@@ -1,3 +1,7 @@

+Fri Aug  1 00:07:30 CEST 2008 (tk)

+----------------------------------

+  * libclamav: scan disasm data with type-8 sigs (bb#895)

+

 Thu Jul 31 18:09:58 CEST 2008 (tk)

 ----------------------------------

   * libclamav: add support for loading specific PUA categories (bb#939)

@@ -39,6 +39,7 @@ typedef enum {

     /* Please do not add any new types above this line */

     CL_TYPE_ERROR,

     CL_TYPE_MSEXE,

+    CL_TYPE_PE_DISASM,

     CL_TYPE_ELF,

     CL_TYPE_POSIX_TAR,

     CL_TYPE_OLD_TAR,

@@ -96,7 +96,7 @@ struct cli_mtarget {

     uint8_t ac_only;

 };

-#define CLI_MTARGETS 8

+#define CLI_MTARGETS 9

 static const struct cli_mtarget cli_mtargets[CLI_MTARGETS] =  {

     { 0,		    "GENERIC",	    0,	0   },

     { CL_TYPE_MSEXE,	    "PE",	    1,	0   },

@@ -105,7 +105,8 @@ static const struct cli_mtarget cli_mtargets[CLI_MTARGETS] =  {

     { CL_TYPE_MAIL,	    "MAIL",	    4,	1   },

     { CL_TYPE_GRAPHICS,	    "GRAPHICS",	    5,	1   },

     { CL_TYPE_ELF,	    "ELF",	    6,	1   },

-    { CL_TYPE_TEXT_ASCII,   "ASCII",	    7,	1   }

+    { CL_TYPE_TEXT_ASCII,   "ASCII",	    7,	1   },

+    { CL_TYPE_PE_DISASM,    "DISASM",	    8,	1   }

 };

 struct cli_target_info {

@@ -897,9 +897,15 @@ int cli_scanpe(int desc, cli_ctx *ctx)

     CLI_UNPTEMP("DISASM",(exe_sections,0));

     disasmbuf(epbuff, epsize, ndesc);

+    lseek(ndesc, 0, SEEK_SET);

+    ret = cli_scandesc(ndesc, ctx, CL_TYPE_PE_DISASM, 1, NULL, AC_SCAN_VIR);

     close(ndesc);

     CLI_TMPUNLK();

     free(tempfile);

+    if(ret == CL_VIRUS) {

+	free(exe_sections);

+	return ret;

+    }

     /* Attempt to detect some popular polymorphic viruses */