open-dsi
/
clamav
mirror of https://github.com/Cisco-Talos/clamav
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix all-match mode FP checks

Browse Source 
The `cli_append_virus()` function does an FP check. If it is an FP, it
will return `CL_CLEAN` and the match/alert/virus should be discarded.

This fix will respect FP verdicts when appending virus name in ac and
bm matchers in all match mode.
pull/172/head
Mickey Sola 5 years ago committed by Micah Snyder
parent a71eb34999
commit c0bad34b09
2 changed files with 20 additions and 9 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 9
      libclamav/matcher-ac.c
  2. 16
      libclamav/matcher-bm.c

9
libclamav/matcher-ac.c
Unescape View File

@ -1712,6 +1712,7 @@ cl_error_t cli_ac_scanbuff(
int type = CL_CLEAN;
struct cli_ac_result *newres;
int rc;
int ret;
if (!root->ac_root)
return CL_CLEAN;
@ -1923,9 +1924,11 @@ cl_error_t cli_ac_scanbuff(
continue;
} else {
if (ctx && SCAN_ALLMATCHES) {
cli_append_virus(ctx, (const char *)pt->virname);
ret = cli_append_virus(ctx, (const char *)pt->virname);
if(ret == CL_VIRUS) {
viruses_found = 1;
}
}
if (virname)
*virname = pt->virname;
if (customdata)
@ -1978,9 +1981,11 @@ cl_error_t cli_ac_scanbuff(
continue;
} else {
if (ctx && SCAN_ALLMATCHES) {
cli_append_virus(ctx, (const char *)pt->virname);
ret = cli_append_virus(ctx, (const char *)pt->virname);
if(ret == CL_VIRUS) {
viruses_found = 1;
}
}
if (virname)
*virname = pt->virname;

16
libclamav/matcher-bm.c
Unescape View File

@ -379,17 +379,21 @@ cl_error_t cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const c
continue;
}
}
viruses_found += 1;
if (virname) {
*virname = p->virname;
if (ctx != NULL && SCAN_ALLMATCHES) {
cli_append_virus(ctx, *virname);
//*viroffset = offset + i + j - BM_MIN_LENGTH + BM_BLOCK_SIZE;
ret = cli_append_virus(ctx, *virname);
if (ret == CL_CLEAN && viruses_found > 0) {
viruses_found -= 1;
}
}
}
if (patt)
*patt = p;
viruses_found = 1;
if (ctx != NULL && !SCAN_ALLMATCHES)
return CL_VIRUS;
@ -404,8 +408,9 @@ cl_error_t cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const c
for (; offdata->pos < offdata->cnt && off >= offdata->offtab[offdata->pos]; offdata->pos++)
;
if (offdata->pos == offdata->cnt || off >= offdata->offtab[offdata->pos]) {
if (viruses_found)
if (viruses_found > 0) {
return CL_VIRUS;
}
return CL_CLEAN;
}
i += offdata->offtab[offdata->pos] - off;
@ -414,7 +419,8 @@ cl_error_t cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const c
}
}
if (viruses_found)
if (viruses_found > 0) {
return CL_VIRUS;
}
return CL_CLEAN;
}

Write Preview
Loading…
Cancel
Save