156 Commits (28fcc2450c80c0c90a799384efbe429539e58d4d)

Author	SHA1	Message	Date
Török Edvin	3d664817f6	fix recursion level crash (bb #3706). ... Thanks to Stephane Chazelas for the analysis.	14 years ago
Török Edvin	63feb6cdf4	Add some performance measurement code. ... Default off, activated by --dev-performance, and always on in c4w.	14 years ago
Török Edvin	0796f1cab5	bytecode: successfully skip bytecodes that use unknown APIs ... When unknown APIs are used, the bytecode is skipped. However we were still checking that the number of loaded functions is correct, and of course we were failing because when skipping the number of loaded functions is 0. Fix this by not checking the number of loaded functions when skipping a bytecode.	14 years ago
aCaB	7cbc72d3b1	c4w: error path engine leak	15 years ago
Török Edvin	110731e784	Fix valgrind warning.	15 years ago
Török Edvin	4116c65d1b	Add bytecode API to determine whether running under JIT.	15 years ago
Török Edvin	d7531f2ad2	Fix warnings.	15 years ago
Török Edvin	35d6165fa5	bytecode: fix multiple bytecode execution in same hook. ... Do not reset filesize to 0. Otherwise only the 1st bytecode executed in a hook can really scan the file, all further bytecodes executed in same hook will fail to read anything from the file.	15 years ago
Török Edvin	6b5af78c33	bytecode_vm: do a 2nd pass over types to update array sizes. ... TODO: in the future the .cbc should include these sizes itself.	15 years ago
Török Edvin	8a8dbd59ea	bytecode test mode: collect & diff events for JIT and interpreter. ... If execution is different for JIT and interpreter test mode shows error.	15 years ago
Török Edvin	f1ea72ae5b	Fix memory leak in runlsig (bb #2291).	15 years ago
Török Edvin	93e0033fb2	Avoid 'line too long for provided buffer'. ... This time it was just a message that didn't prevent the DB to be loaded. Silence it though by using at least a 4k buffer always.	15 years ago
Török Edvin	f73212dc62	Fix bytecode virusname reporting (bb #2255). ... Also adds possibility to stop a hook from executing, and set a virus as heuristic (by using BC.Heuristic* name)	15 years ago
Török Edvin	fcbfb1c6ee	Properly skip bytecodes with long lines. ... Prevent 'Line too long for provided buffer'. We must skip using a buffer of length declared in cbc header, not 4096. So perform the skip in bytecode.c rather than readdb.c (which doesn't know the length). The skip in readdb.c is good for skipping the source code, so keep it.	15 years ago
Török Edvin	71ca3536c4	Fix hung clamd on FreeBSD (bb #2235). ... bytecode selfcheck running under JIT ran too early, and spawned a thread. Then clamd forked. threads + fork = bad idea. So prevent the thread from being spawned in selfcheck mode. So at the time of fork clamd will still be single threaded as in 0.96.1.	15 years ago
Török Edvin	4abbeb3a6c	Sync headers with bytecode compiler.	15 years ago
Török Edvin	540fc128a0	freshclam is using private symbol that changed proto (bb #2187). ... Change name to prevent crash with 0.96.1 freshclam and 0.96.2 libclamav. You'll get a missing symbol error.	15 years ago
Török Edvin	d732b5aa67	Reenable JIT selfcheck. ... Lost in startup.cbc conversion.	15 years ago
Török Edvin	70c222c99c	save lsig counts/offsets (bb #2055).	15 years ago
Török Edvin	762d46e8ea	Fix matchicon bytecode API (bb #2139). ... Now you can call it both from a normal lsig triggered BC, and from a PE hook BC. The normal lsig triggered BC has exe_info (but not PE info) which allows it to invoke the icon matcher API. Also putting ICONGROUP1 into the ldb trigger of the bytecode works.	15 years ago
Török Edvin	213dfdff06	run 1 unit-test at least in test mode (bb #2151). ... Also allow running test mode if JIT is not available, still checking for failed startup.cbc execution.	15 years ago
Török Edvin	dc200c6b19	Add bytecode API for pdf.	15 years ago
Török Edvin	dbd3ed9345	Make BC_STARTUP run a minimal self-test. ... Also change return value to something else than 0. It is too easy for buggy bytecode to return 0.	15 years ago
Török Edvin	b3b8b6dd40	Pointers are always 64-bit for interpreter. ... pointers in the interpreter are of the form: | pointer id | pointer offset |, where pointer id is an offset into an array that contains information about the pointer like its bounds.	15 years ago
Török Edvin	c09f9b2941	Fix bytecode on bigendian. ... The last commits broke it: we store bytecode constants little-endian-like, so an 8-bit constant is at offset 0, a 16-bit one at offsets 0,1; a 32-bit one at 0,1,2,3; and a 64-bit one 0,1,2,3,4,5,6,7,8. Of course the constant itself is in host-endianness.	15 years ago
