45,9 @@ and bug reporting included in ClamAV 0.98.5:

 Andreas Cadhalpun

 Sebastian Andrzej Siewior

+Damien Millescamp

+Reinhard Max

+Kurt Seifried

 0.98.4

 ------

@@ -47,5 +47,5 @@ endif

 DEFS = @DEFS@ -DCL_NOLIBCLAMAV

 LIBS = $(top_builddir)/libclamav/libclamav_internal_utils.la @CLAMAV_MILTER_LIBS@ @THREAD_LIBS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ -I$(top_srcdir)/clamd -I$(top_srcdir)/libclamav -I$(top_srcdir)/shared -I$(top_srcdir) @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

+AM_CPPFLAGS = -I$(top_srcdir)/clamd -I$(top_srcdir)/libclamav -I$(top_srcdir)/shared -I$(top_srcdir) @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

 CLEANFILES=*.gcda *.gcno

@@ -512,7 +512,7 @@ top_srcdir = @top_srcdir@

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@man_MANS = $(top_builddir)/docs/man/clamav-milter.8

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@AM_CFLAGS = @WERR_CFLAGS_MILTER@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ -I$(top_srcdir)/clamd -I$(top_srcdir)/libclamav -I$(top_srcdir)/shared -I$(top_srcdir) @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

+AM_CPPFLAGS = -I$(top_srcdir)/clamd -I$(top_srcdir)/libclamav -I$(top_srcdir)/shared -I$(top_srcdir) @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

 CLEANFILES = *.gcda *.gcno

 all: all-am

@@ -381,7 +381,7 @@ int main(int argc, char **argv) {

 	if((fd = fopen(opt->strarg, "w")) == NULL) {

 	    logg("!Can't save PID in file %s\n", opt->strarg);

 	} else {

-	    if (fprintf(fd, "%u", (unsigned int)getpid())<0) {

+	    if (fprintf(fd, "%u\n", (unsigned int)getpid())<0) {

 	    	logg("!Can't save PID in file %s\n", opt->strarg);

 	    }

 	    fclose(fd);

@@ -53,7 +53,7 @@ AM_CFLAGS=@WERR_CFLAGS@

 endif

 LIBS = $(top_builddir)/libclamav/libclamav.la @CLAMD_LIBS@ @THREAD_LIBS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

 # it does support --help and --version but with the default config file

 # it outputs an error message which tells us to edit the config files

@@ -487,7 +487,7 @@ top_srcdir = @top_srcdir@

 @BUILD_CLAMD_TRUE@    fan.h

 @BUILD_CLAMD_TRUE@AM_CFLAGS = @WERR_CFLAGS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

 # it does support --help and --version but with the default config file

 # it outputs an error message which tells us to edit the config files

@@ -1064,7 +1064,7 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

 	if((fd = fopen(opt->strarg, "w")) == NULL) {

 	    logg("!Can't save PID in file %s\n", opt->strarg);

 	} else {

-	    if (fprintf(fd, "%u", (unsigned int) mainpid)<0) {

+	    if (fprintf(fd, "%u\n", (unsigned int) mainpid)<0) {

 	    	logg("!Can't save PID in file %s\n", opt->strarg);

 	    }

 	    fclose(fd);

@@ -44,7 +44,7 @@ endif

 DEFS = @DEFS@ -DCL_NOTHREADS -DCL_NOLIBCLAMAV

-AM_CPPFLAGS = @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/clamscan -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @CLAMDSCAN_CPPFLAGS@

+AM_CPPFLAGS = @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/clamscan -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @CLAMDSCAN_CPPFLAGS@

 LIBS = $(top_builddir)/libclamav/libclamav_internal_utils_nothreads.la  @CLAMDSCAN_LIBS@

 AM_INSTALLCHECK_STD_OPTIONS_EXEMPT=clamdscan$(EXEEXT)

@@ -476,7 +476,7 @@ top_srcdir = @top_srcdir@

 @BUILD_CLAMD_TRUE@    client.h

 @BUILD_CLAMD_TRUE@AM_CFLAGS = @WERR_CFLAGS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/clamscan -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @CLAMDSCAN_CPPFLAGS@

