@@ -611,9 +611,9 @@ Byte compare subsignatures can be used to evaluate a numeric value at a given of

   - `offset` must be a positive hex or decimal value. This will be the number of bytes from the start of the referenced `subsigid_trigger` match within the file buffer to begin the comparison.

-- `byte_options` are used to specify the numeric type and endianess of the extracted byte sequence in that order as well as the number of bytes to be read. By default ClamAV will attempt to matchup up to the number of byte specified, unless the `e` (exact) option is specified or the numeric type is `b` (binary).  This field follows the form `[h|d|i][l|b][e]num_bytes`

+- `byte_options` are used to specify the numeric type and endianess of the extracted byte sequence in that order as well as the number of bytes to be read. By default ClamAV will attempt to matchup up to the number of byte specified, unless the `e` (exact) option is specified or the numeric type is `b` (binary).  This field follows the form `[h|d|a|i][l|b][e]num_bytes`

-  - `h|d|i` where `h` specifies the byte sequence will be in hex, `d` decimal, and `i` signifies raw binary data.

+  - `h|d|a|i` where `h` specifies the byte sequence will be in hex, `d` decimal, `a` automatic detection of hex or decimal at runtime, and `i` signifies raw binary data.

   - `l|b` where `l` specifies the byte sequence will be in little endian order and `b` big endian.

@@ -221,26 +221,38 @@ cl_error_t cli_bcomp_addpatt(struct cli_matcher *root, const char *virname, cons

         switch (*buf_start) {

             case 'h':

-                /* hex, decimal, and binary options are mutually exclusive parameters */

-                if (bcomp->options & CLI_BCOMP_DEC || bcomp->options & CLI_BCOMP_BIN) {

+                /* hex, decimal, auto, and binary options are mutually exclusive parameters */

+                if (bcomp->options & CLI_BCOMP_DEC || bcomp->options & CLI_BCOMP_BIN || bcomp->options & CLI_BCOMP_AUTO) {

                     ret = CL_EMALFDB;

                 } else {

                     bcomp->options |= CLI_BCOMP_HEX;

                 } break;

+

             case 'd':

-                /* hex, decimal, and binary options are mutually exclusive parameters */

-                if (bcomp->options & CLI_BCOMP_HEX || bcomp->options & CLI_BCOMP_BIN) {

+                /* hex, decimal, auto, and binary options are mutually exclusive parameters */

+                if (bcomp->options & CLI_BCOMP_HEX || bcomp->options & CLI_BCOMP_BIN || bcomp->options & CLI_BCOMP_AUTO) {

                     ret = CL_EMALFDB;

                 } else {

                     bcomp->options |= CLI_BCOMP_DEC;

                 } break;

+

             case 'i':

-                /* hex, decimal, and binary options are mutually exclusive parameters */

-                if (bcomp->options & CLI_BCOMP_HEX || bcomp->options & CLI_BCOMP_DEC) {

+                /* hex, decimal, auto, and binary options are mutually exclusive parameters */

+                if (bcomp->options & CLI_BCOMP_HEX || bcomp->options & CLI_BCOMP_DEC || bcomp->options & CLI_BCOMP_AUTO) {

                     ret = CL_EMALFDB;

                 } else {

                     bcomp->options |= CLI_BCOMP_BIN;

                 } break;

+

+            case 'a':

+                /* for automatic hex or decimal run-time detection */

+                /* hex, decimal, auto, and binary options are mutually exclusive parameters */

+                if (bcomp->options & CLI_BCOMP_HEX || bcomp->options & CLI_BCOMP_DEC || bcomp->options & CLI_BCOMP_BIN) {

+                    ret = CL_EMALFDB;

+                } else {

+                    bcomp->options |= CLI_BCOMP_AUTO;

+                } break;

+

             case 'l':

                 /* little and big endian options are mutually exclusive parameters */

                 if (bcomp->options & CLI_BCOMP_BE) {

@@ -248,6 +260,7 @@ cl_error_t cli_bcomp_addpatt(struct cli_matcher *root, const char *virname, cons

