@@ -1,3 +1,7 @@

+Mon Jul 31 12:59:30 CEST 2006 (acab)

+------------------------------------

+  * libclamav: packers review

+

 Mon Jul 31 10:24:35 BST 2006 (njh)

 ----------------------------------

   * libclamav/pdf.c, binhex.c:	Fixed compilation error under MSVC

@@ -138,7 +138,7 @@ static int cli_ddump(int desc, int offset, int size, const char *file)

 	return -1;

     }

-    while((bread = read(desc, buff, FILEBUFF)) > 0) {

+    while((bread = cli_readn(desc, buff, FILEBUFF)) > 0) {

 	if(sum + bread >= size) {

 	    if(write(ndesc, buff, size - sum) == -1) {

 		cli_dbgmsg("Can't write to file\n");

@@ -190,7 +190,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	size_t fsize;

-    if(read(desc, &e_magic, sizeof(e_magic)) != sizeof(e_magic)) {

+    if(cli_readn(desc, &e_magic, sizeof(e_magic)) != sizeof(e_magic)) {

 	cli_dbgmsg("Can't read DOS signature\n");

 	return CL_CLEAN;

     }

@@ -202,7 +202,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     lseek(desc, 58, SEEK_CUR); /* skip to the end of the DOS header */

-    if(read(desc, &e_lfanew, sizeof(e_lfanew)) != sizeof(e_lfanew)) {

+    if(cli_readn(desc, &e_lfanew, sizeof(e_lfanew)) != sizeof(e_lfanew)) {

 	cli_dbgmsg("Can't read new header address\n");

 	/* truncated header? */

 	if(DETECT_BROKEN) {

@@ -226,7 +226,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	return CL_CLEAN;

     }

-    if(read(desc, &file_hdr, sizeof(struct pe_image_file_hdr)) != sizeof(struct pe_image_file_hdr)) {

+    if(cli_readn(desc, &file_hdr, sizeof(struct pe_image_file_hdr)) != sizeof(struct pe_image_file_hdr)) {

 	/* bad information in e_lfanew - probably not a PE file */

 	cli_dbgmsg("Can't read file header\n");

 	return CL_CLEAN;

@@ -374,7 +374,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     if(!pe_plus) { /* PE */

-	if(read(desc, &optional_hdr32, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

+	if(cli_readn(desc, &optional_hdr32, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

 	    cli_dbgmsg("Can't read optional file header\n");

 	    if(DETECT_BROKEN) {

 		if(ctx->virname)

@@ -411,7 +411,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     } else { /* PE+ */

-	if(read(desc, &optional_hdr64, sizeof(struct pe_image_optional_hdr64)) != sizeof(struct pe_image_optional_hdr64)) {

+	if(cli_readn(desc, &optional_hdr64, sizeof(struct pe_image_optional_hdr64)) != sizeof(struct pe_image_optional_hdr64)) {

 	    cli_dbgmsg("Can't optional file header\n");

 	    if(DETECT_BROKEN) {

 		if(ctx->virname)

@@ -503,7 +503,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     for(i = 0; i < nsections; i++) {

-	if(read(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

+	if(cli_readn(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

 	    cli_dbgmsg("Can't read section header\n");

 	    cli_dbgmsg("Possibly broken PE file\n");

 	    free(section_hdr);

@@ -600,7 +600,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     /* W32.Parite.B */

     if(SCAN_ALGO && !dll && ep == EC32(section_hdr[nsections - 1].PointerToRawData)) {

 	lseek(desc, ep, SEEK_SET);

-	if(read(desc, buff, 4096) == 4096) {

+	if(cli_readn(desc, buff, 4096) == 4096) {

 		const char *pt = cli_memstr(buff, 4040, "\x47\x65\x74\x50\x72\x6f\x63\x41\x64\x64\x72\x65\x73\x73\x00", 15);

 	    if(pt) {

 		    uint32_t dw1, dw2;

@@ -619,7 +619,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     if(SCAN_ALGO && CLI_ISCONTAINED(EC32(section_hdr[nsections - 1].PointerToRawData), EC32(section_hdr[nsections - 1].SizeOfRawData), ep, 0x0fd2)) {

 	cli_dbgmsg("in kriz\n");

 	lseek(desc, ep, SEEK_SET);

-	if(read(desc, buff, 200) == 200) {

+	if(cli_readn(desc, buff, 200) == 200) {

 		while (1) {

 			char *krizpos=buff+3;

 			char *krizmov, *krizxor;

@@ -687,7 +687,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		int bw = rsize < 0x7000 ? rsize : 0x7000;

 	    lseek(desc, EC32(section_hdr[nsections - 1].PointerToRawData) + rsize - bw, SEEK_SET);

-	    if(read(desc, buff, 4096) == 4096) {

+	    if(cli_readn(desc, buff, 4096) == 4096) {

 		if(cli_memstr(buff, 4091, "\xe8\x2c\x61\x00\x00", 5)) {

 		    *ctx->virname = "W32.Magistr.A";

 		    free(section_hdr);

@@ -699,7 +699,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		int bw = rsize < 0x8000 ? rsize : 0x8000;

 	    lseek(desc, EC32(section_hdr[nsections - 1].PointerToRawData) + rsize - bw, SEEK_SET);

-	    if(read(desc, buff, 4096) == 4096) {

+	    if(cli_readn(desc, buff, 4096) == 4096) {

 		if(cli_memstr(buff, 4091, "\xe8\x04\x72\x00\x00", 5)) {

 		    *ctx->virname = "W32.Magistr.B";

 		    free(section_hdr);

@@ -833,7 +833,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	    return CL_EIO;

 	}

-        if(read(desc, buff, 168) != 168) {

+        if(cli_readn(desc, buff, 168) != 168) {

 	    cli_dbgmsg("UPX/FSG: Can't read 168 bytes at 0x%x (%d)\n", ep, ep);

 	    cli_dbgmsg("UPX/FSG: Broken or not UPX/FSG compressed file\n");

             free(section_hdr);

@@ -878,7 +878,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		}

 		lseek(desc, EC32(section_hdr[i + 1].PointerToRawData), SEEK_SET);

-		if((unsigned int) read(desc, src, ssize) != ssize) {

+		if((unsigned int) cli_readn(desc, src, ssize) != ssize) {

 		    cli_dbgmsg("Can't read raw data of section %d\n", i);

 		    free(section_hdr);

 		    free(src);

@@ -1053,7 +1053,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		    return CL_EMEM;

 		}

-		if(read(desc, support, gp) != gp) {

+		if(cli_readn(desc, support, gp) != gp) {

 		    cli_dbgmsg("Can't read %d bytes from padding area\n", gp); 

 		    free(section_hdr);

 		    free(support);

@@ -1120,7 +1120,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		}

 		lseek(desc, EC32(section_hdr[i + 1].PointerToRawData), SEEK_SET);

-		if((unsigned int) read(desc, src, ssize) != ssize) {

+		if((unsigned int) cli_readn(desc, src, ssize) != ssize) {

 		    cli_dbgmsg("Can't read raw data of section %d\n", i);

 		    free(section_hdr);

 		    free(sections);

@@ -1280,7 +1280,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		    return CL_EMEM;

 		}

-		if(read(desc, support, gp) != gp) {

+		if(cli_readn(desc, support, gp) != gp) {

 		    cli_dbgmsg("Can't read %d bytes from padding area\n", gp); 

 		    free(section_hdr);

 		    free(support);

@@ -1328,7 +1328,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		}

 		lseek(desc, EC32(section_hdr[i + 1].PointerToRawData), SEEK_SET);

-		if((unsigned int) read(desc, src, ssize) != ssize) {

+		if((unsigned int) cli_readn(desc, src, ssize) != ssize) {

 		    cli_dbgmsg("Can't read raw data of section %d\n", i);

 		    free(section_hdr);

 		    free(sections);

@@ -1473,7 +1473,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	    }

 	    lseek(desc, EC32(section_hdr[i + 1].PointerToRawData), SEEK_SET);

-	    if((unsigned int) read(desc, src, ssize) != ssize) {

+	    if((unsigned int) cli_readn(desc, src, ssize) != ssize) {

 		cli_dbgmsg("Can't read raw data of section %d\n", i);

 		free(section_hdr);

 		free(src);

@@ -1491,7 +1491,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		return CL_EIO;

 	    }

-	    if(read(desc, buff, 126) != 126) { /* i.e. 0x69 + 13 + 8 */

+	    if(cli_readn(desc, buff, 126) != 126) { /* i.e. 0x69 + 13 + 8 */

 		cli_dbgmsg("UPX: Can't read 126 bytes at 0x%x (%d)\n", ep, ep);

 		cli_dbgmsg("UPX/FSG: Broken or not UPX/FSG compressed file\n");

 		free(section_hdr);

@@ -1620,7 +1620,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     found = 2;

     lseek(desc, ep, SEEK_SET);

-    if(read(desc, buff, 200) != 200) {

+    if(cli_readn(desc, buff, 200) != 200) {

 	cli_dbgmsg("Can't read 200 bytes\n");

 	free(section_hdr);

 	return CL_EIO;

@@ -1662,7 +1662,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 		if(section_hdr[i].SizeOfRawData) {

 			uint32_t offset = cli_rawaddr(EC32(section_hdr[i].VirtualAddress), section_hdr, nsections, &err);

-		    if(err || lseek(desc, offset, SEEK_SET) == -1 || (unsigned int) read(desc, dest + EC32(section_hdr[i].VirtualAddress) - min, EC32(section_hdr[i].SizeOfRawData)) != EC32(section_hdr[i].SizeOfRawData)) {

+		    if(err || lseek(desc, offset, SEEK_SET) == -1 || (unsigned int) cli_readn(desc, dest + EC32(section_hdr[i].VirtualAddress) - min, EC32(section_hdr[i].SizeOfRawData)) != EC32(section_hdr[i].SizeOfRawData)) {

 			free(section_hdr);

 			free(dest);

 			return CL_EIO;

@@ -1745,7 +1745,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	}

 	lseek(desc, 0, SEEK_SET);

-	if((size_t) read(desc, spinned, fsize) != fsize) {

+	if((size_t) cli_readn(desc, spinned, fsize) != fsize) {

 	    cli_dbgmsg("PESpin: Can't read %d bytes\n", fsize);

 	    free(spinned);

 	    free(section_hdr);

@@ -1814,7 +1814,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	  }

 	  lseek(desc, 0, SEEK_SET);

-	  if((size_t) read(desc, spinned, fsize) != fsize) {

+	  if((size_t) cli_readn(desc, spinned, fsize) != fsize) {

 	    cli_dbgmsg("yC: Can't read %d bytes\n", fsize);

 	    free(spinned);

 	    free(section_hdr);

@@ -1907,7 +1907,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

       memset(dest, 0, dsize);

       lseek(desc, 0, SEEK_SET);

-      if((size_t) read(desc, dest, headsize) != headsize) {

+      if((size_t) cli_readn(desc, dest, headsize) != headsize) {

 	cli_dbgmsg("WWPack: Can't read %d bytes from headers\n", headsize);

 	free(dest);

 	free(section_hdr);

@@ -1918,7 +1918,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	if(section_hdr[i].SizeOfRawData) {

 	  uint32_t offset = cli_rawaddr(EC32(section_hdr[i].VirtualAddress), section_hdr, nsections, &err);

-	  if(err || lseek(desc, offset, SEEK_SET) == -1 || (unsigned int) read(desc, dest + headsize + EC32(section_hdr[i].VirtualAddress) - min, EC32(section_hdr[i].SizeOfRawData)) != EC32(section_hdr[i].SizeOfRawData)) {

+	  if(err || lseek(desc, offset, SEEK_SET) == -1 || (unsigned int) cli_readn(desc, dest + headsize + EC32(section_hdr[i].VirtualAddress) - min, EC32(section_hdr[i].SizeOfRawData)) != EC32(section_hdr[i].SizeOfRawData)) {

 	    free(dest);

 	    free(section_hdr);

 	    return CL_EIO;

