| /* |
| * Copyright (C) 2002 - 2007 Tomasz Kojm <tkojm@clamav.net> |
| * |
| * This program is free software; you can redistribute it and/or modify |
| * it under the terms of the GNU General Public License version 2 as |
| * published by the Free Software Foundation. |
| * |
| * This program is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| * GNU General Public License for more details. |
| * |
| * You should have received a copy of the GNU General Public License |
| * along with this program; if not, write to the Free Software |
| * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
| * MA 02110-1301, USA. |
| */ |
| |
| #if HAVE_CONFIG_H |
| #include "clamav-config.h" |
| #endif |
| |
| #include <stdio.h> |
| #include <string.h> |
| #include <stdlib.h> |
| #ifdef HAVE_UNISTD_H |
| #include <unistd.h> |
| #endif |
| |
| #include "clamav.h" |
| #include "others.h" |
| #include "matcher.h" |
| #include "matcher-ac.h" |
| #include "filetypes.h" |
| #include "cltypes.h" |
| #include "str.h" |
| |
| uint8_t cli_ac_mindepth = AC_DEFAULT_MIN_DEPTH; |
| uint8_t cli_ac_maxdepth = AC_DEFAULT_MAX_DEPTH; |
| |
| int cli_ac_addpatt(struct cli_matcher *root, struct cli_ac_patt *pattern) |
| { |
| struct cli_ac_node *pt, *next, **newtable; |
| struct cli_ac_patt *ph; |
| struct cli_ac_alt *a1, *a2; |
| uint8_t i, match; |
| uint16_t len = MIN(root->ac_maxdepth, pattern->length); |
| |
| |
| for(i = 0; i < len; i++) { |
| if(pattern->pattern[i] & CLI_MATCH_WILDCARD) { |
| len = i; |
| break; |
| } |
| } |
| |
| if(len < root->ac_mindepth) |
| return CL_EPATSHORT; |
| |
| pt = root->ac_root; |
| |
| for(i = 0; i < len; i++) { |
| if(!pt->trans) { |
| pt->trans = (struct cli_ac_node **) cli_calloc(256, sizeof(struct cli_ac_node *)); |
| if(!pt->trans) { |
| cli_errmsg("cli_ac_addpatt: Can't allocate memory for pt->trans\n"); |
| return CL_EMEM; |
| } |
| } |
| |
| next = pt->trans[(unsigned char) (pattern->pattern[i] & 0xff)]; |
| |
| if(!next) { |
| next = (struct cli_ac_node *) cli_calloc(1, sizeof(struct cli_ac_node)); |
| if(!next) { |
| cli_errmsg("cli_ac_addpatt: Can't allocate memory for AC node\n"); |
| return CL_EMEM; |
| } |
| |
| if(i != len - 1) { |
| next->trans = (struct cli_ac_node **) cli_calloc(256, sizeof(struct cli_ac_node *)); |
| if(!next->trans) { |
| cli_errmsg("cli_ac_addpatt: Can't allocate memory for next->trans\n"); |
| free(next); |
| return CL_EMEM; |
| } |
| } else { |
| next->leaf = 1; |
| } |
| |
| root->ac_nodes++; |
| newtable = (struct cli_ac_node **) cli_realloc(root->ac_nodetable, root->ac_nodes * sizeof(struct cli_ac_node *)); |
| if(!newtable) { |
| root->ac_nodes--; |
| cli_errmsg("cli_ac_addpatt: Can't realloc ac_nodetable\n"); |
| if(next->trans) |
| free(next->trans); |
| free(next); |
| return CL_EMEM; |
| } |
| newtable[root->ac_nodes - 1] = next; |
| root->ac_nodetable = newtable; |
| |
| pt->trans[(unsigned char) (pattern->pattern[i] & 0xff)] = next; |
| pt->leaf = 0; |
| } |
| |
| pt = next; |
| } |
| |
| root->ac_patterns++; |
