@@ -1,3 +1,8 @@

+Tue May 27 17:39:06 CEST 2008

+-----------------------------

+  * improve handling of PDF, CAB, RTF, OLE2 and HTML files (sync with

+    branch/0.93)

+

 Sat May 24 21:38:47 EEST 2008 (edwin)

 -------------------------------------

   * clamd/others.c, session.c, m4/fdpassing.m4:

@@ -1167,6 +1167,7 @@ main(int argc, char **argv)

 			memset(&ifr, '\0', sizeof(struct ifreq));

 			strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name) - 1);

+			ifr.ifr_name[sizeof(ifr.ifr_name)-1]='\0';

 			if(setsockopt(broadcastSock, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) < 0) {

 				perror(iface);

 				return EX_CONFIG;

@@ -1515,6 +1516,7 @@ main(int argc, char **argv)

 		memset((char *)&sockun, 0, sizeof(struct sockaddr_un));

 		sockun.sun_family = AF_UNIX;

 		strncpy(sockun.sun_path, localSocket, sizeof(sockun.sun_path));

+		sockun.sun_path[sizeof(sockun.sun_path)-1]='\0';

 		sessions = (struct session *)cli_malloc(sizeof(struct session));

 		if((sessions[0].sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {

@@ -2197,6 +2199,7 @@ pingServer(int serverNumber)

 		memset((char *)&server, 0, sizeof(struct sockaddr_un));

 		server.sun_family = AF_UNIX;

 		strncpy(server.sun_path, localSocket, sizeof(server.sun_path));

+		server.sun_path[sizeof(server.sun_path)-1]='\0';

 		if((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {

 			perror(localSocket);

@@ -2749,6 +2752,7 @@ clamfi_connect(SMFICTX *ctx, char *hostname, _SOCK_ADDR *hostaddr)

 		}

 #else

 		strncpy(ip, (char *)inet_ntoa(*(struct in_addr *)hostent.h_addr), sizeof(ip));

+		ip[sizeof(ip)-1]='\0';

 #endif

 		/*

@@ -3409,6 +3413,7 @@ clamfi_eom(SMFICTX *ctx)

 		memset((char *)&server, 0, sizeof(struct sockaddr_un));

 		server.sun_family = AF_UNIX;

 		strncpy(server.sun_path, localSocket, sizeof(server.sun_path));

+		server.sun_path[sizeof(server.sun_path)-1]='\0';

 		if(connect(privdata->cmdSocket, (struct sockaddr *)&server, sizeof(struct sockaddr_un)) < 0) {

 			perror(localSocket);

@@ -3530,19 +3535,20 @@ clamfi_eom(SMFICTX *ctx)

 				const char *j = smfi_getsymval(ctx, "{j}");

 				if(j)

-					strncpy(hostname, j,

-						sizeof(hostname) - 1);

+					strncpy(hostname, j, sizeof(hostname) - 1);

 				else

 					strcpy(hostname, _("Error determining host"));

+				hostname[sizeof(hostname)-1]='\0';

 			} else if(strchr(hostname, '.') == NULL) {

 				/*

 				 * Determine fully qualified name

 				 */

 				struct hostent hostent;

-				if((r_gethostbyname(hostname, &hostent, buf, sizeof(buf)) == 0) &&

-				   hostent.h_name)

+				if((r_gethostbyname(hostname, &hostent, buf, sizeof(buf)) == 0) && hostent.h_name) {

 					strncpy(hostname, hostent.h_name, sizeof(hostname));

+					hostname[sizeof(hostname)-1]='\0';

+				}

 			}

 #ifdef	SESSION

@@ -4557,6 +4563,7 @@ connect2clamd(struct privdata *privdata)

 			memset((char *)&server, 0, sizeof(struct sockaddr_un));

 			server.sun_family = AF_UNIX;

 			strncpy(server.sun_path, localSocket, sizeof(server.sun_path));

+			server.sun_path[sizeof(server.sun_path)-1]='\0';

 			if((privdata->cmdSocket = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {

 				perror("socket");

@@ -6405,6 +6412,7 @@ spf(struct privdata *privdata, table_t *prevhosts)

 			continue;

 		}

 		strncpy(txt, (const char *)&p[1], sizeof(txt) - 1);

+		txt[sizeof(txt)-1]='\0';

 		txt[len - 1] = '\0';

 		if((strncmp(txt, "v=spf1 ", 7) == 0) || (strncmp(txt, "spf2.0/pra ", 11) == 0)) {

 			int j;

@@ -173,11 +173,13 @@ int dazukoRegister_TS(dazuko_id_t **dazuko_id, const char *groupName, const char

 	if (strcasecmp(mode, "r") == 0)

 	{

 		strncpy(regMode, "R", sizeof(regMode));

