@@ -1,3 +1,8 @@

+Wed Dec 19 10:17:02 GMT 2007 (trog)

+-----------------------------------

+  * libclamav/chmunpack.[ch], scanners.c: re-structure CHM unpacker. Uses no

+  			dynamic memory when mmap() available.

+

 Tue Dec 18 19:55:13 CET 2007 (acab)

 -----------------------------------

   * libclamav/unzip.c: Fix mmap leaks in unzip 

@@ -65,63 +65,7 @@

 #define	O_BINARY	0

 #endif

-#define CHM_ITSF_MIN_LEN (0x60)

-typedef struct itsf_header_tag

-{

-	unsigned char signature[4];

-	int32_t version __attribute__ ((packed));

-	int32_t header_len __attribute__ ((packed));

-	uint32_t unknown __attribute__ ((packed));

-	uint32_t last_modified __attribute__ ((packed));

-	uint32_t lang_id __attribute__ ((packed));

-	unsigned char dir_clsid[16];

-	unsigned char stream_clsid[16];

-	uint64_t sec0_offset __attribute__ ((packed));

-	uint64_t sec0_len __attribute__ ((packed));

-	uint64_t dir_offset __attribute__ ((packed));

-	uint64_t dir_len __attribute__ ((packed));

-	uint64_t data_offset __attribute__ ((packed));

-} itsf_header_t;

-

-#define CHM_ITSP_LEN (0x54)

-typedef struct itsp_header_tag

-{

-	unsigned char signature[4];

-	int32_t version __attribute__ ((packed));

-	int32_t header_len __attribute__ ((packed));

-	int32_t unknown1 __attribute__ ((packed));

-	uint32_t block_len __attribute__ ((packed));

-	int32_t blockidx_intvl __attribute__ ((packed));

-	int32_t index_depth __attribute__ ((packed));

-	int32_t index_root __attribute__ ((packed));

-	int32_t index_head __attribute__ ((packed));

-	int32_t index_tail __attribute__ ((packed));

-	int32_t unknown2 __attribute__ ((packed));

-	uint32_t num_blocks __attribute__ ((packed));

-	uint32_t lang_id __attribute__ ((packed));

-	unsigned char system_clsid[16];

-	unsigned char unknown4[16];

-} itsp_header_t;

-

 #define CHM_CHUNK_HDR_LEN (0x14)

-typedef struct chunk_header_tag

-{

-	char signature[4];

-	uint32_t free_space __attribute__ ((packed));

-	uint32_t unknown __attribute__ ((packed));

-	int32_t block_prev __attribute__ ((packed));

-	int32_t block_next __attribute__ ((packed));

-	char *chunk_data;

-	uint16_t num_entries;

-} chunk_header_t;

-

-typedef struct file_list_tag

-{

-	uint64_t section;

-	uint64_t offset;

-	uint64_t length;

-	struct file_list_tag *next;

-} file_list_t;

 #define CHM_CONTROL_LEN (0x18)

 typedef struct lzx_control_tag {

@@ -215,18 +159,7 @@ static uint64_t chm_copy_file_data(int ifd, int ofd, uint64_t len)

 	return len;

 }

-static void free_file_list(file_list_t *file_l)

-{

-	file_list_t *next;

-	

-	while (file_l) {

-		next = file_l->next;

-		free(file_l);

-		file_l = next;

-	}

-}

-

-static void itsf_print_header(itsf_header_t *itsf_hdr)

+static void itsf_print_header(chm_itsf_header_t *itsf_hdr)

 {

 	if (!itsf_hdr) {

 		return;

@@ -247,7 +180,7 @@ static void itsf_print_header(itsf_header_t *itsf_hdr)

 	}

 }

-static int itsf_read_header(int fd, itsf_header_t *itsf_hdr, char *m_area, off_t m_length)

+static int itsf_read_header(int fd, chm_itsf_header_t *itsf_hdr, char *m_area, off_t m_length)

 {

 #if defined(HAVE_ATTRIB_PACKED) || defined(HAVE_PRAGMA_PACK) || defined(HAVE_PRAGMA_PACK_HPPA)

 	if (!chm_read_data(fd, (char *) itsf_hdr, 0, CHM_ITSF_MIN_LEN,

@@ -315,7 +248,7 @@ static int itsf_read_header(int fd, itsf_header_t *itsf_hdr, char *m_area, off_t

 	return TRUE;

 }

-static void itsp_print_header(itsp_header_t *itsp_hdr)

+static void itsp_print_header(chm_itsp_header_t *itsp_hdr)

 {

 	if (!itsp_hdr) {

 		return;

