@@ -1,3 +1,10 @@

+Mon Dec 20 14:52:03 GMT 2004 (trog)

+-----------------------------------

+  * libclamav/chmunpack.c: relax over stringent offset checks.

+			Explicitly cast some long long constants.

+

+  * libclamav/ole2_extract.c: remove variable size array declaration.

+

 Mon Dec 20 02:57:29 CET 2004 (tk)

 ---------------------------------

   * libclamav/others.c: added cli_filecopy()

@@ -173,12 +173,12 @@ static uint32_t chm_endian_convert_32(uint32_t v)

 #else

 static uint64_t chm_endian_convert_64(uint64_t v)

 {

-	return ((v >> 56) | ((v & 0x00FF000000000000) >> 40) |

-		((v & 0x0000FF0000000000) >> 24) |

-		((v & 0x000000FF00000000) >> 8) |

-		((v & 0x00000000FF000000) << 8) |

-		((v & 0x0000000000FF0000) << 24) |

-		((v & 0x000000000000FF00) << 40) |

+	return ((v >> 56) | ((v & 0x00FF000000000000LL) >> 40) |

+		((v & 0x0000FF0000000000LL) >> 24) |

+		((v & 0x000000FF00000000LL) >> 8) |

+		((v & 0x00000000FF000000LL) << 8) |

+		((v & 0x0000000000FF0000LL) << 24) |

+		((v & 0x000000000000FF00LL) << 40) |

 		(v << 56));

 }

 #endif

@@ -643,7 +643,7 @@ static lzx_control_t *read_sys_control(int fd, itsf_header_t *itsf_hdr, file_lis

 		return NULL;

 	}

 	offset = itsf_hdr->data_offset + file_e->offset;

-	if ((offset < 0) || (offset < itsf_hdr->sec0_offset)) {

+	if (offset < 0) {

 		return NULL;

 	}

@@ -761,7 +761,7 @@ static lzx_reset_table_t *read_sys_reset_table(int fd, itsf_header_t *itsf_hdr,

 	/* Skip past unknown entry in offset calc */

 	offset = itsf_hdr->data_offset + file_e->offset + 4;

-	if ((offset < 0) || (offset < itsf_hdr->sec0_offset)) {

+	if (offset < 0) {

 		return NULL;

 	}

@@ -568,7 +568,7 @@ static void ole2_walk_property_tree(int fd, ole2_header_t *hdr, const char *dir,

 /* Write file Handler - write the contents of the entry to a file */

 static int handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const char *dir)

 {

-	unsigned char buff[(1 << hdr->log2_big_block_size)];

+	unsigned char *buff;

 	int32_t current_block, ofd, len, offset;

 	char *name, *newname;

@@ -626,18 +626,26 @@ static int handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const

 	current_block = prop->start_block;

 	len = prop->size;

+	buff = (unsigned char *) cli_malloc(1 << hdr->log2_big_block_size);

+	if (!buff) {

+		close(ofd);

+		return FALSE;

+	}

+

 	while((current_block >= 0) && (len > 0)) {

 		if (prop->size < hdr->sbat_cutoff) {

 			/* Small block file */

-			if (!ole2_get_sbat_data_block(fd, hdr, &buff, current_block)) {

+			if (!ole2_get_sbat_data_block(fd, hdr, buff, current_block)) {

 				cli_dbgmsg("ole2_get_sbat_data_block failed\n");

 				close(ofd);

+				free(buff);

 				return FALSE;

 			}

 			/* buff now contains the block with 8 small blocks in it */

 			offset = 64 * (current_block % 8);

 			if (cli_writen(ofd, &buff[offset], MIN(len,64)) != MIN(len,64)) {

 				close(ofd);

+				free(buff);

 				return FALSE;

 			}

@@ -645,13 +653,15 @@ static int handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const

 			current_block = ole2_get_next_sbat_block(fd, hdr, current_block);

 		} else {

 			/* Big block file */

-			if (!ole2_read_block(fd, hdr, &buff, current_block)) {

+			if (!ole2_read_block(fd, hdr, buff, current_block)) {

 				close(ofd);

+				free(buff);

 				return FALSE;

 			}

-			if (cli_writen(ofd, &buff, MIN(len,(1 << hdr->log2_big_block_size))) !=

+			if (cli_writen(ofd, buff, MIN(len,(1 << hdr->log2_big_block_size))) !=

 							MIN(len,(1 << hdr->log2_big_block_size))) {

 				close(ofd);

+				free(buff);

 				return FALSE;

 			}

@@ -660,6 +670,7 @@ static int handler_writefile(int fd, ole2_header_t *hdr, property_t *prop, const

 		}

 	}

 	close(ofd);

+	free(buff);

 	return TRUE;

 }