+AM_CPPFLAGS = @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/clamscan -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @CLAMDSCAN_CPPFLAGS@

 AM_INSTALLCHECK_STD_OPTIONS_EXEMPT = clamdscan$(EXEEXT)

 CLEANFILES = *.gcda *.gcno

 all: all-am

@@ -11,8 +11,8 @@ clamdtop_SOURCES = \

     clamdtop.c

 AM_CFLAGS=@WERR_CFLAGS@

-AM_CPPFLAGS = -I$(top_srcdir) @CURSES_CPPFLAGS@ @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

-clamdtop_LDADD = @CURSES_LIBS@ @SSL_LDFLAGS@ @SSL_LIBS@ $(top_builddir)/libclamav/libclamav_internal_utils_nothreads.la

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @CURSES_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

+clamdtop_LDADD = @SSL_LDFLAGS@ @SSL_LIBS@ @CURSES_LIBS@ $(top_builddir)/libclamav/libclamav_internal_utils_nothreads.la

 endif

 DEFS = @DEFS@ -DCL_NOTHREADS -DCL_NOLIBCLAMAV

 EXTRA_DIST = clamdtop.c

@@ -473,8 +473,8 @@ top_srcdir = @top_srcdir@

 @HAVE_CURSES_TRUE@    clamdtop.c

 @HAVE_CURSES_TRUE@AM_CFLAGS = @WERR_CFLAGS@

-@HAVE_CURSES_TRUE@AM_CPPFLAGS = -I$(top_srcdir) @CURSES_CPPFLAGS@ @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

-@HAVE_CURSES_TRUE@clamdtop_LDADD = @CURSES_LIBS@ @SSL_LDFLAGS@ @SSL_LIBS@ $(top_builddir)/libclamav/libclamav_internal_utils_nothreads.la

+@HAVE_CURSES_TRUE@AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @CURSES_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

+@HAVE_CURSES_TRUE@clamdtop_LDADD = @SSL_LDFLAGS@ @SSL_LIBS@ @CURSES_LIBS@ $(top_builddir)/libclamav/libclamav_internal_utils_nothreads.la

 EXTRA_DIST = clamdtop.c

 all: all-am

@@ -38,6 +38,6 @@ clamscan_SOURCES = \

 AM_CFLAGS=@WERR_CFLAGS@

 DEFS = @DEFS@ -DCL_NOTHREADS

 LIBS = $(top_builddir)/libclamav/libclamav.la @THREAD_LIBS@ @CLAMSCAN_LIBS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @CLAMSCAN_CPPFLAGS@

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ @CLAMSCAN_CPPFLAGS@

 CLEANFILES=*.gcda *.gcno

@@ -464,7 +464,7 @@ clamscan_SOURCES = \

     manager.h

 AM_CFLAGS = @WERR_CFLAGS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @CLAMSCAN_CPPFLAGS@

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ @CLAMSCAN_CPPFLAGS@

 CLEANFILES = *.gcda *.gcno

 all: all-am

@@ -31,7 +31,7 @@ clamsubmit_SOURCES = \

 AM_CFLAGS=@WERR_CFLAGS@ @CLAMSUBMIT_CFLAGS@

 DEFS = @DEFS@ -DCL_NOTHREADS

-AM_CPPFLAGS = @JSON_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @JSON_CPPFLAGS@

 LIBS = $(top_builddir)/libclamav/libclamav.la @CLAMSUBMIT_LIBS@ @THREAD_LIBS@

 AM_INSTALLCHECK_STD_OPTIONS_EXEMPT=clamsubmit$(EXEEXT)

@@ -457,7 +457,7 @@ clamsubmit_SOURCES = \

 	clamsubmit.c

 AM_CFLAGS = @WERR_CFLAGS@ @CLAMSUBMIT_CFLAGS@

-AM_CPPFLAGS = @JSON_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @JSON_CPPFLAGS@

 AM_INSTALLCHECK_STD_OPTIONS_EXEMPT = clamsubmit$(EXEEXT)

