@@ -1,3 +1,9 @@

+Fri Aug 27 02:14:07 CEST 2004 (tk)

+----------------------------------

+  * libclamav/pe.c: include new function cli_peheader() (only dumps specific

+		    values from PE files)

+  * libclamav/matcher-bm.c: fix crash when bm_shift is not initialised

+

 Thu Aug 26 15:17:03 BST 2004 (trog)

 -----------------------------------

   * libclamav/ole2_extract.c: sanitize filenames

@@ -269,10 +269,8 @@ int cli_ac_scanbuff(const char *buffer, unsigned int length, const char **virnam

         unsigned int i;

-    if(!root->ac_root) {

-	cli_dbgmsg("cli_ac_scanbuff: Pattern matcher not initialised\n");

+    if(!root->ac_root)

 	return CL_CLEAN;

-    }

     if(!partcnt || !partoff) {

 	cli_dbgmsg("cli_ac_scanbuff(): partcnt == NULL || partoff == NULL\n");

@@ -124,6 +124,9 @@ int cli_bm_scanbuff(const char *buffer, unsigned int length, const char **virnam

 	char prefix;

+    if(!root->bm_shift)

+	return CL_CLEAN;

+

     if(length < BM_MIN_LENGTH)

 	return CL_CLEAN;

@@ -299,6 +299,11 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

     cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr.NumberOfRvaAndSizes));

     cli_dbgmsg("------------------------------------\n");

+    if(fstat(desc, &sb) == -1) {

+	cli_dbgmsg("fstat failed\n");

+	return CL_EIO;

+    }

+

     section_hdr = (struct pe_image_section_hdr *) cli_calloc(nsections, sizeof(struct pe_image_section_hdr));

     if(!section_hdr) {

@@ -306,12 +311,6 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 	return CL_EMEM;

     }

-    if(fstat(desc, &sb) == -1) {

-	cli_dbgmsg("fstat failed\n");

-	free(section_hdr);

-	return CL_EIO;

-    }

-

     for(i = 0; i < nsections; i++) {

 	if(read(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

@@ -1182,3 +1181,132 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

     free(section_hdr);

     return CL_CLEAN;

 }

+

+int cli_peheader(int desc, struct cli_pe_info **peinfo)

+{

+	uint16_t e_magic; /* DOS signature ("MZ") */

+	uint32_t e_lfanew; /* address of new exe header */

+	struct pe_image_file_hdr file_hdr;

+	struct pe_image_optional_hdr optional_hdr;

+	struct pe_image_section_hdr *section_hdr;

+	struct stat sb;

+	struct cli_pe_info *info;

+	int i;

+

+

+    cli_dbgmsg("in cli_peheader\n");

+

+    if(read(desc, &e_magic, sizeof(e_magic)) != sizeof(e_magic)) {

+	cli_dbgmsg("Can't read DOS signature\n");

+	return -1;

+    }

+

+    if(EC16(e_magic) != IMAGE_DOS_SIGNATURE && EC16(e_magic) != IMAGE_DOS_SIGNATURE_OLD) {

+	cli_dbgmsg("Invalid DOS signature\n");

+	return -1;

+    }

+

+    lseek(desc, 58, SEEK_CUR); /* skip to the end of the DOS header */

+

+    if(read(desc, &e_lfanew, sizeof(e_lfanew)) != sizeof(e_lfanew)) {

+	cli_dbgmsg("Can't read new header address\n");

+	/* truncated header? */

+	return -1;

+    }

+

+    e_lfanew = EC32(e_lfanew);

+    if(!e_lfanew) {

+	cli_dbgmsg("Not a PE file\n");

+	return -1;

+    }

+

+    if(lseek(desc, e_lfanew, SEEK_SET) < 0) {

+	/* probably not a PE file */

+	cli_dbgmsg("Can't lseek to e_lfanew\n");

+	return -1;

