| /* |
| * Copyright (C) 2002 - 2005 Tomasz Kojm <tkojm@clamav.net> |
| * With enhancements from Thomas Lamy <Thomas.Lamy@in-online.net> |
| * |
| * This program is free software; you can redistribute it and/or modify |
| * it under the terms of the GNU General Public License version 2 as |
| * published by the Free Software Foundation. |
| * |
| * This program is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| * GNU General Public License for more details. |
| * |
| * You should have received a copy of the GNU General Public License |
| * along with this program; if not, write to the Free Software |
| * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, |
| * MA 02110-1301, USA. |
| */ |
| |
| #if HAVE_CONFIG_H |
| #include "clamav-config.h" |
| #endif |
| |
| #include <stdio.h> |
| #include <string.h> |
| #include <stdlib.h> |
| #include <ctype.h> |
| #include <sys/types.h> |
| #ifdef HAVE_UNISTD_H |
| #include <unistd.h> |
| #endif |
| |
| #include "clamav.h" |
| #include "filetypes.h" |
| #include "others.h" |
| #include "readdb.h" |
| #include "matcher-ac.h" |
| #include "str.h" |
| |
| #include "htmlnorm.h" |
| #include "entconv.h" |
| |
| struct cli_magic_s { |
| size_t offset; |
| const char *magic; |
| size_t length; |
| const char *descr; |
| cli_file_t type; |
| }; |
| |
| struct cli_smagic_s { |
| const char *sig; |
| const char *descr; |
| cli_file_t type; |
| }; |
| |
| static const struct cli_magic_s cli_magic[] = { |
| |
| /* Executables */ |
| |
| {0, "MZ", 2, "DOS/W32 executable/library/driver", CL_TYPE_MSEXE}, |
| {0, "\177ELF", 4, "ELF", CL_TYPE_ELF}, |
| |
| /* Archives */ |
| |
| {0, "Rar!", 4, "RAR", CL_TYPE_RAR}, |
| {0, "PK\003\004", 4, "ZIP", CL_TYPE_ZIP}, |
| {0, "PK00PK\003\004", 8, "ZIP", CL_TYPE_ZIP}, |
| {0, "\037\213", 2, "GZip", CL_TYPE_GZ}, |
| {0, "BZh", 3, "BZip", CL_TYPE_BZ}, |
| {0, "\x60\xea", 2, "ARJ", CL_TYPE_ARJ}, |
| {0, "SZDD", 4, "compress.exe'd", CL_TYPE_MSSZDD}, |
| {0, "MSCF", 4, "MS CAB", CL_TYPE_MSCAB}, |
| {0, "ITSF", 4, "MS CHM", CL_TYPE_MSCHM}, |
| {8, "\x19\x04\x00\x10", 4, "SIS", CL_TYPE_SIS}, |
| {0, "#@~^", 4, "SCRENC", CL_TYPE_SCRENC}, |
| {0, "(This file must be converted with BinHex 4.0)", |
| 45, "BinHex", CL_TYPE_BINHEX}, |
| |
| /* Mail */ |
| |
| {0, "From ", 5, "MBox", CL_TYPE_MAIL}, |
| {0, "Received: ", 10, "Raw mail", CL_TYPE_MAIL}, |
| {0, "Return-Path: ", 13, "Maildir", CL_TYPE_MAIL}, |
| {0, "Return-path: ", 13, "Maildir", CL_TYPE_MAIL}, |
| {0, "Delivered-To: ", 14, "Mail", CL_TYPE_MAIL}, |
| {0, "X-UIDL: ", 8, "Mail", CL_TYPE_MAIL}, |
| {0, "X-Apparently-To: ", 17, "Mail", CL_TYPE_MAIL}, |
| {0, "X-Envelope-From: ", 17, "Mail", CL_TYPE_MAIL}, |
| {0, "X-Original-To: ", 15, "Mail", CL_TYPE_MAIL}, |
| {0, "X-Symantec-", 11, "Symantec", CL_TYPE_MAIL}, |
| {0, "X-EVS", 5, "EVS mail", CL_TYPE_MAIL}, |
| {0, "X-Real-To: ", 11, "Mail", CL_TYPE_MAIL}, |