| root->ac_pattable = (struct cli_ac_patt **) cli_realloc2(root->ac_pattable, root->ac_patterns * sizeof(struct cli_ac_patt *)); |
| if(!root->ac_pattable) { |
| cli_errmsg("cli_ac_addpatt: Can't realloc ac_pattable\n"); |
| return CL_EMEM; |
| } |
| root->ac_pattable[root->ac_patterns - 1] = pattern; |
| |
| pt->final = 1; |
| pattern->depth = i; |
| |
| ph = pt->list; |
| while(ph) { |
| if((ph->length == pattern->length) && (ph->prefix_length == pattern->prefix_length)) { |
| if(!memcmp(ph->pattern, pattern->pattern, ph->length * sizeof(uint16_t)) && !memcmp(ph->prefix, pattern->prefix, ph->prefix_length * sizeof(uint16_t))) { |
| if(!ph->alt && !pattern->alt) { |
| match = 1; |
| } else if(ph->alt == pattern->alt) { |
| match = 1; |
| for(i = 0; i < ph->alt; i++) { |
| a1 = ph->alttable[i]; |
| a2 = pattern->alttable[i]; |
| |
| if(a1->num != a2->num) { |
| match = 0; |
| break; |
| } |
| if(a1->chmode != a2->chmode) { |
| match = 0; |
| break; |
| } else if(a1->chmode) { |
| if(memcmp(a1->str, a2->str, a1->num)) { |
| match = 0; |
| break; |
| } |
| } else { |
| while(a1 && a2) { |
| if((a1->len != a2->len) || memcmp(a1->str, a2->str, a1->len)) |
| break; |
| a1 = a1->next; |
| a2 = a2->next; |
| } |
| if(a1 || a2) { |
| match = 0; |
| break; |
| } |
| } |
| } |
| } else { |
| match = 0; |
| } |
| |
| if(match) { |
| pattern->next_same = ph->next_same; |
| ph->next_same = pattern; |
| return CL_SUCCESS; |
| } |
| } |
| } |
| ph = ph->next; |
| } |
| |
| pattern->next = pt->list; |
| pt->list = pattern; |
| |
| return CL_SUCCESS; |
| } |
| |
| struct bfs_list { |
| struct cli_ac_node *node; |
| struct bfs_list *next; |
| }; |
| |
| static int bfs_enqueue(struct bfs_list **bfs, struct bfs_list **last, struct cli_ac_node *n) |
| { |
| struct bfs_list *new; |
| |
| |
| new = (struct bfs_list *) cli_malloc(sizeof(struct bfs_list)); |
| if(!new) { |
| cli_errmsg("bfs_enqueue: Can't allocate memory for bfs_list\n"); |
| return CL_EMEM; |
| } |
| new->next = NULL; |
| new->node = n; |
| |
| if(*last) { |
| (*last)->next = new; |
| *last = new; |
| } else { |
| *bfs = *last = new; |
| } |
| |
| return CL_SUCCESS; |
| } |
| |
| static struct cli_ac_node *bfs_dequeue(struct bfs_list **bfs, struct bfs_list **last) |
| { |
| struct bfs_list *lpt; |
| struct cli_ac_node *pt; |
| |
| |
| if(!(lpt = *bfs)) { |
| return NULL; |
| } else { |
| *bfs = (*bfs)->next; |
| pt = lpt->node; |
| if(lpt == *last) |
| *last = NULL; |
| free(lpt); |
| return pt; |
| } |
| } |
| |
| static int ac_maketrans(struct cli_matcher *root) |
| { |
| struct bfs_list *bfs = NULL, *bfs_last = NULL; |
| struct cli_ac_node *ac_root = root->ac_root, *child, *node, *fail; |
| struct cli_ac_patt *patt; |
| int i, ret; |
| |
| |
| for(i = 0; i < 256; i++) { |
| node = ac_root->trans[i]; |
| if(!node) { |
| ac_root->trans[i] = ac_root; |
| } else { |
| node->fail = ac_root; |
| if((ret = bfs_enqueue(&bfs, &bfs_last, node))) |
| return ret; |
| } |
| } |
| |
| while((node = bfs_dequeue(&bfs, &bfs_last))) { |
| if(node->leaf) |
| continue; |
| |
| for(i = 0; i < 256; i++) { |
| child = node->trans[i]; |
| if(child) { |
| fail = node->fail; |
| while(fail->leaf || !fail->trans[i]) |
| fail = fail->fail; |
| |
| child->fail = fail->trans[i]; |
| |
| if(child->list) { |
| patt = child->list; |
| while(patt->next) |
| patt = patt->next; |
| |
| patt->next = child->fail->list; |
| } else { |
| child->list = child->fail->list; |
| } |
| |
| if(child->list) |
| child->final = 1; |
| |
| if((ret = bfs_enqueue(&bfs, &bfs_last, child)) != 0) |
| return ret; |
| } |
| } |
| } |
| |
| return CL_SUCCESS; |
| } |
| |
| int cli_ac_buildtrie(struct cli_matcher *root) |
| { |
| if(!root) |
| return CL_EMALFDB; |
| |
| if(!root->ac_root) { |
| cli_dbgmsg("cli_ac_buildtrie: AC pattern matcher is not initialised\n"); |
| return CL_SUCCESS; |
| } |
| |
| return ac_maketrans(root); |
| } |
| |
| int cli_ac_init(struct cli_matcher *root, uint8_t mindepth, uint8_t maxdepth) |
| { |
| |
| root->ac_root = (struct cli_ac_node *) cli_calloc(1, sizeof(struct cli_ac_node)); |
| if(!root->ac_root) { |
| cli_errmsg("cli_ac_init: Can't allocate memory for ac_root\n"); |
| return CL_EMEM; |
| } |
| |
| root->ac_root->trans = (struct cli_ac_node **) cli_calloc(256, sizeof(struct cli_ac_node *)); |
| if(!root->ac_root->trans) { |
| cli_errmsg("cli_ac_init: Can't allocate memory for ac_root->trans\n"); |
| free(root->ac_root); |
| return CL_EMEM; |
| } |
| |
| root->ac_mindepth = mindepth; |
| root->ac_maxdepth = maxdepth; |
| |
| return CL_SUCCESS; |
| } |
| |
| static void ac_free_alt(struct cli_ac_patt *p) |
| { |
| uint16_t i; |
| struct cli_ac_alt *a1, *a2; |
| |
| |
| if(!p->alt) |
| return; |
| |
| for(i = 0; i < p->alt; i++) { |
| a1 = p->alttable[i]; |
| while(a1) { |
| a2 = a1; |
| a1 = a1->next; |
| if(a2->str) |
| free(a2->str); |
| free(a2); |
| } |
| } |
| free(p->alttable); |
| } |
| |
| void cli_ac_free(struct cli_matcher *root) |
| { |
| uint32_t i; |
| struct cli_ac_patt *patt; |
| |
| |
| for(i = 0; i < root->ac_patterns; i++) { |
| patt = root->ac_pattable[i]; |
| |
| if(patt->prefix) |
| free(patt->prefix); |
| else |
| free(patt->pattern); |
| free(patt->virname); |
| if(patt->offset) |
| free(patt->offset); |
| if(patt->alt) |
| ac_free_alt(patt); |
| free(patt); |
| } |
| if(root->ac_pattable) |
| free(root->ac_pattable); |
| |
| for(i = 0; i < root->ac_nodes; i++) { |
| if(!root->ac_nodetable[i]->leaf) |
| free(root->ac_nodetable[i]->trans); |
| free(root->ac_nodetable[i]); |
| } |
| |
| if(root->ac_nodetable) |
| free(root->ac_nodetable); |
| |
| if(root->ac_root) { |
| free(root->ac_root->trans); |
| free(root->ac_root); |
| } |
| } |
| |
| /* |
| * FIXME: the current support for string alternatives uses a brute-force |
| * approach and doesn't perform any kind of verification and |
| * backtracking. This may easily lead to false negatives, eg. when |
| * an alternative contains strings of different lengths and |
| * more than one of them can match at the current position. |
| */ |
| |
| #define AC_MATCH_CHAR(p,b) \ |
| switch(wc = p & CLI_MATCH_WILDCARD) { \ |
| case CLI_MATCH_CHAR: \ |
| if((unsigned char) p != b) \ |
| return 0; \ |
| break; \ |
| \ |
| case CLI_MATCH_IGNORE: \ |
| break; \ |
| \ |
| case CLI_MATCH_ALTERNATIVE: \ |
| found = 0; \ |
| alt = pattern->alttable[altcnt]; \ |
| if(alt->chmode) { \ |
| for(j = 0; j < alt->num; j++) { \ |
| if(alt->str[j] == b) { \ |
| found = 1; \ |
| break; \ |
| } \ |
| } \ |
| } else { \ |
| while(alt) { \ |
| if(bp + alt->len <= length) { \ |
| if(!memcmp(&buffer[bp], alt->str, alt->len)) { \ |
| found = 1; \ |
| bp += alt->len - 1; \ |
| break; \ |
| } \ |
| } \ |
| alt = alt->next; \ |
| } \ |
| } \ |
| if(!found) \ |
| return 0; \ |
| altcnt++; \ |
| break; \ |
| \ |
| case CLI_MATCH_NIBBLE_HIGH: \ |
| if((unsigned char) (p & 0x00f0) != (b & 0xf0)) \ |
| return 0; \ |
| break; \ |
| \ |
| case CLI_MATCH_NIBBLE_LOW: \ |
| if((unsigned char) (p & 0x000f) != (b & 0x0f)) \ |
| return 0; \ |
| break; \ |
| \ |
| default: \ |
| cli_errmsg("ac_findmatch: Unknown wildcard 0x%x\n", wc); \ |
| return 0; \ |
| } |
| |
| inline static int ac_findmatch(const unsigned char *buffer, uint32_t offset, uint32_t length, const struct cli_ac_patt *pattern, uint32_t *end) |
| { |
| uint32_t bp; |
| uint16_t wc, i, j, altcnt = pattern->alt_pattern; |
| uint8_t found; |
| struct cli_ac_alt *alt; |
| |
| |
| if((offset + pattern->length > length) || (pattern->prefix_length > offset)) |
| return 0; |
| |
| bp = offset + pattern->depth; |
| |
| for(i = pattern->depth; i < pattern->length && bp < length; i++) { |
| AC_MATCH_CHAR(pattern->pattern[i],buffer[bp]); |
| bp++; |
| } |
| *end = bp; |
| |
| if(pattern->prefix) { |
| altcnt = 0; |
| bp = offset - pattern->prefix_length; |
| |
| for(i = 0; i < pattern->prefix_length; i++) { |
| AC_MATCH_CHAR(pattern->prefix[i],buffer[bp]); |
| bp++; |
| } |
| } |
| |
| return 1; |
| } |
| |
| int cli_ac_initdata(struct cli_ac_data *data, uint32_t partsigs, uint8_t tracklen) |
| { |
| |
| if(!data) { |
| cli_errmsg("cli_ac_init: data == NULL\n"); |
| return CL_ENULLARG; |
| } |
| |
| data->partsigs = partsigs; |
| |
| if(!partsigs) |
| return CL_SUCCESS; |
| |
| data->offmatrix = (int32_t ***) cli_calloc(partsigs, sizeof(int32_t **)); |
| if(!data->offmatrix) { |
| cli_errmsg("cli_ac_init: Can't allocate memory for data->offmatrix\n"); |
| return CL_EMEM; |
| } |
| |
| return CL_SUCCESS; |
| } |
| |
| void cli_ac_freedata(struct cli_ac_data *data) |
| { |
| uint32_t i; |
| |
| |
| if(data && data->partsigs) { |
| for(i = 0; i < data->partsigs; i++) { |
| if(data->offmatrix[i]) { |
| free(data->offmatrix[i][0]); |
| free(data->offmatrix[i]); |
| } |
| } |
| free(data->offmatrix); |
| } |
| } |
| |
| inline static int ac_addtype(struct cli_matched_type **list, cli_file_t type, off_t offset) |
| { |
| struct cli_matched_type *tnode, *tnode_last; |
| |
| |
| if(*list && (*list)->cnt >= MAX_EMBEDDED_OBJ) |
| return CL_SUCCESS; |
| |
| if(!(tnode = cli_calloc(1, sizeof(struct cli_matched_type)))) { |
| cli_errmsg("cli_ac_addtype: Can't allocate memory for new type node\n"); |
| return CL_EMEM; |
| } |
| |