+		regMode[sizeof(regMode)-1]='\0';

 		write_mode = 0;

 	}

 	else if (strcasecmp(mode, "r+") == 0 || strcasecmp(mode, "rw") == 0)

 	{

 		strncpy(regMode, "RW", sizeof(regMode));

+		regMode[sizeof(regMode)-1]='\0';

 		write_mode = 1;

 	}

 	else

@@ -116,6 +116,7 @@ int dazukoRegister_TS_compat12(struct dazuko_id *dazuko, const char *groupName)

 	opt->command = REGISTER;

 	strncpy(opt->buffer, groupName, sizeof(opt->buffer) - 1);

+	opt->buffer[sizeof(opt->buffer)-1]='\0';

 	opt->buffer_length = strlen(opt->buffer) + 1;

 	if (ioctl(dazuko->device, _IOW(dazuko->dev_major, IOCTL_SET_OPTION, void *), opt) != 0)

@@ -186,6 +187,7 @@ int dazuko_set_path_compat12(struct dazuko_id *dazuko, const char *path, int com

 	opt->command = command;

 	strncpy(opt->buffer, path, sizeof(opt->buffer) - 1);

+	opt->buffer[sizeof(opt->buffer)-1]='\0';

 	opt->buffer_length = strlen(opt->buffer) + 1;

 	if (ioctl(dazuko->device, _IOW(dazuko->dev_major, IOCTL_SET_OPTION, void *), opt) != 0)

@@ -64,6 +64,7 @@ int localserver(const struct cfgstruct *copt)

     memset((char *) &server, 0, sizeof(server));

     server.sun_family = AF_UNIX;

     strncpy(server.sun_path, cfgopt(copt, "LocalSocket")->strarg, sizeof(server.sun_path));

+    server.sun_path[sizeof(server.sun_path)-1]='\0';

     if((sockfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {

 	estr = strerror(errno);

@@ -376,6 +376,8 @@ int readsock(int sockfd, char *buf, size_t size, unsigned char delim, int timeou

 		break;

 	    } else {

 		n = recv(sockfd, buf+boff, n, 0);

+		if(n < 0)

+		    return -1;

 		if((boff+n) == size)

 		    break;

 		boff += n;

@@ -284,6 +284,7 @@ static int dconnect(const struct optstruct *opt)

 	server.sun_family = AF_UNIX;

 	strncpy(server.sun_path, cpt->strarg, sizeof(server.sun_path));

+	server.sun_path[sizeof(server.sun_path)-1]='\0';

 	if((sockd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {

 	    perror("socket()");

@@ -226,6 +226,7 @@ int scanmanager(const struct optstruct *opt)

 	if(tolower(ptr[strlen(ptr) - 1]) == 'm') {

 	    cpy = calloc(strlen(ptr), 1);

 	    strncpy(cpy, ptr, strlen(ptr) - 1);

+	    cpy[strlen(ptr)-1]='\0';

 	    limits.maxscansize = atoi(cpy) * 1024 * 1024;

 	    free(cpy);

 	} else

@@ -239,6 +240,7 @@ int scanmanager(const struct optstruct *opt)

 	if(tolower(ptr[strlen(ptr) - 1]) == 'm') {

 	    cpy = calloc(strlen(ptr), 1);

 	    strncpy(cpy, ptr, strlen(ptr) - 1);

+	    cpy[strlen(ptr)-1]='\0';

 	    limits.maxfilesize = atoi(cpy) * 1024 * 1024;

 	    free(cpy);

 	} else

@@ -467,6 +469,7 @@ static int clamav_unpack(const char *prog, const char **args, const char *tmpdir

 	if(tolower(ptr[strlen(ptr) - 1]) == 'm') { /* megabytes */

 	    cpy = calloc(strlen(ptr), 1);

 	    strncpy(cpy, ptr, strlen(ptr) - 1);

+	    cpy[strlen(ptr)-1]='\0';

 	    maxscansize = atoi(cpy) * 1024;

 	    free(cpy);

 	} else /* default - kilobytes */

@@ -150,14 +150,17 @@ int match_regex(const char *filename, const char *pattern)

 #else

 	if(pattern[strlen(pattern) - 1] == '\\') {

 	    strncpy(fname, filename, 510);

+	    fname[509]='\0';

 	    len = strlen(fname);

 	    if(fname[len - 1] != '\\') {

 		fname[len] = '\\';

 		fname[len + 1] = 0;

 	    }

 #endif

-	} else

+	} else {

 	    strncpy(fname, filename, 513);

+	    fname[512]='\0';

+	}

 	match = (cli_regexec(&reg, fname, 0, NULL, 0) == REG_NOMATCH) ? 0 : 1;

 	cli_regfree(&reg);

@@ -73,6 +73,7 @@ int notify(const char *cfgfile)

 	socktype = "UNIX";

 	server.sun_family = AF_UNIX;

 	strncpy(server.sun_path, cpt->strarg, sizeof(server.sun_path));

+	server.sun_path[sizeof(server.sun_path)-1]='\0';

 	if((sockd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {

 	    logg("^Clamd was NOT notified: Can't create socket endpoint for %s\n", cpt->strarg);

@@ -122,7 +122,6 @@ static char *cab_readstr(int fd, int *ret)

     }

     if(lseek(fd, (off_t) (pos + i + 1), SEEK_SET) == -1) {

-	/* *ret = CL_EIO; */

 	*ret = CL_EFORMAT; /* most likely a corrupted file */

 	return NULL;

     }

@@ -136,15 +135,17 @@ static char *cab_readstr(int fd, int *ret)

     return str;

 }

-static int cab_chkname(const char *name)

+static int cab_chkname(char *name, int san)

 {

 	size_t i, len = strlen(name);

     for(i = 0; i < len; i++) {

-	if(strchr("%/*?|\\\"+=<>;:\t ", name[i]) || !isascii(name[i])) {

+	if(!san && (strchr("%/*?|\\\"+=<>;:\t ", name[i]) || !isascii(name[i]))) {

 	    cli_dbgmsg("cab_chkname: File name contains disallowed characters\n");

 	    return 1;

+	} else if(san && !isalnum(name[i])) {

+	    name[i] = '*';

 	}

     }

@@ -189,7 +190,7 @@ void cab_free(struct cab_archive *cab)

 int cab_open(int fd, off_t offset, struct cab_archive *cab)

 {

-	unsigned int i, bscore = 0, badname = 0;

+	unsigned int i, folders = 0;

 	struct cab_file *file, *lfile = NULL;

 	struct cab_folder *folder, *lfolder = NULL;

 	struct cab_hdr hdr;

@@ -210,7 +211,6 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

     if(cli_readn(fd, &hdr, sizeof(hdr)) != sizeof(hdr)) {

 	cli_dbgmsg("cab_open: Can't read cabinet header\n");

-	/* return CL_EIO; */

 	return CL_EFORMAT; /* most likely a corrupted file */

     }

@@ -232,8 +232,8 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

     cab->length = EC32(hdr.cbCabinet);

     cli_dbgmsg("CAB: Cabinet length: %u\n", cab->length);

     if((off_t) cab->length > rsize) {

+	cli_dbgmsg("CAB: Truncating file size from %lu to %lu\n", (unsigned long int) cab->length, (unsigned long int) rsize);

 	cab->length = (uint32_t) rsize;

-	bscore++;

     }

     cab->nfolders = EC16(hdr.cFolders);

@@ -245,7 +245,6 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	if(cab->nfolders > CAB_FOLDER_LIMIT) {

 	    cab->nfolders = CAB_FOLDER_LIMIT;

 	    cli_dbgmsg("CAB: *** Number of folders limited to %u ***\n", cab->nfolders);

-	    bscore++;

 	}

     }

@@ -258,19 +257,15 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	if(cab->nfiles > CAB_FILE_LIMIT) {

 	    cab->nfiles = CAB_FILE_LIMIT;

 	    cli_dbgmsg("CAB: *** Number of files limited to %u ***\n", cab->nfiles);

-	    bscore++;

 	}

     }

     cli_dbgmsg("CAB: File format version: %u.%u\n", hdr.versionMajor, hdr.versionMinor);

-    if(hdr.versionMajor != 1 || hdr.versionMinor != 3)

-	bscore++;

     cab->flags = EC16(hdr.flags);

     if(cab->flags & 0x0004) {

 	if(cli_readn(fd, &hdr_opt, sizeof(hdr_opt)) != sizeof(hdr_opt)) {

 	    cli_dbgmsg("cab_open: Can't read file header (fake cab?)\n");

-	    /* return CL_EIO; */

 	    return CL_EFORMAT; /* most likely a corrupted file */

 	}

@@ -281,7 +276,6 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	if(cab->reshdr) {

 	    if(lseek(fd, cab->reshdr, SEEK_CUR) == -1) {

 		cli_dbgmsg("cab_open: Can't lseek to %u (fake cab?)\n", cab->reshdr);

-		/* return CL_EIO; */

 		return CL_EFORMAT; /* most likely a corrupted file */

 	    }

 	}

@@ -292,8 +286,8 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	pt = cab_readstr(fd, &ret);

 	if(ret)

 	    return ret;

-	if(cab_chkname(pt))

-	    badname = 1;

+	if(cab_chkname(pt, 0))

+	    cli_dbgmsg("CAB: Invalid name of preceeding cabinet\n");

 	else

 	    cli_dbgmsg("CAB: Preceeding cabinet name: %s\n", pt);

 	free(pt);

