@@ -1,3 +1,10 @@

+Thu Jul  8 15:39:29 CEST 2004 (tk)

+----------------------------------

+  * libclamav: extend engine to support character alternatives (a|b|..|z)

+	       and distance limits in multipattern signatures (exact: {n}

+	       and variable: {n-} (n or more), {-n} (n or less), {n1-n2}

+	       (n1, n2 or between them))

+

 Wed Jul  7 02:17:00 CEST 2004 (tk)

 ----------------------------------

   * libclamav: pe: Improve UPX detection (thanks to aCaB). Ignore old "ZM"

@@ -78,9 +78,10 @@ extern "C"

 struct cli_patt {

     short int *pattern;

-    unsigned int length;

+    unsigned int length, mindist, maxdist;

     char *virname;

-    unsigned short int sigid, parts, partno, type;

+    unsigned short int sigid, parts, partno, type, alt, *altn;

+    char **altc;

     struct cli_patt *next;

 };

@@ -21,4 +21,6 @@

 #endif

 #define VIRUSDB DATADIR "/viruses.db"

+

 #define CLI_IGN -200

+#define CLI_ALT -201

@@ -176,6 +176,7 @@ int cl_buildtrie(struct cl_node *root)

 static void cli_freepatt(struct cli_patt *list)

 {

 	struct cli_patt *handler, *prev;

+	int i;

     handler = list;

@@ -183,6 +184,12 @@ static void cli_freepatt(struct cli_patt *list)

     while(handler) {

 	free(handler->pattern);

 	free(handler->virname);

+	if(handler->alt) {

+	    free(handler->altn);

+	    for(i = 0; i < handler->alt; i++)

+		free(handler->altc[i]);

+	    free(handler->altc);

+	}

 	prev = handler;

 	handler = handler->next;

 	free(prev);

@@ -206,9 +213,10 @@ int inline cli_findpos(const char *buffer, int offset, int length, const struct

 {

 	int bufferpos = offset + CL_MIN_LENGTH;

 	int postfixend = offset + length;

-	unsigned int i;

+	unsigned int i, j, alt = 0, found = 0;

-    if (bufferpos >= length)

+

+    if(bufferpos >= length)

 	bufferpos %= length;

     for(i = CL_MIN_LENGTH; i < pattern->length; i++) {

@@ -216,30 +224,41 @@ int inline cli_findpos(const char *buffer, int offset, int length, const struct

 	if(bufferpos == postfixend)

 	    return 0;

-	if(pattern->pattern[i] != CLI_IGN && (char) pattern->pattern[i] != buffer[bufferpos])

+	if(pattern->pattern[i] == CLI_ALT) {

+	    for(j = 0; j < pattern->altn[alt]; j++) {

+		if(pattern->altc[alt][j] == buffer[bufferpos])

+		    found = 1;

+	    }

+

+	    if(!found)

+		return 0;

+	    alt++;

+

+	} else if(pattern->pattern[i] != CLI_IGN && (char) pattern->pattern[i] != buffer[bufferpos])

 	    return 0;

 	bufferpos++;

-	if (bufferpos == length)

+	if(bufferpos == length)

 	    bufferpos = 0;

     }

     return 1;

 }

-int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, int *partcnt, int typerec)

+int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, int *partcnt, int typerec, unsigned long int offset, unsigned long int *partoff)

 {

 	struct cl_node *current;

 	struct cli_patt *pt;

-	int position, type = CL_CLEAN;

+	int position, type = CL_CLEAN, dist;

         unsigned int i;

+int j;

     current = (struct cl_node *) root;

-    if(!partcnt) {

-	cli_dbgmsg("cli_scanbuff(): partcnt == NULL\n");

+    if(!partcnt || !partoff) {

+	cli_dbgmsg("cli_scanbuff(): partcnt == NULL || partoff == NULL\n");

 	return CL_EMEM;

     }

@@ -254,21 +273,37 @@ int cli_scanbuff(const char *buffer, unsigned int length, const char **virname,

 		if(cli_findpos(buffer, position, length, pt)) {

 		    if(pt->sigid) { /* it's a partial signature */

 			if(partcnt[pt->sigid] + 1 == pt->partno) {

-			    if(++partcnt[pt->sigid] == pt->parts) { /* the last one */

-				if(pt->type) {

-				    if(typerec) {

-					cli_dbgmsg("Matched signature for file type: %s\n", pt->virname);

-					if(pt->type > type)

-					    type = pt->type;

-				    }

-				} else {

-				    if(virname)

-					*virname = pt->virname;

-				    return CL_VIRUS;

+			    dist = 1;

+			    if(pt->maxdist)