| tnode->type = type; |
| tnode->offset = offset; |
| |
| tnode_last = *list; |
| while(tnode_last && tnode_last->next) |
| tnode_last = tnode_last->next; |
| |
| if(tnode_last) |
| tnode_last->next = tnode; |
| else |
| *list = tnode; |
| |
| (*list)->cnt++; |
| return CL_SUCCESS; |
| } |
| |
| int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_matcher *root, struct cli_ac_data *mdata, uint8_t otfrec, uint32_t offset, cli_file_t ftype, int fd, struct cli_matched_type **ftoffset) |
| { |
| struct cli_ac_node *current; |
| struct cli_ac_patt *patt, *pt; |
| uint32_t i, bp, realoff, matchend; |
| uint16_t j; |
| int32_t **offmatrix; |
| uint8_t found; |
| struct cli_target_info info; |
| int type = CL_CLEAN; |
| |
| |
| if(!root->ac_root) |
| return CL_CLEAN; |
| |
| if(!mdata) { |
| cli_errmsg("cli_ac_scanbuff: mdata == NULL\n"); |
| return CL_ENULLARG; |
| } |
| |
| memset(&info, 0, sizeof(info)); |
| current = root->ac_root; |
| |
| for(i = 0; i < length; i++) { |
| |
| while(current->leaf || !current->trans[buffer[i]]) |
| current = current->fail; |
| |
| current = current->trans[buffer[i]]; |
| |
| if(current->final) { |
| patt = current->list; |
| while(patt) { |
| bp = i + 1 - patt->depth; |
| if(ac_findmatch(buffer, bp, length, patt, &matchend)) { |
| pt = patt; |
| while(pt) { |
| realoff = offset + bp - pt->prefix_length; |
| |
| if((pt->offset || pt->target) && (!pt->sigid || pt->partno == 1)) { |
| if((fd == -1 && !ftype) || !cli_validatesig(ftype, pt->offset, realoff, &info, fd, pt->virname)) { |
| pt = pt->next_same; |
| continue; |
| } |
| } |
| |
| if(pt->sigid) { /* it's a partial signature */ |
| |
| if(pt->partno != 1 && (!mdata->offmatrix[pt->sigid - 1] || !mdata->offmatrix[pt->sigid - 1][pt->partno - 2][0])) { |
| pt = pt->next_same; |
| continue; |
| } |
| |
| if(!mdata->offmatrix[pt->sigid - 1]) { |
| mdata->offmatrix[pt->sigid - 1] = cli_malloc(pt->parts * sizeof(int32_t *)); |
| if(!mdata->offmatrix[pt->sigid - 1]) { |
| cli_errmsg("cli_ac_scanbuff: Can't allocate memory for mdata->offmatrix[%u]\n", pt->sigid - 1); |
| return CL_EMEM; |
| } |
| |
| mdata->offmatrix[pt->sigid - 1][0] = cli_malloc(pt->parts * (AC_DEFAULT_TRACKLEN + 1) * sizeof(int32_t)); |
| if(!mdata->offmatrix[pt->sigid - 1][0]) { |
| cli_errmsg("cli_ac_scanbuff: Can't allocate memory for mdata->offmatrix[%u][0]\n", pt->sigid - 1); |
| free(mdata->offmatrix[pt->sigid - 1]); |
| mdata->offmatrix[pt->sigid - 1] = NULL; |
| return CL_EMEM; |
| } |
| memset(mdata->offmatrix[pt->sigid - 1][0], -1, pt->parts * (AC_DEFAULT_TRACKLEN + 1) * sizeof(int32_t)); |
| mdata->offmatrix[pt->sigid - 1][0][0] = 0; |
| for(j = 1; j < pt->parts; j++) { |
| mdata->offmatrix[pt->sigid - 1][j] = mdata->offmatrix[pt->sigid - 1][0] + j * (AC_DEFAULT_TRACKLEN + 1); |
| mdata->offmatrix[pt->sigid - 1][j][0] = 0; |
| } |
| } |
| offmatrix = mdata->offmatrix[pt->sigid - 1]; |
| |
| if(pt->partno != 1) { |
| found = 0; |
| for(j = 1; j <= AC_DEFAULT_TRACKLEN && offmatrix[pt->partno - 2][j] != -1; j++) { |
| found = 1; |
| if(pt->maxdist) |
