@@ -793,11 +793,16 @@ const char *cli_gettmpdir(void);

 /**

  * @brief Sanitize a relative path, so it cannot have a negative depth.

  *

- * Caller is responsible for freeing the filename.

- *

- * @return char* filename or NULL.

+ * Caller is responsible for freeing the sanitized filepath.

+ * The optioal sanitized_filebase output param is a pointer into the filepath,

+ * if set, and does not need to be freed.

+ *

+ * @param filepath                  The filepath to sanitize

+ * @param filepath_len              The length of the filepath

+ * @param[out] sanitized_filebase   Pointer to the basename portion of the sanitized filepath. (optional)

+ * @return char*

  */

-char *cli_sanitize_filepath(const char *filepath, size_t filepath_len);

+char *cli_sanitize_filepath(const char *filepath, size_t filepath_len, char **sanitized_filebase);

 /**

  * @brief Generate tempfile filename (no path) with a random MD5 hash.

@@ -55,6 +55,7 @@

 #include "clamav.h"

 #include "others.h"

+#include "str.h"

 #include "platform.h"

 #include "regex/regex.h"

 #include "ltdl.h"

@@ -849,7 +850,7 @@ unsigned int cli_rndnum(unsigned int max)

     return 1 + (unsigned int)(max * (rand() / (1.0 + RAND_MAX)));

 }

-char *cli_sanitize_filepath(const char *filepath, size_t filepath_len)

+char *cli_sanitize_filepath(const char *filepath, size_t filepath_len, char **sanitized_filebase)

 {

     uint32_t depth           = 0;

     size_t index             = 0;

@@ -900,9 +901,9 @@ char *cli_sanitize_filepath(const char *filepath, size_t filepath_len)

             }

 #ifdef _WIN32

             /*

-         * Windows' POSIX style API's accept both "/" and "\\" style path separators.

-         * The following checks using POSIX style path separators on Windows.

-         */

+             * Windows' POSIX style API's accept both "/" and "\\" style path separators.

+             * The following checks using POSIX style path separators on Windows.

+             */

         } else if (0 == strncmp(filepath + index, "/", strlen("/"))) {

             /*

              * Is "/".

@@ -931,17 +932,39 @@ char *cli_sanitize_filepath(const char *filepath, size_t filepath_len)

                 sanitized_index += strlen("../");

                 index += strlen("../");

                 depth--;

+

+                /* Convert path separator to Windows separator */

+                sanitized_filepath[sanitized_index - 1] = '\\';

             }

 #endif

         } else {

             /*

              * Is not "/", "./", or "../".

              */

+

             /* Find the next path separator. */

-            next_pathsep = CLI_STRNSTR(filepath + index, PATHSEP, filepath_len - index);

+#ifdef _WIN32

+            char *next_windows_pathsep = NULL;

+#endif

+            next_pathsep = CLI_STRNSTR(filepath + index, "/", filepath_len - index);

+

+#ifdef _WIN32

+            /* Check for both types of separators. */

+            next_windows_pathsep = CLI_STRNSTR(filepath + index, "\\", filepath_len - index);

+            if (NULL != next_windows_pathsep) {

+                if ((NULL == next_pathsep) || (next_windows_pathsep < next_pathsep)) {

+                    next_pathsep = next_windows_pathsep;

+                }

+            }

+#endif

             if (NULL == next_pathsep) {

                 /* No more path separators, copy the rest (filename) into the sanitized path */

                 strncpy(sanitized_filepath + sanitized_index, filepath + index, filepath_len - index);

+

+                if (NULL != sanitized_filebase) {

+                    /* Set output variable to point to the file base name */

+                    *sanitized_filebase = sanitized_filepath + sanitized_index;

+                }

                 break;

             }

             next_pathsep += strlen(PATHSEP); /* Include the path separator in the copy */

@@ -951,6 +974,11 @@ char *cli_sanitize_filepath(const char *filepath, size_t filepath_len)

             sanitized_index += next_pathsep - (filepath + index);

             index += next_pathsep - (filepath + index);

             depth++;

+

+#ifdef _WIN32

+            /* Convert path separator to Windows separator */

+            sanitized_filepath[sanitized_index - 1] = '\\';

+#endif

         }

     }

@@ -966,16 +994,19 @@ done:

