open-dsi
/
clamav
mirror of https://github.com/Cisco-Talos/clamav
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

provide fmap_fd() accessor to fd.

Browse Source 
Accessing fd directly is deprecated, and most unpackers can unpack directly the
map, with the rest being fixed shortly.
Only the pre/post callbacks need the fd (they will get -1 if we not scanning a
fd), and the zlib_from_the_80s.
remotes/push_mirror/fmapify
Török Edvin 14 years ago
parent 40cf24f6bf
commit b4d884d920
5 changed files with 23 additions and 24 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 16
      libclamav/fmap.c
  2. 4
      libclamav/fmap.h
  3. 2
      libclamav/matcher.c
  4. 17
      libclamav/scanners.c
  5. 8
      sigtool/vba.c

16
libclamav/fmap.c
Unescape View File

@ -144,7 +144,7 @@ fmap_t *fmap_check_empty(int fd, off_t offset, size_t len, int *empty) {
/* fault the header while we still have the lock - we DO context switch here a lot here :@ */
memset(fmap_bitmap, 0, sizeof(uint32_t) * pages);
fmap_unlock;
m->fd = fd;
m->_fd = fd;
m->dumb = dumb;
m->mtime = st.st_mtime;
m->offset = offset;
@ -283,7 +283,7 @@ static int fmap_readpage(fmap_t *m, unsigned int first_page, unsigned int count,
if(fmap_bitmap[j] & FM_MASK_SEEN) {
/* page we've seen before: check mtime */
struct stat st;
if(fstat(m->fd, &st)) {
if(fstat(m->_fd, &st)) {
cli_warnmsg("fmap_readpage: fstat failed\n");
return 1;
}
@ -298,7 +298,7 @@ static int fmap_readpage(fmap_t *m, unsigned int first_page, unsigned int count,
eintr_off = 0;
while(readsz) {
ssize_t got;
got=pread(m->fd, pptr, readsz, eintr_off + m->offset + first_page * m->pgsz);
got=pread(m->_fd, pptr, readsz, eintr_off + m->offset + first_page * m->pgsz);
if(got < 0 && errno == EINTR)
continue;
@ -585,7 +585,7 @@ fmap_t *fmap_check_empty(int fd, off_t offset, size_t len, int *empty) { /* WIN3
free(m);
return NULL;
}
m->fd = fd;
m->_fd = fd;
m->dumb = dumb;
m->mtime = st.st_mtime;
m->offset = offset;
@ -706,3 +706,11 @@ static inline unsigned int fmap_align_to(unsigned int sz, unsigned int al) {
static inline unsigned int fmap_which_page(fmap_t *m, size_t at) {
return at / m->pgsz;
}
int fmap_fd(fmap_t *m)
{
/* This will return -1 when once custom mapping is be used */
int fd = m->_fd;
lseek(fd, 0, SEEK_SET);
return fd;
}

4
libclamav/fmap.h
Unescape View File

@ -29,7 +29,7 @@
#include "cltypes.h"
typedef struct {
int fd;
int _fd;
unsigned short dumb;
unsigned short dont_cache_flag;
time_t mtime;
@ -80,4 +80,6 @@ static inline const void *fmap_need_ptr_once_len(fmap_t *m, const void *ptr, siz
return fmap_need_off_once_len(m, (char*)ptr - (char*)m - m->hdrsz, len, lenout);
}
int fmap_fd(fmap_t *m);
#endif

2
libclamav/matcher.c
Unescape View File

@ -450,7 +450,7 @@ int cli_checkfp(unsigned char *digest, size_t size, cli_ctx *ctx)
#endif
if (ctx->engine->cb_hash)
ctx->engine->cb_hash(ctx->fmap[0]->fd, size, md5, ctx->virname ? *ctx->virname : NULL, ctx->cb_ctx);
ctx->engine->cb_hash(fmap_fd(*ctx->fmap), size, md5, ctx->virname ? *ctx->virname : NULL, ctx->cb_ctx);
return CL_VIRUS;
}