| {0, "X-Sieve: ", 9, "Mail", CL_TYPE_MAIL}, |
| {0, ">From ", 6, "Mail", CL_TYPE_MAIL}, |
| {0, "Date: ", 6, "Mail", CL_TYPE_MAIL}, |
| {0, "Message-Id: ", 12, "Mail", CL_TYPE_MAIL}, |
| {0, "Message-ID: ", 12, "Mail", CL_TYPE_MAIL}, |
| {0, "Envelope-to: ", 13, "Mail", CL_TYPE_MAIL}, |
| {0, "Delivery-date: ", 15, "Mail", CL_TYPE_MAIL}, |
| {0, "To: ", 4, "Mail", CL_TYPE_MAIL}, |
| {0, "Subject: ", 9, "Mail", CL_TYPE_MAIL}, |
| {0, "For: ", 5, "Eserv mail", CL_TYPE_MAIL}, |
| {0, "From: ", 6, "Exim mail", CL_TYPE_MAIL}, |
| {0, "v:\015\012Received: ", 14, "VPOP3 Mail (DOS)", CL_TYPE_MAIL}, |
| {0, "v:\012Received: ", 13, "VPOP3 Mail (UNIX)", CL_TYPE_MAIL}, |
| {0, "Hi. This is the qmail-send", 26, "Qmail bounce", CL_TYPE_MAIL}, |
| {0, "\170\237\076\042", 4, "TNEF", CL_TYPE_TNEF}, |
| |
| {0, "begin ", 6, "UUencoded", CL_TYPE_UUENCODED}, |
| {0, "\041\102\104\116", 4, "PST", CL_TYPE_PST}, |
| |
| /* Graphics (may contain exploits against MS systems) */ |
| |
| {0, "GIF", 3, "GIF", CL_TYPE_GRAPHICS}, |
| {0, "BM", 2, "BMP", CL_TYPE_GRAPHICS}, |
| {0, "\377\330\377", 3, "JPEG", CL_TYPE_GRAPHICS}, |
| {6, "JFIF", 4, "JPEG", CL_TYPE_GRAPHICS}, |
| {6, "Exif", 4, "JPEG", CL_TYPE_GRAPHICS}, |
| {0, "\x89PNG", 4, "PNG", CL_TYPE_GRAPHICS}, |
| {0, "RIFF", 4, "RIFF", CL_TYPE_RIFF}, |
| {0, "RIFX", 4, "RIFX", CL_TYPE_RIFF}, |
| |
| /* Others */ |
| |
| {0, "\320\317\021\340\241\261\032\341", 8, "OLE2 container", CL_TYPE_MSOLE2}, |
| {0, "%PDF-", 5, "PDF document", CL_TYPE_PDF}, |
| {0, "\266\271\254\256\376\377\377\377", 8, "CryptFF", CL_TYPE_CRYPTFF}, |
| {0, "{\\rtf", 5, "RTF", CL_TYPE_RTF}, |
| |
| /* Ignored types */ |
| |
| {0, "\000\000\001\263", 4, "MPEG video stream", CL_TYPE_DATA}, |
| {0, "\000\000\001\272", 4, "MPEG sys stream", CL_TYPE_DATA}, |
| {0, "OggS", 4, "Ogg Stream", CL_TYPE_DATA}, |
| {0, "ID3", 3, "MP3", CL_TYPE_DATA}, |
| {0, "\377\373\220", 3, "MP3", CL_TYPE_DATA}, |
| {0, "%!PS-Adobe-", 11, "PostScript", CL_TYPE_DATA}, |
| {0, "\060\046\262\165\216\146\317", 7, "WMA/WMV/ASF", CL_TYPE_DATA}, |
| {0, ".RMF" , 4, "Real Media File", CL_TYPE_DATA}, |
| |
| {0, NULL, 0, NULL, CL_TYPE_UNKNOWN_DATA} |
| }; |
| |
| static const struct cli_smagic_s cli_smagic[] = { |
| |
| /* "\nFrom: " * "\nContent-Type: " */ |
| {"0a46726f6d3a20{-2048}0a436f6e74656e742d547970653a20", "Mail file", CL_TYPE_MAIL}, |
| |
| /* "\nReceived: " * "\nContent-Type: " */ |
| {"0a52656365697665643a20{-2048}0a436f6e74656e742d547970653a20", "Mail file", CL_TYPE_MAIL}, |
| |
| /* "\nReceived: " * "\nContent-type: " */ |
| {"0a52656365697665643a20{-2048}0a436f6e74656e742d747970653a20", "Mail file", CL_TYPE_MAIL}, |
| |
| /* "MIME-Version: " * "\nContent-Type: " */ |
| {"4d494d452d56657273696f6e3a20{-2048}0a436f6e74656e742d547970653a20", "Mail file", CL_TYPE_MAIL}, |
| |
| /* remember the matcher is case sensitive */ |
