clamav

Commit Graph

Author	SHA1	Message	Date
Török Edvin	e6ec609032	Support building with external LLVM 2.8. Adds --with-system-llvm=/path/to/llvm-config	15 years ago
Török Edvin	70c222c99c	save lsig counts/offsets (bb #2055 ).	15 years ago
Török Edvin	d1a28db048	Fix off by two in new pdf parser.	15 years ago
Török Edvin	762d46e8ea	Fix matchicon bytecode API (bb #2139 ). Now you can call it both from a normal lsig triggered BC, and from a PE hook BC. The normal lsig triggered BC has exe_info (but not PE info) which allows it to invoke the icon matcher API. Also putting ICONGROUP1 into the ldb trigger of the bytecode works.	15 years ago
Török Edvin	e865b2d8e3	typo	15 years ago
Török Edvin	7882e72107	Reset virname after iconscan API called from bytecode.	15 years ago
Török Edvin	a8935f90b9	Update startup.cbc (bb #2151 ). It is a compiler bug, shortcircuiting the bigendian path to return 0xdead11. Since this test is meant to test libclamav, disable this test for now. When the compiler is fixed (bb #2157) the test can be readded.	15 years ago
Török Edvin	213dfdff06	run 1 unit-test at least in test mode (bb #2151 ). Also allow running test mode if JIT is not available, still checking for failed startup.cbc execution.	15 years ago
Török Edvin	1dae00ebf4	bytecode: add icon match API.	15 years ago
Török Edvin	dc200c6b19	Add bytecode API for pdf.	15 years ago
Török Edvin	f14bf644de	Guard Heuristics.PDF.ObfuscatedNameObject by CL_SCAN_ALGORITHMIC.	15 years ago
aCaB	5b4b8ddff6	be fixes - bb#2151	15 years ago
Tomasz Kojm	9d10f054a5	libclamav/matcher: make icon sigs work with bytecode (bb#2137)	15 years ago
Török Edvin	9acc81d603	pdf: improve handling of truncated files, and fix some filter handling bugs. Also don't dump images by default, this will be overridable from bytecode.	15 years ago
Török Edvin	cacd0927b4	pdf: fix uninitialized values, and bytesleft.	15 years ago
Török Edvin	e8c7cc2185	pdf: avoid negative lengths. Thanks to nitrox for reporting.	15 years ago
Török Edvin	80db7712ec	Add filter abbreviations used in images.	15 years ago
Török Edvin	b835a528db	Some more fixes for signed/encrypted pdfs.	15 years ago
Török Edvin	edeb59b344	Some flag fixes for pdf.	15 years ago
Török Edvin	f984f75bbc	Improve handling of pdf streams. Also dump undecompressable streams, since we are not decrypting.	15 years ago
aCaB	a66201acd1	bump CLI_MAX_ALLOCATION - bb#2124	15 years ago
aCaB	08b5aec381	fix previous: typo in unit_tests, order in cli_exe_info	15 years ago
aCaB	453d818022	use cached metadata in icon parser, add icon unit tests	15 years ago
Török Edvin	2a599782aa	Disable debug code in pdf.	15 years ago
Török Edvin	eb270d5a36	Improve extraction of PDF objects (bb #1596 , #1994 , #2029 ). Seems to extract most pdf/openaction/and streams (flate, ascii85, asciihex). Doesn't normalize extracted JS, that will be done once bytecode hooks are added.	15 years ago
Török Edvin	69650bea38	win32 build fix. forgot to commit.	15 years ago
Török Edvin	d3f99af1ea	Remove duplicate header.	15 years ago
Török Edvin	dbd3ed9345	Make BC_STARTUP run a minimal self-test. Also change return value to something else than 0. It is too easy for buggy bytecode to return 0.	15 years ago
Török Edvin	b3b8b6dd40	Pointers are always 64-bit for interpreter. pointers in the interpreter are of the form: \| pointer id \| pointer offset \|, where pointer id is an offset into an array that contains information about the pointer like its bounds.	15 years ago
Török Edvin	c09f9b2941	Fix bytecode on bigendian. The last commits broke it: we store bytecode constants little-endian-like, so an 8-bit constant is at offset 0, a 16-bit one at offsets 0,1; a 32-bit one at 0,1,2,3; and a 64-bit one 0,1,2,3,4,5,6,7,8. Of course the constant itself is in host-endianness.	15 years ago
Török Edvin	88d54dcb72	Fix distcheck warnings.	15 years ago
aCaB	2445be8c34	cli_lsig_eval use cached info	15 years ago