| if(realoff - offmatrix[pt->partno - 2][j] > pt->maxdist) |
| found = 0; |
| |
| if(found && pt->mindist) |
| if(realoff - offmatrix[pt->partno - 2][j] < pt->mindist) |
| found = 0; |
| |
| if(found) |
| break; |
| } |
| } |
| |
| if(pt->partno == 1 || (found && (pt->partno != pt->parts))) { |
| offmatrix[pt->partno - 1][0] %= AC_DEFAULT_TRACKLEN; |
| offmatrix[pt->partno - 1][0]++; |
| offmatrix[pt->partno - 1][offmatrix[pt->partno - 1][0]] = offset + matchend; |
| |
| if(pt->partno == 1) /* save realoff for the first part */ |
| offmatrix[pt->parts - 1][offmatrix[pt->partno - 1][0]] = realoff; |
| } else if(found && pt->partno == pt->parts) { |
| if(pt->type) { |
| if(otfrec) { |
| if(pt->type > type || pt->type >= CL_TYPE_SFX || pt->type == CL_TYPE_MSEXE) { |
| /* This debug message was causing trouble on the test-suite for being non-deterministic */ |
| /*cli_dbgmsg("Matched signature for file type %s\n", pt->virname);*/ |
| type = pt->type; |
| if(ftoffset && (!*ftoffset || (*ftoffset)->cnt < MAX_EMBEDDED_OBJ) && ((ftype == CL_TYPE_MSEXE && type >= CL_TYPE_SFX) || ((ftype == CL_TYPE_MSEXE || ftype == CL_TYPE_ZIP) && type == CL_TYPE_MSEXE))) { |
| /* FIXME: we don't know which offset of the first part is the correct one */ |
| for(j = 1; j <= AC_DEFAULT_TRACKLEN && offmatrix[0][j] != -1; j++) { |
| if(ac_addtype(ftoffset, type, offmatrix[pt->parts - 1][j])) { |
| if(info.exeinfo.section) |
| free(info.exeinfo.section); |
| return CL_EMEM; |
| } |
| } |
| } |
| |
| memset(offmatrix[0], -1, pt->parts * (AC_DEFAULT_TRACKLEN + 1) * sizeof(int32_t)); |
| for(j = 0; j < pt->parts; j++) |
| offmatrix[j][0] = 0; |
| } |
| } |
| |
| } else { /* !pt->type */ |
| if(virname) |
| *virname = pt->virname; |
| |
| if(info.exeinfo.section) |
| free(info.exeinfo.section); |
| |
| return CL_VIRUS; |
| } |
| } |
| |
| } else { /* old type signature */ |
| if(pt->type) { |
| if(otfrec) { |
| if(pt->type > type || pt->type >= CL_TYPE_SFX || pt->type == CL_TYPE_MSEXE) { |
| cli_dbgmsg("Matched signature for file type %s at %u\n", pt->virname, realoff); |
| type = pt->type; |
| if(ftoffset && (!*ftoffset || (*ftoffset)->cnt < MAX_EMBEDDED_OBJ) && ((ftype == CL_TYPE_MSEXE && type >= CL_TYPE_SFX) || ((ftype == CL_TYPE_MSEXE || ftype == CL_TYPE_ZIP) && type == CL_TYPE_MSEXE))) { |
| |
| if(ac_addtype(ftoffset, type, realoff)) { |
| if(info.exeinfo.section) |
| free(info.exeinfo.section); |
| return CL_EMEM; |
| } |
| } |
| } |
| } |
| } else { |
| if(virname) |
| *virname = pt->virname; |
| |
| if(info.exeinfo.section) |
| free(info.exeinfo.section); |
| return CL_VIRUS; |
| } |
| } |
| pt = pt->next_same; |
| } |
| } |
| patt = patt->next; |
| } |
| } |
| } |
| |
| if(info.exeinfo.section) |
| free(info.exeinfo.section); |
| |
| return otfrec ? type : CL_CLEAN; |
| } |
| |
| /* FIXME: clean up the code */ |
| int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hexsig, uint32_t sigid, uint16_t parts, uint16_t partno, uint16_t type, uint32_t mindist, uint32_t maxdist, const char *offset, uint8_t target) |
| { |