 CLEANFILES = *.gcda *.gcno

 all: all-am

@@ -5108,7 +5108,7 @@ $as_echo "$ac_cv_safe_to_define___extensions__" >&6; }

 VERSION="devel-`date +%Y%m%d`"

 LC_CURRENT=7

-LC_REVISION=22

+LC_REVISION=24

 LC_AGE=1

 LIBCLAMAV_VERSION="$LC_CURRENT":"$LC_REVISION":"$LC_AGE"

Binary files a/docs/ClamAV_Document_Properties.xlsx and b/docs/ClamAV_Document_Properties.xlsx differ

@@ -51,7 +51,7 @@ freshclam_SOURCES = \

 AM_CFLAGS=@WERR_CFLAGS@

 DEFS = @DEFS@ -DCL_NOTHREADS

-AM_CPPFLAGS = @SSL_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @FRESHCLAM_CPPFLAGS@  @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @FRESHCLAM_CPPFLAGS@  @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

 LIBS = @SSL_LDFLAGS@ @SSL_LIBS@ $(top_builddir)/libclamav/libclamav.la @FRESHCLAM_LIBS@ @THREAD_LIBS@

 AM_INSTALLCHECK_STD_OPTIONS_EXEMPT=freshclam$(EXEEXT)

@@ -480,7 +480,7 @@ freshclam_SOURCES = \

     mirman.h

 AM_CFLAGS = @WERR_CFLAGS@

-AM_CPPFLAGS = @SSL_CPPFLAGS@ -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @FRESHCLAM_CPPFLAGS@  @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

+AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/shared -I$(top_srcdir)/libclamav @SSL_CPPFLAGS@ @FRESHCLAM_CPPFLAGS@  @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

 AM_INSTALLCHECK_STD_OPTIONS_EXEMPT = freshclam$(EXEEXT)

 CLEANFILES = *.gcda *.gcno

 all: all-am

@@ -135,7 +135,7 @@ writepid (const char *pidfile)

     }

     else

     {

-        fprintf (fd, "%d", (int) getpid ());

+        fprintf (fd, "%d\n", (int) getpid ());

         fclose (fd);

     }

     umask (old_umask);

@@ -244,7 +244,7 @@ download (const struct optstruct *opts, const char *cfgfile)

                     opt = (struct optstruct *) opt->nextarg;

                     if (!opt)

                     {

-                        logg ("Update failed. Your network may be down or none of the mirrors listed in %s is working. Check http://www.clamav.net/documentation.html for possible reasons.\n", cfgfile);

+                        logg ("Update failed. Your network may be down or none of the mirrors listed in %s is working. Check http://www.clamav.net/doc/mirrors-faq.html for possible reasons.\n", cfgfile);

                     }

                 }

@@ -2060,7 +2060,7 @@ updatedb (const char *dbname, const char *hostname, char *ip, int *signo,

             logg ("^Current functionality level = %d, recommended = %d\n",

                   flevel, current->fl);

             logg ("Please check if ClamAV tools are linked against the proper version of libclamav\n");

-            logg ("DON'T PANIC! Read http://www.clamav.net/documentation.html\n");

+            logg ("DON'T PANIC! Read http://www.clamav.net/doc/install.html\n");

         }

         *signo += current->sigs;

@@ -100,7 +100,9 @@ enum FunctionalityLevels {

     FUNC_LEVEL_098_1     = 76, /**< LibClamAV release 0.98.2 */ /*last syncing to clamav*/

     FUNC_LEVEL_098_2     = 77, /**< LibClamAV release 0.98.2 */

     FUNC_LEVEL_098_3     = 77, /**< LibClamAV release 0.98.3 */

-    FUNC_LEVEL_098_4     = 78, /**< LibClamAV release 0.98.4: JSON reading API requires this minimum level */

+    FUNC_LEVEL_098_4     = 77, /**< LibClamAV release 0.98.4 */

+    FUNC_LEVEL_098_5     = 79, /**< LibClamAV release 0.98.5: JSON reading API requires this minimum level */

+    FUNC_LEVEL_098_6     = 79, /**< LibClamAV release 0.98.6 */

     FUNC_LEVEL_100       = 100 /*future release candidate*/

 };