@@ -335,7 +268,7 @@ static void itsp_print_header(itsp_header_t *itsp_hdr)

 	cli_dbgmsg("Lang ID:\t%u\n\n", itsp_hdr->lang_id);

 }

-static int itsp_read_header(int fd, itsp_header_t *itsp_hdr, off_t offset,

+static int itsp_read_header(int fd, chm_itsp_header_t *itsp_hdr, off_t offset,

 				char *m_area, off_t m_length)

 {

 #if defined(HAVE_ATTRIB_PACKED) || defined(HAVE_PRAGMA_PACK) || defined(HAVE_PRAGMA_PACK_HPPA)

@@ -438,167 +371,128 @@ static uint64_t read_enc_int(char **start, char *end)

 	return retval;

 }

-/* Read chunk entries */

-/* Note: the file lists end up in reverse order to the order in the chunk */

-static int read_chunk_entries(char *chunk, uint32_t chunk_len,

-					uint16_t num_entries,

-					file_list_t *file_l, file_list_t *sys_file_l)

+/* Read control entries */

+static int read_control_entries(chm_metadata_t *metadata)

 {

-	char *current, *end;

-	uint64_t name_len;

-	file_list_t *file_e;

+	char *name;

+	uint64_t name_len, section, offset, length;

-	end = chunk + chunk_len;

-	current = chunk + CHM_CHUNK_HDR_LEN;

-	

-	while (num_entries--) {

-		if (current > end) {

+	while (metadata->chunk_entries--) {

+		if (metadata->chunk_current > metadata->chunk_end) {

 			cli_dbgmsg("read chunk entries failed\n");

 			return FALSE;

 		}

-		name_len = read_enc_int(&current, end);

-		if (((current + name_len) > end) || ((current + name_len) < chunk)) {

+		name_len = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		if (((metadata->chunk_current + name_len) > metadata->chunk_end) || ((metadata->chunk_current + name_len) < metadata->chunk_data)) {

 			cli_dbgmsg("Bad CHM name_len detected\n");

 			return FALSE;

 		}

-		if ((name_len >= 2) && (current[0] == ':') &&

-				(current[1] == ':')) {

-			if ((name_len == CHM_SYS_CONTROL_LEN) && (strcmp(current, CHM_SYS_CONTROL_NAME) == 0)) {

-				current += name_len;

-				sys_file_l[0].section = read_enc_int(&current, end);

-				sys_file_l[0].offset = read_enc_int(&current, end);

-				sys_file_l[0].length = read_enc_int(&current, end);

-			} else if ((name_len == CHM_SYS_CONTENT_LEN) && (strcmp(current, CHM_SYS_CONTENT_NAME) == 0)) {

-				current += name_len;

-				sys_file_l[1].section = read_enc_int(&current, end);

-				sys_file_l[1].offset = read_enc_int(&current, end);

-				sys_file_l[1].length = read_enc_int(&current, end);

-			} else if ((name_len == CHM_SYS_RESETTABLE_LEN) && (strcmp(current, CHM_SYS_RESETTABLE_NAME) == 0)) {

-				current += name_len;

-				sys_file_l[2].section = read_enc_int(&current, end);

-				sys_file_l[2].offset = read_enc_int(&current, end);

-				sys_file_l[2].length = read_enc_int(&current, end);

-			}

-		} else {

-			current += name_len;

-			file_e = (file_list_t *) cli_malloc(sizeof(file_list_t));

-			if (!file_e) {

-				return FALSE;

+		name = metadata->chunk_current;

+		metadata->chunk_current += name_len;

+		section = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		offset = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		length = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		

+		/* CHM_SYS_CONTENT_LEN is the shortest name we are searching for */

+		if ((name_len >= CHM_SYS_CONTENT_LEN) && (name[0] == ':') &&

+				(name[1] == ':')) {

+			if ((name_len == CHM_SYS_CONTROL_LEN) && (strcmp(name, CHM_SYS_CONTROL_NAME) == 0)) {

+				cli_dbgmsg("found CHM_SYS_CONTROL_NAME\n");

+				metadata->sys_control.offset = offset;

+				metadata->sys_control.length = length;

+			} else if ((name_len == CHM_SYS_CONTENT_LEN) && (strcmp(name, CHM_SYS_CONTENT_NAME) == 0)) {

+				cli_dbgmsg("found CHM_SYS_CONTENT_NAME\n");

+				metadata->sys_content.offset = offset;

+				metadata->sys_content.length = length;

+			} else if ((name_len == CHM_SYS_RESETTABLE_LEN) && (strcmp(name, CHM_SYS_RESETTABLE_NAME) == 0)) {

