From c24654d24439f5aeefe590aa1c40e3fd98f586ee Mon Sep 17 00:00:00 2001 From: Micah Snyder Date: Mon, 11 Oct 2021 16:40:20 -0700 Subject: [PATCH] Fix all-match mode bug in PE section hash scans The PE section hash scanning code didn't implement the all-match check. While this check isn't the ideal implementation for all-match mode... (see the commit message for the previous commit) ...it's simple enough to add the all-match check here for now. --- libclamav/pe.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/libclamav/pe.c b/libclamav/pe.c index 06ef42f2d..ee37b9974 100644 --- a/libclamav/pe.c +++ b/libclamav/pe.c @@ -2847,13 +2847,17 @@ int cli_scanpe(cli_ctx *ctx) if ((DCONF & PE_CONF_MD5SECT) && ctx->engine->hm_mdb) { ret = scan_pe_mdb(ctx, &(peinfo->sections[i])); if (ret != CL_CLEAN) { - // TODO Handle allmatch - if (ret != CL_VIRUS) + if (ret == CL_VIRUS && !SCAN_ALLMATCHES) { + cli_dbgmsg("------------------------------------\n"); + cli_exe_info_destroy(peinfo); + return ret; + } else if (ret != CL_VIRUS) { cli_errmsg("cli_scanpe: scan_pe_mdb failed: %s!\n", cl_strerror(ret)); - cli_dbgmsg("------------------------------------\n"); - cli_exe_info_destroy(peinfo); - return ret; + cli_dbgmsg("------------------------------------\n"); + cli_exe_info_destroy(peinfo); + return ret; + } } } }