+				if(offset + i - partoff[pt->sigid] > pt->maxdist)

+				    dist = 0;

+

+			    if(dist && pt->mindist)

+				if(offset + i - partoff[pt->sigid] < pt->mindist)

+				    dist = 0;

+

+

+			    if(dist) {

+				partoff[pt->sigid] = offset + i + pt->length;

+

+				if(++partcnt[pt->sigid] == pt->parts) { /* the last one */

+				    if(pt->type) {

+					if(typerec) {

+					    cli_dbgmsg("Matched signature for file type: %s\n", pt->virname);

+					    if(pt->type > type)

+						type = pt->type;

+					}

+				    } else {

+					if(virname)

+					    *virname = pt->virname;

+

+					return CL_VIRUS;

+				    }

 				}

 			    }

 			}

+

 		    } else { /* old type signature */

 			if(pt->type) {

 			    if(typerec) {

@@ -298,6 +333,7 @@ int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, c

 {

 	int ret, *partcnt;

+	unsigned long int *partoff;

     if((partcnt = (int *) cli_calloc(root->partsigs + 1, sizeof(int))) == NULL) {

@@ -305,7 +341,12 @@ int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, c

 	return CL_EMEM;

     }

-    ret = cli_scanbuff(buffer, length, virname, root, partcnt, 0);

+    if((partoff = (unsigned long int *) cli_calloc(root->partsigs + 1, sizeof(unsigned long int))) == NULL) {

+	cli_dbgmsg("cli_scanbuff(): unable to cli_calloc(%d, %d)\n", root->partsigs + 1, sizeof(unsigned long int));

+	return CL_EMEM;

+    }

+

+    ret = cli_scanbuff(buffer, length, virname, root, partcnt, 0, 0, partoff);

     free(partcnt);

     return ret;

@@ -31,6 +31,6 @@ struct nodelist *cli_bfsadd(struct nodelist *bfs, struct cl_node *n);

 void cli_failtrans(struct cl_node *root);

 void cli_fasttrie(struct cl_node *n, struct cl_node *root);

 int cli_findpos(const char *buffer, int offset, int length, const struct cli_patt *pattern);

-int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, int *partcnt, int typerec);

+int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, int *partcnt, int typerec, unsigned long int offset, unsigned long int *partoff);

 #endif

@@ -39,11 +39,11 @@

 #include "defaults.h"

-static int cli_addsig(struct cl_node *root, const char *virname, const char *hexsig, int sigid, int parts, int partno, int type)

+static int cli_addsig(struct cl_node *root, const char *virname, const char *hexsig, int sigid, int parts, int partno, int type, unsigned int mindist, unsigned int maxdist)

 {

 	struct cli_patt *new;

-	char *pt;

-	int virlen, ret;

+	char *pt, *hex;

+	int virlen, ret, i, error = 0;

     if((new = (struct cli_patt *) cli_calloc(1, sizeof(struct cli_patt))) == NULL)

@@ -53,13 +53,119 @@ static int cli_addsig(struct cl_node *root, const char *virname, const char *hex

     new->sigid = sigid;

     new->parts = parts;

     new->partno = partno;

+    new->mindist = mindist;

+    new->maxdist = maxdist;

-    new->length = strlen(hexsig) / 2;

+    if(strchr(hexsig, '(')) {

+	    char *hexcpy, *hexnew, *start, *h;

+	    short int *c;

+

+	if(!(hexcpy = strdup(hexsig))) {

+	    free(new);

+	    return CL_EMEM;

+	}

+

+	if(!(hexnew = (char *) cli_calloc(strlen(hexsig) + 1, 1))) {

+	    free(hexcpy);

+	    free(new);

+	    return CL_EMEM;

+	}

+

+	start = pt = hexcpy;

+	while((pt = strchr(start, '('))) {

+	    *pt++ = 0;

+

+	    if(!start) {

+		error = 1;

+		break;

+	    }

+

+	    strcat(hexnew, start);

+	    strcat(hexnew, "@@");

+

+	    if(!(start = strchr(pt, ')'))) {

+		error = 1;

+		break;

+	    }

+	    *start++ = 0;

+

+	    new->alt++;

+	    new->altn = (unsigned short int *) realloc(new->altn, new->alt);

+	    new->altn[new->alt - 1] = 0;

+	    new->altc = (char **) realloc(new->altc, new->alt);

+

+	    for(i = 0; i < strlen(pt); i++)

+		if(pt[i] == '|')

+		    new->altn[new->alt - 1]++;

+

+	    if(!new->altn[new->alt - 1]) {

+		error = 1;

+		break;

+	    } else

+		new->altn[new->alt - 1]++;