Török Edvin	b1018ea52e	Fix another interpreter bug accessing structs. Now that structs are not size 0, fix accessing their fields: need to map field reads to byte offsets, not struct field index!	15 years ago
Török Edvin	669623d5a6	Fix computation of type sizes in interpreter. It was not computing the size of structs. Bug: all bytecodes that had structs on the stack failed with internal out-of-bounds errors. Workaround: compiler will need to avoid putting structs on stack, or do so only for FLEVEL == 0.96.2	15 years ago
Török Edvin	9f1715ccea	Add new bytecode APIs to access the environment. check_platform(...) is an API that can be used to: - blacklist JIT/bytecode on just a very specific platform (not recommended) - mask (with 0xf/0xff) some fields, and keep just the flags that uniquely identify the system where a bug occurs (for example linux + ppc32). - it returns a bool so you can do further checks if needed. The bytecode also has access to all the information collected from the environment, so it can make more detailed decisions (based on CPU, presence of SELinux/PaX, etc.). You can't introduce new detections via bytecode, but you can write new conditions using existing ones. The previously added builtin bytecode moved all the JIT disable logic to bytecode for easy updating.	15 years ago
Török Edvin	0d4c99465e	Add the builtin bytecode.	15 years ago
Török Edvin	d5ffa2acff	Introduce BC_STARTUP bytecode (bb #2101 , #2078 ). This bytecode will be run in interpreter mode on startup: it can disable the JIT, or disable all further bytecodes. There will be a builtin copy of it that is loaded if no BC_STARTUP bytecodes were loaded (like filetypes_int.h and daily.ftm). Only one BC_STARTUP bytecode is accepted, so as soon as bytecode.cvd will contain one, it won't be overridable! This bytecode will replace all the JIT checks (CPU, selinux, pax) etc., and allows to disable the JIT on just specific OS/arch/compiler/etc. combinations. There are too many combinations to have a dconf flag for each. Also fix the bytecode dconf so that the individual JIT_* flags actually work (previously we could disable the entire JIT, or none at all). Also introduce preliminary support for bytecode test mode (we already have auto, jit and interpreter mode, introducing another mode here is easiest). The test mode doesn't actually compare the outputs yet, but it does fail if the JIT is disabled / falls back to interpreter.	15 years ago
Török Edvin	927d054838	Add engine param to bytecode, and remove dconf from _init.	15 years ago
Török Edvin	78f73f0f77	Add new files to build system.	15 years ago
Török Edvin	c85060ff79	Move environment detection code to bytecode_detect.c. This is in preparation for bug #2078, so that the bytecodes can turn themselves off based on more than just the arch itself.	15 years ago
aCaB	dc0bf21281	fix variable declaration	15 years ago
aCaB	822160b599	use fmap in embpe	15 years ago
aCaB	ac867aad67	use fmap in autoit	15 years ago
Török Edvin	8977ed61fe	Update paxctl message to 'paxctl -cm' (bb #2092 ).	15 years ago
Török Edvin	7da37b9648	Don't phishcheck email addresses (bb #2067 ). To avoid false positives.	15 years ago
Török Edvin	598d7edae0	Fix use of uninitialized value (bb #2140 ). This bug may cause crashes in certain cases.	15 years ago
aCaB	92ba841614	vs10 compat, upgrading vcprojs soon	15 years ago
Török Edvin	a5a19f4518	bytecode: PaX and selfcheck. Detect PaX and fallback to intepreter if needed (bb #2092). Recent PaX versions deny the RWX mapping, but older versions silently change it to RW, which causes the program to die as soon as it tries to execute JITed code. Add selfcheck on startup (bb #2092). This will run a very simple bytecode on startup in both JIT and interpreter mode. The bytecode only calls 1 libclamav API and returns.	15 years ago
Tomasz Kojm	6e2b40687f	libclamav/mspack.c: fix write error	15 years ago
aCaB	38681d6bd9	clam4win: resolve errors	15 years ago

1 2 3 4 5 ...

1906 Commits (e6ec6090320bb74f7991fb5e3ac0d9bdb3cb9052)