@@ -301,8 +295,8 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	pt = cab_readstr(fd, &ret);

 	if(ret)

 	    return ret;

-	if(cab_chkname(pt))

-	    badname = 1;

+	if(cab_chkname(pt, 0))

+	    cli_dbgmsg("CAB: Invalid info for preceeding cabinet\n");

 	else

 	    cli_dbgmsg("CAB: Preceeding cabinet info: %s\n", pt);

 	free(pt);

@@ -313,8 +307,8 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	pt = cab_readstr(fd, &ret);

 	if(ret)

 	    return ret;

-	if(cab_chkname(pt))

-	    badname = 1;

+	if(cab_chkname(pt, 0))

+	    cli_dbgmsg("CAB: Invalid name of next cabinet\n");

 	else

 	    cli_dbgmsg("CAB: Next cabinet name: %s\n", pt);

 	free(pt);

@@ -322,37 +316,37 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	pt = cab_readstr(fd, &ret);

 	if(ret)

 	    return ret;

-	if(cab_chkname(pt))

-	    badname = 1;

+	if(cab_chkname(pt, 0))

+	    cli_dbgmsg("CAB: Invalid info for next cabinet\n");

 	else

 	    cli_dbgmsg("CAB: Next cabinet info: %s\n", pt);

 	free(pt);

     }

-    bscore += badname;

-

-    if(bscore >= 4) {

-	cli_dbgmsg("CAB: bscore == %u, most likely a fake cabinet\n", bscore);

-	return CL_EFORMAT;

-    }

     /* folders */

     for(i = 0; i < cab->nfolders; i++) {

 	if(cli_readn(fd, &folder_hdr, sizeof(folder_hdr)) != sizeof(folder_hdr)) {

-	    cli_errmsg("cab_open: Can't read header for folder %u\n", i);

-	    cab_free(cab);

-	    /* return CL_EIO; */

-	    return CL_EFORMAT; /* most likely a corrupted file */

+	    cli_dbgmsg("cab_open: Can't read header for folder %u\n", i);

+	    break;

 	}

 	if(resfold) {

 	    if(lseek(fd, resfold, SEEK_CUR) == -1) {

-		cli_errmsg("cab_open: Can't lseek to %u (resfold)\n", (unsigned int) resfold);

-		cab_free(cab);

-		/* return CL_EIO; */

-		return CL_EFORMAT; /* most likely a corrupted file */

+		cli_dbgmsg("cab_open: Can't lseek to %u (resfold)\n", (unsigned int) resfold);

+		break;

 	    }

 	}

+	if(EC32(folder_hdr.coffCabStart) + offset > rsize) {

+	    cli_dbgmsg("CAB: Folder out of file\n");

+	    continue;

+	}

+

+	if((EC16(folder_hdr.typeCompress) & 0x000f) > 3) {

+	    cli_dbgmsg("CAB: Unknown compression method\n");

+	    continue;

+	}

+

 	folder = (struct cab_folder *) cli_calloc(1, sizeof(struct cab_folder));

 	if(!folder) {

 	    cli_errmsg("cab_open: Can't allocate memory for folder\n");

@@ -362,16 +356,12 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	folder->cab = (struct cab_archive *) cab;

 	folder->offset = (off_t) EC32(folder_hdr.coffCabStart) + offset;

-	if(folder->offset > rsize)

-	    bscore++;

 	folder->nblocks = EC16(folder_hdr.cCFData);

 	folder->cmethod = EC16(folder_hdr.typeCompress);

 	cli_dbgmsg("CAB: Folder record %u\n", i);

 	cli_dbgmsg("CAB: Folder offset: %u\n", (unsigned int) folder->offset);

 	cli_dbgmsg("CAB: Folder compression method: %d\n", folder->cmethod);

-	if((folder->cmethod & 0x000f) > 3)

-	    bscore++;

 	if(!lfolder)

 	    cab->folders = folder;

@@ -379,27 +369,20 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	    lfolder->next = folder;

 	lfolder = folder;

-

-	if(bscore > 10) {

-	    cab_free(cab);

-	    cli_dbgmsg("CAB: bscore == %u, most likely a fake cabinet\n", bscore);

-	    return CL_EFORMAT;

-	}

+	folders++;

     }

+    cli_dbgmsg("CAB: Recorded folders: %u\n", folders);

     /* files */

+    if(cab->nfolders != folders && lseek(fd, EC16(hdr.coffFiles), SEEK_SET) == -1) {

+	cli_dbgmsg("cab_open: Can't lseek to hdr.coffFiles\n");

+	cab_free(cab);

+	return CL_EFORMAT;

+    }

     for(i = 0; i < cab->nfiles; i++) {

-	if(bscore > 10) {

-	    cab_free(cab);

-	    cli_dbgmsg("CAB: bscore == %u, most likely a fake cabinet\n", bscore);

