Additional variable type changes for correctness and to silence warnings. A handful of other minor changes to silence warnings. Corrected a number of function definitions so they return cl_error_t rather than int.

pull/111/head
Micah Snyder 6 years ago
parent 53e3045bf4
commit 97a0647e88
  1. 4
      libclamav/asn1.c
  2. 6
      libclamav/bytecode.c
  3. 7
      libclamav/entconv.c
  4. 2
      libclamav/htmlnorm.c
  5. 70
      libclamav/hwp.c
  6. 20
      libclamav/hwp.h
  7. 21
      libclamav/matcher-pcre.c
  8. 10
      libclamav/mbox.c
  9. 15
      libclamav/msdoc.c
  10. 19
      libclamav/msxml.c
  11. 2
      libclamav/msxml.h
  12. 14
      libclamav/msxml_parser.h
  13. 18
      libclamav/ooxml.c
  14. 52
      libclamav/pdfdecode.c
  15. 5
      libclamav/pdfng.c
  16. 4
      libclamav/xar.c
  17. 3
      shared/queue.h
  18. 5
      sigtool/vba.c

@ -364,13 +364,13 @@ static int asn1_expect_hash_algo(fmap_t *map, const void **asn1data, unsigned in
unsigned int avail;
int ret;
if (ret = asn1_expect_objtype(map, *asn1data, asn1len, &obj, ASN1_TYPE_SEQUENCE)) {
if (0 != (ret = asn1_expect_objtype(map, *asn1data, asn1len, &obj, ASN1_TYPE_SEQUENCE))) {
cli_dbgmsg("asn1_expect_hash_algo: expected SEQUENCE to start AlgorithmIdentifier\n");
return ret;
}
avail = obj.size;
*asn1data = obj.next;
if (ret = asn1_expect_objtype(map, obj.content, &avail, &obj, ASN1_TYPE_OBJECT_ID)) {
if (0 != (ret = asn1_expect_objtype(map, obj.content, &avail, &obj, ASN1_TYPE_OBJECT_ID))) {
cli_dbgmsg("asn1_expect_hash_algo: unexpected object type inside AlgorithmIdentifier SET\n");
return ret;
}

@ -1470,7 +1470,7 @@ void cli_sigperf_print()
continue;
}
if (name)
name_len = strlen(name);
name_len = (int)strlen(name);
else
name_len = 0;
if (name_len > max_name_len)
@ -1483,8 +1483,8 @@ void cli_sigperf_print()
elem++;
elems++;
}
if (max_name_len < strlen("Bytecode name"))
max_name_len = strlen("Bytecode name");
if (max_name_len < (int)strlen("Bytecode name"))
max_name_len = (int)strlen("Bytecode name");
cli_qsort(stats, elems, sizeof(struct sigperf_elem), sigelem_comp);

@ -157,12 +157,17 @@ static size_t encoding_bytes(const char* fromcode, enum encodings* encoding)
static iconv_t iconv_open(const char* tocode, const char* fromcode)
{
UNUSEDPARAM(tocode);
iconv_t iconv = cli_malloc(sizeof(*iconv));
if (!iconv)
return NULL;
cli_dbgmsg(MODULE_NAME "Internal iconv\n");
/* TODO: check that tocode is UTF16BE */
iconv->size = encoding_bytes(fromcode, &iconv->encoding);
return iconv;
}
@ -685,7 +690,7 @@ static int in_iconv_u16(const m_area_t* in_m_area, iconv_t* iconv_struct, m_area
return 0;
}
/* convert encoding conv->tmp_area. conv->out_area */
alignfix = inleft % 4; /* iconv gives an error if we give him 3 bytes to convert,
alignfix = inleft % 4; /* iconv gives an error if we give him 3 bytes to convert,
and we are using ucs4, ditto for utf16, and 1 byte*/
inleft -= alignfix;

@ -91,7 +91,7 @@ typedef enum {
typedef struct file_buff_tag {
int fd;
unsigned char buffer[HTML_FILE_BUFF_LEN];
int length;
size_t length;
} file_buff_t;
struct tag_contents {