@@ -60,11 +60,22 @@

 #include "others.h"

 #include "libclamav/conv.h"

 #include "libclamav/str.h"

+#include "iowrap.h"

 #if defined(_WIN32)

 char * strptime(const char *buf, const char *fmt, struct tm *tm);

 #endif

+#if defined(_WIN32)

+#define EXCEPTION_PREAMBLE __try {

+#define EXCEPTION_POSTAMBLE } __except (filter_memcpy(GetExceptionCode(), GetExceptionInformation())) { \

+    winres=1; \

+}

+#else

+#define EXCEPTION_PREAMBLE

+#define EXCEPTION_POSTAMBLE

+#endif

+

 #if !defined(MIN)

     #define MIN(x,y) ((x)<(y)?(x):(y))

 #endif

@@ -132,6 +143,7 @@ unsigned char *cl_hash_data(char *alg, const void *buf, size_t len, unsigned cha

     const EVP_MD *md;

     unsigned int i;

     size_t cur;

+    int winres=0;

     md = EVP_get_digestbyname(alg);

     if (!(md))

@@ -151,6 +163,11 @@ unsigned char *cl_hash_data(char *alg, const void *buf, size_t len, unsigned cha

         return NULL;

     }

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_DigestInit_ex(ctx, md, NULL)) {

         if (!(obuf))

             free(ret);

@@ -165,6 +182,8 @@ unsigned char *cl_hash_data(char *alg, const void *buf, size_t len, unsigned cha

     cur=0;

     while (cur < len) {

         size_t todo = MIN((unsigned long)EVP_MD_block_size(md), (unsigned long)(len-cur));

+

+        EXCEPTION_PREAMBLE

         if (!EVP_DigestUpdate(ctx, (void *)(((unsigned char *)buf)+cur), todo)) {

             if (!(obuf))

                 free(ret);

@@ -175,6 +194,18 @@ unsigned char *cl_hash_data(char *alg, const void *buf, size_t len, unsigned cha

             EVP_MD_CTX_destroy(ctx);

             return NULL;

         }

+        EXCEPTION_POSTAMBLE

+

+        if (winres) {

+            if (!(obuf))

+                free(ret);

+

+            if ((olen))

+                *olen = 0;

+

+            EVP_MD_CTX_destroy(ctx);

+            return NULL;

+        }

         cur += todo;

     }

@@ -212,6 +243,11 @@ unsigned char *cl_hash_file_fd(int fd, char *alg, unsigned int *olen)

     if (!(ctx))

         return NULL;

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_DigestInit_ex(ctx, md, NULL)) {

         EVP_MD_CTX_destroy(ctx);

         return NULL;

@@ -230,6 +266,7 @@ unsigned char *cl_hash_file_fd_ctx(EVP_MD_CTX *ctx, int fd, unsigned int *olen)

     int mdsz;

     unsigned int hashlen;

     STATBUF sb;

+    int winres=0;

 	unsigned int blocksize;

@@ -267,12 +304,21 @@ unsigned char *cl_hash_file_fd_ctx(EVP_MD_CTX *ctx, int fd, unsigned int *olen)

 #else

     while ((nread = read(fd, buf, blocksize)) > 0) {

 #endif

+        EXCEPTION_PREAMBLE

         if (!EVP_DigestUpdate(ctx, buf, nread)) {

             free(buf);

             free(hash);

             return NULL;

         }

+        EXCEPTION_POSTAMBLE

+

+        if (winres) {

+            free(buf);

+            free(hash);

+

+            return NULL;

+        }

     }

     if (!EVP_DigestFinal_ex(ctx, hash, &hashlen)) {

@@ -321,6 +367,11 @@ int cl_verify_signature_hash(EVP_PKEY *pkey, char *alg, unsigned char *sig, unsi

     mdsz = EVP_MD_size(md);

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_VerifyInit_ex(ctx, md, NULL)) {

         EVP_MD_CTX_destroy(ctx);

         return -1;

@@ -365,6 +416,11 @@ int cl_verify_signature_fd(EVP_PKEY *pkey, char *alg, unsigned char *sig, unsign

         return -1;

