193 Commits (b4d33ebcf7013f37866bbe8713001b3516ea5000)

Author	SHA1	Message	Date
aCaB	febc0c9f77	add whitelisting via cb to phish sigs too	15 years ago
aCaB	aaeba8ea08	clcb_sigload: ... - don't skip sdb - skip cbc - retrieve proper db name for md5 sigs	15 years ago
Török Edvin	88d54dcb72	Fix distcheck warnings.	15 years ago
Török Edvin	d5ffa2acff	Introduce BC_STARTUP bytecode (bb #2101, #2078). ... This bytecode will be run in interpreter mode on startup: it can disable the JIT, or disable all further bytecodes. There will be a builtin copy of it that is loaded if no BC_STARTUP bytecodes were loaded (like filetypes_int.h and daily.ftm). Only one BC_STARTUP bytecode is accepted, so as soon as bytecode.cvd will contain one, it won't be overridable! This bytecode will replace all the JIT checks (CPU, selinux, pax) etc., and allows to disable the JIT on just specific OS/arch/compiler/etc. combinations. There are too many combinations to have a dconf flag for each. Also fix the bytecode dconf so that the individual JIT_* flags actually work (previously we could disable the entire JIT, or none at all). Also introduce preliminary support for bytecode test mode (we already have auto, jit and interpreter mode, introducing another mode here is easiest). The test mode doesn't actually compare the outputs yet, but it does fail if the JIT is disabled / falls back to interpreter.	15 years ago
Török Edvin	927d054838	Add engine param to bytecode, and remove dconf from _init.	15 years ago
Tomasz Kojm	44712fcbe7	libclamav: reduce memory usage for MD5 sigs (bb#2057)	15 years ago
aCaB	eb422a03cf	callback draft - WIP	15 years ago
Török Edvin	a2f709da0b	Fix memory leak in .idb handling. ... This only occurs if not using mempool.	15 years ago
Török Edvin	cbb9db1941	Fix some error path leaks (bb #1990). ... This doesn't actually fix bb #1990 (which is about high memory usage on RHEL6), but fixes some leaks found while investigating that bug.	15 years ago
Tomasz Kojm	7eb6bac71c	libclamav/readdb.c: properly reject .info files passed on cmdline (bb#2025)	15 years ago
Török Edvin	1453c0a3eb	Read entire .cbc file. Fix loading of bytecode.cvd. ... cvd.c checks that we read the entire file, which we don't for skipped bytecodes. And we don't read the trailing source code from cbcs. This all worked for small cbcs since reading the header was enough to get the entire cbc into the dbio buffer.	15 years ago
Tomasz Kojm	fa4d635307	libclamav/readdb.c: add checks to enforce lsig compatibility with 0.95.x (bb#2008)	15 years ago
Török Edvin	3735fda134	min/max functionality level support.	15 years ago
Tomasz Kojm	02e46f3fdb	libclamav: avoid loading duplicate databases (bb#1962)	15 years ago
Török Edvin	e4a0f2c94f	fix compiler warnings (bb #1872, bb #1934, bb #1935)	15 years ago
Török Edvin	92a08a03bf	--enable-unsigned-bytecode. ... Use this instead of --enable-debug to enable load of unsigned bytecode.	15 years ago
Török Edvin	9c92344b09	Only load signed bytecode by default.	15 years ago
Tomasz Kojm	4f3997d67a	libclamav: fix cl_cvdparse() leak (bb#1859)	15 years ago
Tomasz Kojm	8dd6c63cce	avoid marking internal ftypes UNOFFICIAL	15 years ago
Tomasz Kojm	2979de20da	fix some compiler warnings	15 years ago
Tomasz Kojm	486fd3daf5	clean up some checks	15 years ago
Török Edvin	5b74e89a35	enable prefiltering, and add to dconf. ... Also downgrade some warnings to debug messages.	15 years ago
Török Edvin	6eeadbfeda	dconf for bytecode.	15 years ago
Török Edvin	039af772c8	Don't fail if bytecode was skipped due to functionality level.	15 years ago
Török Edvin	cc4b3fca6c	fix memory leak in prefiltering code.	15 years ago
Tomasz Kojm	d46cdd59ea	libclamav: add cl_countsigs() (bb#1473)	16 years ago
Török Edvin	ab89360583	Support for macros in logical subsignatures (bb #164). ... In the LDB there is (one or more) special subsignature ${min-max}MACROID$, which means: must match any signature from group MACROID (for current filetype), and the match must occur at a distance of min-max from the start(!) of the previous logical subsignature match. It also has the sideeffect of making the previous subsignature considered a match only if both that and the macro matches. The offset of first match for the previous logical subsig will be the offset where the {min-max} distance is satisfied. The macro logical subsignature will have a count of 0 (if it didn't match together with the previous subsig), or a count of 1 if it did. The matches can occur anywhere (even in different ac scan buffers), since I don't call cli_ac_scanbuff I just use the offset of first match (which we have for the bytecode anyway). There can be at most 32 macro groups, signatures are added to a macro group by using $MACROID$ as offset. For example pdb entries could be converted to PDB:3:$0:<hexsig of domainname> if we assign macro id 0 to PDB (and we can assign 31 more macro ids to whatever). Example: test.ldb: TestMacro;Target:0;0&1;616161;${3-4}12$ test.ndb: D:0:$12:6262 D:0:$12:6363 D:0:$11:6262 test.dat: aaaaxccdd test-nomatch.dat: aaaaxxxccdd	16 years ago
Tomasz Kojm	e293229df0	don't count lsig associated with bc	16 years ago
Török Edvin	57f14280a7	Fix use-after-free on bytecode load/execution. ... lsig->bc was referring to the bytecode directly (via a pointer), but the bytecode struct changes place in memory (it is realloced on each .cbc load). So use an index instead of the direct pointer.	16 years ago
Tomasz Kojm	bb1e844cc2	fix some warnings	16 years ago
Tomasz Kojm	de351ee1bc	libclamav: handle digitally signed .info files	16 years ago
Török Edvin	a35cfe5137	print bytecode metadata.	16 years ago
Török Edvin	be43f951c6	BytecodeSecurity setting.	16 years ago
Tomasz Kojm	ace26bfe08	libclamav: check .info files while loading CVD/CLD	16 years ago
Tomasz Kojm	0c234f5ffd	CL_DB_CVDNOTMP is now the only way to load .cvd/.cld files; prepare ... for .info signing	16 years ago
Török Edvin	f4e3421592	Support PE hook bytecodes triggered by logical signature.	16 years ago
Török Edvin	261e29da34	Fix bus error on Sparc. ... Now that we have a struct with a 64-bit int member, we need to align everything to 64-bits on sparc! The FRAG itself was aligned, however the ->fake member was at 4-bytes distance (so half the time unaligned). Fix this by adding a dummy 64-bit member in the union to force alignment to at least 64-bit. Also fix some compiler warnings from make distcheck.	16 years ago
Tomasz Kojm	570b1d0050	libclamav: cdb: drop FileType; cover ARJ, CAB, TAR, CPIO and 7Z	16 years ago
aCaB	6223810ba0	tie cache to engine	16 years ago
Tomasz Kojm	545247afb0	libclamav/readdb.c: fix compatibility issue with .zmd sigs (bb#1793)	16 years ago
Tomasz Kojm	12c6a97e9b	fix some compiler warnings	16 years ago
Török Edvin	1d406931e2	Fix array size for parsing .ldb tokens. ... Looks like a wrong merge of the bytecode branch, str_tokenize was updated to use LDB_TOKENS+1, but not the variable's declaration!	16 years ago
Tomasz Kojm	4168b01087	libclamav: allow lsigs be anchored to specific containers (bb#1293), eg. Container:CL_TYPE_ZIP	16 years ago
Tomasz Kojm	8d2654bb3f	libclamav/readdb.c: when some lsig's attribute is unknown ignore the entire signature and not the attribute itself	16 years ago
Tomasz Kojm	15f413d157	libclamav: handle zmd/rmd with cdb (bb#1579)	16 years ago
Tomasz Kojm	20e4199352	fix tokens	16 years ago
Tomasz Kojm	55094a9c76	libclamav: base code for unified container metadata matcher (bb#1579)	16 years ago
Török Edvin	e1120abceb	Fix logic.	16 years ago
aCaB	7134c8e007	force VI anchored sigs into AC	16 years ago
Tomasz Kojm	01b695fd42	fix error message	16 years ago