 #define SHORT_HASH_LENGTH 10

 char *cli_genfname(const char *prefix)

 {

-    char *sanitized_prefix = NULL;

-    char *fname            = NULL;

+    char *sanitized_prefix      = NULL;

+    char *sanitized_prefix_base = NULL;

+    char *fname                 = NULL;

     unsigned char salt[16 + 32];

     char *tmp;

     int i;

     size_t len;

     if (prefix && (strlen(prefix) > 0)) {

-        sanitized_prefix = cli_sanitize_filepath(prefix, strlen(prefix));

-        len              = strlen(sanitized_prefix) + strlen(".") + SHORT_HASH_LENGTH + 1; /* {prefix}.{SHORT_HASH_LENGTH}\0 */

+        sanitized_prefix = cli_sanitize_filepath(prefix, strlen(prefix), &sanitized_prefix_base);

+    }

+    if (NULL != sanitized_prefix_base) {

+        len = strlen(sanitized_prefix_base) + strlen(".") + SHORT_HASH_LENGTH + 1; /* {prefix}.{SHORT_HASH_LENGTH}\0 */

     } else {

         len = strlen("clamav-") + 48 + strlen(".tmp") + 1; /* clamav-{48}.tmp\0 */

     }

@@ -1001,21 +1032,21 @@ char *cli_genfname(const char *prefix)

     pthread_mutex_unlock(&cli_gentemp_mutex);

 #endif

-    if (!tmp) {

+    if (NULL == tmp) {

         free(fname);

         cli_dbgmsg("cli_genfname: out of memory\n");

         return NULL;

     }

-    if (sanitized_prefix) {

-        if (strlen(sanitized_prefix) > 0) {

-            snprintf(fname, len, "%s.%.*s", sanitized_prefix, SHORT_HASH_LENGTH, tmp);

-        }

-        free(sanitized_prefix);

+    if (NULL != sanitized_prefix_base) {

+        snprintf(fname, len, "%s.%.*s", sanitized_prefix_base, SHORT_HASH_LENGTH, tmp);

     } else {

         snprintf(fname, len, "clamav-%s.tmp", tmp);

     }

+    if (NULL != sanitized_prefix) {

+        free(sanitized_prefix);

+    }

     free(tmp);

     return (fname);

@@ -1567,14 +1567,15 @@ cl_error_t find_file(const char *filename, const char *dir, char *result, size_t

  * Scan an OLE directory for a VBA project.

  * Contrary to cli_vba_scandir, this function uses the dir file to locate VBA modules.

  */

-static cl_error_t cli_vba_scandir_new(const char *dirname, cli_ctx *ctx, struct uniq *U)

+static cl_error_t cli_vba_scandir_new(const char *dirname, cli_ctx *ctx, struct uniq *U, int *has_macros)

 {

     cl_error_t ret   = CL_SUCCESS;

     uint32_t hashcnt = 0;

     char *hash       = NULL;

     char path[PATH_MAX];

     char filename[PATH_MAX];

-    int tempfd = -1;

+    int tempfd        = -1;

+    int viruses_found = 0;

     if (CL_SUCCESS != (ret = uniq_get(U, "dir", 3, &hash, &hashcnt))) {

         cli_dbgmsg("cli_vba_scandir_new: uniq_get('dir') failed with ret code (%d)!\n", ret);

@@ -1591,7 +1592,7 @@ static cl_error_t cli_vba_scandir_new(const char *dirname, cli_ctx *ctx, struct

         if (CL_SUCCESS == find_file(filename, dirname, path, sizeof(path))) {

             cli_dbgmsg("cli_vba_scandir_new: Found dir file: %s\n", path);

-            if ((ret = cli_vba_readdir_new(ctx, path, U, hash, hashcnt, &tempfd)) != CL_SUCCESS) {

+            if ((ret = cli_vba_readdir_new(ctx, path, U, hash, hashcnt, &tempfd, has_macros)) != CL_SUCCESS) {

                 //FIXME: Since we only know the stream name of the OLE2 stream, but not its path inside the

                 //       OLE2 archive, we don't know if we have the right file. The only thing we can do is

                 //       iterate all of them until one succeeds.

