@@ -318,6 +318,7 @@ libclamav_la_SOURCES = \

 	pe.h \

 	pe_icons.c \

 	pe_icons.h \

+	pe_structs.h \

 	disasm.c \

 	disasm.h \

 	disasm-common.h \

@@ -391,6 +392,7 @@ libclamav_la_SOURCES = \

 	elf.c \

 	elf.h \

 	execs.h \

+	execs.c \

 	sis.c \

 	sis.h \

 	uuencode.c \

@@ -257,20 +257,21 @@ am__libclamav_la_SOURCES_DIST = matcher-ac.c matcher-ac.h matcher-bm.c \

 	filetypes.h filetypes_int.h rtf.c rtf.h blob.c blob.h mbox.c \

 	mbox.h message.c message.h table.c table.h text.c text.h \

 	ole2_extract.c ole2_extract.h vba_extract.c vba_extract.h \

-	msexpand.c msexpand.h pe.c pe.h pe_icons.c pe_icons.h disasm.c \

-	disasm.h disasm-common.h disasmpriv.h upx.c upx.h htmlnorm.c \

-	htmlnorm.h libmspack.c libmspack.h rebuildpe.c rebuildpe.h \

-	petite.c petite.h wwunpack.c wwunpack.h unsp.c unsp.h aspack.c \

-	aspack.h packlibs.c packlibs.h fsg.c fsg.h mew.c mew.h upack.c \

-	upack.h line.c line.h untar.c untar.h unzip.c unzip.h ooxml.c \

-	ooxml.h inflate64.c inflate64.h inffixed64.h inflate64_priv.h \

+	msexpand.c msexpand.h pe.c pe.h pe_icons.c \

+	pe_icons.h pe_structs.h disasm.c disasm.h disasm-common.h \

+	disasmpriv.h upx.c upx.h htmlnorm.c htmlnorm.h libmspack.c \

+	libmspack.h rebuildpe.c rebuildpe.h petite.c petite.h \

+	wwunpack.c wwunpack.h unsp.c unsp.h aspack.c aspack.h \

+	packlibs.c packlibs.h fsg.c fsg.h mew.c mew.h upack.c upack.h \

+	line.c line.h untar.c untar.h unzip.c unzip.h ooxml.c ooxml.h \

+	inflate64.c inflate64.h inffixed64.h inflate64_priv.h \

 	special.c special.h binhex.c binhex.h is_tar.c is_tar.h tnef.c \

 	tnef.h autoit.c autoit.h unarj.c unarj.h nsis/bzlib.c \

 	nsis/bzlib_private.h nsis/nsis_bzlib.h nsis/nulsft.c \

 	nsis/nulsft.h nsis/infblock.c nsis/nsis_zconf.h \

 	nsis/nsis_zlib.h nsis/nsis_zutil.h pdf.c pdf.h pdfng.c \

 	pdfdecode.c pdfdecode.h spin.c spin.h yc.c yc.h elf.c elf.h \

-	execs.h sis.c sis.h uuencode.c uuencode.h phishcheck.c \

+	execs.h execs.c sis.c sis.h uuencode.c uuencode.h phishcheck.c \

 	phishcheck.h phish_domaincheck_db.c phish_domaincheck_db.h \

 	phish_whitelist.c phish_whitelist.h iana_cctld.h iana_tld.h \

 	regex_list.c regex_list.h regex_suffix.c regex_suffix.h \

@@ -406,8 +407,9 @@ am_libclamav_la_OBJECTS = libclamav_la-matcher-ac.lo \

 	libclamav_la-nulsft.lo libclamav_la-infblock.lo \

 	libclamav_la-pdf.lo libclamav_la-pdfng.lo \

 	libclamav_la-pdfdecode.lo libclamav_la-spin.lo \

-	libclamav_la-yc.lo libclamav_la-elf.lo libclamav_la-sis.lo \

-	libclamav_la-uuencode.lo libclamav_la-phishcheck.lo \

+	libclamav_la-yc.lo libclamav_la-elf.lo libclamav_la-execs.lo \

+	libclamav_la-sis.lo libclamav_la-uuencode.lo \

+	libclamav_la-phishcheck.lo \

 	libclamav_la-phish_domaincheck_db.lo \

 	libclamav_la-phish_whitelist.lo libclamav_la-regex_list.lo \

 	libclamav_la-regex_suffix.lo libclamav_la-entconv.lo \

@@ -1308,20 +1310,21 @@ libclamav_la_SOURCES = matcher-ac.c matcher-ac.h matcher-bm.c \