@@ -1934,7 +1934,7 @@ int cli_scanpe(int desc, cli_ctx *ctx)

       }

       lseek(desc, EC32(section_hdr[nsections - 1].PointerToRawData), SEEK_SET);      

-      if((size_t) read(desc, wwp, EC32(section_hdr[nsections - 1].SizeOfRawData)) != EC32(section_hdr[nsections - 1].SizeOfRawData)) {

+      if((size_t) cli_readn(desc, wwp, EC32(section_hdr[nsections - 1].SizeOfRawData)) != EC32(section_hdr[nsections - 1].SizeOfRawData)) {

 	cli_dbgmsg("WWPack: Can't read %d bytes from wwpack sect\n", EC32(section_hdr[nsections - 1].SizeOfRawData));

 	free(dest);

 	free(wwp);

@@ -2017,7 +2017,7 @@ int cli_peheader(int desc, struct cli_exe_info *peinfo)

     cli_dbgmsg("in cli_peheader\n");

-    if(read(desc, &e_magic, sizeof(e_magic)) != sizeof(e_magic)) {

+    if(cli_readn(desc, &e_magic, sizeof(e_magic)) != sizeof(e_magic)) {

 	cli_dbgmsg("Can't read DOS signature\n");

 	return -1;

     }

@@ -2029,7 +2029,7 @@ int cli_peheader(int desc, struct cli_exe_info *peinfo)

     lseek(desc, 58, SEEK_CUR); /* skip to the end of the DOS header */

-    if(read(desc, &e_lfanew, sizeof(e_lfanew)) != sizeof(e_lfanew)) {

+    if(cli_readn(desc, &e_lfanew, sizeof(e_lfanew)) != sizeof(e_lfanew)) {

 	cli_dbgmsg("Can't read new header address\n");

 	/* truncated header? */

 	return -1;

@@ -2047,7 +2047,7 @@ int cli_peheader(int desc, struct cli_exe_info *peinfo)

 	return -1;

     }

-    if(read(desc, &file_hdr, sizeof(struct pe_image_file_hdr)) != sizeof(struct pe_image_file_hdr)) {

+    if(cli_readn(desc, &file_hdr, sizeof(struct pe_image_file_hdr)) != sizeof(struct pe_image_file_hdr)) {

 	/* bad information in e_lfanew - probably not a PE file */

 	cli_dbgmsg("Can't read file header\n");

 	return -1;

@@ -2072,7 +2072,7 @@ int cli_peheader(int desc, struct cli_exe_info *peinfo)

     if(!pe_plus) { /* PE */

 	cli_dbgmsg("File format: PE\n");

-	if(read(desc, &optional_hdr32, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

+	if(cli_readn(desc, &optional_hdr32, sizeof(struct pe_image_optional_hdr32)) != sizeof(struct pe_image_optional_hdr32)) {

 	    cli_dbgmsg("Can't optional file header\n");

 	    return -1;

 	}

@@ -2080,7 +2080,7 @@ int cli_peheader(int desc, struct cli_exe_info *peinfo)

     } else { /* PE+ */

 	cli_dbgmsg("File format: PE32+\n");

-	if(read(desc, &optional_hdr64, sizeof(struct pe_image_optional_hdr64)) != sizeof(struct pe_image_optional_hdr64)) {

+	if(cli_readn(desc, &optional_hdr64, sizeof(struct pe_image_optional_hdr64)) != sizeof(struct pe_image_optional_hdr64)) {

 	    cli_dbgmsg("Can't optional file header\n");

 	    return -1;

 	}

@@ -2109,7 +2109,7 @@ int cli_peheader(int desc, struct cli_exe_info *peinfo)

     for(i = 0; i < peinfo->nsections; i++) {

-	if(read(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

+	if(cli_readn(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

 	    cli_dbgmsg("Can't read section header\n");

 	    cli_dbgmsg("Possibly broken PE file\n");

 	    free(section_hdr);