-	    return CL_EFORMAT;

-	}

-

 	if(cli_readn(fd, &file_hdr, sizeof(file_hdr)) != sizeof(file_hdr)) {

-	    cli_errmsg("cab_open: Can't read file %u header\n", i);

-	    cab_free(cab);

-	    /* return CL_EIO; */

-	    return CL_EFORMAT; /* most likely a corrupted file */

+	    cli_dbgmsg("cab_open: Can't read file %u header\n", i);

+	    break;

 	}

 	file = (struct cab_file *) cli_calloc(1, sizeof(struct cab_file));

@@ -411,17 +394,18 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	file->cab = cab;

 	file->fd = fd;

-	file->length = EC32(file_hdr.cbFile);

 	file->offset = EC32(file_hdr.uoffFolderStart);

+	file->length = EC32(file_hdr.cbFile);

 	file->attribs = EC32(file_hdr.attribs);

 	fidx = EC32(file_hdr.iFolder);

+	file->error = CL_SUCCESS;

 	file->name = cab_readstr(fd, &ret);

 	if(ret) {

 	    free(file);

-	    cab_free(cab);

-	    return ret;

+	    continue;

 	}

+	cab_chkname(file->name, 1);

 	cli_dbgmsg("CAB: File record %u\n", i);

 	cli_dbgmsg("CAB: File name: %s\n", file->name);

@@ -444,9 +428,7 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 	/* folder index */

 	if(fidx < 0xfffd) {

 	    if(fidx > cab->nfolders) {

-		if(bscore < 3)

-		    cli_dbgmsg("cab_open: File %s is not associated with any folder\n", file->name);

-		bscore++;

+		cli_dbgmsg("cab_open: File %s is not associated with any folder\n", file->name);

 		free(file->name);

 		free(file);

 		continue;

@@ -457,11 +439,10 @@ int cab_open(int fd, off_t offset, struct cab_archive *cab)

 		file->folder = file->folder->next;

 	    if(!file->folder) {

-		cli_errmsg("cab_open: Folder not found for file %s\n", file->name);

+		cli_dbgmsg("cab_open: Folder not found for file %s\n", file->name);

 		free(file->name);

 		free(file);

-		cab_free(cab);

-		return CL_EFORMAT;

+		continue;

 	    }

 	} else {

@@ -490,13 +471,11 @@ static int cab_read_block(int fd, struct cab_state *state, uint16_t resdata)

     if(cli_readn(fd, &block_hdr, sizeof(block_hdr)) != sizeof(block_hdr)) {

 	cli_dbgmsg("cab_read_block: Can't read block header\n");

-	/* return CL_EIO; */

 	return CL_EFORMAT; /* most likely a corrupted file */

     }

     if(resdata && lseek(fd, (off_t) resdata, SEEK_CUR) == -1) {

 	cli_dbgmsg("cab_read_block: lseek failed\n");

-	/* return CL_EIO; */

 	return CL_EFORMAT; /* most likely a corrupted file */

     }

@@ -515,7 +494,6 @@ static int cab_read_block(int fd, struct cab_state *state, uint16_t resdata)

     if(cli_readn(fd, state->block, state->blklen) != state->blklen) {

 	cli_dbgmsg("cab_read_block: Can't read block data\n");

-	/* return CL_EIO; */

 	return CL_EFORMAT; /* most likely a corrupted file */

     }

@@ -530,6 +508,11 @@ static int cab_read(struct cab_file *file, unsigned char *buffer, int bytes)

 	uint16_t todo, left;

+    if((file->cab->state->blknum > file->folder->nblocks) && !file->lread) {

+	file->error = CL_BREAK;

+	return -1;

+    }

+

     todo = bytes;

     while(todo > 0) {

 	left = file->cab->state->end - file->cab->state->pt;

@@ -544,10 +527,8 @@ static int cab_read(struct cab_file *file, unsigned char *buffer, int bytes)

 	    todo -= left;

 	} else {

-	    if(file->cab->state->blknum++ >= file->folder->nblocks) {

-		file->error = CL_EFORMAT;

+	    if(file->cab->state->blknum++ >= file->folder->nblocks)

 		break;

-	    }

 	    file->error = cab_read_block(file->fd, file->cab->state, file->cab->resdata);

 	    if(file->error)

@@ -568,7 +549,7 @@ static int cab_read(struct cab_file *file, unsigned char *buffer, int bytes)

 	}

     }

-    return bytes - todo;

+    return file->lread = bytes - todo;

 }

 static int cab_unstore(struct cab_file *file, int bytes)

@@ -721,11 +702,14 @@ int cab_extract(struct cab_file *file, const char *name)

 	    break;

 	default:

-	    cli_warnmsg("CAB: Not supported compression method: 0x%x\n", file->folder->cmethod & 0x000f);