 	filetypes.h filetypes_int.h rtf.c rtf.h blob.c blob.h mbox.c \

 	mbox.h message.c message.h table.c table.h text.c text.h \

 	ole2_extract.c ole2_extract.h vba_extract.c vba_extract.h \

-	msexpand.c msexpand.h pe.c pe.h pe_icons.c pe_icons.h disasm.c \

-	disasm.h disasm-common.h disasmpriv.h upx.c upx.h htmlnorm.c \

-	htmlnorm.h libmspack.c libmspack.h rebuildpe.c rebuildpe.h \

-	petite.c petite.h wwunpack.c wwunpack.h unsp.c unsp.h aspack.c \

-	aspack.h packlibs.c packlibs.h fsg.c fsg.h mew.c mew.h upack.c \

-	upack.h line.c line.h untar.c untar.h unzip.c unzip.h ooxml.c \

-	ooxml.h inflate64.c inflate64.h inffixed64.h inflate64_priv.h \

+	msexpand.c msexpand.h pe.c pe.h pe_icons.c \

+	pe_icons.h pe_structs.h disasm.c disasm.h disasm-common.h \

+	disasmpriv.h upx.c upx.h htmlnorm.c htmlnorm.h libmspack.c \

+	libmspack.h rebuildpe.c rebuildpe.h petite.c petite.h \

+	wwunpack.c wwunpack.h unsp.c unsp.h aspack.c aspack.h \

+	packlibs.c packlibs.h fsg.c fsg.h mew.c mew.h upack.c upack.h \

+	line.c line.h untar.c untar.h unzip.c unzip.h ooxml.c ooxml.h \

+	inflate64.c inflate64.h inffixed64.h inflate64_priv.h \

 	special.c special.h binhex.c binhex.h is_tar.c is_tar.h tnef.c \

 	tnef.h autoit.c autoit.h unarj.c unarj.h nsis/bzlib.c \

 	nsis/bzlib_private.h nsis/nsis_bzlib.h nsis/nulsft.c \

 	nsis/nulsft.h nsis/infblock.c nsis/nsis_zconf.h \

 	nsis/nsis_zlib.h nsis/nsis_zutil.h pdf.c pdf.h pdfng.c \

 	pdfdecode.c pdfdecode.h spin.c spin.h yc.c yc.h elf.c elf.h \

-	execs.h sis.c sis.h uuencode.c uuencode.h phishcheck.c \

+	execs.h execs.c sis.c sis.h uuencode.c uuencode.h phishcheck.c \

 	phishcheck.h phish_domaincheck_db.c phish_domaincheck_db.h \

 	phish_whitelist.c phish_whitelist.h iana_cctld.h iana_tld.h \

 	regex_list.c regex_list.h regex_suffix.c regex_suffix.h \

@@ -1612,6 +1615,7 @@ distclean-compile:

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-elf.Plo@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-entconv.Plo@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-events.Plo@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-execs.Plo@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-explode.Plo@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-filetypes.Plo@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libclamav_la-filtering.Plo@am__quote@

@@ -2276,6 +2280,13 @@ libclamav_la-elf.lo: elf.c

 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@

 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -c -o libclamav_la-elf.lo `test -f 'elf.c' || echo '$(srcdir)/'`elf.c

+libclamav_la-execs.lo: execs.c

+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -MT libclamav_la-execs.lo -MD -MP -MF $(DEPDIR)/libclamav_la-execs.Tpo -c -o libclamav_la-execs.lo `test -f 'execs.c' || echo '$(srcdir)/'`execs.c

+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libclamav_la-execs.Tpo $(DEPDIR)/libclamav_la-execs.Plo

+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='execs.c' object='libclamav_la-execs.lo' libtool=yes @AMDEPBACKSLASH@

+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@

+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -c -o libclamav_la-execs.lo `test -f 'execs.c' || echo '$(srcdir)/'`execs.c

+

 libclamav_la-sis.lo: sis.c

 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libclamav_la_CFLAGS) $(CFLAGS) -MT libclamav_la-sis.lo -MD -MP -MF $(DEPDIR)/libclamav_la-sis.Tpo -c -o libclamav_la-sis.lo `test -f 'sis.c' || echo '$(srcdir)/'`sis.c

 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libclamav_la-sis.Tpo $(DEPDIR)/libclamav_la-sis.Plo

@@ -2036,7 +2036,6 @@ int asn1_load_mscat(fmap_t *map, struct cl_engine *engine)

 {

     struct cli_asn1 c;

     unsigned int size;

-    struct cli_matcher *db;

     int i;

     // TODO As currently implemented, loading in a .cat file with -d requires

@@ -2172,7 +2171,7 @@ int asn1_load_mscat(fmap_t *map, struct cl_engine *engine)

                 cli_dbgmsg("asn1_load_mscat: got hash %s (%s)\n", sha1, (hashtype == 2) ? "PE" : "CAB");

             }

             if (!engine->hm_fp) {

-                if (!(engine->hm_fp = mpool_calloc(engine->mempool, 1, sizeof(*db)))) {

+                if (!(engine->hm_fp = mpool_calloc(engine->mempool, 1, sizeof(*(engine->hm_fp))))) {

                     tag.size = 1;

                     return 1;

                 }

@@ -45,7 +45,9 @@

 #include "json.h"

 #endif

+#ifndef MAX_BC

 #define MAX_BC 64

+#endif

 #define BC_EVENTS_PER_SIG 2

 #define MAX_BC_SIGEVENT_ID MAX_BC *BC_EVENTS_PER_SIG

@@ -2776,7 +2778,7 @@ int cli_bytecode_runlsig(cli_ctx *cctx, struct cli_target_info *tinfo,

     cli_bytecode_context_setctx(&ctx, cctx);

     cli_bytecode_context_setfile(&ctx, map);

     if (tinfo && tinfo->status == 1) {

-        ctx.sections = tinfo->exeinfo.section;

+        ctx.sections = tinfo->exeinfo.sections;

         memset(&pehookdata, 0, sizeof(pehookdata));

         pehookdata.offset    = tinfo->exeinfo.offset;

         pehookdata.ep        = tinfo->exeinfo.ep;

@@ -339,7 +339,7 @@ static int cli_tgzload(int fd, struct cl_engine *engine, unsigned int *signo, un

         else

             off = ftell(dbio->fs);

-        if ((!dbinfo && cli_strbcasestr(name, ".info")) || (dbinfo && (CLI_DBEXT(name) || cli_strbcasestr(name, ".ign") || cli_strbcasestr(name, ".ign2")))) {

+        if ((!dbinfo && cli_strbcasestr(name, ".info")) || (dbinfo && CLI_DBEXT(name))) {

             ret = cli_load(name, engine, signo, options, dbio);

             if (ret) {

                 cli_errmsg("cli_tgzload: Can't load %s\n", name);

@@ -444,8 +444,8 @@ static int cli_elf_sh32(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

         cli_dbgmsg("ELF: Section header table offset: %d\n", shoff);

     if (elfinfo) {

-        elfinfo->section = (struct cli_exe_section *)cli_calloc(shnum, sizeof(struct cli_exe_section));

-        if (!elfinfo->section) {

+        elfinfo->sections = (struct cli_exe_section *)cli_calloc(shnum, sizeof(struct cli_exe_section));

+        if (!elfinfo->sections) {

             cli_dbgmsg("ELF: Can't allocate memory for section headers\n");

             return CL_EMEM;

         }

@@ -455,10 +455,7 @@ static int cli_elf_sh32(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

         section_hdr = (struct elf_section_hdr32 *)cli_calloc(shnum, shentsize);

         if (!section_hdr) {

             cli_errmsg("ELF: Can't allocate memory for section headers\n");

-            if (elfinfo) {

-                free(elfinfo->section);

-                elfinfo->section = NULL;

-            }

+            cli_exe_info_destroy(elfinfo);

             return CL_EMEM;

         }

         if (ctx) {

@@ -476,10 +473,7 @@ static int cli_elf_sh32(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

                 cli_dbgmsg("ELF: Possibly broken ELF file\n");

             }

             free(section_hdr);

-            if (elfinfo) {

-                free(elfinfo->section);

-                elfinfo->section = NULL;

-            }

+            cli_exe_info_destroy(elfinfo);

             if (ctx && SCAN_HEURISTIC_BROKEN) {

                 cli_append_virus(ctx, "Heuristics.Broken.Executable");

                 return CL_VIRUS;

@@ -490,9 +484,9 @@ static int cli_elf_sh32(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

         shoff += sizeof(struct elf_section_hdr32);

         if (elfinfo) {

-            elfinfo->section[i].rva = EC32(section_hdr[i].sh_addr, conv);

-            elfinfo->section[i].raw = EC32(section_hdr[i].sh_offset, conv);

-            elfinfo->section[i].rsz = EC32(section_hdr[i].sh_size, conv);

+            elfinfo->sections[i].rva = EC32(section_hdr[i].sh_addr, conv);

+            elfinfo->sections[i].raw = EC32(section_hdr[i].sh_offset, conv);

+            elfinfo->sections[i].rsz = EC32(section_hdr[i].sh_size, conv);

         }

         if (ctx) {

             cli_dbgmsg("ELF: Section %u\n", i);

@@ -553,8 +547,8 @@ static int cli_elf_sh64(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

         cli_dbgmsg("ELF: Section header table offset: " STDu64 "\n", shoff);

     if (elfinfo) {

-        elfinfo->section = (struct cli_exe_section *)cli_calloc(shnum, sizeof(struct cli_exe_section));

-        if (!elfinfo->section) {

+        elfinfo->sections = (struct cli_exe_section *)cli_calloc(shnum, sizeof(struct cli_exe_section));

+        if (!elfinfo->sections) {

             cli_dbgmsg("ELF: Can't allocate memory for section headers\n");

             return CL_EMEM;

         }

@@ -564,10 +558,7 @@ static int cli_elf_sh64(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

         section_hdr = (struct elf_section_hdr64 *)cli_calloc(shnum, shentsize);

         if (!section_hdr) {

             cli_errmsg("ELF: Can't allocate memory for section headers\n");

-            if (elfinfo) {

-                free(elfinfo->section);

-                elfinfo->section = NULL;

-            }

+            cli_exe_info_destroy(elfinfo);

             return CL_EMEM;

         }

         if (ctx) {

@@ -585,10 +576,7 @@ static int cli_elf_sh64(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

                 cli_dbgmsg("ELF: Possibly broken ELF file\n");

             }

             free(section_hdr);

-            if (elfinfo) {

-                free(elfinfo->section);

-                elfinfo->section = NULL;

-            }

+            cli_exe_info_destroy(elfinfo);

             if (ctx && SCAN_HEURISTIC_BROKEN) {

                 cli_append_virus(ctx, "Heuristics.Broken.Executable");

                 return CL_VIRUS;

@@ -599,9 +587,9 @@ static int cli_elf_sh64(cli_ctx *ctx, fmap_t *map, struct cli_exe_info *elfinfo,

         shoff += sizeof(struct elf_section_hdr64);

         if (elfinfo) {

-            elfinfo->section[i].rva = EC64(section_hdr[i].sh_addr, conv);

-            elfinfo->section[i].raw = EC64(section_hdr[i].sh_offset, conv);

-            elfinfo->section[i].rsz = EC64(section_hdr[i].sh_size, conv);

+            elfinfo->sections[i].rva = EC64(section_hdr[i].sh_addr, conv);

+            elfinfo->sections[i].raw = EC64(section_hdr[i].sh_offset, conv);

+            elfinfo->sections[i].rsz = EC64(section_hdr[i].sh_size, conv);

         }

         if (ctx) {

             cli_dbgmsg("ELF: Section " STDu32 "\n", (uint32_t)i);

new file mode 100644

@@ -0,0 +1,50 @@

+/*

+ *  Copyright (C) 2018 Cisco Systems, Inc. and/or its affiliates. All rights reserved.

+ *

+ *  Authors: Andrew Williams

+ *

+ *  This program is free software; you can redistribute it and/or modify

+ *  it under the terms of the GNU General Public License version 2 as

+ *  published by the Free Software Foundation.