+    }

+

+    if(read(desc, &file_hdr, sizeof(struct pe_image_file_hdr)) != sizeof(struct pe_image_file_hdr)) {

+	/* bad information in e_lfanew - probably not a PE file */

+	cli_dbgmsg("Can't read file header\n");

+	return -1;

+    }

+

+    if(EC32(file_hdr.Magic) != IMAGE_NT_SIGNATURE) {

+	cli_dbgmsg("Invalid PE signature (probably NE file)\n");

+	return -1;

+    }

+

+    if(EC16(file_hdr.SizeOfOptionalHeader) != sizeof(struct pe_image_optional_hdr)) {

+	cli_warnmsg("Broken PE header detected.\n");

+	return -1;

+    }

+

+    if(!(info = cli_calloc(1, sizeof(struct cli_pe_info)))) {

+	cli_dbgmsg("Can't alloc memory\n");

+	return -1;

+    }

+

+    info->nsections = EC16(file_hdr.NumberOfSections);

+

+    if(read(desc, &optional_hdr, sizeof(struct pe_image_optional_hdr)) != sizeof(struct pe_image_optional_hdr)) {

+	cli_dbgmsg("Can't optional file header\n");

+	free(info);

+	return -1;

+    }

+

+    info->section = (struct SECTION *) cli_calloc(info->nsections, sizeof(struct SECTION));

+

+    if(!info->section) {

+	cli_dbgmsg("Can't allocate memory for section headers\n");

+	free(info);

+	return -1;

+    }

+

+    if(fstat(desc, &sb) == -1) {

+	cli_dbgmsg("fstat failed\n");

+	free(info->section);

+	free(info);

+	return -1;

+    }

+

+    section_hdr = (struct pe_image_section_hdr *) cli_calloc(info->nsections, sizeof(struct pe_image_section_hdr));

+

+    if(!section_hdr) {

+	cli_dbgmsg("Can't allocate memory for section headers\n");

+	free(info->section);

+	free(info);

+	return -1;

+    }

+

+    for(i = 0; i < info->nsections; i++) {

+

+	if(read(desc, &section_hdr[i], sizeof(struct pe_image_section_hdr)) != sizeof(struct pe_image_section_hdr)) {

+	    cli_dbgmsg("Can't read section header\n");

+	    cli_dbgmsg("Possibly broken PE file\n");

+	    free(section_hdr);

+	    free(info->section);

+	    free(info);

+	    return -1;

+	}

+

+	info->section[i].rva = EC32(section_hdr[i].VirtualAddress);

+	info->section[i].vsz = EC32(section_hdr[i].VirtualSize);

+	info->section[i].raw = EC32(section_hdr[i].PointerToRawData);

+	info->section[i].rsz = EC32(section_hdr[i].SizeOfRawData);

+

+    }

+

+    if((info->ep = cli_rawaddr(EC32(optional_hdr.AddressOfEntryPoint), section_hdr, info->nsections)) == -1) {

+	cli_dbgmsg("Possibly broken PE file\n");

+	free(section_hdr);

+	free(info->section);

+	free(info);

+	return -1;

+    }

+

+    free(section_hdr);

+    *peinfo = info;

+

+    return 0;

+}

@@ -23,6 +23,7 @@

 #define __PE_H

 #include "clamav.h"

+#include "rebuildpe.h"

 struct pe_image_file_hdr {

     uint32_t Magic;

@@ -93,6 +94,14 @@ struct pe_image_section_hdr {

     uint32_t Characteristics;

 };

+struct cli_pe_info {

+    uint32_t ep; /* raw entry point */

+    uint16_t nsections;

+    struct SECTION *section;

+};

+

 int cli_scanpe(int desc, const char **virname, long int *scanned, const struct cl_node *root, const struct cl_limits *limits, int options, int *arec, int *mrec);

+int cli_peheader(int desc, struct cli_pe_info **peinfo);

+

 #endif