@@ -1601,6 +1602,30 @@ static cl_error_t cli_vba_scandir_new(const char *dirname, cli_ctx *ctx, struct

                 continue;

             }

+#if HAVE_JSON

+            if (*has_macros && SCAN_COLLECT_METADATA && (ctx->wrkproperty != NULL)) {

+                cli_jsonbool(ctx->wrkproperty, "HasMacros", 1);

+                json_object *macro_languages = cli_jsonarray(ctx->wrkproperty, "MacroLanguages");

+                if (macro_languages) {

+                    cli_jsonstr(macro_languages, NULL, "VBA");

+                } else {

+                    cli_dbgmsg("[cli_vba_scandir_new] Failed to add \"VBA\" entry to MacroLanguages JSON array\n");

+                }

+            }

+#endif

+            if (SCAN_HEURISTIC_MACROS && *has_macros) {

+                ret = cli_append_virus(ctx, "Heuristics.OLE2.ContainsMacros");

+                if (ret == CL_VIRUS) {

+                    viruses_found++;

+                    if (!SCAN_ALLMATCHES) {

+                        goto done;

+                    }

+                }

+            }

+

+            /*

+             * Now rewind the extracted vba-project output FD and scan it!

+             */

             if (lseek(tempfd, 0, SEEK_SET) != 0) {

                 cli_dbgmsg("cli_vba_scandir_new: Failed to seek to beginning of temporary VBA project file\n");

                 ret = CL_ESEEK;

@@ -1610,15 +1635,18 @@ static cl_error_t cli_vba_scandir_new(const char *dirname, cli_ctx *ctx, struct

             ctx->recursion += 1;

             cli_set_container(ctx, CL_TYPE_MSOLE2, 0); //TODO: set correct container size

-            if (cli_scan_desc(tempfd, ctx, CL_TYPE_SCRIPT, 0, NULL, AC_SCAN_VIR, NULL, NULL) == CL_VIRUS) {

-                ctx->recursion -= 1;

-                ret = CL_VIRUS;

-                goto done;

-            }

+            ret = cli_scan_desc(tempfd, ctx, CL_TYPE_SCRIPT, 0, NULL, AC_SCAN_VIR, NULL, NULL);

             close(tempfd);

             tempfd = -1;

             ctx->recursion -= 1;

+

+            if (CL_VIRUS == ret) {

+                viruses_found++;

+                if (!SCAN_ALLMATCHES) {

+                    goto done;

+                }

+            }

         }

         hashcnt--;

@@ -1629,16 +1657,20 @@ done:

         close(tempfd);

         tempfd = -1;

     }

+

+    if (viruses_found > 0)

+        ret = CL_VIRUS;

     return ret;

 }

-static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq *U, int *hasmacros)

+static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq *U, int *has_macros)

 {

-    cl_error_t ret = CL_CLEAN;

+    cl_error_t status = CL_CLEAN;

+    cl_error_t ret;

     int i, j, fd;

     size_t data_len;

     vba_project_t *vba_project;

-    DIR *dd;

+    DIR *dd = NULL;

     struct dirent *dent;

     STATBUF statbuf;

     char *fullname, vbaname[1024];

@@ -1650,7 +1682,8 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

     cli_dbgmsg("VBADir: %s\n", dirname);

     if (CL_SUCCESS != (ret = uniq_get(U, "_vba_project", 12, NULL, &hashcnt))) {

         cli_dbgmsg("VBADir: uniq_get('_vba_project') failed with ret code (%d)!\n", ret);

-        return ret;

+        status = ret;

+        goto done;

     }

     while (hashcnt) {

         if (!(vba_project = (vba_project_t *)cli_vba_readdir(dirname, U, hashcnt))) {

@@ -1669,7 +1702,7 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

                 cli_dbgmsg("VBADir: Decompress VBA project '%s_%u'\n", vba_project->name[i], j);

                 data = (unsigned char *)cli_vba_inflate(fd, vba_project->offset[i], &data_len);

                 close(fd);

-                *hasmacros = *hasmacros + 1;

+                *has_macros = *has_macros + 1;

                 if (!data) {

                 } else {

                     /* cli_dbgmsg("Project content:\n%s", data); */

@@ -1681,13 +1714,15 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

                         if ((ret = cli_gentempfd(ctx->sub_tmpdir, &tempfile, &of)) != CL_SUCCESS) {

                             cli_warnmsg("VBADir: WARNING: VBA project '%s_%u' cannot be dumped to file\n", vba_project->name[i], j);