17
libclamav/scanners.c
Unescape View File

@ -191,7 +191,6 @@ static int cli_unrar_scanmetadata(int desc, unrar_metadata_t *metadata, cli_ctx
if(DETECT_ENCRYPTED && metadata->encrypted) {
cli_dbgmsg("RAR: Encrypted files found in archive.\n");
lseek(desc, 0, SEEK_SET);
ret = cli_scandesc(desc, ctx, 0, 0, NULL, AC_SCAN_VIR, NULL);
if(ret != CL_VIRUS) {
*ctx->virname = "Heuristics.Encrypted.RAR";
@ -411,11 +410,10 @@ static int cli_scangzip_with_zib_from_the_80s(cli_ctx *ctx, unsigned char *buff)
char *tmpname;
gzFile gz;
fd = dup(map->fd);
fd = dup(fmap_fd(map));
if(fd < 0)
return CL_EDUP;
lseek(fd, 0, SEEK_SET);
if(!(gz = gzdopen(fd, "rb"))) {
close(fd);
return CL_EOPEN;
@ -683,7 +681,6 @@ static int cli_scanszdd(cli_ctx *ctx)
}
cli_dbgmsg("MSEXPAND: Decompressed into %s\n", tmpname);
lseek(ofd, 0, SEEK_SET);
ret = cli_magic_scandesc(ofd, ctx);
close(ofd);
if(!ctx->engine->keeptmp)
@ -1001,7 +998,6 @@ static int cli_scanhtml(cli_ctx *ctx)
if(fd >= 0) {
ret = cli_scandesc(fd, ctx, CL_TYPE_HTML, 0, NULL, AC_SCAN_VIR, NULL);
if (ret == CL_CLEAN) {
lseek(fd, 0, SEEK_SET);
ret = cli_scandesc(fd, ctx, CL_TYPE_TEXT_ASCII, 0, NULL, AC_SCAN_VIR, NULL);
}
close(fd);
@ -1287,7 +1283,6 @@ static int cli_scanmschm(cli_ctx *ctx)
}
ret = cli_chm_extract_file(dir, &metadata, ctx);
if (ret == CL_SUCCESS) {
lseek(metadata.ofd, 0, SEEK_SET);
rc = cli_magic_scandesc(metadata.ofd, ctx);
close(metadata.ofd);
if (rc == CL_VIRUS) {
@ -1408,7 +1403,6 @@ static int cli_scancryptff(cli_ctx *ctx)
free(dest);
lseek(ndesc, 0, SEEK_SET);
cli_dbgmsg("CryptFF: Scanning decrypted data\n");
@ -1667,7 +1661,6 @@ static int cli_scanembpe(cli_ctx *ctx, off_t offset)
}
ctx->recursion++;
lseek(fd, 0, SEEK_SET);
corrupted_input = ctx->corrupted_input;
ctx->corrupted_input = 1;
ret = cli_magic_scandesc(fd, ctx);
@ -1879,7 +1872,7 @@ static int cli_scanraw(cli_ctx *ctx, cli_file_t type, uint8_t typercg, cli_file_
ctx->container_type = CL_TYPE_RAR;
ctx->container_size = map->len - fpt->offset; /* not precise */
cli_dbgmsg("RAR/RAR-SFX signature found at %u\n", (unsigned int) fpt->offset);
nret = cli_scanrar(map->fd, ctx, fpt->offset, &lastrar);
nret = cli_scanrar(fmap_fd(map), ctx, fpt->offset, &lastrar);
}
break;
@ -2097,8 +2090,8 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
size_t current_container_size = ctx->container_size, hashed_size;
unsigned char hash[16];
bitset_t *old_hook_lsig_matches;
int desc = (*ctx->fmap)->fd;
const char *filetype;
int desc = fmap_fd(*ctx->fmap);/* TODO: port the rest to fmap, and keep this just for pre/post callbacks */
if(ctx->engine->maxreclevel && ctx->recursion > ctx->engine->maxreclevel) {
cli_dbgmsg("cli_magic_scandesc: Archive recursion limit exceeded (%u, max: %u)\n", ctx->recursion, ctx->engine->maxreclevel);
@ -2168,7 +2161,6 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
#ifdef HAVE__INTERNAL__SHA_COLLECT
if(!ctx->sha_collect && type==CL_TYPE_MSEXE) ctx->sha_collect = 1;
#endif
lseek(desc, 0, SEEK_SET); /* FIXMEFMAP: remove ? */
ctx->hook_lsig_matches = cli_bitset_init();
if (!ctx->hook_lsig_matches) {
@ -2183,7 +2175,6 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
ctx->hook_lsig_matches = old_hook_lsig_matches;
ret_from_magicscan(ret);
}
lseek(desc, 0, SEEK_SET); /* FIXMEFMAP: remove ? */
}
ctx->recursion++;
@ -2447,7 +2438,6 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
}
ctx->recursion++;
lseek(desc, 0, SEEK_SET);
switch(type) {
/* bytecode hooks triggered by a lsig must be a hook
* called from one of the functions here */
@ -2459,7 +2449,6 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
if((DCONF_DOC & DOC_CONF_SCRIPT) && dettype != CL_TYPE_HTML)
ret = cli_scanscript(ctx);
if(SCAN_MAIL && (DCONF_MAIL & MAIL_CONF_MBOX) && ret != CL_VIRUS && (ctx->container_type == CL_TYPE_MAIL || dettype == CL_TYPE_MAIL)) {
lseek(desc, 0, SEEK_SET);
ret = cli_fmap_scandesc(ctx, CL_TYPE_MAIL, 0, NULL, AC_SCAN_VIR, NULL, NULL);
}
perf_nested_stop(ctx, PERFT_SCRIPT, PERFT_SCAN);

8
sigtool/vba.c
Unescape View File

@ -64,9 +64,9 @@ cli_ctx *convenience_ctx(int fd) {
return ctx;
}
void destroy_ctx(cli_ctx *ctx) {
close((*(ctx->fmap))->fd);
void destroy_ctx(int desc, cli_ctx *ctx) {
funmap(*(ctx->fmap));
close(desc);
free(ctx->fmap);
cl_engine_free((struct cl_engine *)ctx->engine);
free(ctx);
@ -1042,7 +1042,7 @@ static int sigtool_scandir (const char *dirname, int hex_output)
}
if ((ret = cli_ole2_extract (dir, ctx, &vba))) {
printf ("ERROR %s\n", cl_strerror (ret));
destroy_ctx(ctx);
destroy_ctx(desc, ctx);
cli_rmdirs (dir);
free (dir);
closedir (dd);
@ -1051,7 +1051,7 @@ static int sigtool_scandir (const char *dirname, int hex_output)
if(vba)
sigtool_vba_scandir (dir, hex_output, vba);
destroy_ctx(ctx);
destroy_ctx(desc, ctx);
cli_rmdirs (dir);
free (dir);
}

Write Preview
Loading…
Cancel
Save