@@ -9,6 +9,10 @@ ClamAV 0.102.1 is a security patch release to address the following issues.

 ### Bug fixes

+- Introduced a new configure option to statically link libjson-c with libclamav.

+  Static linking with libjson is highly recommended to prevent crashes in

+  applications that use libclamav alongside another JSON parsing library.

+

 ### Acknowledgements

 The ClamAV team thanks the following individuals for their code submissions:

@@ -301,7 +301,7 @@ if test "x$enable_libclamav_only" != "xyes"; then

     fi

     if test "X$have_json" = "Xyes"; then

-        CL_MSG_STATUS([clamsubmit  ], [yes (libjson-c-dev found at $LIBJSON_HOME)], [yes])

+        CL_MSG_STATUS([clamsubmit  ], [yes (libjson-c-dev found at $LIBJSON_HOME, linking=$json_linking)], [yes])

     else

         CL_MSG_STATUS([clamsubmit  ], [no (missing libjson-c-dev. Use the website to submit FPs/FNs.)], [no])

     fi

@@ -341,7 +341,7 @@ else

 fi

 CL_MSG_STATUS([unrar       ],[$want_unrar],[$want_unrar])

 if test "X$have_json" = "Xyes"; then

-    CL_MSG_STATUS([preclass    ],[yes (libjson-c-dev found at $LIBJSON_HOME)],[yes])

+    CL_MSG_STATUS([preclass    ],[yes (libjson-c-dev found at $LIBJSON_HOME, linking=$json_linking)],[yes])

 else

     CL_MSG_STATUS([preclass    ],[no (missing libjson-c-dev)],[no])

 fi

@@ -364,21 +364,29 @@ CL_MSG_STATUS([fts         ],[yes],[$lfs_fts_msg])

 # 4.0.x, and 4.1.0 are the known buggy versions

 # 3.4 doesn't have the bug

 if test "x$gcc_check" != "xyes"; then

-	AC_MSG_WARN([

+    AC_MSG_WARN([

 ****** Optimizations disabled to avoid compiler bugs

 ****** The resulting binaries will be slow!

 ****** It is recommended to either upgrade or downgrade your compiler

-])

+    ])

 fi

 if test "x$cross_compiling" != "xno" || test "x$gcc_check" != "xyes" || test "x$bzip_check" != "xok" ; then

-AC_MSG_WARN([

+    AC_MSG_WARN([

 ****** WARNING:

 ****** You are cross compiling to a different host or you are

 ****** linking to bugged system libraries or you have manually

 ****** disabled important configure checks.

 ****** Please be aware that this build may be badly broken.

 ****** DO NOT REPORT BUGS BASED ON THIS BUILD !!!

-])

+    ])

 fi

+if test "X$have_json" = "Xyes" && test "x$json_linking" = "xdynamic"; then

+    AC_MSG_WARN([

+****** libjson-c is known to share symbol names with other JSON libraries

+****** which may result in crashes for applications that use libclamav.

+****** Consider using --with-libjson-static=[path/to/libjson-c.a],

+****** providing a json-c library that was compiled with CFLAGS="-fPIC".

+    ])

+fi

@@ -133,7 +133,7 @@ libclamav_internal_utils_la_SOURCES=str.c\

 libclamav_internal_utils_la_LDFLAGS=-static @SSL_LDFLAGS@ @JSON_LDFLAGS@

 libclamav_internal_utils_la_CFLAGS=$(AM_CFLAGS)  -fPIC -DPIC @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@ @XML_CPPFLAGS@

-libclamav_internal_utils_la_LIBADD=@SSL_LIBS@ @JSON_LIBS@ @PCRE_LIBS@

+libclamav_internal_utils_la_LIBADD=@SSL_LIBS@ @PCRE_LIBS@

 libclamav_internal_utils_nothreads_la_SOURCES=str.c\

 					conv.c \

@@ -160,7 +160,7 @@ libclamav_internal_utils_nothreads_la_SOURCES=str.c\

 libclamav_internal_utils_nothreads_la_LDFLAGS=-static @SSL_LDFLAGS@ @JSON_LDFLAGS@

 libclamav_internal_utils_nothreads_la_CFLAGS=$(AM_CFLAGS) -DCL_NOTHREADS @SSL_CPPFLAGS@ @JSON_CPPFLAGS@ @PCRE_CPPFLAGS@

-libclamav_internal_utils_nothreads_la_LIBADD=@SSL_LIBS@ @JSON_LIBS@ @PCRE_LIBS@

+libclamav_internal_utils_nothreads_la_LIBADD=@SSL_LIBS@ @PCRE_LIBS@

 SUBDIRS=

 if ENABLE_LLVM

@@ -3,23 +3,23 @@ dnl Check for libjson

 have_json_header="no"

 AC_MSG_CHECKING([for libjson installation])

-AC_ARG_WITH([libjson],

-[AS_HELP_STRING([--with-libjson@<:@=DIR@:>@], [path to directory containing libjson

-                @<:@default=/usr/local or /usr if not found in /usr/local@:>@])],

-[

-find_json="no"

-if test "X$withval" = "Xyes"; then

-    find_json="yes"

-else

-    if test "X$withval" != "Xno"; then

-        if test -f "${withval}/include/json/json.h" -o -f "${withval}/include/json-c/json.h"; then

-            LIBJSON_HOME="$withval"

-            have_json_header="yes"

+AC_ARG_WITH([libjson], [AS_HELP_STRING([--with-libjson@<:@=DIR@:>@], [path to directory containing libjson

+                        @<:@default=/usr/local or /usr if not found in /usr/local@:>@])],

+    [

+        find_json="no"

+        if test "X$withval" = "Xyes"; then

+            find_json="yes"

+        else

+            if test "X$withval" != "Xno"; then

+                if test -f "${withval}/include/json/json.h" -o -f "${withval}/include/json-c/json.h"; then

+                    LIBJSON_HOME="$withval"

+                    have_json_header="yes"

+                fi

+            fi

         fi

-    fi

-fi

-],

-[find_json="yes"])

+    ],

+    [find_json="yes"]

+)

 if test "X$find_json" = "Xyes"; then

     for p in /usr/local /usr ; do

@@ -58,15 +58,52 @@ if test "X$have_json_header" = "Xyes"; then

         CFLAGS="$CFLAGS $JSON_CPPFLAGS"

     fi

-    AC_SEARCH_LIBS([json_object_object_get_ex], [json-c json], [

-        have_json="yes"

-        have_deprecated_json="no"], [

-        have_json="no"

-        AC_SEARCH_LIBS([json_object_object_get], [json-c json], [

+    AC_CHECK_LIB([json-c], [json_object_object_get_ex],

+        [

+            dnl Found

             have_json="yes"

-            have_deprecated_json="yes"

-        ])

-    ])

+            have_deprecated_json="no"

+            json_libname="json-c"

+        ],

+        [

+            dnl Not-Found

+            AC_CHECK_LIB([json], [json_object_object_get_ex],

+                [

+                    dnl Found

+                    have_json="yes"

+                    have_deprecated_json="no"

+                    json_libname="json"

+                ],

+                [

+                    dnl Not-Found

+                    AC_CHECK_LIB([json-c], [json_object_object_get],

+                        [

+                            dnl Found

+                            have_json="yes"

+                            have_deprecated_json="yes"

+                            json_libname="json-c"

+                        ],

+                        [

+                            dnl Not-Found

+                            AC_CHECK_LIB([json], [json_object_object_get],

+                                [

+                                    dnl Found

+                                    have_json="yes"

+                                    have_deprecated_json="yes"

+                                    json_libname="json"

+                                ],

+                                [

+                                    dnl Not-Found

+                                    have_json="no"

+                                    AC_MSG_ERROR([Unable to find libjson library.])

+                                ]

+                            )

+                        ]

+                    )

+                ]

+            )

+        ]

+    )

     CFLAGS="$save_CFLAGS"

     LDFLAGS="$save_LDFLAGS"

@@ -77,7 +114,19 @@ if test "X$have_json" = "Xyes"; then

     if test "X$have_deprecated_json" = "Xyes"; then

         AC_DEFINE([HAVE_DEPRECATED_JSON],1,[Define to 1 if you have a deprecated version of the 'libjson' library (-ljson).])

     fi

-    JSON_LIBS="$LIBS"

+

+    dnl Determine linking method to json

+    AC_ARG_WITH([libjson-static],

+        [AC_HELP_STRING([--with-libjson-static=DIR],[path to libjson-c.a static library])],

+        [

+            json_linking="static"

+            JSON_LIBS="$withval $LIBS"

+        ],

+        [

+            json_linking="dynamic"

+            JSON_LIBS="-l${json_libname} $LIBS"

+        ]

+    )

 fi

 LIBS="$save_LIBS"