     }

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_VerifyInit_ex(ctx, md, NULL)) {

         free(digest);

         EVP_MD_CTX_destroy(ctx);

@@ -435,6 +491,11 @@ int cl_verify_signature(EVP_PKEY *pkey, char *alg, unsigned char *sig, unsigned

         return -1;

     }

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_VerifyInit_ex(ctx, md, NULL)) {

         free(digest);

         if (decode)

@@ -643,6 +704,11 @@ unsigned char *cl_sign_data(EVP_PKEY *pkey, char *alg, unsigned char *hash, unsi

         return NULL;

     }

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_SignInit_ex(ctx, md, NULL)) {

         free(sig);

         EVP_MD_CTX_destroy(ctx);

@@ -1078,6 +1144,11 @@ void *cl_hash_init(const char *alg)

         return NULL;

     }

+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW

+    /* we will be using MD5, which is not allowed under FIPS */

+    EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

+#endif

+

     if (!EVP_DigestInit_ex(ctx, md, NULL)) {

         EVP_MD_CTX_destroy(ctx);

         return NULL;

@@ -1088,11 +1159,18 @@ void *cl_hash_init(const char *alg)

 int cl_update_hash(void *ctx, void *data, size_t sz)

 {

+    int winres=0;

+

     if (!(ctx) || !(data))

         return -1;

+    EXCEPTION_PREAMBLE

     if (!EVP_DigestUpdate((EVP_MD_CTX *)ctx, data, sz))

         return -1;

+    EXCEPTION_POSTAMBLE

+

+    if (winres)

+        return -1;

     return 0;

 }

@@ -660,7 +660,7 @@ int cli_cvdload(FILE *fs, struct cl_engine *engine, unsigned int *signo, unsigne

     if(cvd.fl > cl_retflevel()) {

 	cli_warnmsg("***********************************************************\n");

 	cli_warnmsg("***  This version of the ClamAV engine is outdated.     ***\n");

-	cli_warnmsg("***   Read http://www.clamav.net/documentation.html     ***\n");

+	cli_warnmsg("***   Read http://www.clamav.net/doc/install.html       ***\n");

 	cli_warnmsg("***********************************************************\n");

     }

@@ -41,6 +41,7 @@

 #include "iowrap.h"

 #include "mbr.h"

 #include "gpt.h"

+#include "ooxml.h"

 #include "htmlnorm.h"

 #include "entconv.h"

@@ -33,7 +33,7 @@

 #endif

 #ifdef _WIN32

-static int filter_memcpy(unsigned int code, struct _EXCEPTION_POINTERS *ep) {

+int filter_memcpy(unsigned int code, struct _EXCEPTION_POINTERS *ep) {

     if ((code == EXCEPTION_IN_PAGE_ERROR) || (code == STATUS_DEVICE_DATA_ERROR)) {

         return EXCEPTION_EXECUTE_HANDLER;

     }

@@ -42,4 +42,8 @@

  */

 int cli_memcpy(void *target, const void *source, unsigned long size);

+#ifdef _WIN32

+int filter_memcpy(unsigned int code, struct _EXCEPTION_POINTERS *ep);

+#endif

+

 #endif

@@ -3315,7 +3315,7 @@ getline_from_mbox(char *buffer, size_t buffer_len, fmap_t *map, size_t *at)

 	return NULL;

     }

     if((buffer_len == 0) || (buffer == NULL)) {

-	cli_errmsg("Invalid call to getline_from_mbox(). Refer to http://www.clamav.net/documentation.html\n");

+	cli_errmsg("Invalid call to getline_from_mbox(). Refer to http://www.clamav.net/doc/install.html\n");

 	return NULL;

     }

@@ -623,7 +623,11 @@ void *mpool_malloc(struct MP *mp, size_t size) {

     struct FRAG *fold = f;

     mp->avail[sbits] = f->u.next.ptr;

     /* we always have enough space for this, align_increase ensured that */

+#ifdef _WIN64

+    f = (struct FRAG*)(alignto((unsigned long long)f + FRAG_OVERHEAD, align)-FRAG_OVERHEAD);

