@@ -1,3 +1,9 @@

+Tue Oct 18 11:29:04 BST 2005 (trog)

+-----------------------------------

+  * libclamav/others.c,h: Add generic bitset implementation

+

+  * libclamav/ole2_extract.c: Make sure the property tree doesn't loop

+

 Fri Sep 30 17:00:49 BST 2005 (njh)

 ----------------------------------

   * clamav-milter:	Added --freshclam-monitor

@@ -111,6 +111,7 @@ typedef struct ole2_header_tag

 	int32_t sbat_root_start __attribute__ ((packed));

 	unsigned char *m_area;

 	off_t m_length;

+	bitset_t *bitset;

 } ole2_header_t;

 typedef struct property_tag

@@ -468,7 +469,7 @@ static void ole2_walk_property_tree(int fd, ole2_header_t *hdr, const char *dir,

 	if ((prop_index < 0) || (rec_level > 100) || (*file_count > 100000)) {

 		return;

 	}

-	

+

 	if (limits && limits->maxfiles && (*file_count > limits->maxfiles)) {

 		cli_dbgmsg("OLE2: File limit reached (max: %d)\n", limits->maxfiles);

 		return;

@@ -507,6 +508,17 @@ static void ole2_walk_property_tree(int fd, ole2_header_t *hdr, const char *dir,

 	prop_block[index].size = ole2_endian_convert_32(prop_block[index].size);

 	print_ole2_property(&prop_block[index]);

+

+	/* Check we aren't in a loop */

+	if (cli_bitset_test(hdr->bitset, (unsigned long) prop_index)) {

+		/* Loop in property tree detected */

+		cli_dbgmsg("OLE2: Property tree loop detected at index %d\n", prop_index);

+		return;

+	}

+	if (!cli_bitset_set(hdr->bitset, (unsigned long) prop_index)) {

+		return;

+	}

+

 	switch (prop_block[index].type) {

 		case 5: /* Root Entry */

 			if ((prop_index != 0) || (rec_level !=0) ||

@@ -745,7 +757,7 @@ int cli_ole2_extract(int fd, const char *dirname, const struct cl_limits *limits

 	/* size of header - size of other values in struct */

 	hdr_size = sizeof(struct ole2_header_tag) - sizeof(int32_t) -

-			sizeof(unsigned char *) - sizeof(off_t);

+			sizeof(unsigned char *) - sizeof(off_t) - sizeof(bitset_t *);

 	hdr.m_area = NULL;

@@ -791,7 +803,12 @@ int cli_ole2_extract(int fd, const char *dirname, const struct cl_limits *limits

 	hdr.xbat_count = ole2_endian_convert_32(hdr.xbat_count);

 	hdr.sbat_root_start = -1;

-	

+

+	hdr.bitset = cli_bitset_init();

+	if (!hdr.bitset) {

+		return CL_EOLE2;

+	}

+

 	if (strncmp(hdr.magic, magic_id, 8) != 0) {

 		cli_dbgmsg("OLE2 magic failed!\n");

 #ifdef HAVE_MMAP

@@ -799,6 +816,7 @@ int cli_ole2_extract(int fd, const char *dirname, const struct cl_limits *limits

 			munmap(hdr.m_area, hdr.m_length);

 		}

 #endif

+		cli_bitset_free(hdr.bitset);

 		return CL_EOLE2;

 	}

@@ -831,5 +849,6 @@ abort:

 		munmap(hdr.m_area, hdr.m_length);

 	}

 #endif

+	cli_bitset_free(hdr.bitset);

 	return 0;

 }

@@ -681,3 +681,89 @@ int cli_filecopy(const char *src, const char *dest)

     return close(d);

 }

+

+/* Implement a generic bitset */

+

+#define BITS_PER_CHAR (8)

+#define BITSET_DEFAULT_SIZE (1024)

+#define FALSE (0)

+#define TRUE (1)

+

+static unsigned long nearest_power(unsigned long num)

+{

+	unsigned long n = BITSET_DEFAULT_SIZE;

+

+	while (n < num) {

+		n <<= 1;

+		if (n == 0) {

+			return num;

+		}

+	}

+	return n;

+}

+

+bitset_t *cli_bitset_init()

+{

+	bitset_t *bs;

+	

+	bs = malloc(sizeof(bitset_t));

+	if (!bs) {

+		return NULL;

+	}

+	bs->length = BITSET_DEFAULT_SIZE;

+	bs->bitset = calloc(BITSET_DEFAULT_SIZE, 1);

+	return bs;

+}

+

+void cli_bitset_free(bitset_t *bs)

+{

+	if (!bs) {

+		return;

+	}

+	if (bs->bitset) {

+		free(bs->bitset);

+	}

+	free(bs);

+}

+

+static bitset_t *bitset_realloc(bitset_t *bs, unsigned long min_size)

+{

+	unsigned long new_length;

+	

+	new_length = nearest_power(min_size);

+	bs->bitset = (unsigned char *) realloc(bs->bitset, new_length);

+	if (!bs->bitset) {

+		return NULL;

+	}

+	memset(bs->bitset+bs->length, 0, new_length-bs->length);

+	bs->length = new_length;

+	return bs;

+}

+

+int cli_bitset_set(bitset_t *bs, unsigned long bit_offset)

+{

+	unsigned long char_offset;

+	

+	char_offset = bit_offset / BITS_PER_CHAR;

+	bit_offset = bit_offset % BITS_PER_CHAR;

+

+	if (char_offset >= bs->length) {

+		bs = bitset_realloc(bs, char_offset+1);

+		if (!bs) {

+			return FALSE;

+		}

+	}

+	bs->bitset[char_offset] |= ((unsigned char)1 << bit_offset);

+	return TRUE;

+}

+

+int cli_bitset_test(bitset_t *bs, unsigned long bit_offset)

+{

+	unsigned long char_offset;

+	

+	char_offset = bit_offset / BITS_PER_CHAR;

+	bit_offset = bit_offset % BITS_PER_CHAR;

+	

+	return (bs->bitset[char_offset] & ((unsigned char)1 << bit_offset));

+}

+

@@ -23,6 +23,12 @@

 #include <stdlib.h>

 #include "cltypes.h"

+typedef struct bitset_tag

+{

+        unsigned char *bitset;

+        unsigned long length;

+} bitset_t;

+

 void cli_warnmsg(const char *str, ...);

 void cli_errmsg(const char *str, ...);

 void cli_dbgmsg(const char *str, ...);

@@ -43,5 +49,8 @@ char *cli_gentempdesc(const char *dir, int *fd);

 char *cli_gentempstream(const char *dir, FILE **fs);

 unsigned int cli_rndnum(unsigned int max);

 int cli_filecopy(const char *src, const char *dest);

-

+bitset_t *cli_bitset_init();

+void cli_bitset_free(bitset_t *bs);

+int cli_bitset_set(bitset_t *bs, unsigned long bit_offset);

+int cli_bitset_test(bitset_t *bs, unsigned long bit_offset);

 #endif