@ -72,8 +72,9 @@
#define hwpml_debug(...) ;
#endif
typedef int (*hwp_cb)(void *cbdata, int fd, const char *filepath, cli_ctx *ctx);
static int decompress_and_callback(cli_ctx *ctx, fmap_t *input, off_t at, size_t len, const char *parent, hwp_cb cb, void *cbdata)
typedef cl_error_t (*hwp_cb)(void *cbdata, int fd, const char *filepath, cli_ctx *ctx);
static cl_error_t decompress_and_callback(cli_ctx *ctx, fmap_t *input, off_t at, size_t len, const char *parent, hwp_cb cb, void *cbdata)
{
cl_error_t ret = CL_SUCCESS;
int zret, ofd;
@ -197,8 +198,8 @@ dc_end:
#define HANGUL_NUMERICAL 0
static char *convert_hstr_to_utf8(const char *begin, size_t sz, const char *parent, cl_error_t *ret)
{
int rc = CL_SUCCESS;
char *res = NULL;
cl_error_t rc = CL_SUCCESS;
char *res = NULL;
#if HANGUL_NUMERICAL && HAVE_ICONV
char *p1, *p2, *inbuf = NULL, *outbuf = NULL;
size_t inlen, outlen;
@ -275,7 +276,7 @@ static char *convert_hstr_to_utf8(const char *begin, size_t sz, const char *pare
}
/*** HWPOLE2 ***/
int cli_scanhwpole2(cli_ctx *ctx)
cl_error_t cli_scanhwpole2(cli_ctx *ctx)
{
fmap_t *map = *ctx->fmap;
uint32_t usize, asize;
@ -298,7 +299,7 @@ int cli_scanhwpole2(cli_ctx *ctx)
/*** HWP5 ***/
int cli_hwp5header(cli_ctx *ctx, hwp5_header_t *hwp5)
cl_error_t cli_hwp5header(cli_ctx *ctx, hwp5_header_t *hwp5)
{
if (!ctx || !hwp5)
return CL_ENULLARG;
@ -369,7 +370,7 @@ int cli_hwp5header(cli_ctx *ctx, hwp5_header_t *hwp5)
return CL_SUCCESS;
}
static int hwp5_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
static cl_error_t hwp5_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
{
UNUSEDPARAM(cbdata);
@ -379,7 +380,7 @@ static int hwp5_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
return cli_magic_scandesc(fd, filepath, ctx);
}
int cli_scanhwp5_stream(cli_ctx *ctx, hwp5_header_t *hwp5, char *name, int fd, const char *filepath)
cl_error_t cli_scanhwp5_stream(cli_ctx *ctx, hwp5_header_t *hwp5, char *name, int fd, const char *filepath)
{
hwp5_debug("HWP5.x: NAME: %s\n", name ? name : "(NULL)");
@ -403,7 +404,7 @@ int cli_scanhwp5_stream(cli_ctx *ctx, hwp5_header_t *hwp5, char *name, int fd, c
/* DocInfo JSON Handling */
STATBUF statbuf;
fmap_t *input;
int ret;
cl_error_t ret;
hwp5_debug("HWP5.x: Sending %s for decompress and scan\n", name);
@ -509,10 +510,10 @@ struct hwp3_docsummary_entry {
#define PCSD_SIZE 0 /* offset 0 (2 bytes) - size of characters */
#define PCSD_PROP 26 /* offset 26 (1 byte) - properties */
static inline int parsehwp3_docinfo(cli_ctx *ctx, off_t offset, struct hwp3_docinfo *docinfo)
static inline cl_error_t parsehwp3_docinfo(cli_ctx *ctx, off_t offset, struct hwp3_docinfo *docinfo)
{
const uint8_t *hwp3_ptr;
int iret;
cl_error_t iret;
//TODO: use fmap_readn?
if (!(hwp3_ptr = fmap_need_off_once(*ctx->fmap, offset, HWP3_DOCINFO_SIZE))) {
@ -670,14 +671,16 @@ static inline cl_error_t parsehwp3_docsummary(cli_ctx *ctx, off_t offset)
#define HWP3_PSPECIAL_VERIFY(map, offset, second, id, match)
#endif
static inline int parsehwp3_paragraph(cli_ctx *ctx, fmap_t *map, int p, int level, off_t *roffset, int *last)
static inline cl_error_t parsehwp3_paragraph(cli_ctx *ctx, fmap_t *map, int p, uint32_t level, off_t *roffset, int *last)
{
cl_error_t ret = CL_SUCCESS;
off_t offset = *roffset;
off_t new_offset;
uint16_t nchars, nlines, content;
uint8_t ppfs, ifsc, cfsb;
uint16_t i;
int c, l, sp = 0, term = 0, ret = CL_SUCCESS;
int c, l, sp = 0, term = 0;
#if HWP3_VERIFY
uint16_t match;
#endif
@ -695,8 +698,8 @@ static inline int parsehwp3_paragraph(cli_ctx *ctx, fmap_t *map, int p, int leve
uint8_t pcsd_prop;
#endif
hwp3_debug("HWP3.x: recursion level: %d\n", level);
hwp3_debug("HWP3.x: Paragraph[%d, %d] starts @ offset %llu\n", level, p, (long long unsigned)offset);
hwp3_debug("HWP3.x: recursion level: %u\n", level);
hwp3_debug("HWP3.x: Paragraph[%u, %d] starts @ offset %llu\n", level, p, (long long unsigned)offset);
if (level >= ctx->engine->maxrechwp3)
return CL_EMAXREC;
@ -1515,11 +1518,13 @@ static inline int parsehwp3_paragraph(cli_ctx *ctx, fmap_t *map, int p, int leve
return CL_SUCCESS;
}
static inline int parsehwp3_infoblk_1(cli_ctx *ctx, fmap_t *dmap, off_t *offset, int *last)
static inline cl_error_t parsehwp3_infoblk_1(cli_ctx *ctx, fmap_t *dmap, off_t *offset, int *last)
{
cl_error_t ret = CL_SUCCESS;
uint32_t infoid, infolen;
fmap_t *map = (dmap ? dmap : *ctx->fmap);
int i, count, ret = CL_SUCCESS;
int i, count;
long long unsigned infoloc = (long long unsigned)(*offset);
#if HWP3_DEBUG
char field[HWP3_FIELD_LENGTH];
@ -1751,11 +1756,12 @@ static inline int parsehwp3_infoblk_1(cli_ctx *ctx, fmap_t *dmap, off_t *offset,
return ret;
}
static int hwp3_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
static cl_error_t hwp3_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
{
cl_error_t ret = CL_SUCCESS;
fmap_t *map, *dmap;
off_t offset, start, new_offset;
int i, p = 0, last = 0, ret = CL_SUCCESS;
int i, p = 0, last = 0;
uint16_t nstyles;
#if HAVE_JSON
json_object *fonts;
@ -1859,8 +1865,8 @@ static int hwp3_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
/* scan the uncompressed stream - both compressed and uncompressed cases [ALLMATCH] */
if ((ret == CL_SUCCESS) || ((SCAN_ALLMATCHES) && (ret == CL_VIRUS))) {
int subret = ret;
size_t dlen = offset - start;
cl_error_t subret = ret;
size_t dlen = offset - start;
ret = cli_map_scandesc(map, start, dlen, ctx, CL_TYPE_ANY);
//ret = cli_map_scandesc(map, 0, 0, ctx, CL_TYPE_ANY);
@ -1874,10 +1880,11 @@ static int hwp3_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
return ret;
}
int cli_scanhwp3(cli_ctx *ctx)
cl_error_t cli_scanhwp3(cli_ctx *ctx)
{
cl_error_t ret = CL_SUCCESS;
struct hwp3_docinfo docinfo;
int ret = CL_SUCCESS;
off_t offset = 0, new_offset = 0;
fmap_t *map = *ctx->fmap;
@ -1969,7 +1976,7 @@ static const struct key_entry hwpml_keys[] = {
static size_t num_hwpml_keys = sizeof(hwpml_keys) / sizeof(struct key_entry);
/* binary streams needs to be base64-decoded then decompressed if fields are set */
static int hwpml_scan_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
static cl_error_t hwpml_scan_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ctx)
{
UNUSEDPARAM(cbdata);
@ -1979,9 +1986,11 @@ static int hwpml_scan_cb(void *cbdata, int fd, const char *filepath, cli_ctx *ct
return cli_magic_scandesc(fd, filepath, ctx);
}
static int hwpml_binary_cb(int fd, const char *filepath, cli_ctx *ctx, int num_attribs, struct attrib_entry *attribs, void *cbdata)
static cl_error_t hwpml_binary_cb(int fd, const char *filepath, cli_ctx *ctx, int num_attribs, struct attrib_entry *attribs, void *cbdata)
{
int i, ret, df = 0, com = 0, enc = 0;
cl_error_t ret;
int i, df = 0, com = 0, enc = 0;
char *tempfile;
UNUSEDPARAM(cbdata);
@ -2106,13 +2115,14 @@ hwpml_end:
}
#endif /* HAVE_LIBXML2 */
int cli_scanhwpml(cli_ctx *ctx)
cl_error_t cli_scanhwpml(cli_ctx *ctx)
{
cl_error_t ret = CL_SUCCESS;
#if HAVE_LIBXML2
struct msxml_cbdata cbdata;
struct msxml_ctx mxctx;
xmlTextReaderPtr reader = NULL;
int ret = CL_SUCCESS;
cli_dbgmsg("in cli_scanhwpml()\n");
@ -2143,7 +2153,7 @@ int cli_scanhwpml(cli_ctx *ctx)
UNUSEDPARAM(ctx);
cli_dbgmsg("in cli_scanhwpml()\n");
cli_dbgmsg("cli_scanhwpml: scanning hwpml documents requires libxml2!\n");
return CL_SUCCESS;
#endif
return ret;
}

