@@ -1,3 +1,7 @@

+Thu Oct 19 20:27:06 CEST 2006 (acab)

+------------------------------------

+  * libclamav: obey limits in unspin - closes bug#81 (thanks Trog)

+

 Thu Oct 19 18:34:43 BST 2006 (njh)

 ----------------------------------

   * libclamav:	Added JavaScript scanning

@@ -1892,7 +1892,19 @@ int cli_scanpe(int desc, cli_ctx *ctx)

        EC32(optional_hdr32.AddressOfEntryPoint) < EC32(section_hdr[nsections - 1].VirtualAddress) + EC32(section_hdr[nsections - 1].SizeOfRawData) - 0x3217 - 4 &&

        memcmp(buff+4, "\xe8\x00\x00\x00\x00\x8b\x1c\x24\x83\xc3", 10) == 0)  {

-	    char *spinned;

+	char *spinned;

+	int spinres;

+	    

+	if(ctx->limits && ctx->limits->maxfilesize && fsize > ctx->limits->maxfilesize) {

+	    cli_dbgmsg("PEspin: Size exceeded (fsize: %u, max: %lu)\n", fsize, ctx->limits->maxfilesize);

+            free(section_hdr);

+	    if(BLOCKMAX) {

+		*ctx->virname = "PE.Pespin.ExceededFileSize";

+		return CL_VIRUS;

+	    } else {

+		return CL_CLEAN;

+	    }

+	}

 	if((spinned = (char *) cli_malloc(fsize)) == NULL) {

 	    free(section_hdr);

@@ -1921,36 +1933,47 @@ int cli_scanpe(int desc, cli_ctx *ctx)

 	    return CL_EIO;

 	}

-	if(!unspin(spinned, fsize, section_hdr, nsections - 1, EC32(optional_hdr32.AddressOfEntryPoint), ndesc)) {

+	switch(unspin(spinned, fsize, section_hdr, nsections - 1, EC32(optional_hdr32.AddressOfEntryPoint), ndesc, ctx)) {

+	case 0:

 	    free(spinned);

-	    cli_dbgmsg("PESpin: Unpacked and rebuilt executable saved in %s\n", tempfile);

+	    if(cli_leavetemps_flag)

+		cli_dbgmsg("PESpin: Unpacked and rebuilt executable saved in %s\n", tempfile);

+	    else

+		cli_dbgmsg("PESpin: Unpacked and rebuilt executable\n");

 	    fsync(ndesc);

 	    lseek(ndesc, 0, SEEK_SET);

-

 	    if(cli_magic_scandesc(ndesc, ctx) == CL_VIRUS) {

-		free(section_hdr);

 		close(ndesc);

-		if(!cli_leavetemps_flag) {

+		if(!cli_leavetemps_flag)

 		    unlink(tempfile);

-		    free(tempfile);

-		} else {

-		    free(tempfile);

-		}

+	        free(tempfile);

+		free(section_hdr);

 		return CL_VIRUS;

 	    }

-

-	} else {

+	    close(ndesc);

+   	    if(!cli_leavetemps_flag)

+		unlink(tempfile);

+	    break;

+	case 1:

 	    free(spinned);

+	    close(ndesc);

+	    unlink(tempfile);

 	    cli_dbgmsg("PESpin: Rebuilding failed\n");

-	}

-

-	close(ndesc);

-	if(!cli_leavetemps_flag) {

+	    break;

+	case 2:

+	    free(spinned);

+	    close(ndesc);

 	    unlink(tempfile);

-	    free(tempfile);

-	} else {

-	    free(tempfile);

+	    cli_dbgmsg("PESpin: Size exceeded\n");

+	    if(BLOCKMAX) {

+		free(tempfile);

+		free(section_hdr);

+		*ctx->virname = "PE.Pespin.ExceededFileSize";

+		return CL_VIRUS;

+	    }

 	}

+	free(tempfile);

+	

     }

@@ -155,7 +155,7 @@ static uint32_t summit (char *src, int size)

 }

-int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sectcnt, uint32_t nep, int desc) {

+int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sectcnt, uint32_t nep, int desc, cli_ctx *ctx) {

   char *curr, *emu, *ep, *spinned;

   char **sects;

   int blobsz=0, j;

@@ -371,6 +371,21 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

   bitmap = cli_readint32(ep+0x3061);

   bitman = bitmap;

+

+  if(ctx->limits && ctx->limits->maxfilesize) {

+    unsigned long int filesize = 0;

+    

+    for (j=0; j<sectcnt; j++) {

+      if (bitmap&1) {

+	if ( filesize > ctx->limits->maxfilesize || (uint32_t)EC32(sections[j].VirtualSize) > ctx->limits->maxfilesize - filesize ) return 2;

+	filesize += (uint32_t)EC32(sections[j].VirtualSize);

+      }

+      bitmap>>=1;

+    }

+    

+    bitmap = bitman;

+  }

+

   cli_dbgmsg("spin: Compression bitmap is %x\n", bitmap);

   if ( (sects= (char **) cli_malloc(sectcnt*sizeof(char *))) == NULL )

     return 1;

@@ -395,7 +410,7 @@ int unspin(char *src, int ssize, struct pe_image_section_hdr *sections, int sect

       sects[j] = src + EC32(sections[j].PointerToRawData);

       cli_dbgmsg("spin: Not growing sect%d\n", j);

     }

-    bitmap = bitmap >>1 & 0x7fffffff;

+    bitmap>>=1;

   }

   cli_dbgmsg("spin: decompression complete\n");

@@ -23,6 +23,6 @@

 #include "cltypes.h"

 #include "rebuildpe.h"

-int unspin(char *, int, struct pe_image_section_hdr *, int, uint32_t, int);

+int unspin(char *, int, struct pe_image_section_hdr *, int, uint32_t, int, cli_ctx *);

 #endif