+				cli_dbgmsg("found CHM_SYS_RESETTABLE_NAME\n");

+				metadata->sys_reset.offset = offset;

+				metadata->sys_reset.length = length;

 			}

-			file_e->section = read_enc_int(&current, end);

-			file_e->offset = read_enc_int(&current, end);

-			file_e->length = read_enc_int(&current, end);

-			file_e->next = file_l->next;

-			file_l->next = file_e;

-			cli_dbgmsg("Section: %llu Offset: %llu Length: %llu\n",

-					file_e->section, file_e->offset,

-					file_e->length);

 		}

 	}

 	return TRUE;

 }

-static void print_chunk(chunk_header_t *chunk)

+static int prepare_file(int fd, chm_metadata_t *metadata)

 {

+	uint64_t name_len, section;

-	cli_dbgmsg("---- Chunk ----\n");

-	cli_dbgmsg("Signature:\t%c%c%c%c\n", chunk->signature[0],

-		chunk->signature[1],chunk->signature[2],chunk->signature[3]);

-	cli_dbgmsg("Free Space:\t%u\n", chunk->free_space);

-	if (memcmp(chunk->signature, "PMGL", 4) == 0) {

-		cli_dbgmsg("Prev Block:\t%d\n", chunk->block_prev);

-		cli_dbgmsg("Next Block:\t%d\n", chunk->block_next);

-		cli_dbgmsg("Num entries:\t%d\n\n", chunk->num_entries);

+	while (metadata->chunk_entries--) {

+		if (metadata->chunk_current >= metadata->chunk_end) {

+			return CL_EFORMAT;

+		}

+	

+		name_len = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		if (((metadata->chunk_current + name_len) >= metadata->chunk_end) ||

+				((metadata->chunk_current + name_len) < metadata->chunk_data)) {

+			cli_dbgmsg("Bad CHM name_len detected\n");

+			return CL_EFORMAT;

+		}

+		metadata->chunk_current += name_len;

+		section = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		metadata->file_offset = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+                metadata->file_length = read_enc_int(&metadata->chunk_current, metadata->chunk_end);

+		if (section == 1) {

+			return CL_SUCCESS;

+		}

 	}

-	return;

+	

+	return CL_BREAK;

 }

-static int read_chunk(int fd, off_t offset, uint32_t chunk_len,

-					char *m_area, off_t m_length,

-					file_list_t *file_l, file_list_t *sys_file_l)

+static int read_chunk(chm_metadata_t *metadata, int fd)

 {

-	chunk_header_t *chunk_hdr;

-	int retval = FALSE;

-	

-	if (chunk_len < 8 || chunk_len > 33554432) {

-		return FALSE;

-	}

-	

-	chunk_hdr = (chunk_header_t *) cli_malloc(sizeof(chunk_header_t));

-	if (!chunk_hdr) {

-		return FALSE;

-	}

-	

-	chunk_hdr->chunk_data = (char *) cli_malloc(chunk_len);

-	if (!chunk_hdr->chunk_data) {

-		free(chunk_hdr);

+	cli_dbgmsg("in read_chunk\n");

+

+	if (metadata->itsp_hdr.block_len < 8 || metadata->itsp_hdr.block_len > 33554432) {

 		return FALSE;

 	}

-	

-#if defined(HAVE_ATTRIB_PACKED) || defined(HAVE_PRAGMA_PACK) || defined(HAVE_PRAGMA_PACK_HPPA)

-	/* 8 bytes reads the signature and the free_space */

-	if (!chm_read_data(fd, chunk_hdr->signature, offset, 8,

-				m_area,	m_length)) {

-		goto abort;

-	}

-	if (!chm_read_data(fd, chunk_hdr->chunk_data, offset, chunk_len,

-				m_area,	m_length)) {

-		goto abort;

-	}

-#else	

-	if (lseek(fd, offset, SEEK_SET) != offset) {

-		goto abort;

-	}

-	if (cli_readn(fd, chunk_hdr->chunk_data, chunk_len) != chunk_len) {

-		goto abort;

-	}

-	if (lseek(fd, offset, SEEK_SET) != offset) {

-		goto abort;

-	}

-	if (cli_readn(fd, &chunk_hdr->signature, 4) != 4) {

-		goto abort;

-	}

-	if (cli_readn(fd, &chunk_hdr->free_space, 4) != 4) {

-		goto abort;

-	}

-#endif

-	chunk_hdr->free_space = chm_endian_convert_32(chunk_hdr->free_space);

-	

-	if (memcmp(chunk_hdr->signature, "PMGL", 4) == 0) {

-#if defined(HAVE_ATTRIB_PACKED) || defined(HAVE_PRAGMA_PACK) || defined(HAVE_PRAGMA_PACK_HPPA)