+ *

+ *  This program is distributed in the hope that it will be useful,

+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *  GNU General Public License for more details.

+ *

+ *  You should have received a copy of the GNU General Public License

+ *  along with this program; if not, write to the Free Software

+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

+ *  MA 02110-1301, USA.

+ */

+

+#include "execs.h"

+#include <string.h>

+

+void cli_exe_info_init(struct cli_exe_info *exeinfo, uint32_t offset)

+{

+

+    if (NULL == exeinfo) {

+        return;

+    }

+    // TODO the memset below might not be needed.  Instead, replace with:

+    // exeinfo->sections = NULL;

+    // memset(&exeinfo->vinfo, '\0', sizeof(exeinfo->vinfo));

+    memset(exeinfo, '\0', sizeof(*exeinfo));

+    exeinfo->offset = offset;

+}

+

+void cli_exe_info_destroy(struct cli_exe_info *exeinfo)

+{

+

+    if (NULL == exeinfo) {

+        return;

+    }

+

+    if (NULL != exeinfo->sections) {

+        free(exeinfo->sections);

+        exeinfo->sections = NULL;

+    }

+

+    cli_hashset_destroy(&(exeinfo->vinfo));

+}

\ No newline at end of file

@@ -25,10 +25,25 @@

 #include "clamav-types.h"

 #include "hashtab.h"

 #include "bcfeatures.h"

+#include "pe_structs.h"

 /** @file */

 /** Section of executable file.

   \group_pe

+ *  NOTE: This is used to store PE, MachO, and ELF section information. Not

+ *  all members are populated by the respective parsing functions.

+ *

+ *  NOTE: This structure MUST stay in-sync with the ones defined within the

+ *  clamav-bytecode-compiler source at:

+ *  - clang/lib/Headers/bytecode_execs.h

+ *  - llvm/tools/clang/lib/Headers/bytecode_execs.h

+ *  We allocate space for an array of these and pass it directly to the

+ *  bytecode sig runtime for use.

+ *

+ *  TODO Next time we are making changes to the clamav-bytecode-compiler

+ *  source, modify this structure to also include the section name (here and

+ *  there).  Then, populate this field in the PE/MachO/ELF header parsing

+ *  functions.  Choose a length that's reasonable for all platforms

 */

 struct cli_exe_section {

     uint32_t rva;  /**< Relative VirtualAddress */

@@ -43,25 +58,111 @@ struct cli_exe_section {

 };

 /** Executable file information

-  \group_pe

+ *  NOTE: This is used to store PE, MachO, and ELF executable information,

+ *  but it predominantly has fields for PE info.  Not all members are

+ *  populated by the respective parsing functions.

+ * 

+ *  TODO: Document which fields are PE only (maybe put those into a union of

+ *  structs containing the various type-specific members)

+

+ *  NOTE: This structure is also defined in the clamav-bytecode-compiler

+ *  source at:

+ *  - clang/lib/Headers/bytecode_execs.h

+ *  - llvm/tools/clang/lib/Headers/bytecode_execs.h

+ *  Based on how we use it, though, it doesn't need to stay in-sync

+ *

+ *  TODO Next time we are making changes to the clamav-bytecode-compiler

+ *  source, remove this structure definition there so it's not confusing

 */

 struct cli_exe_info {

     /** Information about all the sections of this file. 

      * This array has \p nsection elements */

-    struct cli_exe_section *section;

-    /** Offset where this executable start in file (nonzero if embedded) */

+    struct cli_exe_section *sections;

+

+    /** Offset where this executable starts in file (nonzero if embedded) */

     uint32_t offset;

-    /** Entrypoint of executable */

+

+    /** File offset to the entrypoint of the executable. */

     uint32_t ep;

-    /** Number of sections*/

+

+    /** Number of sections.

+     *  NOTE: If a section is determined to be invalid (exists outside of the

+     *  file) then it will not be included in this count (at least for PE).

+     */

     uint16_t nsections;

+

+    // TODO Remove - not required

     void *dummy; /* for compat - preserve offset */

+

     /** Resources RVA - PE ONLY */

+    // TODO Maybe get rid of this - it looks like it's only used by the

+    // icon matching code (and maybe the bytecode API more broadly?)

     uint32_t res_addr;

-    /** Address size - PE ONLY */

+

+    /** Size of the  header (aligned) - PE ONLY. This corresponds to

+     *  SizeOfHeaders in the optional header

+    */

     uint32_t hdr_size;

+

     /** Hashset for versioninfo matching */

     struct cli_hashset vinfo;

+

+    /** Entry point RVA */

+    uint32_t vep;

+

+    /** Number of data directory entries at the end of the optional header.

+     *  This also corresponds to the number of entries in dirs that has

+     *  been populated with information.

+     */

+    uint32_t ndatadirs;

+

+    /** Whether this file is a DLL */

+    uint32_t is_dll;

+

+    /** Whether this file is a PE32+ exe (64-bit) */

+    uint32_t is_pe32plus;

+

+    /**< address of new exe header */

+    uint32_t e_lfanew;

+

+    /** The lowest section RVA */

+    uint32_t min;

+

+    /** The RVA of the highest byte contained within a section */

+    uint32_t max;

+

+    /** Offset of any file overlays, as determined by parsing the PE header */

+    uint32_t overlay_start;

+

+    /**< size of overlay */

+    uint32_t overlay_size;

+

+    /* Raw data copied in from the EXE directly.