+	    cli_dbgmsg("CAB: Not supported compression method: 0x%x\n", file->folder->cmethod & 0x000f);

 	    ret = CL_EFORMAT;

     }

     close(file->ofd);

+    if(ret == CL_BREAK)

+	ret = CL_SUCCESS;

+

     return ret;

 }

@@ -54,6 +54,7 @@ struct cab_file {

     char *name;

     uint32_t length;

     int error;

+    int lread;

     int fd;

     int ofd;

     struct cab_folder *folder;

@@ -135,7 +135,7 @@ int is_tar(unsigned char *buf, unsigned int nbytes);

 cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 {

-	unsigned char smallbuff[MAGIC_BUFFER_SIZE + 1], *decoded, *bigbuff;

+	unsigned char buff[MAGIC_BUFFER_SIZE + 1], *decoded;

 	int bread, sret;

 	cli_file_t ret = CL_TYPE_BINARY_DATA;

 	struct cli_matcher *root;

@@ -147,12 +147,13 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 	return CL_TYPE_ERROR;

     }

-    memset(smallbuff, 0, sizeof(smallbuff));

-    bread = cli_readn(desc, smallbuff, MAGIC_BUFFER_SIZE);

+    memset(buff, 0, sizeof(buff));

+    bread = cli_readn(desc, buff, MAGIC_BUFFER_SIZE);

     if(bread == -1)

 	return CL_TYPE_ERROR;

+    buff[bread] = 0;

-    ret = cli_filetype(smallbuff, bread, engine);

+    ret = cli_filetype(buff, bread, engine);

     if(ret >= CL_TYPE_TEXT_ASCII && ret <= CL_TYPE_BINARY_DATA) {

 	/* HTML files may contain special characters and could be

@@ -165,7 +166,7 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 	if(cli_ac_initdata(&mdata, root->ac_partsigs, AC_DEFAULT_TRACKLEN))

 	    return ret;

-	sret = cli_ac_scanbuff(smallbuff, bread, NULL, engine->root[0], &mdata, 0, ret, desc, NULL, AC_SCAN_FT, NULL);

+	sret = cli_ac_scanbuff(buff, bread, NULL, engine->root[0], &mdata, 0, ret, desc, NULL, AC_SCAN_FT, NULL);

 	cli_ac_freedata(&mdata);

@@ -175,7 +176,7 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 	    if(cli_ac_initdata(&mdata, root->ac_partsigs, AC_DEFAULT_TRACKLEN))

 		return ret;

-	    decoded = (unsigned char *) cli_utf16toascii((char *) smallbuff, bread);

+	    decoded = (unsigned char *) cli_utf16toascii((char *) buff, bread);

 	    if(decoded) {

 		sret = cli_ac_scanbuff(decoded, strlen((char *) decoded), NULL, engine->root[0], &mdata, 0, CL_TYPE_TEXT_ASCII, desc, NULL, AC_SCAN_FT, NULL);

 		free(decoded);

@@ -190,11 +191,11 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

 		    /* check if we can autodetect this encoding.

 		     * If we can't don't try to detect HTML sig, since

 		     * we just tried that above, and failed */

-		    if((encoding = encoding_detect_bom(smallbuff, bread))) {

-			    unsigned char decodedbuff[sizeof(smallbuff)*2];

+		    if((encoding = encoding_detect_bom(buff, bread))) {

+			    unsigned char decodedbuff[sizeof(buff)*2];

 			    m_area_t in_area, out_area;

-			    in_area.buffer = (unsigned char *) smallbuff;

+			    in_area.buffer = (unsigned char *) buff;

 			    in_area.length = bread;

 			    in_area.offset = 0;

 			    out_area.buffer = decodedbuff;

@@ -227,38 +228,16 @@ cli_file_t cli_filetype2(int desc, const struct cl_engine *engine)

     }

     if(ret == CL_TYPE_BINARY_DATA) {

-

-	if(!(bigbuff = (unsigned char *) cli_calloc(37638 + 1, sizeof(unsigned char))))

-	    return ret;

-

-	lseek(desc, 0, SEEK_SET);

-	if((bread = cli_readn(desc, bigbuff, 37638)) > 0) {

-

-	    bigbuff[bread] = 0;

-

-	    switch(is_tar(bigbuff, bread)) {

-		case 1:

-		    ret = CL_TYPE_OLD_TAR;

-		    cli_dbgmsg("Recognized old fashioned tar file\n");

-		    break;

-		case 2:

-		    ret = CL_TYPE_POSIX_TAR;

-		    cli_dbgmsg("Recognized POSIX tar file\n");

-		    break;

-	    }

+	switch(is_tar(buff, bread)) {

+	    case 1:

+		ret = CL_TYPE_OLD_TAR;