-		if (!chm_read_data(fd, (char *) &chunk_hdr->unknown, offset+8, 12,

-					m_area,	m_length)) {

-			goto abort;

+

+	if (metadata->m_area != NULL) {

+		if (metadata->chunk_offset > metadata->m_length) {

+			return CL_EFORMAT;

 		}

-#else

-		if (cli_readn(fd, &chunk_hdr->unknown, 4) != 4) {

-			goto abort;

+		if ((metadata->chunk_offset + metadata->itsp_hdr.block_len) > metadata->m_length) {

+			return CL_EFORMAT;

 		}

-		if (cli_readn(fd, &chunk_hdr->block_next, 4) != 4) {

-			goto abort;

+		metadata->chunk_data = metadata->m_area + metadata->chunk_offset;

+

+	} else {

+		if (!metadata->chunk_data) {

+			metadata->chunk_data = (char *) cli_malloc(metadata->itsp_hdr.block_len);

+			if (!metadata->chunk_data) {

+				return CL_EMEM;

+			}

 		}

-		if (cli_readn(fd, &chunk_hdr->block_prev, 4) != 4) {

-			goto abort;

+        	if (lseek(fd, metadata->chunk_offset, SEEK_SET) != metadata->chunk_offset) {

+                	goto abort;

+        	}

+        	if (cli_readn(fd, metadata->chunk_data, metadata->itsp_hdr.block_len) != metadata->itsp_hdr.block_len) {

+               		goto abort;

+        	}

+	}

+	metadata->chunk_current = metadata->chunk_data + CHM_CHUNK_HDR_LEN;

+	metadata->chunk_end = metadata->chunk_data + metadata->itsp_hdr.block_len;

+

+	if (memcmp(metadata->chunk_data, "PMGL", 4) == 0) {

+		metadata->chunk_entries = (uint16_t)((((uint8_t const *)(metadata->chunk_data))[metadata->itsp_hdr.block_len-2] << 0)

+					| (((uint8_t const *)(metadata->chunk_data))[metadata->itsp_hdr.block_len-1] << 8));

+	} else if (memcmp(metadata->chunk_data, "PMGI", 4) != 0) {

+		if (metadata->m_area != NULL) {

+			free(metadata->chunk_data);

 		}

-#endif

-		chunk_hdr->block_next = chm_endian_convert_32(chunk_hdr->block_next);

-		chunk_hdr->block_prev = chm_endian_convert_32(chunk_hdr->block_prev);

-		

-		chunk_hdr->num_entries = (uint16_t)((((uint8_t const *)(chunk_hdr->chunk_data))[chunk_len-2] << 0)

-					| (((uint8_t const *)(chunk_hdr->chunk_data))[chunk_len-1] << 8));

-		read_chunk_entries(chunk_hdr->chunk_data, chunk_len,

-                        chunk_hdr->num_entries, file_l, sys_file_l);

-	} else if (memcmp(chunk_hdr->signature, "PMGI", 4) != 0) {

-		goto abort;

+		return CL_BREAK;

 	}

-	print_chunk(chunk_hdr);

-	retval=TRUE;

+	return CL_SUCCESS;

 abort:

-	free(chunk_hdr->chunk_data);

-	free(chunk_hdr);

-	return retval;

+	if (metadata->m_area != NULL) {

+		free(metadata->chunk_data);

+		metadata->chunk_data = NULL;

+	}

+	return CL_EFORMAT;

 }

 static void print_sys_control(lzx_control_t *lzx_control)

@@ -617,50 +511,44 @@ static void print_sys_control(lzx_control_t *lzx_control)

 	cli_dbgmsg("Cache Size:\t%d\n\n", lzx_control->cache_size);

 }

-static lzx_control_t *read_sys_control(int fd, itsf_header_t *itsf_hdr, file_list_t *file_e,

-					char *m_area, off_t m_length)

+static int read_sys_control(int fd, chm_metadata_t *metadata, lzx_control_t *lzx_control)

 {

 	off_t offset;

-	lzx_control_t *lzx_control;

-	if (file_e->length != 28) {

-		return NULL;

+	if (metadata->sys_control.length != 28) {

+		return FALSE;

 	}

-	offset = itsf_hdr->data_offset + file_e->offset;

+	offset = metadata->itsf_hdr.data_offset + metadata->sys_control.offset;

 	if (offset < 0) {

-		return NULL;

+		return FALSE;

 	}

-	lzx_control = (lzx_control_t *) cli_malloc(sizeof(lzx_control_t));