+     *

+     * NOTE: The data in the members below haven't been converted to host

+     * endianness, so all field accesses most account for this to ensure

+     * proper functionality on big endian systems (the PE header is always

+     * little-endian)

+     */

+

+    /** Image File Header for this PE file */

+    struct pe_image_file_hdr file_hdr;

+

+    /** PE optional header. Use is_pe32plus to determine whether the 32-bit

+     *  or 64-bit union member should be used. */

+    union {

+        struct pe_image_optional_hdr64 opt64;

+        struct pe_image_optional_hdr32 opt32;

+    } pe_opt;

+

+    /**< PE data directory header. If ndatadirs is less than 16,

+     * the unpopulated entries will be memset'd to zero.

+     */

+    struct pe_image_data_dir dirs[16];

 };

+// TODO Document

+void cli_exe_info_init(struct cli_exe_info *exeinfo, uint32_t offset);

+void cli_exe_info_destroy(struct cli_exe_info *exeinfo);

+

 #endif

@@ -483,7 +483,7 @@ int cli_scanmacho(cli_ctx *ctx, struct cli_exe_info *fileinfo)

     if (matcher) {

         fileinfo->ep        = ep;

         fileinfo->nsections = sect;

-        fileinfo->section   = sections;

+        fileinfo->sections  = sections;

         return 0;

     } else {

         free(sections);

@@ -55,7 +55,9 @@

 #undef MATCHER_PCRE_DEBUG

 /* PERFORMANCE MACROS AND FUNCTIONS */

+#ifndef MAX_TRACKED_PCRE

 #define MAX_TRACKED_PCRE 64

+#endif

 #define PCRE_EVENTS_PER_SIG 2

 #define MAX_PCRE_SIGEVENT_ID MAX_TRACKED_PCRE *PCRE_EVENTS_PER_SIG

@@ -445,8 +445,12 @@ int cli_caloff(const char *offstr, const struct cli_target_info *info, unsigned

         *offset_min = CLI_OFF_NONE;

         if (offset_max)

             *offset_max = CLI_OFF_NONE;

-        if (info->status == -1)

+        if (info->status == -1) {

+            // TODO I wonder if this means that sigs with these types won't

+            // work (which kinda makes sense).  Warn the user of this for now

+            cli_dbgmsg("cli_caloff: cli_target_info is invalid - unable to determine offsets for ndb/ldb subsigs using EOF-n/EP+n/EP-n/Sx+n/SEx/SL+n\n");

             return CL_SUCCESS;

+        }

         switch (offdata[0]) {

             case CLI_OFF_EOF_MINUS:

@@ -462,23 +466,26 @@ int cli_caloff(const char *offstr, const struct cli_target_info *info, unsigned

                 break;

             case CLI_OFF_SL_PLUS:

-                *offset_min = info->exeinfo.section[info->exeinfo.nsections - 1].raw + offdata[1];

+                *offset_min = info->exeinfo.sections[info->exeinfo.nsections - 1].raw + offdata[1];

                 break;

             case CLI_OFF_SX_PLUS:

                 if (offdata[3] >= info->exeinfo.nsections)

                     *offset_min = CLI_OFF_NONE;

                 else

-                    *offset_min = info->exeinfo.section[offdata[3]].raw + offdata[1];

+                    *offset_min = info->exeinfo.sections[offdata[3]].raw + offdata[1];

                 break;

             case CLI_OFF_SE:

                 if (offdata[3] >= info->exeinfo.nsections) {

                     *offset_min = CLI_OFF_NONE;

                 } else {

-                    *offset_min = info->exeinfo.section[offdata[3]].raw;

+                    *offset_min = info->exeinfo.sections[offdata[3]].raw;

                     if (offset_max)

-                        *offset_max = *offset_min + info->exeinfo.section[offdata[3]].rsz + offdata[2];

+                        *offset_max = *offset_min + info->exeinfo.sections[offdata[3]].rsz + offdata[2];

+                    // TODO offdata[2] == MaxShift. Won't this make offset_max

+                    // extend beyond the end of the section?  This doesn't seem like

+                    // what we want...

                 }

                 break;

@@ -498,16 +505,31 @@ int cli_caloff(const char *offstr, const struct cli_target_info *info, unsigned

     return CL_SUCCESS;

 }

+void cli_targetinfo_init(struct cli_target_info *info)

+{

+

+    if (NULL == info) {

+        return;

+    }

+    // Things that must be initialized here:

+    // - status (set to 0)

+    // - vinfo

+    // Maybe other things.

+    // TODO Consider replacing with just the required member assignments

+    // for performance

+    memset(info, 0, sizeof(struct cli_target_info));

+

+    cli_hashset_init_noalloc(&info->exeinfo.vinfo);

+}

+

 void cli_targetinfo(struct cli_target_info *info, unsigned int target, fmap_t *map)

 {

     int (*einfo)(fmap_t *, struct cli_exe_info *) = NULL;

-    memset(info, 0, sizeof(struct cli_target_info));

     info->fsize = map->len;

-    cli_hashset_init_noalloc(&info->exeinfo.vinfo);

     if (target == 1)

-        einfo = cli_peheader;

+        einfo = cli_pe_targetinfo;

     else if (target == 6)

         einfo = cli_elfheader;

     else if (target == 9)

@@ -521,6 +543,16 @@ void cli_targetinfo(struct cli_target_info *info, unsigned int target, fmap_t *m

         info->status = 1;

 }

+void cli_targetinfo_destroy(struct cli_target_info *info)

+{

+

+    if (NULL == info || info->status != 1) {

+        return;

+    }

+

+    cli_exe_info_destroy(&(info->exeinfo));

+}

+

 int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx)

 {

     return cli_checkfp_virus(digest, size, ctx, NULL);

@@ -667,7 +699,7 @@ static int matchicon(cli_ctx *ctx, struct cli_exe_info *exeinfo, const char *grp

     cli_icongroupset_init(&iconset);

     cli_icongroupset_add(grp1 ? grp1 : "*", &iconset, 0, ctx);

     cli_icongroupset_add(grp2 ? grp2 : "*", &iconset, 1, ctx);

-    return cli_scanicon(&iconset, exeinfo->res_addr, ctx, exeinfo->section, exeinfo->nsections, exeinfo->hdr_size);

+    return cli_scanicon(&iconset, ctx, exeinfo);

 }

 int32_t cli_bcapi_matchicon(struct cli_bc_ctx *ctx, const uint8_t *grp1, int32_t grp1len,

@@ -700,7 +732,7 @@ int32_t cli_bcapi_matchicon(struct cli_bc_ctx *ctx, const uint8_t *grp1, int32_t

             info.res_addr = le32_to_host(ctx->hooks.pedata->dirs[2].VirtualAddress);

     } else

         info.res_addr = ctx->resaddr; /* from target_info */

-    info.section   = (struct cli_exe_section *)ctx->sections;

+    info.sections  = (struct cli_exe_section *)ctx->sections;

     info.nsections = ctx->hooks.pedata->nsections;

     info.hdr_size  = ctx->hooks.pedata->hdr_size;

     cli_dbgmsg("bytecode matchicon %s %s\n", group1, group2);

@@ -939,14 +971,12 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

             maxpatlen = groot->maxpatlen;

     }

+    cli_targetinfo_init(&info);

     cli_targetinfo(&info, i, map);

     if (!ftonly) {

         if ((ret = cli_ac_initdata(&gdata, groot->ac_partsigs, groot->ac_lsigs, groot->ac_reloff_num, CLI_DEFAULT_AC_TRACKLEN)) || (ret = cli_ac_caloff(groot, &gdata, &info))) {

-            if (info.exeinfo.section)

-                free(info.exeinfo.section);

-

-            cli_hashset_destroy(&info.exeinfo.vinfo);

+            cli_targetinfo_destroy(&info);

             cl_hash_destroy(md5ctx);

             cl_hash_destroy(sha1ctx);

             cl_hash_destroy(sha256ctx);

@@ -954,10 +984,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

         }

         if ((ret = cli_pcre_recaloff(groot, &gpoff, &info, ctx))) {

             cli_ac_freedata(&gdata);

-            if (info.exeinfo.section)

-                free(info.exeinfo.section);

-

-            cli_hashset_destroy(&info.exeinfo.vinfo);

+            cli_targetinfo_destroy(&info);

             cl_hash_destroy(md5ctx);

             cl_hash_destroy(sha1ctx);

             cl_hash_destroy(sha256ctx);

@@ -971,10 +998,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

                 cli_ac_freedata(&gdata);

                 cli_pcre_freeoff(&gpoff);

             }

-            if (info.exeinfo.section)

-                free(info.exeinfo.section);

-

-            cli_hashset_destroy(&info.exeinfo.vinfo);

+            cli_targetinfo_destroy(&info);

             cl_hash_destroy(md5ctx);

             cl_hash_destroy(sha1ctx);

             cl_hash_destroy(sha256ctx);

@@ -989,10 +1013,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

                     }

                     cli_ac_freedata(&tdata);

-                    if (info.exeinfo.section)

-                        free(info.exeinfo.section);

-

-                    cli_hashset_destroy(&info.exeinfo.vinfo);

+                    cli_targetinfo_destroy(&info);

                     cl_hash_destroy(md5ctx);

                     cl_hash_destroy(sha1ctx);

                     cl_hash_destroy(sha256ctx);

@@ -1011,10 +1032,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

             cli_ac_freedata(&tdata);

             if (bm_offmode)

                 cli_bm_freeoff(&toff);

-            if (info.exeinfo.section)

-                free(info.exeinfo.section);

-

-            cli_hashset_destroy(&info.exeinfo.vinfo);

+            cli_targetinfo_destroy(&info);

             cl_hash_destroy(md5ctx);

             cl_hash_destroy(sha1ctx);

             cl_hash_destroy(sha256ctx);

@@ -1076,10 +1094,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

                     cli_bm_freeoff(&toff);

                 cli_pcre_freeoff(&tpoff);

-                if (info.exeinfo.section)

-                    free(info.exeinfo.section);

-

-                cli_hashset_destroy(&info.exeinfo.vinfo);

+                cli_targetinfo_destroy(&info);

                 cl_hash_destroy(md5ctx);

                 cl_hash_destroy(sha1ctx);

                 cl_hash_destroy(sha256ctx);

@@ -1105,10 +1120,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

                     cli_pcre_freeoff(&tpoff);

                 }

-                if (info.exeinfo.section)

-                    free(info.exeinfo.section);

-

-                cli_hashset_destroy(&info.exeinfo.vinfo);

+                cli_targetinfo_destroy(&info);

                 cl_hash_destroy(md5ctx);

                 cl_hash_destroy(sha1ctx);

                 cl_hash_destroy(sha256ctx);

@@ -1233,10 +1245,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

         cli_pcre_freeoff(&gpoff);

     }

-    if (info.exeinfo.section)

-        free(info.exeinfo.section);

-

-    cli_hashset_destroy(&info.exeinfo.vinfo);

+    cli_targetinfo_destroy(&info);

     if (SCAN_ALLMATCHES && viruses_found) {

         return CL_VIRUS;

@@ -35,6 +35,9 @@ struct cli_target_info {

     int status; /* 0 == not initialised, 1 == initialised OK, -1 == error */

 };

