@@ -1,3 +1,8 @@

+Fri Apr 10 16:23:00 EEST 2009 (edwin)

+-------------------------------------

+ * libclamav/pe.c, libclamav/special.c, libclamav/special.h: Fix some

+ Trojan.Swizzor.Gen false positives (bb #1558).

+

 Fri Apr 10 15:06:43 EEST 2009 (edwin)

 -------------------------------------

  * shared/output.c: logg flags documentation

@@ -357,6 +357,10 @@ static void cli_parseres_special(uint32_t base, uint32_t rva, int srcfd, struct

     }*/

     for (i=0; i<unnamed; i++, entry += 8) {

 	uint32_t id, offs;

+	if (stats->errors >= SWIZZ_MAXERRORS) {

+	    cli_dbgmsg("cli_parseres_special: resources broken, ignoring\n");

+	    return;

+	}

 	id = cli_readint32(entry)&0x7fffffff;

 	if(level==0) {

 		type = 0;

@@ -396,6 +400,7 @@ static void cli_parseres_special(uint32_t base, uint32_t rva, int srcfd, struct

 					cli_dbgmsg("cli_parseres_special: invalid resource table entry: %lu + %lu\n", 

 							(unsigned long)rawaddr, 

 							(unsigned long)isz);

+					stats->errors++;

 					continue;

 				}

 				str = cli_malloc(isz);

@@ -380,6 +380,7 @@ void cli_detect_swizz_str(const unsigned char *str, uint32_t len, struct swizz_s

 	uint16_t words = 0;

 	int ret;

+	stats->entries++;

 	for(i=0;i<len-1 && j < sizeof(stri)-2;i += 2) {

 		unsigned char c = str[i];

 		if (str[i+1] || !c) {

@@ -430,6 +431,7 @@ void cli_detect_swizz_str(const unsigned char *str, uint32_t len, struct swizz_s

 		ngram_cnts[i] = (v<<10)/all;

 	}

 	ret = swizz_j48(ngram_cnts) ? CL_VIRUS : CL_CLEAN;

+	if (!words) ret = CL_CLEAN;

 	cli_dbgmsg("cli_detect_swizz_str: %s, %u words\n", ret == CL_VIRUS ? "suspicious" : "ok", words);

 	if (ret == CL_VIRUS) {

 		stats->suspicious += j;

@@ -494,11 +496,15 @@ int cli_detect_swizz(struct swizz_stats *stats)

 		cli_dbgmsg("\ncli_detect_swizz: global: %s\n", global_swizz ? "suspicious" : "clean");

 	}

+	if (stats->errors > stats->entries || stats->errors >= SWIZZ_MAXERRORS) {

+	    cli_dbgmsg("cli_detect_swizz: resources broken, ignoring\n");

+	    return CL_CLEAN;

+	}

 	if (stats->total <= 337)

-		return CL_CLEAN;

+	    return CL_CLEAN;

 	if (stats->suspicious<<10 > 20*stats->total)

-		return CL_VIRUS;

-  if (!stats->suspicious)

-    return CL_CLEAN;

+	    return CL_VIRUS;

+	if (!stats->suspicious)

+	    return CL_CLEAN;

 	return global_swizz;

 }

@@ -22,12 +22,15 @@

 #define __SPECIAL_H

 #include "others.h"

+#define SWIZZ_MAXERRORS 2000

 struct swizz_stats {

 	uint16_t gngrams[17576];

 	uint32_t total;

 	uint32_t suspicious;

 	int has_version;

 	int has_manifest;

+	int errors;

+	int entries;

 };

 int cli_check_mydoom_log(int desc, const char **virname);