                 } else {

                     bcomp->options |= CLI_BCOMP_LE;

                 } break;

+

             case 'b':

                 /* little and big endian options are mutually exclusive parameters */

                 if (bcomp->options & CLI_BCOMP_LE) {

@@ -255,6 +268,7 @@ cl_error_t cli_bcomp_addpatt(struct cli_matcher *root, const char *virname, cons

                 } else {

                     bcomp->options |= CLI_BCOMP_BE;

                 } break;

+

             case 'e':

                 /* for exact byte length matches */

                 bcomp->options |= CLI_BCOMP_EXACT;

@@ -291,6 +305,14 @@ cl_error_t cli_bcomp_addpatt(struct cli_matcher *root, const char *virname, cons

         return CL_EMALFDB;

     }

+    /* same deal with hex byte lengths */

+    if (bcomp->options & CLI_BCOMP_HEX && (byte_length > CLI_BCOMP_MAX_HEX_BLEN)) {

+        cli_errmsg("cli_bcomp_addpatt: while parsing (%s#%s#%s), byte length was too long\n", tokens[0], tokens[1], tokens[2]);

+        free(buf);

+        cli_bcomp_freemeta(root, bcomp);

+        return CL_EMALFDB;

+    }

+

     bcomp->byte_len = byte_length;

     /* we can have up to two comparison eval statements, each sperated by a comma, let's parse them in a separate string */

@@ -569,6 +591,47 @@ cl_error_t cli_bcomp_compare_check(const unsigned char* buffer, size_t buffer_le

     /* grab the first byte to handle byte length options to convert the string appropriately */

     switch((opt & 0x00FF)) {

+        /*al*/

+        case CLI_BCOMP_AUTO | CLI_BCOMP_LE:

+            errno = 0;

+            value = cli_strntol((char*) buffer, byte_len, (char**) &end_buf, 0);

+            if ((((value == LONG_MAX) || (value == LONG_MIN)) && errno == ERANGE) || NULL == end_buf) {

+

+                bcm_dbgmsg("cli_bcomp_compare_check: little endian conversion unsuccessful\n");

+                return CL_CLEAN;

+            }

+            /*hle*/

+            if (opt & CLI_BCOMP_EXACT) {

+                if (buffer+byte_len != end_buf) {

+

+                    bcm_dbgmsg("cli_bcomp_compare_check: couldn't extract the exact number of requested bytes\n");

+                    return CL_CLEAN;

+                }

+            }

+

+            value = le64_to_host(value);

+            break;

+

+        /*ab*/  

+        case CLI_BCOMP_AUTO | CLI_BCOMP_BE:

+            value = cli_strntol((char*) buffer, byte_len, (char**) &end_buf, 0);

+            if ((((value == LONG_MAX) || (value == LONG_MIN)) && errno == ERANGE) || NULL == end_buf) {

+

+                bcm_dbgmsg("cli_bcomp_compare_check: big endian conversion unsuccessful\n");

+                return CL_CLEAN;

+            }

+            /*hbe*/

+            if (opt & CLI_BCOMP_EXACT) {

+                if (buffer+byte_len != end_buf) {

+

+                    bcm_dbgmsg("cli_bcomp_compare_check: couldn't extract the exact number of requested bytes\n");

+                    return CL_CLEAN;

+                }

+            }

+

+            value = be64_to_host(value);

+            break;

+

         /*hl*/

         case CLI_BCOMP_HEX | CLI_BCOMP_LE:

             errno = 0;

@@ -35,10 +35,12 @@

 #include "mpool.h"

 #define CLI_BCOMP_MAX_BIN_BLEN 8

+#define CLI_BCOMP_MAX_HEX_BLEN 18

 #define CLI_BCOMP_HEX   0x0001

 #define CLI_BCOMP_DEC   0x0002

 #define CLI_BCOMP_BIN   0x0004

+#define CLI_BCOMP_AUTO  0x0008

 #define CLI_BCOMP_LE    0x0010

 #define CLI_BCOMP_BE    0x0020

 #define CLI_BCOMP_EXACT 0x0100