-                            return ret;

+                            status = ret;

+                            goto done;

                         }

                         if (cli_writen(of, data, data_len) != data_len) {

                             cli_warnmsg("VBADir: WARNING: VBA project '%s_%u' failed to write to file\n", vba_project->name[i], j);

                             close(of);

                             free(tempfile);

-                            return CL_EWRITE;

+                            status = CL_EWRITE;

+                            goto done;

                         }

                         cli_dbgmsg("VBADir: VBA project '%s_%u' dumped to %s\n", vba_project->name[i], j, tempfile);

@@ -1698,7 +1733,7 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

                         viruses_found++;

                         if (!SCAN_ALLMATCHES) {

                             free(data);

-                            ret = CL_VIRUS;

+                            status = CL_VIRUS;

                             break;

                         }

                     }

@@ -1706,23 +1741,24 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

                 }

             }

-            if (ret == CL_VIRUS && !SCAN_ALLMATCHES)

+            if (status == CL_VIRUS)

                 break;

         }

         cli_free_vba_project(vba_project);

         vba_project = NULL;

-        if (ret == CL_VIRUS && !SCAN_ALLMATCHES)

+        if (status == CL_VIRUS)

             break;

         hashcnt--;

     }

-    if (ret == CL_CLEAN || (ret == CL_VIRUS && SCAN_ALLMATCHES)) {

+    if (status == CL_CLEAN || (status == CL_VIRUS && SCAN_ALLMATCHES)) {

         if (CL_SUCCESS != (ret = uniq_get(U, "powerpoint document", 19, &hash, &hashcnt))) {

             cli_dbgmsg("VBADir: uniq_get('powerpoint document') failed with ret code (%d)!\n", ret);

-            return ret;

+            status = ret;

+            goto done;

         }

         while (hashcnt) {

             snprintf(vbaname, 1024, "%s" PATHSEP "%s_%u", dirname, hash, hashcnt);

@@ -1734,7 +1770,7 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

             }

             if ((fullname = cli_ppt_vba_read(fd, ctx))) {

                 if (cli_magic_scan_dir(fullname, ctx) == CL_VIRUS) {

-                    ret = CL_VIRUS;

+                    status = CL_VIRUS;

                     viruses_found++;

                 }

                 if (!ctx->engine->keeptmp)

@@ -1746,10 +1782,11 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

         }

     }

-    if (ret == CL_CLEAN || (ret == CL_VIRUS && SCAN_ALLMATCHES)) {

+    if (status == CL_CLEAN || (status == CL_VIRUS && SCAN_ALLMATCHES)) {

         if (CL_SUCCESS != (ret = uniq_get(U, "worddocument", 12, &hash, &hashcnt))) {

             cli_dbgmsg("VBADir: uniq_get('worddocument') failed with ret code (%d)!\n", ret);

-            return ret;

+            status = ret;

+            goto done;

         }

         while (hashcnt) {

             snprintf(vbaname, sizeof(vbaname), "%s" PATHSEP "%s_%u", dirname, hash, hashcnt);

@@ -1779,7 +1816,7 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

                         viruses_found++;

                         if (!SCAN_ALLMATCHES) {

                             free(data);

-                            ret = CL_VIRUS;

+                            status = CL_VIRUS;

                             break;

                         }

                     }

@@ -1791,24 +1828,20 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

             cli_free_vba_project(vba_project);

             vba_project = NULL;

-            if (ret == CL_VIRUS) {

-                viruses_found++;

-                if (!SCAN_ALLMATCHES)

-                    break;

+            if (status == CL_VIRUS && !SCAN_ALLMATCHES) {

+                break;

             }

             hashcnt--;

         }

     }

-    if (ret != CL_CLEAN && !(ret == CL_VIRUS && SCAN_ALLMATCHES))

-        return ret;

-

 #if HAVE_JSON

     /* JSON Output Summary Information */

     if (SCAN_COLLECT_METADATA && (ctx->wrkproperty != NULL)) {

         if (CL_SUCCESS != (ret = uniq_get(U, "_5_summaryinformation", 21, &hash, &hashcnt))) {

             cli_dbgmsg("VBADir: uniq_get('_5_summaryinformation') failed with ret code (%d)!\n", ret);