+		cli_dbgmsg("Recognized old fashioned tar file\n");

+		break;

+	    case 2:

+		ret = CL_TYPE_POSIX_TAR;

+		cli_dbgmsg("Recognized POSIX tar file\n");

+		break;

 	}

-

-	if(ret == CL_TYPE_BINARY_DATA) {

-	    if(!memcmp(bigbuff + 32769, "CD001" , 5) || !memcmp(bigbuff + 37633, "CD001" , 5)) {

-		cli_dbgmsg("Recognized ISO 9660 CD-ROM data\n");

-		ret = CL_TYPE_IGNORED;

-	    } else if(!memcmp(bigbuff + 32776, "CDROM" , 5)) {

-		cli_dbgmsg("Recognized High Sierra CD-ROM data\n");

-		ret = CL_TYPE_IGNORED;

-	    }

-	}

-

-	free(bigbuff);

     }

     return ret;

@@ -315,6 +315,7 @@ int hashtab_insert(struct hashtable *s, const char* key, const size_t len, const

 				if(!thekey)

 					return CL_EMEM;

 				strncpy(thekey, key, len+1);

+				thekey[len]='\0';

 				element->key = thekey;

 				element->data = data;

 				element->len = len;

@@ -557,3 +558,26 @@ ssize_t hashset_toarray(const struct hashset* hs, uint32_t** array)

 	}

 	return j;

 }

+

+struct uniq *uniq_init(uint32_t count) {

+	struct uniq *U;

+	if(!count) return NULL;

+ 	count = count <= 256 ? 256 : count + (count*20/100);

+	U = (struct uniqueid *)cli_calloc(1, sizeof(U)+sizeof(uint32_t)*count);

+	if(!U) return NULL;

+	U->count = count;

+	return U;

+}

+

+uint32_t uniq_add(struct uniq *U, const char *key, uint32_t key_len, uint32_t *rhash) {

+	uint32_t h = hash((const unsigned char *)key, key_len, U->count);

+	if(rhash) *rhash = h;

+	return U->uniques[h]++;

+}

+

+uint32_t uniq_get(struct uniq *U, const char *key, uint32_t key_len, uint32_t *rhash) {

+	uint32_t h = hash((const unsigned char *)key, key_len, U->count);

+	if(rhash) *rhash = h;

+	return U->uniques[h];

+}

+

@@ -20,11 +20,11 @@

  *  MA 02110-1301, USA.

  */

-#include <stdio.h>

-#include <stddef.h>

 #ifndef _HASHTAB_H

 #define _HASHTAB_H

-

+#include <stdio.h>

+#include <stddef.h>

+#include "cltypes.h"

 typedef long element_data;

 /* define this for debugging/profiling purposes only, NOT in production/release code */

@@ -105,5 +105,17 @@ int hashset_clear(struct hashset* hs);

 void hashset_destroy(struct hashset* hs);

 ssize_t hashset_toarray(const struct hashset* hs, uint32_t** array);

+

+/* A basic storage for unique IDs */

+struct uniq {

+	uint32_t count;

+        uint32_t uniques[];

+};

+

+struct uniq *uniq_init(uint32_t);

+#define uniq_free(X) free(X);

+uint32_t uniq_add(struct uniq *, const char *, uint32_t, uint32_t *);

+uint32_t uniq_get(struct uniq *, const char *, uint32_t, uint32_t *);

+

 #endif

@@ -555,7 +555,7 @@ static int cli_html_normalise(int fd, m_area_t *m_area, const char *dirname, tag

 		/* this will still contains scripts that are inside comments */

 		snprintf(filename, 1024, "%s/nocomment.html", dirname);

 		file_buff_o2->fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, S_IWUSR|S_IRUSR);

-		if (!file_buff_o2->fd) {

+		if (file_buff_o2->fd == -1) {

 			cli_dbgmsg("open failed: %s\n", filename);

 			free(file_buff_o2);

 			file_buff_o2 = file_buff_text = NULL;

@@ -564,6 +564,7 @@ static int cli_html_normalise(int fd, m_area_t *m_area, const char *dirname, tag

 		file_buff_text = (file_buff_t *) cli_malloc(sizeof(file_buff_t));

 		if(!file_buff_text) {

+			close(file_buff_o2->fd);

 			free(file_buff_o2);

 			file_buff_o2 = file_buff_text = NULL;

 			goto abort;

@@ -571,12 +572,13 @@ static int cli_html_normalise(int fd, m_area_t *m_area, const char *dirname, tag

 		snprintf(filename, 1024, "%s/notags.html", dirname);

 		file_buff_text->fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, S_IWUSR|S_IRUSR);

-		if(!file_buff_text->fd) {

+		if(file_buff_text->fd == -1) {

 			cli_dbgmsg("open failed: %s\n", filename);

 			close(file_buff_o2->fd);

 			free(file_buff_o2);

 			free(file_buff_text);

 			file_buff_o2 = file_buff_text = NULL;