@@ -314,7 +314,7 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   memcpy(spinned, src + EC32(sections[sectcnt].PointerToRawData), EC32(sections[sectcnt].SizeOfRawData)); 

   ep = spinned + nep - sections[sectcnt].VirtualAddress;

-  curr = ep+0xdb; /* HELP: as a general rule, can i do char* math or should use monsters like "&ep[0xdb]" instead? */

+  curr = ep+0xdb;

   if ( *curr != '\xbb' ) {

     free(spinned);

     cli_dbgmsg("spin: Not spinned or bad version\n");

@@ -337,26 +337,30 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   cli_dbgmsg("spin: Key8 is %x, Len is %x\n", key8, len);

-  if ( (uint32_t)(ep - spinned) >= EC32(sections[sectcnt].SizeOfRawData) - len - 0x1fe5 ) {

+  if (!CLI_ISCONTAINED(spinned, EC32(sections[sectcnt].SizeOfRawData), ep, len+0x1fe5-1)) {

     free(spinned);

     cli_dbgmsg("spin: len out of bounds, giving up\n");

-    return 1; /* Outta bounds - HELP: i suppose i should check for wraps.. not sure though */

+    return 1;

   }

-

   if ( ep[0x1e0]!='\xb8' )

     cli_dbgmsg("spin: prolly not spinned, expect failure\n");

   if ( (cli_readint32(ep+0x1e1) & 0x00200000) )

     cli_dbgmsg("spin: password protected, expect failure\n");

-

   curr = ep+0x1fe5+len-1;

   while ( len-- ) {

     *curr=(*curr)^(key8--);

     curr--;

   }

+  if (!CLI_ISCONTAINED(spinned, EC32(sections[sectcnt].SizeOfRawData), ep+0x3217, 4)) {

+    free(spinned);

+    cli_dbgmsg("spin: key out of bounds, giving up\n");

+    return 1;

+  }

+

   curr = ep+0x26eb;

   key32 = cli_readint32(curr);

   if ( (len = cli_readint32(curr+5)) != 0x5a0) {

@@ -365,15 +369,15 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

     return 1;

   }

-  curr = ep+0x2d5; /* 0x2d5+5a0 < 0x3217 - still within bounds (checked by caller) */

+  curr = ep+0x2d5;

   cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);

   while ( len-- ) {

     if ( key32 & 1 ) {

-      key32 = key32>>1&0x7fffffff;

+      key32 = key32>>1;

       key32 ^= 0x8c328834;

     } else {

-      key32 = key32>>1 & 0x7fffffff;

+      key32 = key32>>1;

     }

     *curr = *curr ^ (key32 & 0xff);

     curr++;

@@ -383,7 +387,7 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   if ( len >= (uint32_t)ssize ) {

     free(spinned);

     cli_dbgmsg("spin: crc out of bounds, giving up\n");

-    return 1; /* We wrapped */

+    return 1;

   }

   key32 = cli_readint32(ep+0x3217) - summit(src,len);

@@ -391,6 +395,10 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   free(spinned); /* done CRC'ing - can have a dirty buffer now */

   ep = src + nep + sections[sectcnt].PointerToRawData - sections[sectcnt].VirtualAddress; /* Fix the helper */

+  if (!CLI_ISCONTAINED(src, ssize, ep+0x3207, 4)) { /* this one holds all ep based checks */

+    cli_dbgmsg("spin: key out of bounds, giving up\n");

+    return 1;

+  }

   bitmap = cli_readint32(ep+0x3207);

   cli_dbgmsg("spin: Key32 is %x - XORbitmap is %x\n", key32, bitmap);

@@ -402,29 +410,29 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

       char *ptr = src + EC32(sections[j].PointerToRawData);

       uint32_t keydup = key32;

-      if ( EC32(sections[j].PointerToRawData) + size >=  (uint32_t)ssize ) {

+      if (!CLI_ISCONTAINED(src, ssize, ptr, size)) {

 	cli_dbgmsg("spin: sect %d out of file, giving up\n", j);