-            return ret;

+            status = ret;

+            goto done;

         }

         while (hashcnt) {

             snprintf(vbaname, sizeof(vbaname), "%s" PATHSEP "%s_%u", dirname, hash, hashcnt);

@@ -1826,7 +1859,8 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

         if (CL_SUCCESS != (ret = uniq_get(U, "_5_documentsummaryinformation", 29, &hash, &hashcnt))) {

             cli_dbgmsg("VBADir: uniq_get('_5_documentsummaryinformation') failed with ret code (%d)!\n", ret);

-            return ret;

+            status = ret;

+            goto done;

         }

         while (hashcnt) {

             snprintf(vbaname, sizeof(vbaname), "%s" PATHSEP "%s_%u", dirname, hash, hashcnt);

@@ -1844,10 +1878,15 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

     }

 #endif

+    if (status != CL_CLEAN && !(status == CL_VIRUS && SCAN_ALLMATCHES)) {

+        goto done;

+    }

+

     /* Check directory for embedded OLE objects */

     if (CL_SUCCESS != (ret = uniq_get(U, "_1_ole10native", 14, &hash, &hashcnt))) {

         cli_dbgmsg("VBADir: uniq_get('_1_ole10native') failed with ret code (%d)!\n", ret);

-        return ret;

+        status = ret;

+        goto done;

     }

     while (hashcnt) {

         snprintf(vbaname, sizeof(vbaname), "%s" PATHSEP "%s_%u", dirname, hash, hashcnt);

@@ -1857,8 +1896,13 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

         if (fd >= 0) {

             ret = cli_scan_ole10(fd, ctx);

             close(fd);

-            if (ret != CL_CLEAN && !(ret == CL_VIRUS && SCAN_ALLMATCHES))

-                return ret;

+            if (CL_VIRUS == ret) {

+                viruses_found++;

+                if (!SCAN_ALLMATCHES) {

+                    status = ret;

+                    goto done;

+                }

+            }

         }

         hashcnt--;

     }

@@ -1883,7 +1927,7 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

                     /* stat the file */

                     if (LSTAT(fullname, &statbuf) != -1) {

                         if (S_ISDIR(statbuf.st_mode) && !S_ISLNK(statbuf.st_mode))

-                            if (cli_vba_scandir(fullname, ctx, U, hasmacros) == CL_VIRUS) {

+                            if (cli_vba_scandir(fullname, ctx, U, has_macros) == CL_VIRUS) {

                                 viruses_found++;

                                 if (!SCAN_ALLMATCHES) {

                                     ret = CL_VIRUS;

@@ -1898,12 +1942,17 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

         }

     } else {

         cli_dbgmsg("VBADir: Can't open directory %s.\n", dirname);

-        return CL_EOPEN;

+        status = CL_EOPEN;

+        goto done;

+    }

+

+done:

+    if (NULL != dd) {

+        closedir(dd);

     }

-    closedir(dd);

 #if HAVE_JSON

-    if (*hasmacros && SCAN_COLLECT_METADATA && (ctx->wrkproperty != NULL)) {

+    if (*has_macros && SCAN_COLLECT_METADATA && (ctx->wrkproperty != NULL)) {

         cli_jsonbool(ctx->wrkproperty, "HasMacros", 1);

         json_object *macro_languages = cli_jsonarray(ctx->wrkproperty, "MacroLanguages");

         if (macro_languages) {

@@ -1913,14 +1962,16 @@ static cl_error_t cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq

         }

     }

 #endif

-    if (SCAN_HEURISTIC_MACROS && *hasmacros) {

+    if (SCAN_HEURISTIC_MACROS && *has_macros) {

         ret = cli_append_virus(ctx, "Heuristics.OLE2.ContainsMacros");

         if (ret == CL_VIRUS)

             viruses_found++;

     }

-    if (SCAN_ALLMATCHES && viruses_found)

-        return CL_VIRUS;

-    return ret;

+

+    if (SCAN_ALLMATCHES && viruses_found) {

+        status = CL_VIRUS;

+    }

+    return status;

 }

 static cl_error_t cli_xlm_scandir(const char *dirname, cli_ctx *ctx, struct uniq *U)