| {"3c62723e", "HTML data", CL_TYPE_HTML}, /* <br> */ |
| {"3c42723e", "HTML data", CL_TYPE_HTML}, /* <Br> */ |
| {"3c42523e", "HTML data", CL_TYPE_HTML}, /* <BR> */ |
| {"3c703e", "HTML data", CL_TYPE_HTML}, /* <p> */ |
| {"3c503e", "HTML data", CL_TYPE_HTML}, /* <P> */ |
| {"68726566", "HTML data", CL_TYPE_HTML}, /* href */ |
| {"48726566", "HTML data", CL_TYPE_HTML}, /* Href */ |
| {"48524546", "HTML data", CL_TYPE_HTML}, /* HREF */ |
| {"3c68746d6c3e", "HTML data", CL_TYPE_HTML}, /* <html> */ |
| {"3c48544d4c3e", "HTML data", CL_TYPE_HTML}, /* <HTML> */ |
| {"3c48746d6c3e", "HTML data", CL_TYPE_HTML}, /* <Html> */ |
| {"3c686561643e", "HTML data", CL_TYPE_HTML}, /* <head> */ |
| {"3c484541443e", "HTML data", CL_TYPE_HTML}, /* <HEAD> */ |
| {"3c486561643e", "HTML data", CL_TYPE_HTML}, /* <Head> */ |
| {"3c666f6e74", "HTML data", CL_TYPE_HTML}, /* <font */ |
| {"3c466f6e74", "HTML data", CL_TYPE_HTML}, /* <Font */ |
| {"3c464f4e54", "HTML data", CL_TYPE_HTML}, /* <FONT */ |
| {"3c696d67", "HTML data", CL_TYPE_HTML}, /* <img */ |
| {"3c494d47", "HTML data", CL_TYPE_HTML}, /* <IMG */ |
| {"3c496d67", "HTML data", CL_TYPE_HTML}, /* <Img */ |
| {"3c736372697074", "HTML data", CL_TYPE_HTML}, /* <script */ |
| {"3c536372697074", "HTML data", CL_TYPE_HTML}, /* <Script */ |
| {"3c534352495054", "HTML data", CL_TYPE_HTML}, /* <SCRIPT */ |
| {"3c6f626a656374", "HTML data", CL_TYPE_HTML}, /* <object */ |
| {"3c4f626a656374", "HTML data", CL_TYPE_HTML}, /* <Object */ |
| {"3c4f424a454354", "HTML data", CL_TYPE_HTML}, /* <OBJECT */ |
| {"3c696672616d65", "HTML data", CL_TYPE_HTML}, /* <iframe */ |
| {"3c494652414d45", "HTML data", CL_TYPE_HTML}, /* <IFRAME */ |
| {"3c7461626c65", "HTML data", CL_TYPE_HTML}, /* <table */ |
| {"3c5441424c45", "HTML data", CL_TYPE_HTML}, /* <TABLE */ |
| |
| {"526172211a0700", "RAR-SFX", CL_TYPE_RARSFX}, |
| {"504b0304", "ZIP-SFX", CL_TYPE_ZIPSFX}, |
| {"4d534346", "CAB-SFX", CL_TYPE_CABSFX}, |
| {"60ea{7}0002", "ARJ-SFX", CL_TYPE_ARJSFX}, |
| {"60ea{7}0102", "ARJ-SFX", CL_TYPE_ARJSFX}, |
| {"60ea{7}0202", "ARJ-SFX", CL_TYPE_ARJSFX}, |
| {"efbeadde4e756c6c736f6674496e7374", "NSIS", CL_TYPE_NULSFT}, |
| {"a3484bbe986c4aa9994c530a86d6487d41553321454130(35|36)", "AUTOIT", CL_TYPE_AUTOIT}, |
| |
| {"4d5a{60-300}50450000", "PE", CL_TYPE_MSEXE}, |
| |
| {NULL, NULL, CL_TYPE_UNKNOWN_DATA} |
| }; |
| |
| static char internat[256] = { |
| /* TODO: Remember to buy a beer to Joerg Wunsch <joerg@FreeBSD.ORG> */ |
| 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 0, /* 0x0X */ |
| 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, /* 0x1X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x2X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x3X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x4X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x5X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x6X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, /* 0x7X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x8X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x9X */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xaX */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xbX */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xcX */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xdX */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xeX */ |
| 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 /* 0xfX */ |
| }; |
| |
| cli_file_t cli_filetype(const unsigned char *buf, size_t buflen) |
| { |
| int i, text = 1, len; |
| |
| |
| for(i = 0; cli_magic[i].magic; i++) { |
| if(buflen >= cli_magic[i].offset+cli_magic[i].length) { |
| if(memcmp(buf+cli_magic[i].offset, cli_magic[i].magic, cli_magic[i].length) == 0) { |
| cli_dbgmsg("Recognized %s file\n", cli_magic[i].descr); |
| return cli_magic[i].type; |
| } |
| } |
| } |
| |
| /* improve or drop this code |
| * https://wwws.clamav.net/bugzilla/show_bug.cgi?id=373 |
| * |
| buflen < 25 ? (len = buflen) : (len = 25); |
| for(i = 0; i < len; i++) |
| if(!iscntrl(buf[i]) && !isprint(buf[i]) && !internat[buf[i] & 0xff]) { |
| text = 0; |
| break; |
| } |
| */ |
| return text ? CL_TYPE_UNKNOWN_TEXT : CL_TYPE_UNKNOWN_DATA; |
| } |
| |
| int is_tar(unsigned char *buf, unsigned int nbytes); |
| |
| cli_file_t cli_filetype2(int desc, const struct cl_engine *engine) |
| { |
| unsigned char smallbuff[MAGIC_BUFFER_SIZE + 1], *decoded, *bigbuff; |
| int bread, sret; |
| cli_file_t ret = CL_TYPE_UNKNOWN_DATA; |
| struct cli_matcher *root; |
| struct cli_ac_data mdata; |
| |
| |
| memset(smallbuff, 0, sizeof(smallbuff)); |
| if((bread = read(desc, smallbuff, MAGIC_BUFFER_SIZE)) > 0) |
| ret = cli_filetype(smallbuff, bread); |
| |
| if(engine && ret == CL_TYPE_UNKNOWN_TEXT) { |
| root = engine->root[0]; |
| if(!root) |
| return ret; |
| |
| if(cli_ac_initdata(&mdata, root->ac_partsigs, AC_DEFAULT_TRACKLEN)) |
| return ret; |
| |
| sret = cli_ac_scanbuff(smallbuff, bread, NULL, engine->root[0], &mdata, 1, 0, 0, -1, NULL); |
| |
| cli_ac_freedata(&mdata); |
| |
| if(sret >= CL_TYPENO) { |
| ret = sret; |
| } else { |
| if(cli_ac_initdata(&mdata, root->ac_partsigs, AC_DEFAULT_TRACKLEN)) |
| return ret; |
| |
| decoded = (unsigned char *) cli_utf16toascii((char *) smallbuff, bread); |
| if(decoded) { |
| sret = cli_ac_scanbuff(decoded, strlen((char *) decoded), NULL, engine->root[0], &mdata, 1, 0, 0, -1, NULL); |
| free(decoded); |
| if(sret == CL_TYPE_HTML) |
| ret = CL_TYPE_HTML_UTF16; |
| } |
| cli_ac_freedata(&mdata); |
| |
| if((((struct cli_dconf*) engine->dconf)->phishing & PHISHING_CONF_ENTCONV) && ret != CL_TYPE_HTML_UTF16) { |
| struct entity_conv conv; |
| const size_t conv_size = 2*bread < 256 ? 256 : 2*bread; |
| |