+#else

     f = (struct FRAG*)(alignto((unsigned long)f + FRAG_OVERHEAD, align)-FRAG_OVERHEAD);

+#endif

     f->u.a.sbits = sbits;

     f->u.a.padding = (char*)f - (char*)fold;

 #ifdef CL_DEBUG

@@ -62,7 +62,35 @@ ole2_convert_utf(summary_ctx_t *sctx, char *begin, size_t sz, const char *encodi

 #endif

     /* applies in the both case */

     if (sctx->codepage == 20127 || sctx->codepage == 65001) {

-        outbuf = cli_strdup(begin);

+        char *track;

+        int bcnt, scnt;

+

+        outbuf = cli_calloc(1, sz+1);

+        if (!(outbuf))

+            return NULL;

+        memcpy(outbuf, begin, sz);

+

+        track = outbuf+sz-1;

+        if ((sctx->codepage == 65001) && (*track & 0x80)) { /* UTF-8 with a most significant bit */

+            /* locate the start of the last character */

+            for (bcnt = 1; (track != outbuf); track--, bcnt++) {

+                if (((uint8_t)*track & 0xC0) != 0x80)

+                    break;

+            }

+

+            /* count number of set (1) significant bits */

+            for (scnt = 0; scnt < sizeof(uint8_t)*8; scnt++) {

+                if (((uint8_t)*track & (0x80 >> scnt)) == 0)

+                    break;

+            }

+

+            if (bcnt != scnt) {

+                cli_dbgmsg("ole2_convert_utf: cleaning out %d bytes from incomplete "

+                           "utf-8 character length %d\n", bcnt, scnt);

+                for (; bcnt > 0; bcnt--, track++)

+                    *track = '\0';

+            }

+        }

         return outbuf;

     }

@@ -78,11 +78,29 @@ static int ooxml_is_int(const char *value, size_t len, int32_t *val)

     return 1;

 }

+static int ooxml_add_parse_error(json_object *wrkptr, const xmlChar *errstr)

+{

+    json_object *perr;

+

+    if (!wrkptr)

+        return CL_ENULLARG;

+

+    perr = cli_jsonarray(wrkptr, "ParseErrors");

+    if (perr == NULL) {

+        return CL_EMEM;

+    }

+

+    return cli_jsonstr(perr, NULL, errstr);

+}

+

 static int ooxml_parse_value(json_object *wrkptr, const char *arrname, const xmlChar *node_value)

 {

     json_object *newobj, *arrobj;

     int val;

+    if (!wrkptr)

+        return CL_ENULLARG;

+

     arrobj = cli_jsonarray(wrkptr, arrname);

     if (arrobj == NULL) {

         return CL_EMEM;

@@ -247,7 +265,7 @@ static int ooxml_parse_element(cli_ctx *ctx, xmlTextReaderPtr reader, json_objec

     if (node_type != XML_READER_TYPE_ELEMENT) {

         cli_dbgmsg("ooxml_parse_element: first node typed %d, not %d\n", node_type, XML_READER_TYPE_ELEMENT);

-        return CL_EPARSE; /* first type is not an element */

+        return CL_EFORMAT; /* first type is not an element */

     }

     node_name = xmlTextReaderConstLocalName(reader);

@@ -267,7 +285,7 @@ static int ooxml_parse_element(cli_ctx *ctx, xmlTextReaderPtr reader, json_objec

     /* generate json object */

     thisjobj = cli_jsonobj(wrkptr, element_tag);

     if (!thisjobj) {

-        return CL_EPARSE;

+        return CL_EMEM;

     }

     cli_dbgmsg("ooxml_parse_element: generated json object [%s]\n", element_tag);

@@ -386,6 +404,17 @@ static int ooxml_parse_element(cli_ctx *ctx, xmlTextReaderPtr reader, json_objec

     return CL_SUCCESS;

 }

+static int ooxml_updatelimits(int fd, cli_ctx *ctx)

+{

+    STATBUF sb;

+    if (FSTAT(fd, &sb) == -1) {

+        cli_errmsg("ooxml_updatelimits: Can't fstat descriptor %d\n", fd);