-	if (!lzx_control) {

-		return NULL;

-	}

 #if defined(HAVE_ATTRIB_PACKED) || defined(HAVE_PRAGMA_PACK) || defined(HAVE_PRAGMA_PACK_HPPA)

 	if (!chm_read_data(fd, (char *) lzx_control, offset, CHM_CONTROL_LEN,

-				m_area,	m_length)) {

-		goto abort;

+				metadata->m_area, metadata->m_length)) {

+		return FALSE;

 	}

 #else

 	if (lseek(fd, offset, SEEK_SET) != offset) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_control->length, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_control->signature, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_control->version, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_control->reset_interval, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_control->window_size, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_control->cache_size, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 #endif

 	lzx_control->length = chm_endian_convert_32(lzx_control->length);

@@ -671,7 +559,7 @@ static lzx_control_t *read_sys_control(int fd, itsf_header_t *itsf_hdr, file_lis

 	if (strncmp((const char *) "LZXC", (const char *) lzx_control->signature, 4) != 0) {

 		cli_dbgmsg("bad sys_control signature");

-		goto abort;

+		return FALSE;

 	}

 	switch(lzx_control->version) {

 		case 1:

@@ -682,14 +570,11 @@ static lzx_control_t *read_sys_control(int fd, itsf_header_t *itsf_hdr, file_lis

 			break;

 		default:

 			cli_dbgmsg("Unknown sys_control version:%d\n", lzx_control->version);

-			goto abort;

+			return FALSE;

 	}

 	print_sys_control(lzx_control);

-	return lzx_control;

-abort:

-	free(lzx_control);

-	return NULL;

+	return TRUE;

 }

 static void print_sys_content(lzx_content_t *lzx_content)

@@ -703,19 +588,13 @@ static void print_sys_content(lzx_content_t *lzx_content)

 	cli_dbgmsg("Length:\t%llu\n\n", lzx_content->length);

 }

-static lzx_content_t *read_sys_content(int fd, itsf_header_t *itsf_hdr, file_list_t *file_e)

+static int read_sys_content(int fd, chm_metadata_t *metadata, lzx_content_t *lzx_content)

 {

-	lzx_content_t *lzx_content;

-	

-	lzx_content = (lzx_content_t *) cli_malloc(sizeof(lzx_content_t));

-	if (!lzx_content) {

-		return NULL;

-	}

-	lzx_content->offset = itsf_hdr->data_offset + file_e->offset;

-	lzx_content->length = file_e->length;

+	lzx_content->offset = metadata->itsf_hdr.data_offset + metadata->sys_content.offset;

+	lzx_content->length = metadata->sys_content.length;

 	print_sys_content(lzx_content);

-	return lzx_content;

+	return TRUE;

 }

 static void print_sys_reset_table(lzx_reset_table_t *lzx_reset_table)

@@ -733,25 +612,18 @@ static void print_sys_reset_table(lzx_reset_table_t *lzx_reset_table)

 	cli_dbgmsg("Frame Len:\t%llu\n\n", lzx_reset_table->frame_len);

 }

-static lzx_reset_table_t *read_sys_reset_table(int fd, itsf_header_t *itsf_hdr, file_list_t *file_e,

-						char *m_area, off_t m_length)

+static int read_sys_reset_table(int fd, chm_metadata_t *metadata, lzx_reset_table_t *lzx_reset_table)

 {

 	off_t offset;

-	lzx_reset_table_t *lzx_reset_table;

-	if (file_e->length < 40) {

-		return NULL;

+	if (metadata->sys_reset.length < 40) {

+		return FALSE;

 	}

 	/* Skip past unknown entry in offset calc */

-	offset = itsf_hdr->data_offset + file_e->offset + 4;

+	offset = metadata->itsf_hdr.data_offset + metadata->sys_reset.offset + 4;

 	if (offset < 0) {

-		return NULL;

-	}

-

-	lzx_reset_table = (lzx_reset_table_t *) cli_malloc(sizeof(lzx_reset_table_t));

-	if (!lzx_reset_table) {

-		return NULL;

+		return FALSE;

 	}

 	/* Save the entry offset for later use */

@@ -759,30 +631,30 @@ static lzx_reset_table_t *read_sys_reset_table(int fd, itsf_header_t *itsf_hdr,

 #if defined(HAVE_ATTRIB_PACKED) || defined(HAVE_PRAGMA_PACK) || defined(HAVE_PRAGMA_PACK_HPPA)

 	if (!chm_read_data(fd, (char *) lzx_reset_table, offset, CHM_RESET_TABLE_LEN,

-				m_area,	m_length)) {

-		goto abort;