| struct cli_ac_patt *new; |
| char *pt, *hex = NULL; |
| uint16_t i, j, ppos = 0, pend; |
| uint8_t wprefix = 0, zprefix = 1, namelen, plen = 0; |
| struct cli_ac_alt *newalt, *altpt, **newtable; |
| int ret, error = CL_SUCCESS; |
| |
| |
| if(strlen(hexsig) / 2 < root->ac_mindepth) |
| return CL_EPATSHORT; |
| |
| if((new = (struct cli_ac_patt *) cli_calloc(1, sizeof(struct cli_ac_patt))) == NULL) |
| return CL_EMEM; |
| |
| new->type = type; |
| new->sigid = sigid; |
| new->parts = parts; |
| new->partno = partno; |
| new->mindist = mindist; |
| new->maxdist = maxdist; |
| new->target = target; |
| |
| if(strchr(hexsig, '(')) { |
| char *hexcpy, *hexnew, *start, *h, *c; |
| |
| if(!(hexcpy = cli_strdup(hexsig))) { |
| free(new); |
| return CL_EMEM; |
| } |
| |
| if(!(hexnew = (char *) cli_calloc(strlen(hexsig) + 1, 1))) { |
| free(hexcpy); |
| free(new); |
| return CL_EMEM; |
| } |
| |
| start = pt = hexcpy; |
| while((pt = strchr(start, '('))) { |
| *pt++ = 0; |
| |
| if(!start) { |
| error = CL_EMALFDB; |
| break; |
| } |
| |
| strcat(hexnew, start); |
| strcat(hexnew, "()"); |
| |
| if(!(start = strchr(pt, ')'))) { |
| error = CL_EMALFDB; |
| break; |
| } |
| *start++ = 0; |
| |
| newalt = (struct cli_ac_alt *) cli_calloc(1, sizeof(struct cli_ac_alt)); |
| if(!newalt) { |
| cli_errmsg("cli_ac_addsig: Can't allocate newalt\n"); |
| error = CL_EMEM; |
| break; |
| } |
| |
| new->alt++; |
| newtable = (struct cli_ac_alt **) cli_realloc(new->alttable, new->alt * sizeof(struct cli_ac_alt *)); |
| if(!newtable) { |
| new->alt--; |
| free(newalt); |
| cli_errmsg("cli_ac_addsig: Can't realloc new->alttable\n"); |
| error = CL_EMEM; |
| break; |
| } |
| newtable[new->alt - 1] = newalt; |
| new->alttable = newtable; |
| |
| for(i = 0; i < strlen(pt); i++) |
| if(pt[i] == '|') |
| newalt->num++; |
| |
| if(!newalt->num) { |
| error = CL_EMALFDB; |
| break; |
| } else |
| newalt->num++; |
| |
| if(3 * newalt->num - 1 == (uint16_t) strlen(pt)) { |
| newalt->chmode = 1; |
| newalt->str = (unsigned char *) cli_malloc(newalt->num); |
| if(!newalt->str) { |
| cli_errmsg("cli_ac_addsig: Can't allocate newalt->str\n"); |
| error = CL_EMEM; |
| break; |
| } |
| } |
| |
| for(i = 0; i < newalt->num; i++) { |
| if(!(h = cli_strtok(pt, i, "|"))) { |
| error = CL_EMALFDB; |
| break; |
| } |
| |
| if(!(c = cli_hex2str(h))) { |
| free(h); |
| error = CL_EMALFDB; |
| break; |
| } |
| |
| if(newalt->chmode) { |
| newalt->str[i] = *c; |
| free(c); |
| } else { |
| if(i) { |
| altpt = newalt; |
| while(altpt->next) |
| altpt = altpt->next; |
| |
| altpt->next = (struct cli_ac_alt *) cli_calloc(1, sizeof(struct cli_ac_alt)); |
| if(!altpt->next) { |
| cli_errmsg("cli_ac_addsig: Can't allocate altpt->next\n"); |
| error = CL_EMEM; |
| free(c); |
| free(h); |
| break; |
| } |
| |
| altpt->next->str = (unsigned char *) c; |
| altpt->next->len = strlen(h) / 2; |
| } else { |
| newalt->str = (unsigned char *) c; |
| newalt->len = strlen(h) / 2; |
| } |
| } |
| |
| free(h); |
| } |
| |
| if(error) |
| break; |
| } |
| |
| if(start) |