| if(init_entity_converter(&conv,UNKNOWN,conv_size) == 0) { |
| int end = 0; |
| m_area_t area; |
| area.buffer = (unsigned char *) smallbuff; |
| area.length = bread; |
| area.offset = 0; |
| |
| while(!end) { |
| if(cli_ac_initdata(&mdata, root->ac_partsigs, AC_DEFAULT_TRACKLEN)) |
| return ret; |
| |
| decoded = encoding_norm_readline(&conv, NULL, &area, bread); |
| |
| if(decoded) { |
| sret = cli_ac_scanbuff(decoded, strlen((const char *) decoded), NULL, engine->root[0], &mdata, 1, 0, 0, -1, NULL); |
| free(decoded); |
| if(sret == CL_TYPE_HTML) { |
| ret = CL_TYPE_HTML; |
| end = 1; |
| } |
| } else |
| end = 1; |
| |
| cli_ac_freedata(&mdata); |
| } |
| |
| entity_norm_done(&conv); |
| |
| } else { |
| cli_warnmsg("cli_filetype2: Error initializing entity converter\n"); |
| } |
| } |
| } |
| } |
| |
| if(ret == CL_TYPE_UNKNOWN_DATA || ret == CL_TYPE_UNKNOWN_TEXT) { |
| |
| if(!(bigbuff = (unsigned char *) cli_calloc(37638 + 1, sizeof(unsigned char)))) |
| return ret; |
| |
| lseek(desc, 0, SEEK_SET); |
| if((bread = read(desc, bigbuff, 37638)) > 0) { |
| |
| bigbuff[bread] = 0; |
| |
| switch(is_tar(bigbuff, bread)) { |
| case 1: |
| ret = CL_TYPE_OLD_TAR; |
| cli_dbgmsg("Recognized old fashioned tar file\n"); |
| break; |
| case 2: |
| ret = CL_TYPE_POSIX_TAR; |
| cli_dbgmsg("Recognized POSIX tar file\n"); |
| break; |
| } |
| } |
| |
| if(ret == CL_TYPE_UNKNOWN_DATA || ret == CL_TYPE_UNKNOWN_TEXT) { |
| |
| if(!memcmp(bigbuff + 32769, "CD001" , 5) || !memcmp(bigbuff + 37633, "CD001" , 5)) { |
| cli_dbgmsg("Recognized ISO 9660 CD-ROM data\n"); |
| ret = CL_TYPE_DATA; |
| } else if(!memcmp(bigbuff + 32776, "CDROM" , 5)) { |
| cli_dbgmsg("Recognized High Sierra CD-ROM data\n"); |
| ret = CL_TYPE_DATA; |
| } |
| } |
| |
| free(bigbuff); |
| } |
| |
| return ret; |
| } |
| |
| int cli_addtypesigs(struct cl_engine *engine) |
| { |
| int i, ret; |
| struct cli_matcher *root; |
| |
| |
| if(!engine->root[0]) { |
| cli_dbgmsg("cli_addtypesigs: Need to allocate AC trie in engine->root[0]\n"); |
| root = engine->root[0] = (struct cli_matcher *) cli_calloc(1, sizeof(struct cli_matcher)); |
| if(!root) { |
| cli_errmsg("cli_addtypesigs: Can't initialise AC pattern matcher\n"); |
| return CL_EMEM; |
| } |
| |
| if((ret = cli_ac_init(root, cli_ac_mindepth, cli_ac_maxdepth))) { |
| /* No need to free previously allocated memory here - all engine |
| * elements will be properly freed by cl_free() |
| */ |
| cli_errmsg("cli_addtypesigs: Can't initialise AC pattern matcher\n"); |
| return ret; |
| } |
| } else { |
| root = engine->root[0]; |
| } |
| |
| for(i = 0; cli_smagic[i].sig; i++) { |
| if((ret = cli_parse_add(root, cli_smagic[i].descr, cli_smagic[i].sig, cli_smagic[i].type, NULL, 0))) { |
| cli_errmsg("cli_addtypesigs: Problem adding signature for %s\n", cli_smagic[i].descr); |
| return ret; |
| } |
| } |
| |
| return 0; |
| } |