@ -1,19 +1,19 @@
/*
* HWP Stuff
*
*
* Copyright (C) 2015-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
*
*
* Authors: Kevin Lin
*
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License version 2 as published by the
* Free Software Foundation.
*
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 51
* Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@ -47,16 +47,16 @@ typedef struct hwp5_header {
} hwp5_header_t;
/* HWP EMBEDDED OLE2 - 4-byte prefixed OLE2 */
int cli_scanhwpole2(cli_ctx *ctx);
cl_error_t cli_scanhwpole2(cli_ctx *ctx);
/* HWP 5.0 - OLE2 */
int cli_hwp5header(cli_ctx *ctx, hwp5_header_t *hwp5);
int cli_scanhwp5_stream(cli_ctx *ctx, hwp5_header_t *hwp5, char *name, int fd, const char *filepath);
cl_error_t cli_hwp5header(cli_ctx *ctx, hwp5_header_t *hwp5);
cl_error_t cli_scanhwp5_stream(cli_ctx *ctx, hwp5_header_t *hwp5, char *name, int fd, const char *filepath);
/* HWP 3.0 - UNIQUE FORMAT */
int cli_scanhwp3(cli_ctx *ctx);
cl_error_t cli_scanhwp3(cli_ctx *ctx);
/* HWPML - SINGLE XML DOCUMENT (similar to MSXML) */
int cli_scanhwpml(cli_ctx *ctx);
cl_error_t cli_scanhwpml(cli_ctx *ctx);
#endif /* __HWP_H__ */