+

+	    if(!(new->altc[new->alt - 1] = (char *) cli_calloc(new->altn[new->alt - 1], 1))) {

+		error = 1;

+		break;

+	    }

+

+	    for(i = 0; i < new->altn[new->alt - 1]; i++) {

+		if((h = cli_strtok(pt, i, "|")) == NULL) {

+		    error = 1;

+		    break;

+		}

+

+		if((c = cl_hex2str(h)) == NULL) {

+		    free(h);

+		    error = 1;

+		    break;

+		}

+

+		new->altc[new->alt - 1][i] = (char) *c;

+		free(c);

+		free(h);

+	    }

+

+	    if(error)

+		break;

+	}

+

+	if(start)

+	    strcat(hexnew, start);

+

+	hex = hexnew;

+	free(hexcpy);

+

+	if(error) {

+	    free(hexcpy);

+	    free(hexnew);

+	    if(new->alt) {

+		free(new->altn);

+		for(i = 0; i < new->alt; i++)

+		    free(new->altc[i]);

+		free(new->altc);

+	    }

+	    free(new);

+	    return CL_EMALFDB;

+	}

+

+    } else

+	hex = (char *) hexsig;

+

+

+    new->length = strlen(hex) / 2;

     if(new->length > root->maxpatlen)

 	root->maxpatlen = new->length;

-    if((new->pattern = cl_hex2str(hexsig)) == NULL) {

+    if((new->pattern = cl_hex2str(hex)) == NULL) {

+	if(new->alt) {

+	    free(new->altn);

+	    for(i = 0; i < new->alt; i++)

+		free(new->altc[i]);

+	    free(new->altc);

+	    free(hex);

+	}

 	free(new);

 	return CL_EMALFDB;

     }

@@ -70,11 +176,25 @@ static int cli_addsig(struct cl_node *root, const char *virname, const char *hex

 	virlen = strlen(virname);

     if(virlen <= 0) {

+	if(new->alt) {

+	    free(new->altn);

+	    for(i = 0; i < new->alt; i++)

+		free(new->altc[i]);

+	    free(new->altc);

+	    free(hex);

+	}

 	free(new);

 	return CL_EMALFDB;

     }

     if((new->virname = cli_calloc(virlen + 1, sizeof(char))) == NULL) {

+	if(new->alt) {

+	    free(new->altn);

+	    for(i = 0; i < new->alt; i++)

+		free(new->altc[i]);

+	    free(new->altc);

+	    free(hex);

+	}

 	free(new);

 	return CL_EMEM;

     }

@@ -83,21 +203,107 @@ static int cli_addsig(struct cl_node *root, const char *virname, const char *hex

     if((ret = cli_addpatt(root, new))) {

 	free(new->virname);

+	if(new->alt) {

+	    free(new->altn);

+	    for(i = 0; i < new->alt; i++)

+		free(new->altc[i]);

+	    free(new->altc);

+	    free(hex);

+	}

 	free(new);

 	return ret;

     }

+    if(new->alt)

+	free(hex);

+

     return 0;

 }

 int cli_parse_add(struct cl_node *root, char *virname, const char *hexsig, int type)

 {

 	struct cli_patt *new;

-	char *pt;

+	char *pt, *hexcpy, *start, *n;

 	int ret, virlen, parts = 0, i, len;

+	int mindist = 0, maxdist = 0, error = 0;

-    if(strchr(hexsig, '*')) {

+    if(strchr(hexsig, '{')) {

+

+	root->partsigs++;

+

+	if(!(hexcpy = strdup(hexsig)))

+	    return CL_EMEM;

+

+

+	len = strlen(hexsig);

+	for(i = 0; i < len; i++)

+	    if(hexsig[i] == '{')

+		parts++;

+

+	if(parts)

+	    parts++;

+

+	start = pt = hexcpy;

+	for(i = 1; i <= parts; i++) {

+

+	    if(i != parts) {

+		pt = strchr(start, '{');

+		*pt++ = 0;

+	    }

+

+	    if((ret = cli_addsig(root, virname, start, root->partsigs, parts, i, type, mindist, maxdist))) {

+		cli_errmsg("cli_parse_add(): Problem adding signature.\n");

+		error = 1;

+		break;

+	    }

+

+	    if(i == parts)

+		break;

+

+	    if(!(start = strchr(pt, '}'))) {

+		error = 1;

+		break;

+	    }

+	    *start++ = 0;

+

+	    if(!pt) {

+		error = 1;

+		break;

+	    }

+

+	    mindist = maxdist = 0;

+	    if(!strchr(pt, '-')) {

+		if((mindist = maxdist = atoi(pt)) < 0) {

+		    error = 1;

+		    break;

+		}

+	    } else {

+		if((n = cli_strtok(pt, 0, "-")) != NULL) {

+		    if((mindist = atoi(n)) < 0) {

+			error = 1;

+			free(n);

+			break;

+		    }

+		    free(n);

+		}

+

+		if((n = cli_strtok(pt, 1, "-")) != NULL) {

+		    if((maxdist = atoi(n)) < 0) {

+			error = 1;

+			free(n);

+			break;

+		    }

+		    free(n);

+		}

+	    }

+	}

+

+	free(hexcpy);

+	if(error)

+	    return CL_EMALFDB;

+

+    } else if(strchr(hexsig, '*')) {

 	root->partsigs++;

 	len = strlen(hexsig);

@@ -114,7 +320,7 @@ int cli_parse_add(struct cl_node *root, char *virname, const char *hexsig, int t

 		return CL_EMALFDB;

 	    }

-	    if((ret = cli_addsig(root, virname, pt, root->partsigs, parts, i, type))) {

+	    if((ret = cli_addsig(root, virname, pt, root->partsigs, parts, i, type, 0, 0))) {

 		cli_errmsg("cli_parse_add(): Problem adding signature.\n");

 		free(pt);

 		return ret;

@@ -124,7 +330,7 @@ int cli_parse_add(struct cl_node *root, char *virname, const char *hexsig, int t

 	}

     } else { /* static */

-	if((ret = cli_addsig(root, virname, hexsig, 0, 0, 0, type))) {

+	if((ret = cli_addsig(root, virname, hexsig, 0, 0, 0, type, 0, 0))) {

 	    cli_errmsg("cli_parse_add(): Problem adding signature.\n");

 	    return ret;

 	}

@@ -175,12 +381,6 @@ int cl_loaddb(const char *filename, struct cl_node **root, int *virnum)

     while(fgets(buffer, FILEBUFF, fd)) {

-	/* for forward compatibility */

-	if(strchr(buffer, '{') || strchr(buffer, '}')) {

-	    cli_dbgmsg("Not suported signature type detected at line %d. Skipping.\n", line);

-	    continue;

-	}

-

 	line++;

 	cli_chomp(buffer);

@@ -85,6 +85,7 @@ static int cli_scandesc(int desc, const char **virname, long int *scanned, const

 {

  	char *buffer, *buff, *endbl, *pt;

 	int bytes, buffsize, length, ret, *partcnt, type = CL_CLEAN;

+	unsigned long int *partoff, offset = 0;

     /* prepare the buffer */

@@ -100,6 +101,11 @@ static int cli_scandesc(int desc, const char **virname, long int *scanned, const

 	return CL_EMEM;

     }

+    if((partoff = (unsigned long int *) cli_calloc(root->partsigs + 1, sizeof(unsigned long int))) == NULL) {

+	cli_dbgmsg("cli_scanbuff(): unable to cli_calloc(%d, %d)\n", root->partsigs + 1, sizeof(unsigned long int));

+	return CL_EMEM;

+    }

+

     buff = buffer;

     buff += root->maxpatlen; /* pointer to read data block */

     endbl = buff + SCANBUFF - root->maxpatlen; /* pointer to the last block

@@ -116,7 +122,7 @@ static int cli_scandesc(int desc, const char **virname, long int *scanned, const

 	if(bytes < SCANBUFF)

 	    length -= SCANBUFF - bytes;

-	if((ret = cli_scanbuff(pt, length, virname, root, partcnt, typerec)) == CL_VIRUS) {

+	if((ret = cli_scanbuff(pt, length, virname, root, partcnt, typerec, offset, partoff)) == CL_VIRUS) {

 	    free(buffer);

 	    free(partcnt);

 	    return ret;

@@ -126,12 +132,13 @@ static int cli_scandesc(int desc, const char **virname, long int *scanned, const

 		type = ret;

 	}

-	if(bytes == SCANBUFF)

+	if(bytes == SCANBUFF) {

 	    memmove(buffer, endbl, root->maxpatlen);

+	    offset += bytes - root->maxpatlen;

+	}

         pt = buffer;

-        length=buffsize;

-

+        length = buffsize;

     }

     free(buffer);

@@ -68,6 +68,8 @@ short int *cl_hex2str(const char *hex)

     for(i = 0; i < len; i += 2) {

 	if(hex[i] == '?') {

 	    val = CLI_IGN;

+	} else if(hex[i] == '@') {

+	    val = CLI_ALT;

 	} else {

 	    if((c = cli_hex2int(hex[i])) >= 0) {

 		val = c;