@@ -2341,7 +2392,6 @@ static cl_error_t cli_scanole2(cli_ctx *ctx)

     if (CL_VIRUS == ret) {

         viruses_found++;

         if (!SCAN_ALLMATCHES) {

-            ctx->recursion--;

             goto done;

         }

     }

@@ -2358,7 +2408,7 @@ static cl_error_t cli_scanole2(cli_ctx *ctx)

             }

         }

-        ret = cli_vba_scandir_new(dir, ctx, files);

+        ret = cli_vba_scandir_new(dir, ctx, files, &has_macros);

         if (CL_VIRUS == ret) {

             viruses_found++;

             if (!SCAN_ALLMATCHES) {

@@ -2367,9 +2417,6 @@ static cl_error_t cli_scanole2(cli_ctx *ctx)

             }

         }

-        if (cli_magic_scan_dir(dir, ctx) == CL_VIRUS)

-            ret = CL_VIRUS;

-

         ctx->recursion--;

     }

@@ -2392,14 +2439,16 @@ static cl_error_t cli_scanole2(cli_ctx *ctx)

             }

         }

-        if (cli_magic_scan_dir(dir, ctx) == CL_VIRUS)

-            ret = CL_VIRUS;

-

         ctx->recursion--;

     }

-    if (viruses_found > 0) {

-        ret = CL_VIRUS;

+    if ((has_xlm || has_vba) && files) {

+        if (CL_VIRUS == cli_magic_scan_dir(dir, ctx)) {

+            viruses_found++;

+            if (!SCAN_ALLMATCHES) {

+                goto done;

+            }

+        }

     }

 done:

@@ -2413,6 +2462,10 @@ done:

         free(dir);

     }

+    if (viruses_found > 0) {

+        ret = CL_VIRUS;

+    }

+

     return ret;

 }

@@ -357,8 +357,7 @@ static size_t vba_normalize(unsigned char *buffer, size_t size)

  * Read a VBA project in an OLE directory.

  * Contrary to cli_vba_readdir, this function uses the dir file to locate VBA modules.

  */

-cl_error_t

-cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *hash, uint32_t which, int *tempfd)

+cl_error_t cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *hash, uint32_t which, int *tempfd, int *has_macros)

 {

     cl_error_t ret = CL_SUCCESS;

     char fullname[1024];

@@ -375,7 +374,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

     unsigned char *module_data = NULL, *module_data_utf8 = NULL;

     size_t module_data_size = 0, module_data_utf8_size = 0;

-    if (dir == NULL || hash == NULL || tempfd == NULL) {

+    if (dir == NULL || hash == NULL || tempfd == NULL || has_macros == NULL) {

         return CL_EARG;

     }

@@ -396,7 +395,9 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

         goto done;

     }

-    if ((ret = cli_gentempfd(ctx->engine->tmpdir, &tempfile, tempfd)) != CL_SUCCESS) {

+    *has_macros = *has_macros + 1;

+

+    if ((ret = cli_gentempfd_with_prefix(ctx->sub_tmpdir, "vba_project", &tempfile, tempfd)) != CL_SUCCESS) {

         cli_warnmsg("vba_readdir_new: VBA project cannot be dumped to file\n");

         goto done;

     }

@@ -418,7 +419,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

         for (i = 0; i < size; ++i) {                                                       \

             char buf[4];                                                                   \

             if (snprintf(buf, sizeof(buf), "%02x", (msg)[i]) != 2) {                       \

-                cli_warnmsg("vba_readdir_new: Failed to write nex data to output file\n"); \

+                cli_warnmsg("vba_readdir_new: Failed to write hex data to output file\n"); \

                 ret = CL_EWRITE;                                                           \

                 goto done;                                                                 \

             }                                                                              \

@@ -436,7 +437,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                 free(utf8);                                                                                          \

                 utf8 = NULL;                                                                                         \

             } else {                                                                                                 \

-                cli_errmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);      \

+                cli_dbgmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);      \

                 CLI_WRITEN("<error decoding string>", 23);                                                           \

             }                                                                                                        \

         }                                                                                                            \

@@ -452,7 +453,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                 free(utf8);                                                                                                   \

                 utf8 = NULL;                                                                                                  \

