add support for self-extracting MS Cabinet archives

git-svn: trunk@2471

clamav-devel/ChangeLog

@@ -1,3 +1,8 @@
+Wed Nov  1 18:59:48 CET 2006 (tk)
+---------------------------------
+  * libclamav: add support for self-extracting MS Cabinet archives
+	       Thanks to Christoph for a nice bunch of test files.
+
 Wed Nov  1 17:03:54 CET 2006 (tk)
 ---------------------------------
   * libclamav: minor clamav.h (and related) cleanup

clamav-devel/libclamav/filetypes.c

@@ -180,6 +180,7 @@ static const struct cli_smagic_s cli_smagic[] = {
 
     {"526172211a0700", "RAR-SFX", CL_TYPE_RARSFX},
     {"504b0304", "ZIP-SFX", CL_TYPE_ZIPSFX},
+    {"4d534346", "CAB-SFX", CL_TYPE_CABSFX},
 
     {NULL,  NULL,   CL_TYPE_UNKNOWN_DATA}
 };

clamav-devel/libclamav/filetypes.h

@@ -60,7 +60,8 @@ typedef enum {
     CL_TYPE_MAIL,  /* magic + on the fly */
     CL_TYPE_SFX, /* foo SFX marker */
     CL_TYPE_ZIPSFX, /* on the fly */
-    CL_TYPE_RARSFX /* on the fly */
+    CL_TYPE_RARSFX, /* on the fly */
+    CL_TYPE_CABSFX
 
 } cli_file_t;
 

clamav-devel/libclamav/scanners.c

@@ -792,7 +792,7 @@ static int cli_scanszdd(int desc, cli_ctx *ctx)
     return ret;
 }
 
-static int cli_scanmscab(int desc, cli_ctx *ctx)
+static int cli_scanmscab(int desc, cli_ctx *ctx, off_t sfx_offset)
 {
 	struct mscab_decompressor *cabd = NULL;
 	struct mscabd_cabinet *base, *cab;
@@ -808,6 +808,9 @@ static int cli_scanmscab(int desc, cli_ctx *ctx)
 	return CL_EMSCAB;
     }
 
+    if(sfx_offset)
+	lseek(desc, sfx_offset, SEEK_SET);
+
     if((base = cabd->dsearch(cabd, dup(desc))) == NULL) {
 	cli_dbgmsg("MSCAB: I/O error or no valid cabinets found\n");
 	mspack_destroy_cab_decompressor(cabd);
@@ -1626,6 +1629,7 @@ static int cli_scanraw(int desc, cli_ctx *ctx, cli_file_t type)
 
 	    case CL_TYPE_RARSFX:
 	    case CL_TYPE_ZIPSFX:
+	    case CL_TYPE_CABSFX:
 		if(type == CL_TYPE_MSEXE) {
 		    if(SCAN_ARCHIVE) {
 			lastzip = lastrar = 0xdeadbeef;
@@ -1639,7 +1643,12 @@ static int cli_scanraw(int desc, cli_ctx *ctx, cli_file_t type)
 				cli_dbgmsg("ZIP-SFX signature found at %d\n", fpt->offset);
 				if((nret = cli_scanzip(desc, ctx, fpt->offset, &lastzip)) == CL_VIRUS)
 				    break;
+			    } else if(fpt->type == CL_TYPE_CABSFX) {
+				cli_dbgmsg("CAB-SFX signature found at %d\n", fpt->offset);
+				if((nret = cli_scanmscab(desc, ctx, fpt->offset)) == CL_VIRUS)
+				    break;
 			    }
+
 			    fpt = fpt->next;
 			}
 		    }
@@ -1753,7 +1762,7 @@ int cli_magic_scandesc(int desc, cli_ctx *ctx)
 
 	case CL_TYPE_MSCAB:
 	    if(SCAN_ARCHIVE)
-		ret = cli_scanmscab(desc, ctx);
+		ret = cli_scanmscab(desc, ctx, 0);
 	    break;
 
 	case CL_TYPE_HTML: