@@ -1,3 +1,7 @@

+Fri Nov 18 15:23:50 CET 2011 (tk)

+---------------------------------

+ * libclamav/scanners.c: use lsigs when scanning vba data (bb#3922)

+

 Fri Nov 18 15:48:59 EET 2011 (edwin)

 -----------------------------------

  * libclamav/matcher-hash.c: Fix SIGBUS on PA-RISC (big-endian) architectures (bb #3894).

@@ -766,6 +766,37 @@ static int cli_scanmscab(int desc, cli_ctx *ctx, off_t sfx_offset)

     return ret;

 }

+static int vba_scandata(const unsigned char *data, unsigned int len, cli_ctx *ctx)

+{

+	struct cli_matcher *groot = ctx->engine->root[0];

+	struct cli_matcher *troot = ctx->engine->root[2];

+	struct cli_ac_data gmdata, tmdata;

+	struct cli_ac_data *mdata[2];

+	int ret;

+

+    if((ret = cli_ac_initdata(&tmdata, troot->ac_partsigs, troot->ac_lsigs, troot->ac_reloff_num, CLI_DEFAULT_AC_TRACKLEN)))

+	return ret;

+

+    if((ret = cli_ac_initdata(&gmdata, groot->ac_partsigs, groot->ac_lsigs, groot->ac_reloff_num, CLI_DEFAULT_AC_TRACKLEN))) {

+	cli_ac_freedata(&tmdata);

+	return ret;

+    }

+    mdata[0] = &tmdata;

+    mdata[1] = &gmdata;

+

+    ret = cli_scanbuff(data, len, 0, ctx, CL_TYPE_MSOLE2, mdata);

+

+    if(ret != CL_VIRUS) {

+	ret = cli_lsig_eval(ctx, troot, &tmdata, NULL, NULL);

+	if(ret != CL_VIRUS)

+	    ret = cli_lsig_eval(ctx, groot, &gmdata, NULL, NULL);

+    }

+    cli_ac_freedata(&tmdata);

+    cli_ac_freedata(&gmdata);

+

+    return ret;

+}

+

 static int cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq *U)

 {

 	int ret = CL_CLEAN, i, j, fd, data_len, hasmacros = 0;

@@ -806,7 +837,7 @@ static int cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq *U)

 		    /* cli_dbgmsg("Project content:\n%s", data); */

 		    if(ctx->scanned)

 			*ctx->scanned += data_len / CL_COUNT_PRECISION;

-		    if(cli_scanbuff(data, data_len, 0, ctx, CL_TYPE_MSOLE2, NULL) == CL_VIRUS) {

+		    if(vba_scandata(data, data_len, ctx) == CL_VIRUS) {

 			free(data);

 			ret = CL_VIRUS;

 			break;

@@ -865,7 +896,7 @@ static int cli_vba_scandir(const char *dirname, cli_ctx *ctx, struct uniq *U)

 			cli_dbgmsg("Project content:\n%s", data);

 			if(ctx->scanned)

 			    *ctx->scanned += vba_project->length[i] / CL_COUNT_PRECISION;

-			if(cli_scanbuff(data, vba_project->length[i], 0, ctx, CL_TYPE_MSOLE2, NULL) == CL_VIRUS) {

+			if(vba_scandata(data, vba_project->length[i], ctx) == CL_VIRUS) {

 				free(data);

 				ret = CL_VIRUS;

 				break;