+				metadata->m_area, metadata->m_length)) {

+		return FALSE;

 	}

 #else	

 	if (lseek(fd, offset, SEEK_SET) != offset) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_reset_table->num_entries, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_reset_table->entry_size, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_reset_table->table_offset, 4) != 4) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_reset_table->uncom_len, 8) != 8) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_reset_table->com_len, 8) != 8) {

-		goto abort;

+		return FALSE;

 	}

 	if (cli_readn(fd, &lzx_reset_table->frame_len, 8) != 8) {

-		goto abort;

+		return FALSE;

 	}

 #endif

 	lzx_reset_table->num_entries = chm_endian_convert_32(lzx_reset_table->num_entries);

@@ -794,56 +666,52 @@ static lzx_reset_table_t *read_sys_reset_table(int fd, itsf_header_t *itsf_hdr,

 	if (lzx_reset_table->frame_len != LZX_FRAME_SIZE) {

 		cli_dbgmsg("bad sys_reset_table frame_len: 0x%lx\n", (long unsigned int) lzx_reset_table->frame_len);

-		goto abort;

+		return FALSE;

 	}

 	if ((lzx_reset_table->entry_size != 4) && (lzx_reset_table->entry_size != 8)) {

 		cli_dbgmsg("bad sys_reset_table entry_size: 0x%x\n",lzx_reset_table->entry_size);

-		goto abort;

+		return FALSE;

 	}

 	print_sys_reset_table(lzx_reset_table);

-	return lzx_reset_table;

-abort:

-	free(lzx_reset_table);

-	return NULL;

+	return TRUE;

 }

 /* *****************************************************************/

 /* This section interfaces to the mspack files. As such, this is a */

 /* little bit dirty compared to my usual code */

-static int chm_decompress_stream(int fd, const char *dirname, itsf_header_t *itsf_hdr,

-				file_list_t *file_l, file_list_t *sys_file_l,

-				char *m_area, off_t m_length)

+static int chm_decompress_stream(int fd, chm_metadata_t *metadata, const char *dirname)

 {

-	file_list_t *entry;

-	lzx_content_t *lzx_content=NULL;

-	lzx_reset_table_t *lzx_reset_table=NULL;

-	lzx_control_t *lzx_control=NULL;

-	int window_bits, count, length, tmpfd, ofd, retval=FALSE;

-	uint64_t com_offset;

+	lzx_content_t lzx_content;

+	lzx_reset_table_t lzx_reset_table;

+	lzx_control_t lzx_control;

+	int window_bits, length, tmpfd, retval=-1;

 	struct lzx_stream * stream;

 	char filename[1024];

 	snprintf(filename, 1024, "%s/clamav-unchm.bin", dirname);

-	tmpfd = open(filename, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY, S_IRWXU);

+	tmpfd = open(filename, O_RDWR|O_CREAT|O_TRUNC|O_BINARY, S_IRWXU);

 	if (tmpfd<0) {

 		cli_dbgmsg("open failed for %s\n", filename);

-		return FALSE;

+		return -1;

 	}

-	if (!sys_file_l[0].length || !sys_file_l[1].length ||!sys_file_l[2].length) {

+	if (!metadata->sys_control.length || !metadata->sys_content.length ||!metadata->sys_reset.length) {

+		cli_dbgmsg("Control file missing\n");

 		goto abort;

 	}

-	lzx_control = read_sys_control(fd, itsf_hdr, &sys_file_l[0], m_area, m_length);

-	lzx_content = read_sys_content(fd, itsf_hdr, &sys_file_l[1]);

-	lzx_reset_table = read_sys_reset_table(fd, itsf_hdr, &sys_file_l[2], m_area, m_length);

-

-	if (!lzx_content || !lzx_reset_table || !lzx_control) {

+	if (!read_sys_control(fd, metadata, &lzx_control)) {

+		goto abort;

+	}

+	if (!read_sys_content(fd, metadata, &lzx_content)) {

+		goto abort;

+	}

+	if (!read_sys_reset_table(fd, metadata, &lzx_reset_table)) {

 		goto abort;

 	}

-	switch (lzx_control->window_size) {

+	switch (lzx_control.window_size) {

 		case 0x008000:

 			window_bits = 15;

 			break;

@@ -866,26 +734,27 @@ static int chm_decompress_stream(int fd, const char *dirname, itsf_header_t *its

 			window_bits = 21;

 			break;

 		default:

-			cli_dbgmsg("bad control window size: 0x%x\n", lzx_control->window_size);

+			cli_dbgmsg("bad control window size: 0x%x\n", lzx_control.window_size);

 			goto abort;