@ -153,7 +153,7 @@ void cli_pcre_perf_print()
continue;
}
if (name)
name_len = strlen(name);
name_len = (int)strlen(name);
else
name_len = 0;
if (name_len > max_name_len)
@ -166,8 +166,8 @@ void cli_pcre_perf_print()
elem++;
elems++;
}
if (max_name_len < strlen("PCRE Expression"))
max_name_len = strlen("PCRE Expression");
if (max_name_len < (int)strlen("PCRE Expression"))
max_name_len = (int)strlen("PCRE Expression");
cli_qsort(stats, elems, sizeof(struct sigperf_elem), sigelem_comp);
@ -238,11 +238,11 @@ cl_error_t cli_pcre_addpatt(struct cli_matcher *root, const char *virname, const
}
if (lsigid) {
if (rssigs > lsigid[1]) {
if ((uint32_t)rssigs > lsigid[1]) {
cli_errmsg("cli_pcre_addpatt: regex subsig %d logical trigger refers to subsequent subsig %d\n", lsigid[1], rssigs);
return CL_EMALFDB;
}
if (rssigs == lsigid[1]) {
if ((uint32_t)rssigs == lsigid[1]) {
cli_errmsg("cli_pcre_addpatt: regex subsig %d logical trigger is self-referential\n", lsigid[1]);
return CL_EMALFDB;
}
@ -577,6 +577,8 @@ int cli_pcre_qoff(struct cli_pcre_meta *pm, uint32_t length, uint32_t *adjbuffer
cl_error_t cli_pcre_scanbuf(const unsigned char *buffer, uint32_t length, const char **virname, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, const struct cli_pcre_off *data, cli_ctx *ctx)
{
cl_error_t ret = CL_SUCCESS;
struct cli_pcre_meta *pm = NULL;
struct cli_pcre_data *pd;
struct cli_pcre_results p_res;
@ -585,7 +587,8 @@ cl_error_t cli_pcre_scanbuf(const unsigned char *buffer, uint32_t length, const
unsigned int i, evalcnt = 0;
uint64_t evalids = 0;
uint32_t global, encompass, rolling;
int rc = 0, offset = 0, ret = CL_SUCCESS, options = 0;
int rc = 0, options = 0;
uint32_t offset = 0;
uint8_t viruses_found = 0;
if ((root->pcre_metas == 0) || (!root->pcre_metatable) || (ctx && ctx->dconf && !(ctx->dconf->pcre & PCRE_CONF_SUPPORT)))
@ -746,7 +749,7 @@ cl_error_t cli_pcre_scanbuf(const unsigned char *buffer, uint32_t length, const
* NOTE: misses matches starting within the last match; TODO: start from start of last match? */
offset = p_res.match[1];
} while (global && rc > 0 && offset < adjlength);
} while ((global && rc > 0) && (offset < adjlength));
/* handle error code */
if (rc < 0 && p_res.err != CL_SUCCESS) {
@ -772,6 +775,10 @@ void cli_pcre_freemeta(struct cli_matcher *root, struct cli_pcre_meta *pm)
if (!pm)
return;
#ifndef USE_MPOOL
UNUSEDPARAM(root);
#endif
if (pm->trigger) {
MPOOL_FREE(root->mempool, pm->trigger);
pm->trigger = NULL;

