fix infinite loop in cl_free(); check file size

git-svn: trunk@699

clamav-devel/ChangeLog

@@ -1,3 +1,8 @@
+Wed Jul 28 01:10:46 CEST 2004 (tk)
+----------------------------------
+  * libclamav: md5: fix possible infinite loop in cl_free(); check file
+	       size to eliminate potential false positive alerts
+
 Mon Jul 26 14:24:24 BST 2004 (njh)
 ----------------------------------
   * clamav-milter:	%v in the template file handling is now replaced

clamav-devel/libclamav/clamav.h

@@ -99,6 +99,7 @@ struct cli_ac_node {
 
 struct cli_md5_node {
     char *virname, *viralias, *md5;
+    unsigned int size;
     struct cli_md5_node *next;
 };
 

clamav-devel/libclamav/matcher.c

@@ -178,9 +178,19 @@ int cli_scandesc(int desc, const char **virname, long int *scanned, const struct
 	md5_finish_ctx(&ctx, &md5buff);
 
 	if((md5_node = cli_vermd5(md5buff, root))) {
-	    if(virname)
-		*virname = md5_node->virname;
-	    return CL_VIRUS;
+		struct stat sb;
+
+	    if(fstat(desc, &sb))
+		return CL_EIO;
+
+	    if(sb.st_size != md5_node->size) {
+		cli_warnmsg("Detected false positive MD5 match. Please report.\n");
+	    } else {
+		if(virname)
+		    *virname = md5_node->virname;
+
+		return CL_VIRUS;
+	    }
 	}
     }
 
@@ -208,7 +218,8 @@ void cl_free(struct cl_node *root)
 
     if(root->md5_hlist) {
 	for(i = 0; i < 256; i++) {
-	    while((pt = root->md5_hlist[i])) {
+	    pt = root->md5_hlist[i];
+	    while(pt) {
 		h = pt;
 		pt = pt->next;
 		free(h);

clamav-devel/libclamav/readdb.c

@@ -484,14 +484,23 @@ static int cli_loadhdb(FILE *fd, struct cl_node **root, int *virnum)
 	}
 	free(pt);
 
-	if(!(new->virname = cli_strtok(buffer, 1, ":"))) {
+	if(!(pt = cli_strtok(buffer, 1, ":"))) {
+	    free(new->md5);
+	    free(new);
+	    ret = CL_EMALFDB;
+	    break;
+	}
+	new->size = atoi(pt);
+	free(pt);
+
+	if(!(new->virname = cli_strtok(buffer, 2, ":"))) {
 	    free(new->md5);
 	    free(new);
 	    ret = CL_EMALFDB;
 	    break;
 	}
 
-	new->viralias = cli_strtok(buffer, 1, ":"); /* aliases are optional */
+	new->viralias = cli_strtok(buffer, 3, ":"); /* aliases are optional */
 
 	if(!(*root)->md5_hlist) {
 	    cli_dbgmsg("Initializing md5 list structure\n");

clamav-devel/libclamav/scanners.c

@@ -661,9 +661,6 @@ static int cli_scanhtml(int desc, const char **virname, long int *scanned, const
 
 #ifdef HAVE_MMAP
     membuff = mmap(NULL, statbuf.st_size, PROT_READ, MAP_PRIVATE, desc, 0);
-#else /* FIXME */
-    return CL_CLEAN;
-#endif
 
     /* TODO: do file operations if mmap fails */
     if(membuff == MAP_FAILED) {
@@ -690,6 +687,9 @@ static int cli_scanhtml(int desc, const char **virname, long int *scanned, const
 
     free(newbuff);
     return ret;
+#else /* FIXME */
+    return CL_CLEAN;
+#endif
 }
 
 static int cli_scandir(const char *dirname, const char **virname, long int *scanned, const struct cl_node *root, const struct cl_limits *limits, int options, int *arec, int *mrec)