-	return 1; /* sect outta bounds - HELP: i suppose i should check for wraps.. not sure though */

+	return 1; /* FIXME: Already checked in pe.c? */

       }

       while (size--) {

 	if (! (keydup & 1)) {

-	  keydup = keydup>>1&0x7fffffff; /* HELP: clear sign bit for unsigned values too? */

+	  keydup = keydup>>1;

 	  keydup ^= 0xed43af31;

 	} else {

-	  keydup = keydup>>1 & 0x7fffffff; /* HELP: clear sign bit for unsigned values too? */

+	  keydup = keydup>>1;

 	}

 	*ptr = *ptr ^ (keydup & 0xff);

 	ptr++;

       }

     } 

-    bitmap = bitmap >>1 & 0x7fffffff; /* HELP: clear sign bit for unsigned values too? */

+    bitmap = bitmap >>1;

   }

   cli_dbgmsg("spin: done\n");

-  curr = ep+0x644; /* 0x28d3+0x180 < 0x3217 - still within bounds (checked by caller) */

+  curr = ep+0x644;

   if ( (len = cli_readint32(curr)) != 0x180) {

     cli_dbgmsg("spin: Not spinned or bad version\n");

     return 1;

@@ -434,12 +442,16 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   cli_dbgmsg("spin: Key is %x, Len is %x\n", key32, len);

   curr = ep+0x28d3;

+  if (!CLI_ISCONTAINED(src, ssize, curr, len)) { /* always true but i may decide to remove the previous check */

+    cli_dbgmsg("spin: key out of bounds, giving up\n");

+    return 1;

+  }

   while ( len-- ) {

     if ( key32 & 1 ) {

-      key32 = key32>>1&0x7fffffff;

+      key32 = key32>>1;

       key32 ^= 0xed43af32;

     } else {

-      key32 = key32>>1 & 0x7fffffff;

+      key32 = key32>>1;

     }

     *curr = *curr ^ (key32 & 0xff);

     curr++;

@@ -454,8 +466,11 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   cli_dbgmsg("spin: POLY1 len is %x\n", len);

   curr+=0xf; /* POLY1 */

-  emu = ep+0x6d4; /* Still within bounds */

-

+  emu = ep+0x6d4;

+  if (!CLI_ISCONTAINED(src, ssize, emu, len)) {

+    cli_dbgmsg("spin: poly1 out of bounds\n");

+    return 1;

+  }

   while (len) {

     *emu=exec86(*emu, len-- & 0xff, curr); /* unlame POLY1 */

     emu++;

@@ -472,8 +487,8 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

       emu = src + EC32(sections[j].PointerToRawData);

-      if ( emu < src || EC32(sections[j].PointerToRawData) + notthesamelen >= (uint32_t)ssize) { /* HELP: Is this enough for me to be within bounds? */

-	cli_dbgmsg("spin: code to exec is out of file?\n");

+      if (!CLI_ISCONTAINED(src,ssize,curr,0x24)) { /* section bounds already checked twice now */

+	cli_dbgmsg("spin: poly1 emucode is out of file?\n");

 	return 1;

       }

@@ -482,7 +497,7 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

         emu++;

       }

     }

-      bitmap = bitmap >>1 & 0x7fffffff;

+      bitmap = bitmap >>1;

   }

   cli_dbgmsg("spin: done\n");

@@ -496,7 +511,7 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   len = 0;

   for (j=0; j<sectcnt; j++) {

     if (bitmap&1) {

-       if ( (sects[j] = (char *) cli_malloc(EC32(sections[j].VirtualSize)) ) == NULL ) { /* FIXME: use "static" maxmalloc @4380b6 instead??? */

+       if ( (sects[j] = (char *) cli_malloc(EC32(sections[j].VirtualSize)) ) == NULL ) {

 	 cli_dbgmsg("spin: malloc(%d) failed\n", EC32(sections[j].VirtualSize));

 	 len = 1;

 	 break;

