@@ -1,3 +1,7 @@

+Tue May  2 16:21:06 BST 2006 (njh)

+----------------------------------

+  * libclamav/mbox.c:	Reduce bounce false positives

+

 Mon May  1 22:22:28 CEST 2006 (tk)

 ----------------------------------

   * clamconf/clamconf.c: fix typo spotted by NJH

@@ -20,7 +24,7 @@ Sun Apr 30 19:23:35 BST 2006 (njh)

 Tue Apr 25 18:48:23 BST 2006 (njh)

 ----------------------------------

   * libclamav/pst.c:	Apply patch from TK to use le??_to_host and to include

-  				clamav-config.h first

+				clamav-config.h first

 Mon Apr 24 22:19:34 BST 2006 (njh)

 ----------------------------------

@@ -16,7 +16,7 @@

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

  *  MA 02110-1301, USA.

  */

-static	char	const	rcsid[] = "$Id: mbox.c,v 1.292 2006/04/30 18:22:44 nigelhorne Exp $";

+static	char	const	rcsid[] = "$Id: mbox.c,v 1.293 2006/05/02 15:19:24 nigelhorne Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

@@ -196,6 +196,7 @@ static	int	rfc1341(message *m, const char *dir);

 #endif

 static	bool	usefulHeader(int commandNumber, const char *cmd);

 static	char	*getline_from_mbox(char *buffer, size_t len, FILE *fin);

+static	bool	mailStart(const char *line);

 static	void	checkURLs(message *m, const char *dir);

 #ifdef	WITH_CURL

@@ -2666,9 +2667,7 @@ parseEmailBody(message *messageIn, text *textIn, const char *dir, const table_t

 			if(l == NULL)

 				continue;

-			s = lineGetData(l);

-

-			if(cli_filetype(s, strlen(s)) != CL_TYPE_MAIL)

+			if(!mailStart(lineGetData(l)))

 				continue;

 			/*

@@ -2758,8 +2757,8 @@ parseEmailBody(message *messageIn, text *textIn, const char *dir, const table_t

 				l = t->t_line;

 				if((!inheader) && l) {

 					s = lineGetData(l);

-					if(cli_filetype(s, strlen(s)) == CL_TYPE_MAIL) {

-						cli_dbgmsg("Found the start of another bounce candidate\n");

+					if(mailStart(s)) {

+						cli_dbgmsg("Found the start of another bounce candidate (%s)\n", s);

 						break;

 					}

 				}

@@ -4221,3 +4220,36 @@ getline_from_mbox(char *buffer, size_t len, FILE *fin)

 	return ret;

 }

+

+static bool

+mailStart(const char *line)

+{

+	if(line == NULL)

+		return FALSE;

+	if(*line == '\0')

+		return FALSE;

+	if((strncmp(line, "From ", 5) == 0) && !isalnum(line[5]))

+		return FALSE;

+	if((strncmp(line, ">From ", 6) == 0) && !isalnum(line[6]))

+		return FALSE;

+	if(cli_filetype(line, strlen(line)) != CL_TYPE_MAIL)

+		return FALSE;

+

+	if((strncmp(line, "From ", 5) == 0) ||

+	   (strncmp(line, ">From ", 6) == 0)) {

+		int numSpaces = 0, numDigits = 0;

+

+		do

+			if(*line == ' ')

+				numSpaces++;

+			else if(isdigit(*line))

+				numDigits++;

+		while(*++line != '\0');

+

+		if(numSpaces < 6)

+			return FALSE;

+		if(numDigits < 11)

+			return FALSE;

+	}

+	return TRUE;

+}

@@ -16,7 +16,7 @@

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

  *  MA 02110-1301, USA.

  */

-static	char	const	rcsid[] = "$Id: message.c,v 1.164 2006/04/09 19:59:27 kojm Exp $";

+static	char	const	rcsid[] = "$Id: message.c,v 1.165 2006/05/02 15:19:24 nigelhorne Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

@@ -637,7 +637,7 @@ messageFindArgument(const message *m, const char *variable)

 			while(isspace(*ptr))

 				ptr++;

 			if(*ptr != '=') {

-				cli_warnmsg("messageFindArgument: no '=' sign found in MIME header '%s'\n", variable);

+				cli_warnmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i));

 				return NULL;

 			}

 			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {