@@ -1,3 +1,11 @@

+Mon Jan 26 16:00:02 GMT 2004 (trog)

+-----------------------------------

+  * libclamav:	VBA decoder - Fix malloc off-by-one. Add checking

+                for middle and end strings in VBA project file.

+                Fix compiler warnings.

+		OLE2 unpacker - Remove global variables. Fix for

+		nasty MacOffice docs.

+

 Mon Jan 26 14:14:27 GMT 2004 (njh)

 ----------------------------------

   * clamav-milter: Corrected endian problem (ntohs instead of htons)

@@ -37,9 +37,6 @@

 #define MIN(a, b)  (((a) < (b)) ? (a) : (b))

-int big_block_size, small_block_size;

-int sbat_start=-1;

-

 typedef struct ole2_header_tag

 {

 	unsigned char magic[8];			/* should be: 0xd0cf11e0a1b11ae1 */

@@ -63,6 +60,11 @@ typedef struct ole2_header_tag

 	int32_t xbat_start;

 	int32_t xbat_count;

 	int32_t bat_array[109];

+

+	/* not part of the ole2 header, but stuff we need in order to decode */

+	/* must take account of the size of variables below here when

+	   reading the header */

+	int sbat_root_start;

 } ole2_header_t __attribute__ ((packed));

 typedef struct property_tag

@@ -146,7 +148,7 @@ void print_property_name(char *name, int size)

 	int i, count=0;

 	if (*name == 0 || size == 0) {

-		cli_dbgmsg("[unused]                         ");

+		cli_dbgmsg("[no name]                           ");

 		return;

 	}

 	/* size-2 to ignore trailing NULL */

@@ -173,7 +175,7 @@ char *get_property_name(char *name, int size)

 		return NULL;

 	}

-	newname = (char *) cli_malloc(size);

+	newname = (char *) cli_malloc(size*2);

 	if (!newname) {

 		return NULL;

 	}

@@ -191,6 +193,11 @@ char *get_property_name(char *name, int size)

 		}

 	}

 	newname[j] = '\0';

+	if (strlen(newname) == 0) {

+		printf ("zero sized newname\n");

+		free(newname);

+		return NULL;

+	}

 	return newname;

 }

@@ -267,7 +274,7 @@ int ole2_read_block(int fd, ole2_header_t *hdr, void *buff, int blockno)

 	if (lseek(fd, offset, SEEK_SET) != offset) {

 		return FALSE;

 	}

-	if (readn(fd, buff, big_block_size) != big_block_size) {

+	if (readn(fd, buff, (1 << hdr->log2_big_block_size)) != (1 << hdr->log2_big_block_size)) {

 		return FALSE;

 	}

 	return TRUE;

@@ -345,13 +352,13 @@ int ole2_get_sbat_data_block(int fd, ole2_header_t *hdr, void *buff, int sbat_in

 	int block_count;

 	int current_block;

-	if (sbat_start < 0) {

+	if (hdr->sbat_root_start < 0) {

 		cli_errmsg("No root start block\n");

 		return FALSE;

 	}

 	block_count = sbat_index / 8;			// 8 small blocks per big block

-	current_block = sbat_start;

+	current_block = hdr->sbat_root_start;

 	while (block_count > 0) {

 		current_block = ole2_get_next_bat_block(fd, hdr, current_block);

 		block_count--;

@@ -376,9 +383,9 @@ void ole2_read_property_tree(int fd, ole2_header_t *hdr, const char *dir,

 	while(current_block >= 0) {

 		ole2_read_block(fd, hdr, prop_block, current_block);

 		for (index=0 ; index < 4 ; index++) {

-			if (prop_block[index].name[0] != 0) {

+			if (prop_block[index].type > 0) {

 				if (prop_block[index].type == 5) {

-					sbat_start = prop_block[index].start_block;

+					hdr->sbat_root_start = prop_block[index].start_block;

 				}

 				print_ole2_property(&prop_block[index]);

 				handler(fd, hdr, &prop_block[index], dir);

@@ -401,7 +408,7 @@ void handler_null(int fd, ole2_header_t *hdr, property_t *prop, const char *dir)