Török Edvin	88d54dcb72	Fix distcheck warnings.	15 years ago
Török Edvin	b1018ea52e	Fix another interpreter bug accessing structs. ... Now that structs are not size 0, fix accessing their fields: need to map field reads to byte offsets, not struct field index!	15 years ago
Török Edvin	669623d5a6	Fix computation of type sizes in interpreter. ... It was not computing the size of structs. Bug: all bytecodes that had structs on the stack failed with internal out-of-bounds errors. Workaround: compiler will need to avoid putting structs on stack, or do so only for FLEVEL == 0.96.2	15 years ago
Török Edvin	0d4c99465e	Add the builtin bytecode.	15 years ago
Török Edvin	d5ffa2acff	Introduce BC_STARTUP bytecode (bb #2101, #2078). ... This bytecode will be run in interpreter mode on startup: it can disable the JIT, or disable all further bytecodes. There will be a builtin copy of it that is loaded if no BC_STARTUP bytecodes were loaded (like filetypes_int.h and daily.ftm). Only one BC_STARTUP bytecode is accepted, so as soon as bytecode.cvd will contain one, it won't be overridable! This bytecode will replace all the JIT checks (CPU, selinux, pax) etc., and allows to disable the JIT on just specific OS/arch/compiler/etc. combinations. There are too many combinations to have a dconf flag for each. Also fix the bytecode dconf so that the individual JIT_* flags actually work (previously we could disable the entire JIT, or none at all). Also introduce preliminary support for bytecode test mode (we already have auto, jit and interpreter mode, introducing another mode here is easiest). The test mode doesn't actually compare the outputs yet, but it does fail if the JIT is disabled / falls back to interpreter.	15 years ago
Török Edvin	927d054838	Add engine param to bytecode, and remove dconf from _init.	15 years ago
Török Edvin	a5a19f4518	bytecode: PaX and selfcheck. ... Detect PaX and fallback to intepreter if needed (bb #2092). Recent PaX versions deny the RWX mapping, but older versions silently change it to RW, which causes the program to die as soon as it tries to execute JITed code. Add selfcheck on startup (bb #2092). This will run a very simple bytecode on startup in both JIT and interpreter mode. The bytecode only calls 1 libclamav API and returns.	15 years ago
Tomasz Kojm	ffa9b06093	sigtool: print match count and offsets in --test-sigs mode (bb#2054) ... IMPORTANT NOTE: --test-sigs now only works against the final target file (after all processing, normalization, etc. for which the tested signature was directly created)	15 years ago
Török Edvin	5475ec2a72	Don't attempt to allocate 0 bytes (bb #2042).	15 years ago
Török Edvin	cbb9db1941	Fix some error path leaks (bb #1990). ... This doesn't actually fix bb #1990 (which is about high memory usage on RHEL6), but fixes some leaks found while investigating that bug.	15 years ago
Török Edvin	e5f2b2c530	fix build	15 years ago
Török Edvin	6cd36d95f9	bytecode: first close then unlink. ... should fix win32.	15 years ago
Török Edvin	a3a6b8138d	Handle global gep parameter correctly (bb #1955).	15 years ago
Török Edvin	fa0a9143bb	Fix types for store/copy instructions.	15 years ago
Török Edvin	7a7365efe9	0.96.1 new APIs (cli_map etc.)	15 years ago
Török Edvin	1c4683acd1	add match_offsets support.	15 years ago
Török Edvin	3735fda134	min/max functionality level support.	15 years ago
Török Edvin	e86fe7ea90	Add debug messages about how bytecodes are executed (JIT/interpreter).	15 years ago
Török Edvin	b28845c3de	Fix cli_unlink warnings (bb #1956). ... fd == 0 is used to mark an invalid fd (not fd -1). Test that tempfile is not NULL before calling cli_unlink (that is the cause of the Bad address errors). Also call cli_unlink when a virus is found. This isn't strictly necessary since the file will get removed by the parent's rmdirs(), but there is no point in leaving it behind.	15 years ago
Török Edvin	e4a0f2c94f	fix compiler warnings (bb #1872, bb #1934, bb #1935)	15 years ago
Török Edvin	b00a7cc8f8	jsnorm api.	15 years ago
Török Edvin	dcaa403826	Fix use-of-uninit memory on zeroinitializer.	15 years ago
Török Edvin	349e6e118b	More interpreter fixes, pdf.cbc seems to be running now.	15 years ago
Török Edvin	44e134312c	More fixes for pdf.cbc.	15 years ago
Török Edvin	0d9b99f43e	Fix bswap.cbc in interpreter mode.	15 years ago