diff --git a/libclamav/matcher-byte-comp.c b/libclamav/matcher-byte-comp.c index 1e551bdf2..1aae67c5c 100644 --- a/libclamav/matcher-byte-comp.c +++ b/libclamav/matcher-byte-comp.c @@ -457,13 +457,14 @@ cl_error_t cli_bcomp_addpatt(struct cli_matcher *root, const char *virname, cons * @param ctx the clamav context struct * */ -cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, const char **virname, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, cli_ctx *ctx) +cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, cli_ctx *ctx) { - - int64_t i = 0, val = 0, ret = CL_SUCCESS; + size_t i; + int val = 0; + cl_error_t ret = CL_SUCCESS; + cl_error_t bcomp_check = CL_SUCCESS; uint32_t lsigid, ref_subsigid; uint32_t offset = 0; - uint8_t viruses_found = 0; struct cli_bcomp_meta *bcomp = NULL; struct cli_ac_result *newres = NULL; @@ -488,17 +489,11 @@ cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, /* verify the ref_subsigid */ val = cli_ac_chklsig(subsigid, subsigid + strlen(subsigid), mdata->lsigcnt[bcomp->lsigid[1]], &evalcnt, &evalids, 0); - if (val != 1) { bcm_dbgmsg("cli_bcomp_scanbuf: could not verify a match for lsig reference subsigid (%s)\n", subsigid); continue; } - /* ensures the referenced subsig matches as expected, and also ensures mdata has the needed offset */ - if ((ret = lsig_sub_matched(root, mdata, lsigid, ref_subsigid, CLI_OFF_NONE, 0))) { - break; - } - /* grab the needed offset using from the last matched subsig offset matrix, i.e. the match performed above */ if (mdata->lsigsuboff_last[lsigid]) { offset = mdata->lsigsuboff_last[lsigid][ref_subsigid]; @@ -507,7 +502,7 @@ cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, continue; } } else { - /* can't run lsig_sub_matched in sigtool, and mdata isn't populated so run the raw matcher stuffs */ + /* mdata isn't populated in sigtool so run the raw matcher stuffs */ if (res) { newres = (struct cli_ac_result *)cli_calloc(1, sizeof(struct cli_ac_result)); if (!newres) { @@ -528,27 +523,16 @@ cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, } /* now we have all the pieces of the puzzle, so lets do our byte compare check */ - ret = cli_bcomp_compare_check(buffer, buffer_length, offset, bcomp); + bcomp_check = cli_bcomp_compare_check(buffer, buffer_length, offset, bcomp); - /* set and append our lsig's virus name if the comparison came back positive */ - if (CL_VIRUS == ret) { - viruses_found = 1; - - if (virname) { - *virname = bcomp->virname; - } - /* if we aren't scanning all, let's just exit here */ - if (!SCAN_ALLMATCHES) { - break; - } else { - ret = cli_append_virus(ctx, (const char *)bcomp->virname); - } + /* Increase the lsig count for our subsig if the comparison came back positive. + * Later, the lsig-eval will evaluate the logical condition, based on these counts + * and will append the virus alert if the whole logical signature matches. */ + if (CL_VIRUS == bcomp_check) { + mdata->lsigcnt[bcomp->lsigid[1]][bcomp->lsigid[2]]++; } } - if (ret == CL_SUCCESS && viruses_found) { - return CL_VIRUS; - } return ret; } diff --git a/libclamav/matcher-byte-comp.h b/libclamav/matcher-byte-comp.h index 2ddf71114..4b7b0f697 100644 --- a/libclamav/matcher-byte-comp.h +++ b/libclamav/matcher-byte-comp.h @@ -62,7 +62,7 @@ struct cli_bcomp_comp { }; cl_error_t cli_bcomp_addpatt(struct cli_matcher *root, const char *virname, const char *hexsig, const uint32_t *lsigid, unsigned int options); -cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, const char **virname, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, cli_ctx *ctx); +cl_error_t cli_bcomp_scanbuf(const unsigned char *buffer, size_t buffer_length, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, cli_ctx *ctx); cl_error_t cli_bcomp_compare_check(const unsigned char *f_buffer, size_t buffer_length, int offset, struct cli_bcomp_meta *bm); void cli_bcomp_freemeta(struct cli_matcher *root, struct cli_bcomp_meta *bm); uint16_t cli_bcomp_chk_hex(const unsigned char *buffer, uint16_t opt, uint32_t len, uint32_t check_only); diff --git a/libclamav/matcher.c b/libclamav/matcher.c index e1db4fd4a..b6be85d81 100644 --- a/libclamav/matcher.c +++ b/libclamav/matcher.c @@ -182,17 +182,9 @@ static inline cl_error_t matcher_run(const struct cli_matcher *root, } if (root->bcomp_metas) { - ret = cli_bcomp_scanbuf(orig_buffer, orig_length, virname, acres, root, mdata, ctx); + ret = cli_bcomp_scanbuf(orig_buffer, orig_length, acres, root, mdata, ctx); if (ret != CL_CLEAN) { - if (ret == CL_VIRUS) { - if (SCAN_ALLMATCHES) - viruses_found = 1; - else { - ret = cli_append_virus(ctx, *virname); - if (ret != CL_CLEAN) - return ret; - } - } else if (ret > CL_TYPENO && acmode & AC_SCAN_VIR) + if (ret > CL_TYPENO && acmode & AC_SCAN_VIR) saved_ret = ret; else return ret;