             } else {                                                                                                          \

-                cli_errmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");                                      \

+                cli_dbgmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");                                      \

                 CLI_WRITEN("<error decoding string>", 23);                                                                    \

             }                                                                                                                 \

         }                                                                                                                     \

@@ -779,7 +780,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                     if (CL_SUCCESS == cli_codepage_to_utf8((char *)&data[data_offset], size, codepage, &mbcs_name, &mbcs_name_size)) {

                         CLI_WRITEN(mbcs_name, mbcs_name_size);

                     } else {

-                        cli_errmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);

+                        cli_dbgmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);

                         CLI_WRITEN("<error decoding string>", 23);

                     }

                 }

@@ -813,7 +814,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                     if (CL_SUCCESS == cli_codepage_to_utf8((char *)&data[data_offset], size, CODEPAGE_UTF16_LE, &utf16_name, &utf16_name_size)) {

                         CLI_WRITEN(utf16_name, utf16_name_size);

                     } else {

-                        cli_errmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");

+                        cli_dbgmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");

                         CLI_WRITEN("<error decoding string>", 23);

                     }

                 }

@@ -862,7 +863,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                     if (CL_SUCCESS == cli_codepage_to_utf8((char *)&data[data_offset], size, codepage, &mbcs_name, &mbcs_name_size)) {

                         CLI_WRITEN(mbcs_name, mbcs_name_size);

                     } else {

-                        cli_errmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);

+                        cli_dbgmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);

                         CLI_WRITEN("<error decoding string>", 23);

                     }

                 }

@@ -896,7 +897,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                     if (CL_SUCCESS == cli_codepage_to_utf8((char *)&data[data_offset], module_stream_name_size, CODEPAGE_UTF16_LE, &utf16_name, &utf16_name_size)) {

                         CLI_WRITEN(utf16_name, utf16_name_size);

                     } else {

-                        cli_errmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");

+                        cli_dbgmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");

                         CLI_WRITEN("<error decoding string>", 23);

                     }

                 }

@@ -945,7 +946,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                     if (CL_SUCCESS == cli_codepage_to_utf8((char *)&data[data_offset], size, codepage, &mbcs_name, &mbcs_name_size)) {

                         CLI_WRITEN(mbcs_name, mbcs_name_size);

                     } else {

-                        cli_errmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);

+                        cli_dbgmsg("cli_vba_readdir_new: failed to convert codepage %" PRIu16 " to UTF-8\n", codepage);

                         CLI_WRITEN("<error decoding string>", 23);

                     }

                 }

@@ -978,7 +979,7 @@ cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *h

                     if (CL_SUCCESS == cli_codepage_to_utf8((char *)&data[data_offset], size, CODEPAGE_UTF16_LE, &utf16_name, &utf16_name_size)) {

                         CLI_WRITEN(utf16_name, utf16_name_size);

                     } else {

-                        cli_errmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");

+                        cli_dbgmsg("cli_vba_readdir_new: failed to convert UTF16LE to UTF-8\n");

                         CLI_WRITEN("<error decoding string>", 23);

                     }

                 }

@@ -40,7 +40,7 @@ typedef struct vba_project_tag {

 } vba_project_t;

 vba_project_t *cli_vba_readdir(const char *dir, struct uniq *U, uint32_t which);

-cl_error_t cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *hash, uint32_t which, int *tempfd);

+cl_error_t cli_vba_readdir_new(cli_ctx *ctx, const char *dir, struct uniq *U, const char *hash, uint32_t which, int *tempfd, int *has_macros);

 vba_project_t *cli_wm_readdir(int fd);

 void cli_free_vba_project(vba_project_t *vba_project);

@@ -4116,7 +4116,7 @@ cl_error_t cli_xlm_extract_macros(const char *dir, cli_ctx *ctx, struct uniq *U,

         goto done;

     }

-    if ((ret = cli_gentempfd(dir, &tempfile, &out_fd)) != CL_SUCCESS) {

+    if ((ret = cli_gentempfd_with_prefix(ctx->sub_tmpdir, "xlm_macros", &tempfile, &out_fd)) != CL_SUCCESS) {

         cli_dbgmsg("[cli_xlm_extract_macros] Failed to open output file descriptor\n");

         goto done;

     }