added '(W)' special character to match fullword (non-alnum)

libclamav/matcher-ac.c

@@ -50,15 +50,20 @@
 #define AC_SPECIAL_ALT_STR	2
 #define AC_SPECIAL_LINE_MARKER	3
 #define AC_SPECIAL_BOUNDARY	4
-
-#define AC_BOUNDARY_LEFT		1
-#define AC_BOUNDARY_LEFT_NEGATIVE	2
-#define AC_BOUNDARY_RIGHT		4
-#define AC_BOUNDARY_RIGHT_NEGATIVE	8
-#define AC_LINE_MARKER_LEFT		16
-#define AC_LINE_MARKER_LEFT_NEGATIVE	32
-#define AC_LINE_MARKER_RIGHT		64
-#define AC_LINE_MARKER_RIGHT_NEGATIVE	128
+#define AC_SPECIAL_WORD_MARKER	5
+
+#define AC_BOUNDARY_LEFT		0x0001
+#define AC_BOUNDARY_LEFT_NEGATIVE	0x0002
+#define AC_BOUNDARY_RIGHT		0x0004
+#define AC_BOUNDARY_RIGHT_NEGATIVE	0x0008
+#define AC_LINE_MARKER_LEFT		0x0010
+#define AC_LINE_MARKER_LEFT_NEGATIVE	0x0020
+#define AC_LINE_MARKER_RIGHT		0x0040
+#define AC_LINE_MARKER_RIGHT_NEGATIVE	0x0080
+#define AC_WORD_MARKER_LEFT		0x0100
+#define AC_WORD_MARKER_LEFT_NEGATIVE	0x0200
+#define AC_WORD_MARKER_RIGHT		0x0400
+#define AC_WORD_MARKER_RIGHT_NEGATIVE	0x0800
 
 static char boundary[256] = {
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 
@@ -890,6 +895,11 @@ int cli_ac_chklsig(const char *expr, const char *end, uint32_t *lsigcnt, unsigne
 			match = !special->negative;					\
 		    break;								\
 											\
+		case AC_SPECIAL_WORD_MARKER:						\
+		    if(!isalnum(b))							\
+			match = !special->negative;					\
+		    break;								\
+											\
 		default:								\
 		    cli_errmsg("ac_findmatch: Unknown special\n");			\
 		    match = 0;								\
@@ -970,6 +980,24 @@ inline static int ac_findmatch(const unsigned char *buffer, uint32_t offset, uin
             return 0;
     }
 
+    if(pattern->boundary & AC_WORD_MARKER_LEFT) {
+        match = !!(pattern->boundary & AC_WORD_MARKER_LEFT_NEGATIVE);
+        if(!fileoffset || (offset && !isalnum(buffer[offset - 1])))
+            match = !match;
+
+        if(!match)
+            return 0;
+    }
+
+    if(pattern->boundary & AC_WORD_MARKER_RIGHT) {
+        match = !!(pattern->boundary & AC_WORD_MARKER_RIGHT_NEGATIVE);
+        if((length <= SCANBUFF) && (bp == length || !isalnum(buffer[offset - 1])))
+            match = !match;
+
+        if(!match)
+            return 0;
+    }
+
     if(!(pattern->ch[1] & CLI_MATCH_IGNORE)) {
         bp += pattern->ch_mindist[1];
 
@@ -1836,6 +1864,20 @@ int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hex
 		    mpool_free(root->mempool, newspecial);
 		    continue;
 		}
+	    } else if(!strcmp(pt, "W")) {
+		if(!*start) {
+		    new->boundary |= AC_WORD_MARKER_RIGHT;
+		    if(newspecial->negative)
+			new->boundary |= AC_WORD_MARKER_RIGHT_NEGATIVE;
+		    mpool_free(root->mempool, newspecial);
+		    continue;
+		} else if(pt - 1 == hexcpy) {
+		    new->boundary |= AC_WORD_MARKER_LEFT;
+		    if(newspecial->negative)
+			new->boundary |= AC_WORD_MARKER_LEFT_NEGATIVE;
+		    mpool_free(root->mempool, newspecial);
+		    continue;
+		}
 	    }
 	    cli_strlcat(hexnew, "()", hexnewsz);
 	    new->special++;
@@ -1854,10 +1896,8 @@ int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hex
 		newspecial->type = AC_SPECIAL_BOUNDARY;
 	    } else if(!strcmp(pt, "L")) {
 		newspecial->type = AC_SPECIAL_LINE_MARKER;
-	    /*
-	    } else if(strcmp(pt, "W")) {
-		newspecial->type = AC_SPECIAL_WHITE;
-	    */
+	    } else if(!strcmp(pt, "W")) {
+		newspecial->type = AC_SPECIAL_WORD_MARKER;
 	    } else {
 		newspecial->num = 1;
 		for(i = 0; i < strlen(pt); i++)

libclamav/matcher-ac.h

@@ -54,7 +54,7 @@ struct cli_ac_special {
     unsigned char *str;
     struct cli_ac_special *next;
     uint16_t len, num;
-    uint8_t type, negative;
+    uint16_t type, negative;
 };
 
 struct cli_ac_patt {