@@ -508,7 +523,6 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

 	 len++;

          cli_dbgmsg("spin: Unpack failure\n");

        }

-       /* sections[j].rsz = sections[j].vsz; FIXME: can't hack the caller, gotta find a better way! */

     } else {

       blobsz+=EC32(sections[j].SizeOfRawData);

       sects[j] = src + EC32(sections[j].PointerToRawData);

@@ -536,7 +550,7 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

     /*    len = cli_readint32(ep+0x2fc8); -- Using vsizes instead */

     for (j=0; j<sectcnt; j++) {

-      if (EC32(sections[j].VirtualAddress) <= key32 && EC32(sections[j].VirtualAddress)+EC32(sections[j].SizeOfRawData) > key32) /* HELP: wraps? */

+      if (EC32(sections[j].VirtualAddress) <= key32 && EC32(sections[j].VirtualAddress)+EC32(sections[j].SizeOfRawData) > key32)

 	break;

     }

@@ -546,19 +560,19 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

       if ( (curr=(char *)cli_malloc(EC32(sections[j].VirtualSize))) != NULL ) {

 	memcpy(curr, src + EC32(sections[j].PointerToRawData), key32 - EC32(sections[j].VirtualAddress)); /* Uncompressed part */

 	memset(curr + key32 - EC32(sections[j].VirtualAddress), 0, EC32(sections[j].VirtualSize) - (key32 - EC32(sections[j].VirtualAddress))); /* bzero */

-	if ( unfsg(src + EC32(sections[j].PointerToRawData) + key32 - EC32(sections[j].VirtualAddress), curr + key32 - EC32(sections[j].VirtualAddress), EC32(sections[j].SizeOfRawData) - (key32 - EC32(sections[j].VirtualAddress)), EC32(sections[j].VirtualSize) - (key32 - EC32(sections[j].VirtualAddress))) ) { /* HELP: i can't read my own line - hope's ok :( */

+	if ( unfsg(src + EC32(sections[j].PointerToRawData) + key32 - EC32(sections[j].VirtualAddress), curr + key32 - EC32(sections[j].VirtualAddress), EC32(sections[j].SizeOfRawData) - (key32 - EC32(sections[j].VirtualAddress)), EC32(sections[j].VirtualSize) - (key32 - EC32(sections[j].VirtualAddress))) ) {

 	  free(curr);

 	  cli_dbgmsg("spin: Failed to grow resources, continuing anyway\n");

 	  blobsz+=EC32(sections[j].SizeOfRawData);

 	} else {

-	  sects[j]=curr; /* FIXME: bitman check above should save me from leaks */

+	  sects[j]=curr;

 	  bitman|=1<<j;

 	  cli_dbgmsg("spin: Resources grown\n");

 	  blobsz+=EC32(sections[j].VirtualSize);

 	}

       } else {

-	/* HELP: malloc failed but i'm too deep into this crap to worry... what to do next? */

+	/* malloc failed but i'm too deep into this crap to quit without leaking more :( */

 	blobsz+=EC32(sections[j].SizeOfRawData);

       }

     } else {

@@ -584,10 +598,10 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

 	memcpy(to, sects[j], rebhlp[j].rsz);

 	to+=rebhlp[j].rsz;

 	if ( bitmap & 1 ) free(sects[j]);

-	bitmap = bitmap >>1 & 0x7fffffff;

+	bitmap = bitmap >>1;

       }

-      if ( (to = rebuildpe(ep, rebhlp, sectcnt, 0x400000, 0x1000, 0, 0))) { /* HELP: should i bother fixing those values? the rebuilt exe is completely broken anyway. */

+      if ( (to = rebuildpe(ep, rebhlp, sectcnt, 0x400000, 0x1000, 0, 0))) { /* can't be bothered fixing those values: the rebuilt exe is completely broken anyway. */

 	if (cli_writen(desc, to, 0x148+0x80+0x28*j+rebhlp[j-1].raw+rebhlp[j-1].rsz)==-1) {

 	  cli_dbgmsg("spin: Cannot write unpacked file\n");

 	  retval = 1;