@@ -1,3 +1,19 @@

+Wed Apr  8 16:49:32 CEST 2009 (tk)

+----------------------------------

+ * V 0.95.1

+

+Wed Apr  8 16:40:19 CEST 2009 (tk)

+----------------------------------

+ * libclamav/phishcheck.c: fix possible crash in cli_url_canon() (bb#1553)

+			   Patch by Edwin, reported by Nigel Horne

+			    <njh*bandsman.co.uk>

+

+Wed Apr  8 16:35:23 CEST 2009 (tk)

+----------------------------------

+ * libclamav/others.h: harden CLI_ISCONTAINED macro (bb#1552)

+		       Patch by aCaB, reported by Martin Olsen

+		       <marty*lightspeedsystems.com> 

+

 Tue Apr  7 16:53:18 CEST 2009 (acab)

 ------------------------------------

  * clamav-milter/netcode.c: honour ReadTimeout=0

@@ -14962,8 +14962,8 @@ static struct v{

 extern void abort(void);

 #define CLI_ISCONTAINED(bb, bb_size, sb, sb_size)	\

-    (bb_size > 0 && sb_size > 0 && sb_size <= bb_size	\

-     && sb >= bb && sb + sb_size <= bb + bb_size && sb + sb_size > bb)

+  ((bb_size) > 0 && (sb_size) > 0 && (size_t)(sb_size) <= (size_t)(bb_size) \

+   && (sb) >= (bb) && ((sb) + (sb_size)) <= ((bb) + (bb_size)) && ((sb) + (sb_size)) > (bb) && (sb) < ((bb) + (bb_size)))

 int crashtest()

 {

@@ -191,8 +191,8 @@ static struct v{

 extern void abort(void);

 #define CLI_ISCONTAINED(bb, bb_size, sb, sb_size)	\

-    (bb_size > 0 && sb_size > 0 && sb_size <= bb_size	\

-     && sb >= bb && sb + sb_size <= bb + bb_size && sb + sb_size > bb)

+  ((bb_size) > 0 && (sb_size) > 0 && (size_t)(sb_size) <= (size_t)(bb_size) \

+   && (sb) >= (bb) && ((sb) + (sb_size)) <= ((bb) + (bb_size)) && ((sb) + (sb_size)) > (bb) && (sb) < ((bb) + (bb_size)))

 int crashtest()

 {

@@ -59,12 +59,12 @@ extern uint8_t cli_debug_flag;

  * The macro can be used to protect against wraps.

  */

 #define CLI_ISCONTAINED(bb, bb_size, sb, sb_size)	\

-    (bb_size > 0 && sb_size > 0 && (size_t)sb_size <= (size_t)bb_size	\

-     && sb >= bb && sb + sb_size <= bb + bb_size && sb + sb_size > bb)

+  ((bb_size) > 0 && (sb_size) > 0 && (size_t)(sb_size) <= (size_t)(bb_size) \

+   && (sb) >= (bb) && ((sb) + (sb_size)) <= ((bb) + (bb_size)) && ((sb) + (sb_size)) > (bb) && (sb) < ((bb) + (bb_size)))

 #define CLI_ISCONTAINED2(bb, bb_size, sb, sb_size)	\

-    (bb_size > 0 && sb_size >= 0 && (size_t)sb_size <= (size_t)bb_size	\

-     && sb >= bb && sb + sb_size <= bb + bb_size && sb + sb_size >= bb)

+  ((bb_size) > 0 && (sb_size) >= 0 && (size_t)(sb_size) <= (size_t)(bb_size) \

+   && (sb) >= (bb) && ((sb) + (sb_size)) <= ((bb) + (bb_size)) && ((sb) + (sb_size)) >= (bb) && (sb) < ((bb) + (bb_size)))

 #define CLI_MAX_ALLOCATION 184549376

@@ -1280,7 +1280,7 @@ int cli_url_canon(const char *inurl, size_t len, char *urlbuff, size_t dest_len,

 	*p = '\0';

 	p = host_begin;

-	while (p < urlend && p+2 < url + dest_len) {

+	while (p < urlend && p+2 < url + dest_len && urlend < urlbuff+dest_len) {

 	    unsigned char c = *p;

 	    if (c <= 32 || c >= 127 || c == '%' || c == '#') {

 		/* convert non-ascii characters back to % escaped */