+void cli_targetinfo_init(struct cli_target_info *info);

+void cli_targetinfo_destroy(struct cli_target_info *info);

+

 #include "matcher-ac.h"

 #include "matcher-bm.h"

 #include "matcher-hash.h"

@@ -94,9 +94,7 @@

 #define PE_IMAGE_NT_SIGNATURE 0x00004550

 #define PE32_SIGNATURE 0x010b

 #define PE32P_SIGNATURE 0x020b

-

-#define optional_hdr64 pe_opt.opt64

-#define optional_hdr32 pe_opt.opt32

+#define OPT_HDR_SIZE_DIFF (sizeof(struct pe_image_optional_hdr64) - sizeof(struct pe_image_optional_hdr32))

 #define UPX_NRV2B "\x11\xdb\x11\xc9\x01\xdb\x75\x07\x8b\x1e\x83\xee\xfc\x11\xdb\x11\xc9\x11\xc9\x75\x20\x41\x01\xdb"

 #define UPX_NRV2D "\x83\xf0\xff\x74\x78\xd1\xf8\x89\xc5\xeb\x0b\x01\xdb\x75\x07\x8b\x1e\x83\xee\xfc\x11\xdb\x11\xc9"

@@ -119,20 +117,23 @@

 #define PEALIGN(o, a) (((a)) ? (((o) / (a)) * (a)) : (o))

 #define PESALIGN(o, a) (((a)) ? (((o) / (a) + ((o) % (a) != 0)) * (a)) : (o))

+// TODO Replace all of these with static inline functions

 #define CLI_UNPSIZELIMITS(NAME, CHK)                           \

     if (cli_checklimits(NAME, ctx, (CHK), 0, 0) != CL_CLEAN) { \

-        free(exe_sections);                                    \

+        cli_exe_info_destroy(peinfo);                          \

         return CL_CLEAN;                                       \

     }

 #define CLI_UNPTEMP(NAME, FREEME)                                                       \

     if (!(tempfile = cli_gentemp(ctx->engine->tmpdir))) {                               \

+        cli_exe_info_destroy(peinfo);                                                   \

         cli_multifree FREEME;                                                           \

         return CL_EMEM;                                                                 \

     }                                                                                   \

     if ((ndesc = open(tempfile, O_RDWR | O_CREAT | O_TRUNC | O_BINARY, S_IRWXU)) < 0) { \

         cli_dbgmsg(NAME ": Can't create file %s\n", tempfile);                          \

         free(tempfile);                                                                 \

+        cli_exe_info_destroy(peinfo);                                                   \

         cli_multifree FREEME;                                                           \

         return CL_ECREAT;                                                               \

     }

@@ -168,7 +169,7 @@

         cli_dbgmsg(NAME ": Successfully decompressed\n"); \

         close(ndesc);                                     \

         if (cli_unlink(tempfile)) {                       \

-            free(exe_sections);                           \

+            cli_exe_info_destroy(peinfo);                 \

             free(tempfile);                               \

             FREESEC;                                      \

             return CL_EUNLINK;                            \

@@ -179,17 +180,17 @@

         upx_success = 1;                                  \

         break; /* FSG ONLY! - scan raw data after upx block */

-#define SPINCASE()                             \

-    case 2:                                    \

-        free(spinned);                         \

-        close(ndesc);                          \

-        if (cli_unlink(tempfile)) {            \

-            free(exe_sections);                \

-            free(tempfile);                    \

-            return CL_EUNLINK;                 \

-        }                                      \

-        cli_dbgmsg("PESpin: Size exceeded\n"); \

-        free(tempfile);                        \

+#define SPINCASE()                                         \

+    case 2:                                                \

+        free(spinned);                                     \

+        close(ndesc);                                      \

+        if (cli_unlink(tempfile)) {                        \

+            cli_exe_info_destroy(peinfo);                  \

+            free(tempfile);                                \

+            return CL_EUNLINK;                             \

+        }                                                  \

+        cli_dbgmsg("cli_scanpe: PESpin: Size exceeded\n"); \

+        free(tempfile);                                    \

         break;

 #define CLI_UNPRESULTS_(NAME, FSGSTUFF, EXPR, GOOD, FREEME)                                   \

@@ -200,15 +201,15 @@

             else                                                                              \

                 cli_dbgmsg(NAME ": Unpacked and rebuilt executable\n");                       \

             cli_multifree FREEME;                                                             \

-            free(exe_sections);                                                               \

+            cli_exe_info_destroy(peinfo);                                                     \

             lseek(ndesc, 0, SEEK_SET);                                                        \

             cli_dbgmsg("***** Scanning rebuilt PE file *****\n");                             \

             SHA_OFF;                                                                          \

             if (cli_magic_scandesc(ndesc, tempfile, ctx) == CL_VIRUS) {                       \

                 close(ndesc);                                                                 \

+                SHA_RESET;                                                                    \

                 CLI_TMPUNLK();                                                                \

                 free(tempfile);                                                               \

-                SHA_RESET;                                                                    \

                 return CL_VIRUS;                                                              \

             }                                                                                 \

             SHA_RESET;                                                                        \

@@ -223,7 +224,7 @@

             cli_dbgmsg(NAME ": Unpacking failed\n");                                          \

             close(ndesc);                                                                     \

             if (cli_unlink(tempfile)) {                                                       \

-                free(exe_sections);                                                           \

+                cli_exe_info_destroy(peinfo);                                                 \

                 free(tempfile);                                                               \

                 cli_multifree FREEME;                                                         \

                 return CL_EUNLINK;                                                            \

@@ -233,6 +234,9 @@

     }

 #define CLI_UNPRESULTS(NAME, EXPR, GOOD, FREEME) CLI_UNPRESULTS_(NAME, (void)0, EXPR, GOOD, FREEME)

+// TODO The second argument to FSGCASE below should match what gets freed as

+// indicated by FREEME, otherwise a memory leak can occur (as currently used,

+// it looks like dest can get leaked by these macros).