+			goto abort;

 		}

 		file_buff_o2->length = 0;

 		file_buff_text->length = 0;

@@ -74,6 +74,7 @@ CLAMAV_PRIVATE {

     cli_warnmsg;

     cli_strtokbuf;

     cli_leavetemps_flag;

+    uniq_get;

   local:

     *;

 };

@@ -1079,6 +1079,7 @@ int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hex

 	return CL_EMEM;

     }

     strncpy(new->virname, virname, namelen);

+    new->virname[namelen]='\0';

     if(offset) {

 	new->offset = cli_strdup(offset);

@@ -104,7 +104,7 @@ static const unsigned short mszip_bit_mask_tab[17] = {

       if (mszip_read_input(zip)) return zip->error;                      \

       i_ptr = zip->i_ptr;                                               \

       i_end = zip->i_end;                                               \

-      if(i_ptr == i_end) return CL_EFORMAT;				\

+      if(i_ptr == i_end) break;						\

     }                                                                   \

     bit_buffer |= *i_ptr++ << bits_left; bits_left  += 8;               \

   }                                                                     \

@@ -125,7 +125,12 @@ static const unsigned short mszip_bit_mask_tab[17] = {

 static int mszip_read_input(struct mszip_stream *zip) {

   int nread = zip->read_cb ? zip->read_cb(zip->file, zip->inbuf, (int)zip->inbuf_size) : cli_readn(zip->fd, zip->inbuf, (int)zip->inbuf_size);

-  if (nread < 0) return zip->error = CL_EFORMAT;

+  if (nread < 0) {

+    if (zip->file->error == CL_BREAK)

+      return zip->error = CL_BREAK;

+    else

+      return zip->error = CL_EFORMAT;

+  }

   zip->i_ptr = &zip->inbuf[0];

   zip->i_end = &zip->inbuf[nread];

@@ -749,7 +754,12 @@ void mszip_free(struct mszip_stream *zip) {

 static int lzx_read_input(struct lzx_stream *lzx) {

   int bread = lzx->read_cb ? lzx->read_cb(lzx->file, &lzx->inbuf[0], (int)lzx->inbuf_size) : cli_readn(lzx->fd, &lzx->inbuf[0], (int)lzx->inbuf_size);

-  if (bread < 0) return lzx->error = CL_EFORMAT;

+  if (bread < 0) {

+    if (lzx->file->error == CL_BREAK)

+      return lzx->error = CL_BREAK;

+    else

+      return lzx->error = CL_EFORMAT;

+  }

   /* huff decode's ENSURE_BYTES(16) might overrun the input stream, even

    * if those bits aren't used, so fake 2 more bytes */

@@ -1577,7 +1587,12 @@ void lzx_free(struct lzx_stream *lzx) {

 static int qtm_read_input(struct qtm_stream *qtm) {

   int nread = qtm->read_cb ? qtm->read_cb(qtm->file, &qtm->inbuf[0], (int)qtm->inbuf_size) : cli_readn(qtm->fd, &qtm->inbuf[0], (int)qtm->inbuf_size);

-  if (nread < 0) return qtm->error = CL_EFORMAT;

+  if (nread < 0) {

+    if (qtm->file->error == CL_BREAK)

+      return qtm->error = CL_BREAK;

+    else

+      return qtm->error = CL_EFORMAT;

+  }

   qtm->i_ptr = &qtm->inbuf[0];

   qtm->i_end = &qtm->inbuf[nread];

@@ -47,9 +47,10 @@

 #include "cltypes.h"

 #include "others.h"

 #include "ole2_extract.h"

+#include "scanners.h"

+#include "hashtab.h"

 #include "mbox.h"

-#include "blob.h" /* sanitiseName() */

 #define ole2_endian_convert_16(v) le16_to_host((uint16_t)(v))

 #define ole2_endian_convert_32(v) le32_to_host((uint32_t)(v))

@@ -70,6 +71,7 @@

 #define	O_BINARY	0

 #endif

+

 typedef struct ole2_header_tag

 {

 	unsigned char magic[8];		/* should be: 0xd0cf11e0a1b11ae1 */

@@ -102,8 +104,11 @@ typedef struct ole2_header_tag

 	unsigned char *m_area;

 	off_t m_length;

 	bitset_t *bitset;

+	struct uniq *U;

+	int has_vba;

 } ole2_header_t;

+

 typedef struct property_tag

 {

 	char name[64];		/* in unicode */

@@ -136,7 +141,8 @@ typedef struct property_tag

 static unsigned char magic_id[] = { 0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1};

-static char *get_property_name(char *name, int size)

+

+static char *get_property_name2(char *name, int size)

 {