@@ -1,3 +1,8 @@

+

+Thu Oct 17 16:50:00 2013 EDT 2013 (morgan)

+------------------------------------

+ * libclamav: bb#6348 - Add file type recognition for Office Open XML.

+

 Tue Oct 15 16:03:25 2013 EDT 2013 (dar)

 ------------------------------------

  * libclamav: bb #9154 - ELF handling re-write

@@ -6,10 +11,18 @@ Tue Oct 15 16:00:14 2013 EDT 2013 (dar)

 ------------------------------------

  * libclamav: bb #8696 - Bug reported by NIW Solutions

+Mon Oct 14 17:07:40 2013 EDT 2013 (morgan)

+------------------------------------

+ * bb #8209 - move perror()'s so they will work. Patches supplied by Bill Parker.

+

 Fri Oct 11 16:50:34 2013 EDT 2013 (dar)

 ------------------------------------

  * bb #9072: clamscan message separator fix

+Tue Oct 8 17:17:44 EDT 2013 (morgan)

+------------------------------------

+ * libclamav: Add support for XZ file type recognition and decompression.

+

 Thu Oct 3 10:49:11 2013 EDT 2013 (dar)

 ------------------------------------

  * bb #1570: Support ADC compression in DMG

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2007-2008 Sourcefire, Inc.

+ *  Copyright (C) 2007-2013 Sourcefire, Inc.

  *

  *  Authors: Tomasz Kojm

  *

@@ -43,6 +43,8 @@

 #include "htmlnorm.h"

 #include "entconv.h"

 #include "mpool.h"

+#define UNZIP_PRIVATE

+#include "unzip.h"

 static const struct ftmap_s {

     const char *name;

@@ -106,6 +108,9 @@ static const struct ftmap_s {

     { "CL_TYPE_PART_ANY",	CL_TYPE_PART_ANY	},

     { "CL_TYPE_PART_HFSPLUS",	CL_TYPE_PART_HFSPLUS	},

     { "CL_TYPE_XZ",     	CL_TYPE_XZ      	},

+    { "CL_TYPE_OOXML_WORD",	CL_TYPE_OOXML_WORD     	},

+    { "CL_TYPE_OOXML_PPT",	CL_TYPE_OOXML_PPT     	},

+    { "CL_TYPE_OOXML_XL",	CL_TYPE_OOXML_XL     	},

     { NULL,			CL_TYPE_IGNORED		}

 };

@@ -244,7 +249,40 @@ cli_file_t cli_filetype2(fmap_t *map, const struct cl_engine *engine, cli_file_t

 		    cli_dbgmsg("Recognized POSIX tar file\n");

 		    return CL_TYPE_POSIX_TAR;

 	    }

-	}

+	} else if (ret == CL_TYPE_ZIP) {

+            const char lhdr_magic[4] = {0x50,0x4b,0x03,0x04};

+            const unsigned char * zbuff;

+            long zread, zoff = SIZEOF_LH;

+            int lhc = 1;

+

+            zbuff = buff + SIZEOF_LH;

+            zread = bread - SIZEOF_LH;

+

+            do {                

+                long zc = zread;

+                const char * zlh;

+                const unsigned char * zp = zbuff;

+               

+                while (zc > SIZEOF_LH && (zlh = cli_memstr(zp, zc, lhdr_magic, 4))) {

+                    lhc++;

+                    zp = zlh + SIZEOF_LH;

+                    zc = zp - zbuff;

+                    if (0 == memcmp(zp, "word/", 5)) {

+                        cli_dbgmsg("Recognized OOXML Word file\n");

+                        return CL_TYPE_OOXML_WORD;

+                    } else if (0 == memcmp(zp, "ppt/", 4)) {

+                        cli_dbgmsg("Recognized OOXML PPT file\n");

+                        return CL_TYPE_OOXML_PPT;                        

+                    } else if (0 == memcmp(zp, "xl/", 3)) {

+                        cli_dbgmsg("Recognized OOXML XL file\n");

+                        return CL_TYPE_OOXML_XL;

+                    }

+                    //cli_dbgmsg("zip file name:%.10s\n", zp); 

+                }

+                zoff += zread - SIZEOF_LH;

+                zread = MIN(MAGIC_BUFFER_SIZE, map->len-zoff);

+            } while (lhc < 3 && (zbuff = fmap_need_off_once(map, zoff, zread)));

+        }

     }

     if(ret >= CL_TYPE_TEXT_ASCII && ret <= CL_TYPE_BINARY_DATA) {

@@ -80,6 +80,9 @@ typedef enum {

     CL_TYPE_JAVA,

     CL_TYPE_XAR,

     CL_TYPE_XZ,

+    CL_TYPE_OOXML_WORD,

+    CL_TYPE_OOXML_PPT,

+    CL_TYPE_OOXML_XL,

     /* Section for partition types */

     CL_TYPE_PART_ANY, /* unknown partition type */

@@ -2540,6 +2540,9 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)

 	    }

 	    break;

+        case CL_TYPE_OOXML_WORD:

+        case CL_TYPE_OOXML_PPT:

+        case CL_TYPE_OOXML_XL:

 	case CL_TYPE_ZIP:

 	    ctx->container_type = CL_TYPE_ZIP;

 	    if(SCAN_ARCHIVE && (DCONF_ARCH & ARCH_CONF_ZIP))