 	}

-	if (lzx_control->reset_interval % LZX_FRAME_SIZE) {

-		cli_dbgmsg("bad reset_interval: 0x%x\n", lzx_control->window_size);

+	if (lzx_control.reset_interval % LZX_FRAME_SIZE) {

+		cli_dbgmsg("bad reset_interval: 0x%x\n", lzx_control.window_size);

 		goto abort;

 	}

-	length = lzx_reset_table->uncom_len;

-	length += lzx_control->reset_interval;

-	length &= -lzx_control->reset_interval;

+	length = lzx_reset_table.uncom_len;

+	length += lzx_control.reset_interval;

+	length &= -lzx_control.reset_interval;

-	com_offset = lzx_content->offset;

-	cli_dbgmsg("Compressed offset: %llu\n", com_offset);

+	cli_dbgmsg("Compressed offset: %llu\n", lzx_content.offset);

+	if (lseek(fd, lzx_content.offset, SEEK_SET) != lzx_content.offset) {

+		goto abort;

+	}

 	stream = lzx_init(fd, tmpfd, window_bits,

-			lzx_control->reset_interval / LZX_FRAME_SIZE,

+			lzx_control.reset_interval / LZX_FRAME_SIZE,

 			4096, length, NULL, NULL);

-	lseek(fd, com_offset, SEEK_SET);

 	if (!stream) {

 		cli_dbgmsg("lzx_init failed\n");

 		goto abort;

@@ -894,149 +763,175 @@ static int chm_decompress_stream(int fd, const char *dirname, itsf_header_t *its

 	lzx_decompress(stream, length);

 	lzx_free(stream);

-	entry = file_l->next;

-	close(tmpfd);

-	

-	/* Reopen the file for reading */

-	tmpfd = open(filename, O_RDONLY|O_BINARY);

-	if (tmpfd < 0) {

-		cli_dbgmsg("re-open output failed\n");

-		goto abort;

-	}

-	

 	/* Delete the file */

 	unlink(filename);

-	

-	count=0;

-	while(entry) {

-		if (entry->section != 1) {

-			entry = entry->next;

-			continue;

-		}

-		if (lseek(tmpfd, entry->offset, SEEK_SET) != (off_t)entry->offset) {

-			cli_dbgmsg("seek in output failed\n");

-			entry = entry->next;

-			continue;

-		}

-		

-		snprintf(filename, 1024, "%s/%d-%llu.chm", dirname, count, entry->offset);

-		ofd = open(filename, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY, S_IRWXU);

-		if (ofd < 0) {

-			entry = entry->next;

-			continue;

-		}

-		if (chm_copy_file_data(tmpfd, ofd, entry->length) != entry->length) {

-			cli_dbgmsg("failed to copy %lu bytes\n", (long unsigned int) entry->length);

-		}

-		

-		close(ofd);		

-		entry = entry->next;

-		count++;

-	}

-	close(tmpfd);

-	tmpfd=-1;

-	retval = TRUE;

+	retval = tmpfd;

 abort:

-	if (tmpfd>=0) {

+	if ((retval == -1) && (tmpfd >= 0)) {

 		close(tmpfd);

 	}

-	if (lzx_content) {

-		free(lzx_content);

+	return retval;

+}

+

+/* ************ End dirty section ********************/

+

+static int chm_init_metadata(chm_metadata_t *metadata)

+{

+	if (!metadata) {

+		return CL_ENULLARG;

 	}

-	if (lzx_reset_table) {

-		free(lzx_reset_table);

+	

+	metadata->sys_control.length = metadata->sys_content.length = metadata->sys_reset.length = 0;

+	metadata->m_area = NULL;

+	metadata->m_area = 0;

+	metadata->ufd = -1;

+	metadata->num_chunks = metadata->chunk_entries = 0;

+	metadata->chunk_data = NULL;

+	return CL_SUCCESS;

+}

+

+void cli_chm_close(chm_metadata_t *metadata)

+{

+	if (metadata->ufd >= 0) {

+		close(metadata->ufd);

 	}

-	if (lzx_control) {

-		free(lzx_control);

+	if (!metadata->m_area && metadata->chunk_data) {

+		free(metadata->chunk_data);

 	}

-	return retval;

+#ifdef HAVE_MMAP

+	if (metadata->m_area) {

+		munmap(metadata->m_area, metadata-> m_length);

+	}

+#endif

 }

-/* ************ End dirty section ********************/

+int cli_chm_extract_file(int fd, char *dirname, chm_metadata_t *metadata)

+{

+	char filename[1024];

+

+	cli_dbgmsg("in cli_chm_extract_file\n");