@ -207,7 +207,7 @@ static int cli_parse_mbox(const char *dir, cli_ctx *ctx);
static message *parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821Table, const char *firstLine, const char *dir);
static message *parseEmailHeaders(message *m, const table_t *rfc821Table);
static int parseEmailHeader(message *m, const char *line, const table_t *rfc821Table);
static int parseMHTMLComment(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata);
static cl_error_t parseMHTMLComment(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata);
static mbox_status parseRootMHTML(mbox_ctx *mctx, message *m, text *t);
static mbox_status parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int recursion_level);
static int boundaryStart(const char *line, const char *boundary);
@ -1112,13 +1112,13 @@ static size_t num_mhtml_comment_keys = sizeof(mhtml_comment_keys) / sizeof(struc
* Attempts to leverage msxml parser, cannot operate without LIBXML2.
* This function is only used for Preclassification JSON.
*/
static int
parseMHTMLComment(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata)
static cl_error_t parseMHTMLComment(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata)
{
cl_error_t ret = CL_SUCCESS;
#if HAVE_LIBXML2
const char *xmlsrt, *xmlend;
xmlTextReaderPtr reader;
int ret = CL_SUCCESS;
UNUSEDPARAM(cbdata);
UNUSEDPARAM(wrkjobj);
@ -1161,7 +1161,7 @@ parseMHTMLComment(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata
cli_dbgmsg("in parseMHTMLComment\n");
cli_dbgmsg("parseMHTMLComment: parsing html xml-comments requires libxml2!\n");
#endif
return CL_SUCCESS;
return ret;
}
/*

@ -1,20 +1,20 @@
/*
* Extract component parts of OLE2 files (e.g. MS Office Documents)
*
*
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2007-2013 Sourcefire, Inc.
*
*
* Authors: Kevin Lin
*
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License version 2 as published by the
* Free Software Foundation.
*
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 51
* Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@ -65,7 +65,7 @@ ole2_convert_utf(summary_ctx_t *sctx, char *begin, size_t sz, const char *encodi
/* applies in the both case */
if (sctx->codepage == 20127 || sctx->codepage == 65001) {
char *track;
int bcnt, scnt;
size_t bcnt, scnt;
outbuf = cli_calloc(1, sz + 1);
if (!(outbuf))
@ -87,8 +87,7 @@ ole2_convert_utf(summary_ctx_t *sctx, char *begin, size_t sz, const char *encodi
}
if (bcnt != scnt) {
cli_dbgmsg("ole2_convert_utf: cleaning out %d bytes from incomplete "
"utf-8 character length %d\n",
cli_dbgmsg("ole2_convert_utf: cleaning out %zu bytes from incomplete utf-8 character length %zu\n",
bcnt, scnt);
for (; bcnt > 0; bcnt--, track++)
*track = '\0';

@ -1,20 +1,20 @@
/*
* Extract component parts of MS XML files (e.g. MS Office 2003 XML Documents)
*
*
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2007-2013 Sourcefire, Inc.
*
*
* Authors: Kevin Lin
*
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License version 2 as published by the
* Free Software Foundation.
*
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 51
* Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@ -81,7 +81,7 @@ static inline size_t msxml_read_cb_new_window(struct msxml_cbdata *cbdata)
off_t new_mappos;
size_t bytes;
if (cbdata->mappos == cbdata->map->len) {
if ((size_t)cbdata->mappos == cbdata->map->len) {
cli_msxmlmsg("msxml_read_cb: fmap REALLY EOF\n");
return 0;
}
@ -116,11 +116,12 @@ static inline size_t msxml_read_cb_new_window(struct msxml_cbdata *cbdata)
return bytes;
}
int msxml_read_cb(void *ctx, char *buffer, int len)
int msxml_read_cb(void *ctx, char *buffer, int buffer_len)
{
struct msxml_cbdata *cbdata = (struct msxml_cbdata *)ctx;
size_t wbytes, rbytes;
int winret;
size_t len = (size_t)buffer_len;
cli_msxmlmsg("msxml_read_cb called\n");
@ -130,7 +131,7 @@ int msxml_read_cb(void *ctx, char *buffer, int len)
return winret;
}
cli_msxmlmsg("msxml_read_cb: requested %d bytes from offset %llu\n", len, (long long unsigned)(cbdata->mappos + cbdata->winpos));
cli_msxmlmsg("msxml_read_cb: requested %zu bytes from offset %llu\n", len, (long long unsigned)(cbdata->mappos + cbdata->winpos));
wbytes = 0;
rbytes = cbdata->winsize - cbdata->winpos;
@ -165,7 +166,7 @@ int msxml_read_cb(void *ctx, char *buffer, int len)
read_from = cbdata->window + cbdata->winpos;
state = &(cbdata->state);
while (rbytes > 0 && wbytes < len) {
while ((rbytes > 0) && (wbytes < len)) {
switch (*state) {
case MSXML_STATE_NORMAL:
if ((*read_from) == '&')

@ -48,7 +48,7 @@ struct msxml_cbdata {
size_t winsize;
};
int msxml_read_cb(void *ctx, char *buffer, int len);
int msxml_read_cb(void *ctx, char *buffer, int buffer_len);
cl_error_t cli_scanmsxml(cli_ctx *ctx);
#endif /* __MSXML_H */

@ -1,20 +1,20 @@
/*
* Extract component parts of various MS XML files (e.g. MS Office 2003 XML Documents)
*
*
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2007-2013 Sourcefire, Inc.
*
*
* Authors: Kevin Lin
*
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License version 2 as published by the
* Free Software Foundation.
*
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 51
* Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@ -75,8 +75,8 @@ struct key_entry {
uint32_t type;
};
typedef int (*msxml_scan_cb)(int fd, const char *filepath, cli_ctx *ctx, int num_attribs, struct attrib_entry *attribs, void *cbdata);
typedef int (*msxml_comment_cb)(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata);
typedef cl_error_t (*msxml_scan_cb)(int fd, const char *filepath, cli_ctx *ctx, int num_attribs, struct attrib_entry *attribs, void *cbdata);
typedef cl_error_t (*msxml_comment_cb)(const char *comment, cli_ctx *ctx, void *wrkjobj, void *cbdata);
struct msxml_ctx {
msxml_scan_cb scan_cb;

@ -1,19 +1,19 @@
/*
* OOXML JSON Internals
*
*
* Copyright (C) 2014-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
*
*
* Authors: Kevin Lin
*
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License version 2 as published by the
* Free Software Foundation.
*
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc., 51
* Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@ -149,6 +149,8 @@ static int ooxml_core_cb(int fd, const char *filepath, cli_ctx *ctx)
{
int ret;
UNUSEDPARAM(filepath);
cli_dbgmsg("in ooxml_core_cb\n");
ret = ooxml_parse_document(fd, ctx);
if (ret == CL_EPARSE)
@ -163,6 +165,8 @@ static int ooxml_extn_cb(int fd, const char *filepath, cli_ctx *ctx)
{
int ret;
UNUSEDPARAM(filepath);
cli_dbgmsg("in ooxml_extn_cb\n");
ret = ooxml_parse_document(fd, ctx);
if (ret == CL_EPARSE)
@ -182,6 +186,8 @@ static int ooxml_content_cb(int fd, const char *filepath, cli_ctx *ctx)
xmlTextReaderPtr reader = NULL;
uint32_t loff;
UNUSEDPARAM(filepath);
unsigned long sav_scansize = ctx->scansize;
unsigned int sav_scannedfiles = ctx->scannedfiles;
@ -345,6 +351,8 @@ static int ooxml_hwp_cb(int fd, const char *filepath, cli_ctx *ctx)
int ret = CL_SUCCESS;
xmlTextReaderPtr reader = NULL;
UNUSEDPARAM(filepath);
cli_dbgmsg("in ooxml_hwp_cb\n");
/* perform engine limit checks in temporary tracking session */

