Stowage/clamav
2
0
Fork 0
mirror of https://github.com/Cisco-Talos/clamav.git synced 2025-10-19 18:33:16 +00:00
Code Issues Projects Releases Packages Wiki Activity

unioned lsig logic and future yara conditional

Browse source
This commit is contained in:
Kevin Lin 2015-02-11 10:36:43 -08:00
parent a1924d1407
commit b5b3fecd6c
3 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
libclamav/matcher.c
View file

@ -697,7 +697,8 @@ int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *ac
evalcnt = 0; evalcnt = 0;
evalids = 0; evalids = 0;
cli_ac_chkmacro(root, acdata, i); cli_ac_chkmacro(root, acdata, i);
if(cli_ac_chklsig(root->ac_lsigtable[i]->logic, root->ac_lsigtable[i]->logic + strlen(root->ac_lsigtable[i]->logic), acdata->lsigcnt[i], &evalcnt, &evalids, 0) == 1) { //TODO - handle CLI_NORMAL_YARA lsigs here
if(cli_ac_chklsig(root->ac_lsigtable[i]->u.logic, root->ac_lsigtable[i]->u.logic + strlen(root->ac_lsigtable[i]->u.logic), acdata->lsigcnt[i], &evalcnt, &evalids, 0) == 1) {
if(root->ac_lsigtable[i]->tdb.container && root->ac_lsigtable[i]->tdb.container[0] != ctx->container_type) if(root->ac_lsigtable[i]->tdb.container && root->ac_lsigtable[i]->tdb.container[0] != ctx->container_type)
continue; continue;
if(root->ac_lsigtable[i]->tdb.filesize && (root->ac_lsigtable[i]->tdb.filesize[0] > map->len || root->ac_lsigtable[i]->tdb.filesize[1] < map->len)) if(root->ac_lsigtable[i]->tdb.filesize && (root->ac_lsigtable[i]->tdb.filesize[0] > map->len || root->ac_lsigtable[i]->tdb.filesize[1] < map->len))

8
libclamav/matcher.h
View file

@ -79,9 +79,15 @@ struct cli_lsig_tdb {
struct cli_bc; struct cli_bc;
struct cli_ac_lsig { struct cli_ac_lsig {
#define CLI_NORMAL_LSIG 0
#define CLI_NORMAL_YARA 1
uint32_t id; uint32_t id;
unsigned bc_idx; unsigned bc_idx;
char *logic; uint8_t type;
union {
char *logic;
void *other;
} u;
const char *virname; const char *virname;
struct cli_lsig_tdb tdb; struct cli_lsig_tdb tdb;
}; };

8
libclamav/readdb.c
View file

@ -1459,8 +1459,9 @@ static int load_oneldb(char *buffer, int chkpua, struct cl_engine *engine, unsig
return CL_EMEM; return CL_EMEM;
} }
lsig->logic = cli_mpool_strdup(engine->mempool, logic); lsig->type = CLI_NORMAL_LSIG;
if(!lsig->logic) { lsig->u.logic = cli_mpool_strdup(engine->mempool, logic);
if(!lsig->u.logic) {
cli_errmsg("cli_loadldb: Can't allocate memory for lsig->logic\n"); cli_errmsg("cli_loadldb: Can't allocate memory for lsig->logic\n");
FREE_TDB(tdb); FREE_TDB(tdb);
mpool_free(engine->mempool, lsig); mpool_free(engine->mempool, lsig);
@ -3731,7 +3732,8 @@ int cl_engine_free(struct cl_engine *engine)
cli_ac_free(root); cli_ac_free(root);
if(root->ac_lsigtable) { if(root->ac_lsigtable) {
for(j = 0; j < root->ac_lsigs; j++) { for(j = 0; j < root->ac_lsigs; j++) {
mpool_free(engine->mempool, root->ac_lsigtable[j]->logic); if (root->ac_lsigtable[j]->type == CLI_NORMAL_LSIG)
mpool_free(engine->mempool, root->ac_lsigtable[j]->u.logic);
FREE_TDB(root->ac_lsigtable[j]->tdb); FREE_TDB(root->ac_lsigtable[j]->tdb);
mpool_free(engine->mempool, root->ac_lsigtable[j]); mpool_free(engine->mempool, root->ac_lsigtable[j]);
} }