@@ -1,3 +1,7 @@

+Mon Jan  3 16:38:46 CET 2011 (tk)

+---------------------------------

+ * libclamav: improve handling of HandlerType (bb#2298)

+

 Thu Dec 30 15:02:05 CET 2010 (tk)

 ---------------------------------

  * libclamav/filetypes.c: improve detection of tar files

@@ -502,7 +502,7 @@ int cli_scandesc(int desc, cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struc

     return ret;

 }

-int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *acdata, struct cli_target_info *target_info)

+int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *acdata, struct cli_target_info *target_info, const char *hash)

 {

 	unsigned int i, evalcnt;

 	uint64_t evalids;

@@ -527,14 +527,17 @@ int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *ac

 		    continue;

 	    }

-	    if(root->ac_lsigtable[i]->tdb.handlertype) {

-		ctx->recursion++;

-		if(cli_magic_scandesc_type(map->fd, ctx, root->ac_lsigtable[i]->tdb.handlertype[0]) == CL_VIRUS) {

+	    if(hash && root->ac_lsigtable[i]->tdb.handlertype) {

+		if(memcmp(ctx->handlertype_hash, hash, 16)) {

+		    ctx->recursion++;

+		    memcpy(ctx->handlertype_hash, hash, 16);

+		    if(cli_magic_scandesc_type(map->fd, ctx, root->ac_lsigtable[i]->tdb.handlertype[0]) == CL_VIRUS) {

+			ctx->recursion--;

+			return CL_VIRUS;

+		    }

 		    ctx->recursion--;

-		    return CL_VIRUS;

+		    continue;

 		}

-		ctx->recursion--;

-		continue;

 	    }

 	    if(root->ac_lsigtable[i]->tdb.icongrp1 || root->ac_lsigtable[i]->tdb.icongrp2) {

@@ -695,8 +698,18 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

 	offset += bytes - maxpatlen;

     }

+    if(!ftonly && ctx->engine->md5_hdb) {

+	if(!refhash) {

+	    cli_md5_final(digest, &md5ctx);

+	    refhash = digest;

+	}

+	if(cli_md5m_scan(refhash, map->len, ctx->virname, ctx->engine->md5_hdb) == CL_VIRUS && cli_md5m_scan(refhash, map->len, NULL, ctx->engine->md5_fp) != CL_VIRUS)

+	    ret = CL_VIRUS;

+    }

+

     if(troot) {

-	ret = cli_lsig_eval(ctx, troot, &tdata, &info);

+	if(ret != CL_VIRUS)

+	    ret = cli_lsig_eval(ctx, troot, &tdata, &info, refhash);

 	cli_ac_freedata(&tdata);

 	if(bm_offmode)

 	    cli_bm_freeoff(&toff);

@@ -704,7 +717,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

     if(groot) {

 	if(ret != CL_VIRUS)

-	    ret = cli_lsig_eval(ctx, groot, &gdata, &info);

+	    ret = cli_lsig_eval(ctx, groot, &gdata, &info, refhash);

 	cli_ac_freedata(&gdata);

     }

@@ -715,15 +728,6 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli

     if(ret == CL_VIRUS)

 	return CL_VIRUS;

-    if(!ftonly && ctx->engine->md5_hdb) {

-	if(!refhash) {

-	    cli_md5_final(digest, &md5ctx);

-	    refhash = digest;

-	}

-	if(cli_md5m_scan(refhash, map->len, ctx->virname, ctx->engine->md5_hdb) == CL_VIRUS && cli_md5m_scan(refhash, map->len, NULL, ctx->engine->md5_fp) != CL_VIRUS)

-	    return CL_VIRUS;

-    }

-

     return (acmode & AC_SCAN_FT) ? type : CL_CLEAN;

 }

@@ -169,7 +169,7 @@ int cli_scanbuff(const unsigned char *buffer, uint32_t length, uint32_t offset,

 int cli_scandesc(int desc, cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli_matched_type **ftoffset, unsigned int acmode, struct cli_ac_result **acres);

 int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli_matched_type **ftoffset, unsigned int acmode, struct cli_ac_result **acres, unsigned char *refhash);

-int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *acdata, struct cli_target_info *target_info);

+int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *acdata, struct cli_target_info *target_info, const char *hash);

 int cli_caloff(const char *offstr, const struct cli_target_info *info, unsigned int target, uint32_t *offdata, uint32_t *offset_min, uint32_t *offset_max);

 int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx);

@@ -120,6 +120,7 @@ typedef struct cli_ctx_tag {

     unsigned int corrupted_input;

     cli_file_t container_type; /* FIXME: to be made into a stack or array - see bb#1579 & bb#1293 */

     size_t container_size;

+    unsigned char handlertype_hash[16];

     struct cli_dconf *dconf;

     fmap_t **fmap;

     bitset_t* hook_lsig_matches;

@@ -1112,9 +1112,9 @@ static int cli_scanscript(cli_ctx *ctx)

 	}

 	free(normalized);

 	if(ret != CL_VIRUS) {

-	    ret = cli_lsig_eval(ctx, troot, &tmdata, NULL);

+	    ret = cli_lsig_eval(ctx, troot, &tmdata, NULL, NULL);

 	    if(ret != CL_VIRUS)

-		ret = cli_lsig_eval(ctx, groot, &gmdata, NULL);

+		ret = cli_lsig_eval(ctx, groot, &gmdata, NULL, NULL);

 	}

 	cli_ac_freedata(&tmdata);

 	cli_ac_freedata(&gmdata);