@@ -1,3 +1,8 @@

+Thu Mar 11 21:50:32 CET 2004 (tk)

+---------------------------------

+  * libclamav: rar: added support for encrypted archive (Encrypted.RAR)

+	       detection

+

 Thu Mar 11 00:16:11 CET 2004 (tk)

 ---------------------------------

   * libclamav: rar support: due to a bug only first file in archive was

@@ -114,7 +114,7 @@ struct cl_cvd {

 };

 /* file scanning */

-extern int cl_scanbuff(const char *buffer, unsigned int length, char **virname, const struct cl_node *root);

+extern int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root);

 extern int cl_scandesc(int desc, const char **virname, unsigned long int *scanned, const struct cl_node *root, const struct cl_limits *limits, int options);

@@ -193,7 +193,7 @@ void cl_freetrie(struct cl_node *root)

     free(root);

 }

-int cl_scanbuff(const char *buffer, unsigned int length, char **virname, const struct cl_node *root)

+int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root)

 {

 	struct cl_node *current;

 	struct cli_patt *pt;

@@ -199,6 +199,13 @@ static int cli_scanrar(int desc, const char **virname, long int *scanned, const

     rarlist_head = rarlist;

     while(rarlist) {

+	if(DETECT_ENCRYPTED && (rarlist->item.Flags & 4)) {

+	    files++;

+	    cli_dbgmsg("Rar -> Encrypted files found in archive.\n");

+	    *virname = "Encrypted.RAR";

+	    ret = CL_VIRUS;

+	    break;

+	}

 	if(limits) {

 	    if(limits->maxfilesize && (rarlist->item.UnpSize > limits->maxfilesize)) {

@@ -1,5 +1,5 @@

 /* It contains some changes needed for libclamav and isn't compatible with

- * original version, --tk

+ * the original version, --tk

  */

 /* ***************************************************************************

  **

@@ -566,6 +566,7 @@ int urarlib_list(int desc, ArchiveList_struct *list)

     tmp_List->item.UnpVer = NewLhd.UnpVer;

     tmp_List->item.Method = NewLhd.Method;

     tmp_List->item.FileAttr = NewLhd.FileAttr;

+    tmp_List->item.Flags = NewLhd.Flags;

     NoOfFilesInArchive++;                   /* count files                  */

@@ -120,6 +120,7 @@ struct RAR20_archive_entry                  /* These infos about files are  */

   UBYTE  UnpVer;

   UBYTE  Method;

   UDWORD FileAttr;

+  UWORD  Flags;

 };

 typedef struct  archivelist                 /* used to list archives        */