 #define CLI_UNPRESULTSFSG1(NAME, EXPR, GOOD, FREEME) CLI_UNPRESULTS_(NAME, FSGCASE(NAME, free(sections)), EXPR, GOOD, FREEME)

 #define CLI_UNPRESULTSFSG2(NAME, EXPR, GOOD, FREEME) CLI_UNPRESULTS_(NAME, FSGCASE(NAME, (void)0), EXPR, GOOD, FREEME)

@@ -308,6 +312,8 @@ static int versioninfo_cb(void *opaque, uint32_t type, uint32_t name, uint32_t l

     return 0;

 }

+/* Given an RVA (relative to the ImageBase), return the file offset of the

+ * corresponding data */

 uint32_t cli_rawaddr(uint32_t rva, const struct cli_exe_section *shp, uint16_t nos, unsigned int *err, size_t fsize, uint32_t hdr_size)

 {

     int i, found = 0;

@@ -324,7 +330,7 @@ uint32_t cli_rawaddr(uint32_t rva, const struct cli_exe_section *shp, uint16_t n

     }

     for (i = nos - 1; i >= 0; i--) {

-        if (shp[i].rsz && shp[i].rva <= rva && shp[i].rsz > rva - shp[i].rva) {

+        if (shp[i].rsz && shp[i].rva <= rva && shp[i].rsz > (rva - shp[i].rva)) {

             found = 1;

             break;

         }

@@ -335,19 +341,19 @@ uint32_t cli_rawaddr(uint32_t rva, const struct cli_exe_section *shp, uint16_t n

         return 0;

     }

-    ret  = rva - shp[i].rva + shp[i].raw;

+    ret  = (rva - shp[i].rva) + shp[i].raw;

     *err = 0;

     return ret;

 }

 /* 

-   void findres(uint32_t by_type, uint32_t by_name, uint32_t res_rva, cli_ctx *ctx, struct cli_exe_section *exe_sections, uint16_t nsections, uint32_t hdr_size, int (*cb)(void *, uint32_t, uint32_t, uint32_t, uint32_t), void *opaque)

+   void findres(uint32_t by_type, uint32_t by_name, fmap_t *map, struct cli_exe_info *peinfo, int (*cb)(void *, uint32_t, uint32_t, uint32_t, uint32_t), void *opaque)

    callback based res lookup

    by_type: lookup type

    by_name: lookup name or (unsigned)-1 to look for any name

    res_rva: base resource rva (i.e. dirs[2].VirtualAddress)

-   ctx, exe_sections, nsections, hdr_size: same as in scanpe

+   map, peinfo: same as in scanpe

    cb: the callback function executed on each successful match

    opaque: an opaque pointer passed to the callback

@@ -355,14 +361,21 @@ uint32_t cli_rawaddr(uint32_t rva, const struct cli_exe_section *shp, uint16_t n

    int pe_res_cballback (void *opaque, uint32_t type, uint32_t name, uint32_t lang, uint32_t rva);

    the callback shall return 0 to continue the lookup or 1 to abort

 */

-void findres(uint32_t by_type, uint32_t by_name, uint32_t res_rva, fmap_t *map, struct cli_exe_section *exe_sections, uint16_t nsections, uint32_t hdr_size, int (*cb)(void *, uint32_t, uint32_t, uint32_t, uint32_t), void *opaque)

+void findres(uint32_t by_type, uint32_t by_name, fmap_t *map, struct cli_exe_info *peinfo, int (*cb)(void *, uint32_t, uint32_t, uint32_t, uint32_t), void *opaque)

 {

     unsigned int err = 0;

     uint32_t type, type_offs, name, name_offs, lang, lang_offs;

     const uint8_t *resdir, *type_entry, *name_entry, *lang_entry;

     uint16_t type_cnt, name_cnt, lang_cnt;

+    uint32_t res_rva;

+

+    if (NULL == peinfo || peinfo->ndatadirs < 3) {

+        return;

+    }

-    if (!(resdir = fmap_need_off_once(map, cli_rawaddr(res_rva, exe_sections, nsections, &err, map->len, hdr_size), 16)) || err)

+    res_rva = EC32(peinfo->dirs[2].VirtualAddress);

+

+    if (!(resdir = fmap_need_off_once(map, cli_rawaddr(res_rva, peinfo->sections, peinfo->nsections, &err, map->len, peinfo->hdr_size), 16)) || err)

         return;

     type_cnt   = (uint16_t)cli_readint16(resdir + 12);

@@ -379,7 +392,7 @@ void findres(uint32_t by_type, uint32_t by_name, uint32_t res_rva, fmap_t *map,

         type_offs = cli_readint32(type_entry + 4);

         if (type == by_type && (type_offs >> 31)) {

             type_offs &= 0x7fffffff;

-            if (!(resdir = fmap_need_off_once(map, cli_rawaddr(res_rva + type_offs, exe_sections, nsections, &err, map->len, hdr_size), 16)) || err)

+            if (!(resdir = fmap_need_off_once(map, cli_rawaddr(res_rva + type_offs, peinfo->sections, peinfo->nsections, &err, map->len, peinfo->hdr_size), 16)) || err)