bb#11208 - added engine limit checks to ooxml parsing

libclamav/ooxml.c

@@ -404,6 +404,17 @@ static int ooxml_parse_element(cli_ctx *ctx, xmlTextReaderPtr reader, json_objec
     return CL_SUCCESS;
 }
 
+static int ooxml_updatelimits(int fd, cli_ctx *ctx)
+{
+    STATBUF sb;
+    if (FSTAT(fd, &sb) == -1) {
+        cli_errmsg("ooxml_updatelimits: Can't fstat descriptor %d\n", fd);
+        return CL_ESTAT;
+    }
+
+    return cli_updatelimits(ctx, sb.st_size);
+}
+
 static int ooxml_parse_document(int fd, cli_ctx *ctx)
 {
     int ret = CL_SUCCESS;
@@ -411,6 +422,11 @@ static int ooxml_parse_document(int fd, cli_ctx *ctx)
 
     cli_dbgmsg("in ooxml_parse_document\n");
 
+    /* perform engine limit checks in temporary tracking session */
+    ret = ooxml_updatelimits(fd, ctx);
+    if (ret != CL_CLEAN)
+        return ret;
+
     reader = xmlReaderForFd(fd, "properties.xml", NULL, CLAMAV_MIN_XMLREADER_FLAGS);
     if (reader == NULL) {
         cli_dbgmsg("ooxml_parse_document: xmlReaderForFd error\n");
@@ -469,12 +485,24 @@ static int ooxml_content_cb(int fd, cli_ctx *ctx)
     xmlTextReaderPtr reader = NULL;
     uint32_t loff;
 
+    unsigned long sav_scansize = ctx->scansize;
+    unsigned int sav_scannedfiles = ctx->scannedfiles;
+
     cli_dbgmsg("in ooxml_content_cb\n");
 
+    /* perform engine limit checks in temporary tracking session */
+    ret = ooxml_updatelimits(fd, ctx);
+    if (ret != CL_CLEAN)
+        return ret;
+
+    /* apply a reader to the document */
     reader = xmlReaderForFd(fd, "[Content_Types].xml", NULL, CLAMAV_MIN_XMLREADER_FLAGS);
     if (reader == NULL) {
         cli_dbgmsg("ooxml_content_cb: xmlReaderForFd error for ""[Content_Types].xml""\n");
         ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_XML_READER_FD");
+
+        ctx->scansize = sav_scansize;
+        ctx->scannedfiles = sav_scannedfiles;
         return CL_SUCCESS; // libxml2 failed!
     }
 
@@ -617,6 +645,10 @@ static int ooxml_content_cb(int fd, cli_ctx *ctx)
         cli_jsonint(ctx->wrkproperty, "DigitalSignaturesCount", dsig);
     }
 
+    /* restore the engine tracking limits; resets session limit tracking */
+    ctx->scansize = sav_scansize;
+    ctx->scannedfiles = sav_scannedfiles;
+
     xmlTextReaderClose(reader);
     xmlFreeTextReader(reader);
     return ret;
@@ -685,6 +717,10 @@ int cli_process_ooxml(cli_ctx *ctx)
         ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_TIMEOUT");
     else if (tmp == CL_EMEM)
         ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_OUTOFMEM");
+    else if (tmp == CL_EMAXSIZE)
+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_EMAXSIZE");
+    else if (tmp == CL_EMAXFILES)
+        ooxml_add_parse_error(ctx->wrkproperty, "OOXML_ERROR_EMAXFILES");
 
     return tmp;
 #else

libclamav/scanners.c

@@ -2779,7 +2779,7 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
 #if HAVE_JSON
             if ((ctx->options & CL_SCAN_FILE_PROPERTIES) && (ctx->wrkproperty != NULL)) {
                 ret = cli_process_ooxml(ctx);
-                if (ret == CL_ETIMEOUT) {
+                if (ret == CL_ETIMEOUT || ret == CL_EMEM || ret == CL_EMAXSIZE || ret == CL_EMAXFILES) {
                     return magic_scandesc_cleanup(ctx, type, hash, hashed_size, cache_clean, ret, parent_property);
                 }
                 else if (ret != CL_SUCCESS) {