diff --git a/libclamav/pdf.c b/libclamav/pdf.c index 3d95319c1..025228ae8 100644 --- a/libclamav/pdf.c +++ b/libclamav/pdf.c @@ -1429,6 +1429,10 @@ static void handle_pdfname(struct pdf_struct *pdf, struct pdf_obj *obj, const ch return; } + /* record filter order */ + if ((*state == STATE_FILTER) && ((1 << act->set_objflag) & KNOWN_FILTERS)) + obj->filterlist[obj->numfilters++] = act->set_objflag; + if ((act->nameflags & NAMEFLAG_HEURISTIC) && escapes) { /* if a commonly used PDF name is escaped that is certainly suspicious. */ diff --git a/libclamav/pdf.h b/libclamav/pdf.h index 182b2f047..a7a679c21 100644 --- a/libclamav/pdf.h +++ b/libclamav/pdf.h @@ -22,11 +22,14 @@ #define __PDF_H #include "others.h" +#define PDF_FILTERLIST_MAX 64 struct pdf_obj { uint32_t start; uint32_t id; uint32_t flags; uint32_t statsflags; + uint32_t numfilters; + uint32_t filterlist[PDF_FILTERLIST_MAX]; char *path; };