@@ -1,3 +1,7 @@

+Sun Mar 21 17:30:22 GMT 2004 (njh)

+----------------------------------

+  * libclamav:	Scan bounce messages with no headers for encoded viruses/worms

+

 Sun Mar 21 09:51:45 GMT 2004 (njh)

 ----------------------------------

   * libclamav:	Faster scanning for non MIME messages, only scan the message

@@ -17,6 +17,9 @@

  *

  * Change History:

  * $Log: mbox.c,v $

+ * Revision 1.57  2004/03/21 17:19:49  nigelhorne

+ * Handle bounce messages with no headers

+ *

  * Revision 1.56  2004/03/21 09:41:26  nigelhorne

  * Faster scanning for non MIME messages

  *

@@ -159,7 +162,7 @@

  * Compilable under SCO; removed duplicate code with message.c

  *

  */

-static	char	const	rcsid[] = "$Id: mbox.c,v 1.56 2004/03/21 09:41:26 nigelhorne Exp $";

+static	char	const	rcsid[] = "$Id: mbox.c,v 1.57 2004/03/21 17:19:49 nigelhorne Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

@@ -989,7 +992,7 @@ parseEmailBody(message *messageIn, blob **blobsIn, int nBlobs, text *textIn, con

 						break;

 					case MESSAGE:

 						cli_dbgmsg("Found message inside multipart\n");

-						if(messageIsAllText(aMessage))

+						if(encodingLine(aMessage) == NULL)

 							continue;

 						body = parseEmailHeaders(aMessage, rfc821Table);

@@ -1361,7 +1364,7 @@ parseEmailBody(message *messageIn, blob **blobsIn, int nBlobs, text *textIn, con

 					}

 					blobDestroy(b);

 				}

-			} else if((!messageIsAllText(mainMessage)) &&

+			} else if((encodingLine(mainMessage) != NULL) &&

 				  ((t_line = bounceBegin(mainMessage)) != NULL)) {

 				/*

 				 * Attempt to save the original (unbounced)

@@ -1393,9 +1396,33 @@ parseEmailBody(message *messageIn, blob **blobsIn, int nBlobs, text *textIn, con

 					 * content encoding statement don't

 					 * bother saving to scan, it's safe

 					 */

-					saveIt = !messageIsAllText(mainMessage);

-				else

+					saveIt = (encodingLine(mainMessage) != NULL);

+				else if((t_line = encodingLine(mainMessage)) != NULL) {

+					/*

+					 * Some bounces include the message

+					 * body without the headers

+					 */

+					if((b = blobCreate()) != NULL) {

+						cli_dbgmsg("Found a bounce message with no header\n");

+						blobAddData(b, "Received: by clamd\n", 19);

+						do {

+							blobAddData(b, (unsigned char *)t_line->t_text, strlen(t_line->t_text));

+							blobAddData(b, (unsigned char *)"\n", 1);

+						} while((t_line = t_line->t_next) != NULL);

+

+						saveFile(b, dir);

+

+						blobDestroy(b);

+					}

+					saveIt = FALSE;

+				} else {

+					/*

+					 * Save the entire text portion,

+					 * since it it may be an HTML

+					 * file with a JavaScript virus

+					 */

 					saveIt = TRUE;

+				}

 				if(saveIt) {

 					cli_dbgmsg("Saving text part to scan\n");

@@ -17,6 +17,9 @@

  *

  * Change History:

  * $Log: message.c,v $

+ * Revision 1.47  2004/03/21 17:19:49  nigelhorne

+ * Handle bounce messages with no headers

+ *

  * Revision 1.46  2004/03/21 09:41:27  nigelhorne

  * Faster scanning for non MIME messages

  *

@@ -135,7 +138,7 @@

  * uuencodebegin() no longer static

  *

  */

-static	char	const	rcsid[] = "$Id: message.c,v 1.46 2004/03/21 09:41:27 nigelhorne Exp $";

+static	char	const	rcsid[] = "$Id: message.c,v 1.47 2004/03/21 17:19:49 nigelhorne Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

@@ -1251,10 +1254,10 @@ messageIsAllText(const message *m)

 	return 1;

 }

 #else

-int

-messageIsAllText(const message *m)

+const text *

+encodingLine(const message *m)

 {

-	return (m->encoding == NULL);

+	return m->encoding;

 }

 #endif

@@ -1475,7 +1478,7 @@ base64(char c)

 		return 62;

 	if(c != '/')

-		cli_warnmsg("Illegal character <%c> in base64 encoding\n", c);

+		cli_dbgmsg("Illegal character <%c> in base64 encoding\n", c);

 	return 63;

 }

@@ -16,6 +16,9 @@

  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

  *

  * $Log: message.h,v $

+ * Revision 1.7  2004/03/21 17:19:49  nigelhorne

+ * Handle bounce messages with no headers

+ *

  * Revision 1.6  2004/03/21 09:41:27  nigelhorne

  * Faster scanning for non MIME messages

  *

@@ -70,6 +73,6 @@ text	*messageToText(const message *m);

 const	text	*uuencodeBegin(const message *m);

 const	text	*binhexBegin(const message *m);

 const	text	*bounceBegin(const message *m);

-int	messageIsAllText(const message *m);

+const	text	*encodingLine(const message *m);

 #endif	/*_MESSAGE_H*/