+	

+	if (lseek(metadata->ufd, metadata->file_offset, SEEK_SET) != (off_t) metadata->file_offset) {

+		cli_dbgmsg("seek in uncompressed stream failed\n");

+		return CL_EFORMAT;

+	}

+	snprintf(filename, 1024, "%s/%llu.chm", dirname, metadata->file_offset);

+	metadata->ofd = open(filename, O_RDWR|O_CREAT|O_TRUNC|O_BINARY, S_IRWXU);

+	if (metadata->ofd < 0) {

+		return CL_EIO;

+	}

+	if (chm_copy_file_data(metadata->ufd, metadata->ofd, metadata->file_length) != metadata->file_length) {

+		cli_dbgmsg("failed to copy %lu bytes\n", (long unsigned int) metadata->file_length);

+		close(metadata->ofd);

+		return CL_EIO;

+	}

+		

+	return CL_SUCCESS;

+}	

-int chm_unpack(int fd, const char *dirname)

+int cli_chm_prepare_file(int fd, char *dirname, chm_metadata_t *metadata)

+{

+	int retval;

+	

+	cli_dbgmsg("in cli_chm_prepare_file\n");

+

+	if (metadata->chunk_entries == 0) {

+		if (metadata->num_chunks == 0) {

+			return CL_BREAK;

+		}

+		if ((retval = read_chunk(metadata, fd)) != CL_SUCCESS) {

+			return retval;

+		}

+	}

+

+	return prepare_file(fd, metadata);

+}

+

+int cli_chm_open(int fd, const char *dirname, chm_metadata_t *metadata)

 {

-	int retval=FALSE;

-	char *m_area=NULL;

-	off_t m_length=0, offset;

-	file_list_t *file_l, sys_file_l[3];

 	struct stat statbuf;

-	itsf_header_t itsf_hdr;

-	itsp_header_t itsp_hdr;

-	uint32_t num_chunks;

+	int retval;

-	/* These two lists contain the list of files and system files in

-	the archive. The first entry in the list is an empty entry */

+	cli_dbgmsg("in cli_chm_open\n");

-        file_l = (file_list_t *) cli_malloc(sizeof(file_list_t));

-	if (!file_l) {

-		return FALSE;

+	if ((retval = chm_init_metadata(metadata)) != CL_SUCCESS) {

+		return retval;

 	}

-	file_l->next = NULL;

-	sys_file_l[0].length = sys_file_l[1].length = sys_file_l[2].length = 0;

-	

+

 #ifdef HAVE_MMAP

 	if (fstat(fd, &statbuf) == 0) {

 		if (statbuf.st_size < CHM_ITSF_MIN_LEN) {

 			goto abort;

 		}

-		m_length = statbuf.st_size;

-		m_area = (char *) mmap(NULL, m_length, PROT_READ, MAP_PRIVATE, fd, 0);

-		if (m_area == MAP_FAILED) {

-			m_area = NULL;

+		metadata->m_length = statbuf.st_size;

+		metadata->m_area = (char *) mmap(NULL, metadata->m_length, PROT_READ, MAP_PRIVATE, fd, 0);

+		if (metadata->m_area == MAP_FAILED) {

+			metadata->m_area = NULL;

 		}

 	}

 #endif

-	if (!itsf_read_header(fd, &itsf_hdr, m_area, m_length)) {

+	if (!itsf_read_header(fd, &metadata->itsf_hdr, metadata->m_area, metadata->m_length)) {

 		goto abort;

 	}

-	itsf_print_header(&itsf_hdr);

+	itsf_print_header(&metadata->itsf_hdr);

-	if (!itsp_read_header(fd, &itsp_hdr, itsf_hdr.dir_offset, m_area, m_length)) {

+	if (!itsp_read_header(fd, &metadata->itsp_hdr, metadata->itsf_hdr.dir_offset, metadata->m_area, metadata->m_length)) {

 		goto abort;

 	}

-	itsp_print_header(&itsp_hdr);

-	

-	offset = itsf_hdr.dir_offset+CHM_ITSP_LEN;

+	itsp_print_header(&metadata->itsp_hdr);

+

+	metadata->chunk_offset = metadata->itsf_hdr.dir_offset+CHM_ITSP_LEN;

 	/* TODO: need to check this first calculation,

 		currently have no files of this type */

-	if (itsp_hdr.index_head > 0) {

-		offset += itsp_hdr.index_head * itsp_hdr.block_len;

+	if (metadata->itsp_hdr.index_head > 0) {

+		metadata->chunk_offset += metadata->itsp_hdr.index_head * metadata->itsp_hdr.block_len;