| strcat(hexnew, start); |
| |
| hex = hexnew; |
| free(hexcpy); |
| |
| if(error) { |
| if(new->alt) { |
| free(hex); |
| ac_free_alt(new); |
| } |
| free(new); |
| return error; |
| } |
| } |
| |
| if((new->pattern = cli_hex2ui(new->alt ? hex : hexsig)) == NULL) { |
| if(new->alt) { |
| free(hex); |
| ac_free_alt(new); |
| } |
| free(new); |
| return CL_EMALFDB; |
| } |
| new->length = strlen(new->alt ? hex : hexsig) / 2; |
| if(new->alt) |
| free(hex); |
| |
| for(i = 0; i < root->ac_maxdepth && i < new->length; i++) { |
| if(new->pattern[i] & CLI_MATCH_WILDCARD) { |
| wprefix = 1; |
| break; |
| } |
| if(zprefix && new->pattern[i]) |
| zprefix = 0; |
| } |
| |
| if(wprefix || zprefix) { |
| pend = new->length - root->ac_mindepth + 1; |
| for(i = 0; i < pend; i++) { |
| for(j = i; j < i + root->ac_maxdepth && j < new->length; j++) { |
| if(new->pattern[j] & CLI_MATCH_WILDCARD) { |
| break; |
| } else { |
| if(j - i + 1 >= plen) { |
| plen = j - i + 1; |
| ppos = i; |
| } |
| } |
| if(plen >= root->ac_maxdepth && (new->pattern[ppos] || new->pattern[ppos + 1])) |
| break; |
| } |
| if(plen >= root->ac_maxdepth && (new->pattern[ppos] || new->pattern[ppos + 1])) |
| break; |
| } |
| |
| if(plen < root->ac_mindepth) { |
| cli_errmsg("cli_ac_addsig: Can't find a static subpattern of length %u\n", root->ac_mindepth); |
| ac_free_alt(new); |
| free(new->pattern); |
| free(new); |
| return CL_EMALFDB; |
| } |
| |
| new->prefix = new->pattern; |
| new->prefix_length = ppos; |
| new->pattern = &new->prefix[ppos]; |
| new->length -= ppos; |
| |
| for(i = 0; i < new->prefix_length; i++) |
| if((new->prefix[i] & CLI_MATCH_WILDCARD) == CLI_MATCH_ALTERNATIVE) |
| new->alt_pattern++; |
| } |
| |
| if(new->length > root->maxpatlen) |
| root->maxpatlen = new->length; |
| |
| if((pt = strstr(virname, " (Clam)"))) |
| namelen = strlen(virname) - strlen(pt); |
| else |
| namelen = strlen(virname); |
| |
| if(!namelen) { |
| cli_errmsg("cli_ac_addsig: No virus name\n"); |
| if(new->prefix) |
| free(new->prefix); |
| else |
| free(new->pattern); |
| ac_free_alt(new); |
| free(new); |
| return CL_EMALFDB; |
| } |
| |
| if((new->virname = cli_calloc(namelen + 1, sizeof(char))) == NULL) { |
| if(new->prefix) |
| free(new->prefix); |
| else |
| free(new->pattern); |
| ac_free_alt(new); |
| free(new); |
| return CL_EMEM; |
| } |
| strncpy(new->virname, virname, namelen); |
| |
| if(offset) { |
| new->offset = cli_strdup(offset); |
| if(!new->offset) { |
| if(new->prefix) |
| free(new->prefix); |
| else |
| free(new->pattern); |
| ac_free_alt(new); |
| free(new->virname); |
| free(new); |
| return CL_EMEM; |
| } |
| } |
| |
| if((ret = cli_ac_addpatt(root, new))) { |
| if(new->prefix) |
| free(new->prefix); |
| else |
| free(new->pattern); |
| free(new->virname); |
| ac_free_alt(new); |
| if(new->offset) |
| free(new->offset); |
| free(new); |
| return ret; |
| } |
| |
| return CL_SUCCESS; |
| } |
| |
| void cli_ac_setdepth(uint8_t mindepth, uint8_t maxdepth) |
| { |
| cli_ac_mindepth = mindepth; |
| cli_ac_maxdepth = maxdepth; |
| } |