+        return CL_ESTAT;

+    }

+

+    return cli_updatelimits(ctx, sb.st_size);

+}

+

 static int ooxml_parse_document(int fd, cli_ctx *ctx)

 {

     int ret = CL_SUCCESS;

@@ -393,6 +422,11 @@ static int ooxml_parse_document(int fd, cli_ctx *ctx)

     cli_dbgmsg("in ooxml_parse_document\n");

+    /* perform engine limit checks in temporary tracking session */

+    ret = ooxml_updatelimits(fd, ctx);

+    if (ret != CL_CLEAN)

+        return ret;

+

     reader = xmlReaderForFd(fd, "properties.xml", NULL, CLAMAV_MIN_XMLREADER_FLAGS);

     if (reader == NULL) {

         cli_dbgmsg("ooxml_parse_document: xmlReaderForFd error\n");

@@ -406,10 +440,8 @@ static int ooxml_parse_document(int fd, cli_ctx *ctx)

     ret = ooxml_parse_element(ctx, reader, ctx->wrkproperty, 0, NULL);

-    if (ret != CL_SUCCESS && ret != CL_ETIMEOUT && ret != CL_BREAK) {

+    if (ret != CL_SUCCESS && ret != CL_ETIMEOUT && ret != CL_BREAK)

         cli_warnmsg("ooxml_parse_document: encountered issue in parsing properties document\n");

-        cli_jsonbool(ctx->wrkproperty, "ParseError", 1);

-    }

     xmlTextReaderClose(reader);

     xmlFreeTextReader(reader);

@@ -418,37 +450,64 @@ static int ooxml_parse_document(int fd, cli_ctx *ctx)

 static int ooxml_core_cb(int fd, cli_ctx *ctx)

 {

+    int ret;

+

     cli_dbgmsg("in ooxml_core_cb\n");

-    return ooxml_parse_document(fd, ctx);

-    //return ooxml_basic_json(fd, ctx, "CoreProperties");

+    ret = ooxml_parse_document(fd, ctx);

+    if (ret == CL_EPARSE)

+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_CORE_XMLPARSER");

+    else if (ret == CL_EFORMAT)

+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_CORE_MALFORMED");

+

+    return ret;

 }

 static int ooxml_extn_cb(int fd, cli_ctx *ctx)

 {

+    int ret;

+

     cli_dbgmsg("in ooxml_extn_cb\n");

-    return ooxml_parse_document(fd, ctx);

-    //return ooxml_basic_json(fd, ctx, "ExtendedProperties");

+    ret = ooxml_parse_document(fd, ctx);

+    if (ret == CL_EPARSE)

+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_EXTN_XMLPARSER");

+    else if (ret == CL_EFORMAT)

+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_EXTN_MALFORMED");

+

+    return ret;

 }

 static int ooxml_content_cb(int fd, cli_ctx *ctx)

 {

-    int ret = CL_SUCCESS, tmp, toval = 0;

+    int ret = CL_SUCCESS, tmp, toval = 0, state;

     int core=0, extn=0, cust=0, dsig=0;

     int mcore=0, mextn=0, mcust=0;

     const xmlChar *name, *value, *CT, *PN;

     xmlTextReaderPtr reader = NULL;

     uint32_t loff;

+    unsigned long sav_scansize = ctx->scansize;

+    unsigned int sav_scannedfiles = ctx->scannedfiles;

+

     cli_dbgmsg("in ooxml_content_cb\n");

+    /* perform engine limit checks in temporary tracking session */

+    ret = ooxml_updatelimits(fd, ctx);

+    if (ret != CL_CLEAN)

+        return ret;

+

+    /* apply a reader to the document */

     reader = xmlReaderForFd(fd, "[Content_Types].xml", NULL, CLAMAV_MIN_XMLREADER_FLAGS);

     if (reader == NULL) {

         cli_dbgmsg("ooxml_content_cb: xmlReaderForFd error for ""[Content_Types].xml""\n");

+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_XML_READER_FD");

+

+        ctx->scansize = sav_scansize;

+        ctx->scannedfiles = sav_scannedfiles;

         return CL_SUCCESS; // libxml2 failed!