 /* Write file Handler - write the contents of the entry to a file */

 void handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const char *dir)

 {

-	unsigned char buff[big_block_size];

+	unsigned char buff[(1 << hdr->log2_big_block_size)];

 	int current_block, ofd, len, offset;

 	char *name, *newname;

@@ -411,7 +418,15 @@ void handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const char

 	}

 	if (! (name = get_property_name(prop->name, prop->name_size))) {

-		return;

+		/* File without a name - create a name for it */

+		int i;

+                                                                                                                            

+		i = lseek(fd, 0, SEEK_CUR);

+		name = malloc(11);

+		if (!name) {

+			return;

+		}

+		snprintf(name, 10, "%.10d", i + (int) prop);

 	}

 	newname = (char *) cli_malloc(strlen(name) + strlen(dir) + 2);

@@ -449,13 +464,14 @@ void handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const char

 				close(ofd);

 				return;

 			}

-			if (writen(ofd, &buff, MIN(len,big_block_size)) != MIN(len,big_block_size)) {

+			if (writen(ofd, &buff, MIN(len,(1 << hdr->log2_big_block_size))) !=

+							MIN(len,(1 << hdr->log2_big_block_size))) {

 				close(ofd);

 				return;

 			}

 			current_block = ole2_get_next_block_number(fd, hdr, current_block);

-			len -= MIN(len,big_block_size);

+			len -= MIN(len,(1 << hdr->log2_big_block_size));

 		}

 	}

 	close(ofd);

@@ -468,7 +484,10 @@ int cli_ole2_extract(int fd, const char *dirname)

 	cli_dbgmsg("in cli_ole2_extract()\n");

-	readn(fd, &hdr, sizeof(struct ole2_header_tag));

+	/* size of header - size of other values in struct */

+	readn(fd, &hdr, sizeof(struct ole2_header_tag) - sizeof(int));

+

+	hdr.sbat_root_start = -1;

 	if (strncmp(hdr.magic, magic_id, 8) != 0) {

 		cli_dbgmsg("OLE2 magic failed!\n");

@@ -485,9 +504,6 @@ int cli_ole2_extract(int fd, const char *dirname)

 		cli_dbgmsg("WARNING: untested sbat cutoff - please report\n\n");

 	}

-	big_block_size = 1 << hdr.log2_big_block_size;

-	small_block_size = 1 << hdr.log2_small_block_size;

-

 	print_ole2_header(&hdr);

 	ole2_read_property_tree(fd, &hdr, dirname, handler_writefile);

@@ -128,7 +128,7 @@ char *get_unicode_name(char *name, int size)

                 return NULL;

         }

-        newname = (char *) cli_malloc(size);

+        newname = (char *) cli_malloc(size*2);

         if (!newname) {

                 return NULL;

         }

@@ -147,7 +147,48 @@ char *get_unicode_name(char *name, int size)

         newname[j] = '\0';

         return newname;

 }

-                                                                                                                                                                       

+

+static void vba56_test_middle(int fd)

+{

+	char test_middle[20];

+	static const uint8_t middle_str[20] = {

+		0x00, 0x00, 0xe1, 0x2e, 0x45, 0x0d, 0x8f, 0xe0,

+		0x1a, 0x10, 0x85, 0x2e, 0x02, 0x60, 0x8c, 0x4d,

+		0x0b, 0xb4, 0x00, 0x00

+	};

+

+        if (vba_readn(fd, &test_middle, 20) != 20) {

+                return;

+        }

+	

+	if (strncmp(test_middle, middle_str, 20) != 0) {

+	        lseek(fd, -20, SEEK_CUR);

+	}

+	return;

+}

+

+static void vba56_test_end(int fd)

+{

+	char test_end[20];

+	static const uint8_t end_str[20] =

+	{

+		0x00, 0x00, 0x2e, 0xc9, 0x27, 0x8e, 0x64, 0x12,

+		0x1c, 0x10, 0x8a, 0x2f, 0x04, 0x02, 0x24, 0x00,

+		0x9c, 0x02, 0x00, 0x00

+	};

+

+        if (vba_readn(fd, &test_end, 20) != 20) {

+                return;