@ -22,7 +22,7 @@
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
*
* You must obey the GNU General Public License in all respects
* for all of the code used other than OpenSSL. If you modify
* file(s) with this exception, you may extend this exception to your
@ -76,7 +76,7 @@ struct pdf_token {
};
static size_t pdf_decodestream_internal(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_dict *params, struct pdf_token *token, int fout, cl_error_t *status, struct objstm_struct *objstm);
static cl_error_t pdf_decode_dump(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_token *token, int lvl);
static cl_error_t pdf_decode_dump(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_token *token, uint32_t lvl);
static cl_error_t filter_ascii85decode(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_token *token);
static cl_error_t filter_rldecode(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_token *token);
@ -87,10 +87,10 @@ static cl_error_t filter_lzwdecode(struct pdf_struct *pdf, struct pdf_obj *obj,
/**
* @brief Wrapper function for pdf_decodestream_internal.
*
*
* Allocate a token object to store decoded filter data.
* Parse/decode the filter data and scan it.
*
*
* @param pdf Pdf context structure.
* @param obj The object we found the filter content in.
* @param params (optional) Dictionary parameters describing the filter data.
@ -205,10 +205,10 @@ done:
}
/**
* @brief Decode filter buffer data.
*
* @brief Decode filter buffer data.
*
* Attempt to decompress, decrypt or otherwise parse it.
*
*
* @param pdf Pdf context structure.
* @param obj The object we found the filter content in.
* @param params (optional) Dictionary parameters describing the filter data.
@ -227,7 +227,7 @@ static size_t pdf_decodestream_internal(
size_t bytes_scanned = 0;
cli_ctx *ctx = NULL;
const char *filter = NULL;
int i;
uint32_t i;
if (!status) {
/* invalid args, and no way to pass back the status code */
@ -263,32 +263,32 @@ static size_t pdf_decodestream_internal(
for (i = 0; i < obj->numfilters; i++) {
switch (obj->filterlist[i]) {
case OBJ_FILTER_A85:
cli_dbgmsg("pdf_decodestream_internal: decoding [%d] => ASCII85DECODE\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: decoding [%u] => ASCII85DECODE\n", obj->filterlist[i]);
retval = filter_ascii85decode(pdf, obj, token);
break;
case OBJ_FILTER_RL:
cli_dbgmsg("pdf_decodestream_internal: decoding [%d] => RLDECODE\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: decoding [%u] => RLDECODE\n", obj->filterlist[i]);
retval = filter_rldecode(pdf, obj, token);
break;
case OBJ_FILTER_FLATE:
cli_dbgmsg("pdf_decodestream_internal: decoding [%d] => FLATEDECODE\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: decoding [%u] => FLATEDECODE\n", obj->filterlist[i]);
retval = filter_flatedecode(pdf, obj, params, token);
break;
case OBJ_FILTER_AH:
cli_dbgmsg("pdf_decodestream_internal: decoding [%d] => ASCIIHEXDECODE\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: decoding [%u] => ASCIIHEXDECODE\n", obj->filterlist[i]);
retval = filter_asciihexdecode(pdf, obj, token);
break;
case OBJ_FILTER_CRYPT:
cli_dbgmsg("pdf_decodestream_internal: decoding [%d] => CRYPT\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: decoding [%u] => CRYPT\n", obj->filterlist[i]);
retval = filter_decrypt(pdf, obj, params, token, 0);
break;
case OBJ_FILTER_LZW:
cli_dbgmsg("pdf_decodestream_internal: decoding [%d] => LZWDECODE\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: decoding [%u] => LZWDECODE\n", obj->filterlist[i]);
retval = filter_lzwdecode(pdf, obj, params, token);
break;
@ -301,19 +301,19 @@ static size_t pdf_decodestream_internal(
case OBJ_FILTER_JBIG2:
if (!filter) filter = "JBIG2DECODE";
cli_dbgmsg("pdf_decodestream_internal: unimplemented filter type [%d] => %s\n", obj->filterlist[i], filter);
cli_dbgmsg("pdf_decodestream_internal: unimplemented filter type [%u] => %s\n", obj->filterlist[i], filter);
filter = NULL;
retval = CL_BREAK;
break;
default:
cli_dbgmsg("pdf_decodestream_internal: unknown filter type [%d]\n", obj->filterlist[i]);
cli_dbgmsg("pdf_decodestream_internal: unknown filter type [%u]\n", obj->filterlist[i]);
retval = CL_BREAK;
break;
}
if (!(token->content) || !(token->length)) {
cli_dbgmsg("pdf_decodestream_internal: empty content, breaking after %d (of %lu) filters\n", i, (long unsigned)(obj->numfilters));
cli_dbgmsg("pdf_decodestream_internal: empty content, breaking after %u (of %u) filters\n", i, obj->numfilters);
break;
}
@ -338,7 +338,7 @@ static size_t pdf_decodestream_internal(
break;
}
cli_dbgmsg("pdf_decodestream_internal: stopping after %d (of %lu) filters (reason: %s)\n", i, (long unsigned)(obj->numfilters), reason);
cli_dbgmsg("pdf_decodestream_internal: stopping after %d (of %u) filters (reason: %s)\n", i, obj->numfilters, reason);
break;
}
}
@ -372,7 +372,7 @@ static size_t pdf_decodestream_internal(
if ((NULL != objstm) &&
((CL_SUCCESS == *status) || ((CL_VIRUS == *status) && SCAN_ALLMATCHES))) {
int objs_found = pdf->nobjs;
unsigned int objs_found = pdf->nobjs;
/*
* The caller indicated that the decoded data is an object stream.
@ -395,7 +395,7 @@ static size_t pdf_decodestream_internal(
if (pdf->nobjs <= objs_found) {
cli_dbgmsg("pdf_decodestream_internal: pdf_find_and_parse_objs_in_objstm did not find any new objects!\n");
} else {
cli_dbgmsg("pdf_decodestream_internal: pdf_find_and_parse_objs_in_objstm found %d new objects.\n", pdf->nobjs - objs_found);
cli_dbgmsg("pdf_decodestream_internal: pdf_find_and_parse_objs_in_objstm found %u new objects.\n", pdf->nobjs - objs_found);
}
}
@ -409,22 +409,22 @@ done:
/**
* @brief Dump PDF filter content such as stream contents to a temp file.
*
*
* Temp file is created in the pdf->dir directory.
* Filename format is "pdf<pdf->files-1>_<lvl>".
*
*
* @param pdf Pdf context structure.
* @param obj The object we found the filter content in.
* @param token The struct for the filter contents.
* @param lvl A unique index to distinguish the files from each other.
* @return cl_error_t
* @return cl_error_t
*/
static cl_error_t pdf_decode_dump(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_token *token, int lvl)
static cl_error_t pdf_decode_dump(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdf_token *token, uint32_t lvl)
{
char fname[1024];
int ifd;
snprintf(fname, sizeof(fname), "%s" PATHSEP "pdf%02u_%02ui", pdf->dir, (pdf->files - 1), lvl);
snprintf(fname, sizeof(fname), "%s" PATHSEP "pdf%02u_%02u", pdf->dir, (pdf->files - 1), lvl);
ifd = open(fname, O_RDWR | O_CREAT | O_EXCL | O_TRUNC | O_BINARY, 0600);
if (ifd < 0) {
char err[128];
@ -433,7 +433,7 @@ static cl_error_t pdf_decode_dump(struct pdf_struct *pdf, struct pdf_obj *obj, s
return CL_ETMPFILE;
}
cli_dbgmsg("cli_pdf: decoded filter %d obj %u %u\n", lvl, obj->id >> 8, obj->id & 0xff);
cli_dbgmsg("cli_pdf: decoded filter %u obj %u %u\n", lvl, obj->id >> 8, obj->id & 0xff);
cli_dbgmsg(" ... to %s\n", fname);
if (cli_writen(ifd, token->content, token->length) != token->length) {

@ -22,7 +22,7 @@
* OpenSSL library under certain conditions as described in each
* individual source file, and distribute linked combinations
* including the two.
*
*
* You must obey the GNU General Public License in all respects
* for all of the code used other than OpenSSL. If you modify
* file(s) with this exception, you may extend this exception to your
@ -380,7 +380,6 @@ char *pdf_parse_string(struct pdf_struct *pdf, struct pdf_obj *obj, const char *
size_t len, checklen;
char *res = NULL;
uint32_t objid;
size_t i;
if (obj->objstm) {
if (objsize > (size_t)(obj->objstm->streambuf_len - (objstart - obj->objstm->streambuf))) {
@ -453,7 +452,7 @@ char *pdf_parse_string(struct pdf_struct *pdf, struct pdf_obj *obj, const char *
if (newobj == obj)
return NULL;
/*
/*
* If pdf_handlename hasn't been called for this object,
* then parse the object prior to extracting it
*/

@ -78,7 +78,9 @@ static int xar_get_numeric_from_xml_element(xmlTextReaderPtr reader, size_t *val
char *endptr = NULL;
errno = 0;
numval = strtol((const char *)numstr, &endptr, 10);
if (((numval == LONG_MAX || numval == LONG_MIN) && errno) || endptr == numstr) {
if ((((numval == LONG_MAX) || (numval == LONG_MIN)) && errno) ||
((const xmlChar *)endptr == numstr)) {
cli_dbgmsg("cli_scanxar: XML element value invalid\n");
return CL_EFORMAT;
} else if (numval < 0) {

@ -449,6 +449,7 @@ struct { \
LIST_FIRST((head)) = NULL; \
} while (0)
#undef LIST_INSERT_AFTER
#define LIST_INSERT_AFTER(listelm, elm, field) do { \
QMD_LIST_CHECK_NEXT(listelm, field); \
if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\
@ -458,6 +459,7 @@ struct { \
(elm)->field.le_prev = &LIST_NEXT((listelm), field); \
} while (0)
#undef LIST_INSERT_BEFORE
#define LIST_INSERT_BEFORE(listelm, elm, field) do { \
QMD_LIST_CHECK_PREV(listelm, field); \
(elm)->field.le_prev = (listelm)->field.le_prev; \
@ -466,6 +468,7 @@ struct { \
(listelm)->field.le_prev = &LIST_NEXT((elm), field); \
} while (0)
#undef LIST_INSERT_HEAD
#define LIST_INSERT_HEAD(head, elm, field) do { \
QMD_LIST_CHECK_HEAD((head), field); \
if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL) \

@ -1186,7 +1186,8 @@ int sigtool_vba_scandir(const char *dirname, int hex_output, struct uniq *U)
{
cl_error_t status = CL_CLEAN;
cl_error_t ret;
int i, fd, data_len;
int i, fd;
size_t data_len;
vba_project_t *vba_project = NULL;
DIR *dd;
struct dirent *dent;
@ -1278,7 +1279,7 @@ int sigtool_vba_scandir(const char *dirname, int hex_output, struct uniq *U)
for (i = 0; i < vba_project->count; i++) {
data_len = vba_project->length[i];
data = (unsigned char *)cli_wm_decrypt_macro(fd, vba_project->offset[i], data_len, vba_project->key[i]);
data = (unsigned char *)cli_wm_decrypt_macro(fd, vba_project->offset[i], (uint32_t)data_len, vba_project->key[i]);
if (data) {
data = (unsigned char *)realloc(data, data_len + 1);
data[data_len] = '\0';

Loading…
Cancel
Save