     }

-    /* locate core-properties, extended-properties, and custom-properties (optional)  */

-    while (xmlTextReaderRead(reader) == 1) {

+    /* locate core-properties, extended-properties, and custom-properties (optional) */

+    while ((state = xmlTextReaderRead(reader)) == 1) {

         if (cli_json_timeout_cycle_check(ctx, &toval) != CL_SUCCESS) {

             ret = CL_ETIMEOUT;

             goto ooxml_content_exit;

@@ -480,93 +539,116 @@ static int ooxml_content_cb(int fd, cli_ctx *ctx)

         if (!CT && !PN) continue;

         if (!xmlStrcmp(CT, (const xmlChar *)"application/vnd.openxmlformats-package.core-properties+xml")) {

-            if (!core) {

-                /* default: /docProps/core.xml*/

-                tmp = unzip_search_single(ctx, (const char *)(PN+1), xmlStrlen(PN)-1, &loff);

-                if (tmp == CL_ETIMEOUT) {

-                    ret = tmp;

-                }

-                else if (tmp != CL_VIRUS) {

-                    cli_dbgmsg("cli_process_ooxml: failed to find core properties file \"%s\"!\n", PN);

-                    mcore++;

-                }

-                else {

-                    cli_dbgmsg("ooxml_content_cb: found core properties file \"%s\" @ %x\n", PN, loff);

-                    ret = unzip_single_internal(ctx, loff, ooxml_core_cb);

-                    core++;

+            /* default: /docProps/core.xml*/

+            tmp = unzip_search_single(ctx, (const char *)(PN+1), xmlStrlen(PN)-1, &loff);

+            if (tmp == CL_ETIMEOUT) {

+                ret = tmp;

+            }

+            else if (tmp != CL_VIRUS) {

+                cli_dbgmsg("cli_process_ooxml: failed to find core properties file \"%s\"!\n", PN);

+                mcore++;

+            }

+            else {

+                cli_dbgmsg("ooxml_content_cb: found core properties file \"%s\" @ %x\n", PN, loff);

+                if (!core) {

+                    tmp = unzip_single_internal(ctx, loff, ooxml_core_cb);

+                    if (tmp == CL_ETIMEOUT || tmp == CL_EMEM) {

+                        ret = tmp;

+                    }

                 }

+                core++;

             }

         }

         else if (!xmlStrcmp(CT, (const xmlChar *)"application/vnd.openxmlformats-officedocument.extended-properties+xml")) {

-            if (!extn) {

-                /* default: /docProps/app.xml */

-                tmp = unzip_search_single(ctx, (const char *)(PN+1), xmlStrlen(PN)-1, &loff);

-                if (tmp == CL_ETIMEOUT) {

-                    ret = tmp;

-                }

-                else if (tmp != CL_VIRUS) {

-                    cli_dbgmsg("cli_process_ooxml: failed to find extended properties file \"%s\"!\n", PN);

-                    mextn++;

-                }

-                else {

-                    cli_dbgmsg("ooxml_content_cb: found extended properties file \"%s\" @ %x\n", PN, loff);

-                    ret = unzip_single_internal(ctx, loff, ooxml_extn_cb);

-                    extn++;

+            /* default: /docProps/app.xml */

+            tmp = unzip_search_single(ctx, (const char *)(PN+1), xmlStrlen(PN)-1, &loff);

+            if (tmp == CL_ETIMEOUT) {

+                ret = tmp;

+            }

+            else if (tmp != CL_VIRUS) {

+                cli_dbgmsg("cli_process_ooxml: failed to find extended properties file \"%s\"!\n", PN);

+                mextn++;

+            }

+            else {

+                cli_dbgmsg("ooxml_content_cb: found extended properties file \"%s\" @ %x\n", PN, loff);

+                if (!extn) {

+                    tmp = unzip_single_internal(ctx, loff, ooxml_extn_cb);

+                    if (tmp == CL_ETIMEOUT || tmp == CL_EMEM) {

+                        ret = tmp;

+                    }

                 }

+                extn++;