+        }

+                                                                                                                                    

+        if (strncmp(test_end, end_str, 20) != 0) {

+                lseek(fd, -20, SEEK_CUR);

+        }

+	printf("End found\n");

+        return;

+}

+

+

 vba_project_t *vba56_dir_read(const char *dir)

 {

 	unsigned char magic[2];

@@ -176,7 +217,7 @@ vba_project_t *vba56_dir_read(const char *dir)

 	cli_dbgmsg("in vba56_dir_read()\n");

-	fullname = (char *) cli_malloc(strlen(dir) + 14);

+	fullname = (char *) cli_malloc(strlen(dir) + 15);

 	sprintf(fullname, "%s/_VBA_PROJECT", dir);

         fd = open(fullname, O_RDONLY);

@@ -276,13 +317,17 @@ vba_project_t *vba56_dir_read(const char *dir)

 		return NULL;

 	}*/

-	for (i=0; record_count >0 ; record_count--) {

+	for (;;) {

 		if (vba_readn(fd, &length, 2) != 2) {

 			return NULL;

 		}

+		if (length < 6) {

+			lseek(fd, -2, SEEK_CUR);

+			break;

+		}

 		cli_dbgmsg ("record: %d.%d, length: %d, ", record_count, i, length);

-		buff = cli_malloc(length);

+		buff = (unsigned char *) cli_malloc(length);

 		if (!buff) {

 			cli_errmsg("cli_malloc failed\n");

 			return NULL;

@@ -300,7 +345,7 @@ vba_project_t *vba56_dir_read(const char *dir)

 		   having a 12 byte trailer */

 		/* TODO: Need to check if types H(same as G) and D(same as C) exist */

                 if (!strncmp ("*\\G", name, 3)) {

-			buff = cli_malloc(12);

+			buff = (unsigned char *) cli_malloc(12);

                         if (vba_readn(fd, buff, 12) != 12) {

 				cli_errmsg("failed to read blob\n");

                                 free(buff);

@@ -310,7 +355,7 @@ vba_project_t *vba56_dir_read(const char *dir)

 			free(buff);

                 } else if (!strncmp("*\\C", name, 3)) {

 			if (i == 1) {

-				buff = cli_malloc(12);

+				buff = (unsigned char *) cli_malloc(12);

                         	if (vba_readn(fd, buff, 12) != 12) {

 					cli_errmsg("failed to read blob\n");

                                 	free(buff);

@@ -324,12 +369,16 @@ vba_project_t *vba56_dir_read(const char *dir)

 				record_count++;

 			}

 		} else {

-			cli_errmsg("unknown record type!!\n\n");

+			/* Unknown type - probably ran out of strings - rewind */

+			lseek(fd, -(length+2), SEEK_CUR);

+			break;

 		}

 		free(name);

+		vba56_test_middle(fd);

 	}

-	/* TODO: may need to seek forward 20 bytes here. Bleh! */

+	/* may need to seek forward 20 bytes here. Bleh! */

+	vba56_test_end(fd);

 	if (vba_readn(fd, &record_count, 2) != 2) {

 		return NULL;

@@ -343,7 +392,7 @@ vba_project_t *vba56_dir_read(const char *dir)

 	lseek(fd, 4, SEEK_CUR);

 	/* Read fixed octet */

-	buff = cli_malloc(8);

+	buff = (unsigned char *) cli_malloc(8);

 	if (!buff) {

 		return NULL;

 	}

@@ -396,7 +445,7 @@ vba_project_t *vba56_dir_read(const char *dir)

 		if (vba_readn(fd, &length, 2) != 2) {

 			return NULL;

 		}

-		buff = cli_malloc(length);

+		buff = (unsigned char *) cli_malloc(length);

 		if (!buff) {

 			cli_dbgmsg("cli_malloc failed\n");

 			return NULL;

@@ -462,7 +511,7 @@ vba_project_t *vba56_dir_read(const char *dir)

 void byte_array_append(byte_array_t *array, unsigned char *src, unsigned int len)

 {

 	if (array->length == 0) {

-		array->data = cli_malloc(len);

+		array->data = (unsigned char *) cli_malloc(len);

 		array->length = len;

 		strncpy(array->data, src, len);

 	} else {