@@ -1,3 +1,8 @@

+Wed Nov  1 18:59:48 CET 2006 (tk)

+---------------------------------

+  * libclamav: add support for self-extracting MS Cabinet archives

+	       Thanks to Christoph for a nice bunch of test files.

+

 Wed Nov  1 17:03:54 CET 2006 (tk)

 ---------------------------------

   * libclamav: minor clamav.h (and related) cleanup

@@ -180,6 +180,7 @@ static const struct cli_smagic_s cli_smagic[] = {

     {"526172211a0700", "RAR-SFX", CL_TYPE_RARSFX},

     {"504b0304", "ZIP-SFX", CL_TYPE_ZIPSFX},

+    {"4d534346", "CAB-SFX", CL_TYPE_CABSFX},

     {NULL,  NULL,   CL_TYPE_UNKNOWN_DATA}

 };

@@ -60,7 +60,8 @@ typedef enum {

     CL_TYPE_MAIL,  /* magic + on the fly */

     CL_TYPE_SFX, /* foo SFX marker */

     CL_TYPE_ZIPSFX, /* on the fly */

-    CL_TYPE_RARSFX /* on the fly */

+    CL_TYPE_RARSFX, /* on the fly */

+    CL_TYPE_CABSFX

 } cli_file_t;

@@ -792,7 +792,7 @@ static int cli_scanszdd(int desc, cli_ctx *ctx)

     return ret;

 }

-static int cli_scanmscab(int desc, cli_ctx *ctx)

+static int cli_scanmscab(int desc, cli_ctx *ctx, off_t sfx_offset)

 {

 	struct mscab_decompressor *cabd = NULL;

 	struct mscabd_cabinet *base, *cab;

@@ -808,6 +808,9 @@ static int cli_scanmscab(int desc, cli_ctx *ctx)

 	return CL_EMSCAB;

     }

+    if(sfx_offset)

+	lseek(desc, sfx_offset, SEEK_SET);

+

     if((base = cabd->dsearch(cabd, dup(desc))) == NULL) {

 	cli_dbgmsg("MSCAB: I/O error or no valid cabinets found\n");

 	mspack_destroy_cab_decompressor(cabd);

@@ -1626,6 +1629,7 @@ static int cli_scanraw(int desc, cli_ctx *ctx, cli_file_t type)

 	    case CL_TYPE_RARSFX:

 	    case CL_TYPE_ZIPSFX:

+	    case CL_TYPE_CABSFX:

 		if(type == CL_TYPE_MSEXE) {

 		    if(SCAN_ARCHIVE) {

 			lastzip = lastrar = 0xdeadbeef;

@@ -1639,7 +1643,12 @@ static int cli_scanraw(int desc, cli_ctx *ctx, cli_file_t type)

 				cli_dbgmsg("ZIP-SFX signature found at %d\n", fpt->offset);

 				if((nret = cli_scanzip(desc, ctx, fpt->offset, &lastzip)) == CL_VIRUS)

 				    break;

+			    } else if(fpt->type == CL_TYPE_CABSFX) {

+				cli_dbgmsg("CAB-SFX signature found at %d\n", fpt->offset);

+				if((nret = cli_scanmscab(desc, ctx, fpt->offset)) == CL_VIRUS)

+				    break;

 			    }

+

 			    fpt = fpt->next;

 			}

 		    }

@@ -1753,7 +1762,7 @@ int cli_magic_scandesc(int desc, cli_ctx *ctx)

 	case CL_TYPE_MSCAB:

 	    if(SCAN_ARCHIVE)

-		ret = cli_scanmscab(desc, ctx);

+		ret = cli_scanmscab(desc, ctx, 0);

 	    break;

 	case CL_TYPE_HTML: