ClamAV is an open source (GPLv2) anti-virus toolkit.

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Micah Snyder 2e55c901b1 Fix byte-compare subsignature premature alert ... The byte compare feature in logical signatures will cause the rule to alert if it successfully matches regardless of the rest of the logical signature. An easy way to test this is with a logical signature that has two bcomp subsignatures and requires both to match for the rule to alert. In the following example, we have 4 signatures where - the first will match both bcomp subsigs. - the second will match neither. - the last two match just one bcomp subsig. In an --allmatch test, you'll find that the 3 of these match, with the first one matching *twice*, once for each bcomp subsig. test.ldb: ``` bcomp.both;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=123);4242;2(>>5#hb2#=255) bcomp.neither;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=124);4242;2(>>5#hb2#=254) bcomp.second;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=124);4242;2(>>5#hb2#=255) bcomp.first;Engine:51-255,Target:0;0&1&2&3;4141;0(>>5#hb2#=123);4242;2(>>5#hb2#=254) ``` test.sample: ``` AA = 7B; BB = FF ``` You can also try a similar test to compare the behavior with regular ac-pattern-match subsigs with this lsig-test.ldb: ``` pattern.both;Engine:51-255,Target:0;0&1;4141;4242 pattern.neither;Engine:51-255,Target:0;0&1;4140;4241 pattern.second;Engine:51-255,Target:0;0&1;4140;4242 pattern.first;Engine:51-255,Target:0;0&1;4141;4241 ``` This commit fixes the issue by incrementing the logical subsignature count for each bcomp subsig match instead of appending an alert for each bcomp match. Also removed call to `lsig_sub_matched()` that didn't do anything.		4 years ago
..
7z	fuzz-17763: Fix leak in Xz error handling	6 years ago
c++	Add explicit log level parameter to application logging API	4 years ago
jsparse	Add explicit log level parameter to application logging API	4 years ago
lzw	Add explicit log level parameter to application logging API	4 years ago
nsis	libclamav: Fix scan recursion tracking	4 years ago
regex	Assortment of warning fixes.	6 years ago
tomsfastmath	Update vendored TomsFastMath code to 0.13.1	4 years ago
7z_iface.c	Bump copyright for 2022	4 years ago
7z_iface.h	Bump copyright for 2022	4 years ago
CMakeLists.txt	CMake: Support external TomsFastMath library (libtfm)	4 years ago
Doxyfile	…
adc.c	Bump copyright for 2022	4 years ago
adc.h	Bump copyright for 2022	4 years ago
apm.c	Bump copyright for 2022	4 years ago
apm.h	Add explicit log level parameter to application logging API	4 years ago
arc4.c	Bump copyright for 2022	4 years ago
arc4.h	Bump copyright for 2022	4 years ago
asn1.c	Add explicit log level parameter to application logging API	4 years ago
asn1.h	Bump copyright for 2022	4 years ago
aspack.c	Bump copyright for 2022	4 years ago
aspack.h	Bump copyright for 2022	4 years ago
autoit.c	Add explicit log level parameter to application logging API	4 years ago
autoit.h	Bump copyright for 2022	4 years ago
bcfeatures.h	Bump copyright for 2022	4 years ago
bignum.h	Update vendored TomsFastMath code to 0.13.1	4 years ago
binhex.c	Bump copyright for 2022	4 years ago
binhex.h	Bump copyright for 2022	4 years ago
blob.c	Add explicit log level parameter to application logging API	4 years ago
blob.h	Add explicit log level parameter to application logging API	4 years ago
builtin_bytecodes.h	Bump copyright for 2022	4 years ago
bytecode.c	Add explicit log level parameter to application logging API	4 years ago
bytecode.h	Bump copyright for 2022	4 years ago
bytecode_api.c	Add explicit log level parameter to application logging API	4 years ago
bytecode_api.h	Add explicit log level parameter to application logging API	4 years ago
bytecode_api_decl.c	Bump copyright for 2022	4 years ago
bytecode_api_impl.h	Bump copyright for 2022	4 years ago
bytecode_detect.c	Bump copyright for 2022	4 years ago
bytecode_detect.h	Bump copyright for 2022	4 years ago
bytecode_hooks.h	Bump copyright for 2022	4 years ago
bytecode_nojit.c	Bump copyright for 2022	4 years ago
bytecode_priv.h	Bump copyright for 2022	4 years ago
bytecode_vm.c	Bump copyright for 2022	4 years ago
cache.c	Update vendored TomsFastMath code to 0.13.1	4 years ago
cache.h	Bump copyright for 2022	4 years ago
clamav.h	Bump copyright for 2022	4 years ago
clambc.h	Bump copyright for 2022	4 years ago
conv.c	Add CMake build tooling	5 years ago
conv.h	…
cpio.c	Bump copyright for 2022	4 years ago
cpio.h	Bump copyright for 2022	4 years ago
crtmgr.c	Update vendored TomsFastMath code to 0.13.1	4 years ago
crtmgr.h	Update vendored TomsFastMath code to 0.13.1	4 years ago
crypto.c	Add CMake build tooling	5 years ago
cvd.c	Bump copyright for 2022	4 years ago
cvd.h	Bump copyright for 2022	4 years ago
dconf.c	Bump copyright for 2022	4 years ago
dconf.h	Bump copyright for 2022	4 years ago
default.h	Bump copyright for 2022	4 years ago
disasm-common.h	Bump copyright for 2022	4 years ago
disasm.c	Bump copyright for 2022	4 years ago
disasm.h	Bump copyright for 2022	4 years ago
disasmpriv.h	Bump copyright for 2022	4 years ago
dlp.c	Add explicit log level parameter to application logging API	4 years ago
dlp.h	Bump copyright for 2022	4 years ago
dmg.c	Bump copyright for 2022	4 years ago
dmg.h	Bump copyright for 2022	4 years ago
dsig.c	Update vendored TomsFastMath code to 0.13.1	4 years ago
dsig.h	Migrate script2cdiff from sigtool.c to cdiff.rs	4 years ago
egg.c	Add explicit log level parameter to application logging API	4 years ago
egg.h	Bump copyright for 2022	4 years ago
elf.c	Bump copyright for 2022	4 years ago
elf.h	Bump copyright for 2022	4 years ago
encoding_aliases.h	Bump copyright for 2022	4 years ago
entconv.c	Add explicit log level parameter to application logging API	4 years ago
entconv.h	Bump copyright for 2022	4 years ago
entitylist.h	Bump copyright for 2022	4 years ago
events.c	Bump copyright for 2022	4 years ago
events.h	Bump copyright for 2022	4 years ago
execs.c	Add explicit log level parameter to application logging API	4 years ago
execs.h	Add explicit log level parameter to application logging API	4 years ago
explode.c	Add explicit log level parameter to application logging API	4 years ago
explode.h	Bump copyright for 2022	4 years ago
filetypes.c	Bump copyright for 2022	4 years ago
filetypes.h	Bump copyright for 2022	4 years ago
filetypes_int.h	Bump copyright for 2022	4 years ago
filtering.c	Add explicit log level parameter to application logging API	4 years ago
filtering.h	Bump copyright for 2022	4 years ago
fmap.c	Add explicit log level parameter to application logging API	4 years ago
fmap.h	Bump copyright for 2022	4 years ago
fpu.c	Bump copyright for 2022	4 years ago
fpu.h	Bump copyright for 2022	4 years ago
fsg.c	Bump copyright for 2022	4 years ago
fsg.h	Bump copyright for 2022	4 years ago
gif.c	Bump copyright for 2022	4 years ago
gif.h	Bump copyright for 2022	4 years ago
gpt.c	Bump copyright for 2022	4 years ago
gpt.h	Add explicit log level parameter to application logging API	4 years ago
hashtab.c	Add explicit log level parameter to application logging API	4 years ago
hashtab.h	Bump copyright for 2022	4 years ago
hfsplus.c	Add explicit log level parameter to application logging API	4 years ago
hfsplus.h	Bump copyright for 2022	4 years ago
hostid_internal.c	Add explicit log level parameter to application logging API	4 years ago
hostid_internal.h	Add CMake build tooling	5 years ago
htmlnorm.c	Add explicit log level parameter to application logging API	4 years ago
htmlnorm.h	Bump copyright for 2022	4 years ago
hwp.c	Add explicit log level parameter to application logging API	4 years ago
hwp.h	Bump copyright for 2022	4 years ago
iana_cctld.h	…
iana_tld.h	…
inffixed64.h	…
inflate64.c	…
inflate64.h	…
inflate64_priv.h	…
iowrap.c	Bump copyright for 2022	4 years ago
iowrap.h	Bump copyright for 2022	4 years ago
is_tar.c	Add explicit log level parameter to application logging API	4 years ago
is_tar.h	libclamav: Fix scan recursion tracking	4 years ago
ishield.c	Bump copyright for 2022	4 years ago
ishield.h	Bump copyright for 2022	4 years ago
iso9660.c	Bump copyright for 2022	4 years ago
iso9660.h	Bump copyright for 2022	4 years ago
jpeg.c	Bump copyright for 2022	4 years ago
jpeg.h	Bump copyright for 2022	4 years ago
json_api.c	Bump copyright for 2022	4 years ago
json_api.h	Bump copyright for 2022	4 years ago
libclamav.map	CMake: Add CTest support to match Autotools checks	5 years ago
libclamav_main.c	Bump copyright for 2022	4 years ago
libmspack.c	Fix ability to disable filesize limit with libclamav C API	4 years ago
libmspack.h	Add explicit log level parameter to application logging API	4 years ago
line.c	Bump copyright for 2022	4 years ago
line.h	Bump copyright for 2022	4 years ago
lzma_iface.c	Bump copyright for 2022	4 years ago
lzma_iface.h	Bump copyright for 2022	4 years ago
macho.c	Bump copyright for 2022	4 years ago
macho.h	Bump copyright for 2022	4 years ago
matcher-ac.c	Bump copyright for 2022	4 years ago
matcher-ac.h	Bump copyright for 2022	4 years ago
matcher-bm.c	Add explicit log level parameter to application logging API	4 years ago
matcher-bm.h	Bump copyright for 2022	4 years ago
matcher-byte-comp.c	Fix byte-compare subsignature premature alert	4 years ago
matcher-byte-comp.h	Fix byte-compare subsignature premature alert	4 years ago
matcher-hash.c	Bump copyright for 2022	4 years ago
matcher-hash.h	Bump copyright for 2022	4 years ago
matcher-pcre.c	Add explicit log level parameter to application logging API	4 years ago
matcher-pcre.h	Bump copyright for 2022	4 years ago
matcher.c	Fix byte-compare subsignature premature alert	4 years ago
matcher.h	Bump copyright for 2022	4 years ago
mbox.c	Add explicit log level parameter to application logging API	4 years ago
mbox.h	Bump copyright for 2022	4 years ago
mbr.c	Bump copyright for 2022	4 years ago
mbr.h	Bump copyright for 2022	4 years ago
message.c	Add explicit log level parameter to application logging API	4 years ago
message.h	Add explicit log level parameter to application logging API	4 years ago
mew.c	Add explicit log level parameter to application logging API	4 years ago
mew.h	Bump copyright for 2022	4 years ago
mpool.c	Bump copyright for 2022	4 years ago
mpool.h	Bump copyright for 2022	4 years ago
msdoc.c	Add explicit log level parameter to application logging API	4 years ago
msdoc.h	Bump copyright for 2022	4 years ago
msexpand.c	Bump copyright for 2022	4 years ago
msexpand.h	Bump copyright for 2022	4 years ago
msxml.c	Bump copyright for 2022	4 years ago
msxml.h	Bump copyright for 2022	4 years ago
msxml_parser.c	Add explicit log level parameter to application logging API	4 years ago
msxml_parser.h	Bump copyright for 2022	4 years ago
ole2_extract.c	Add explicit log level parameter to application logging API	4 years ago
ole2_extract.h	Bump copyright for 2022	4 years ago
ooxml.c	OOXML: Fix invalid pointer dereference	4 years ago
ooxml.h	Bump copyright for 2022	4 years ago
openioc.c	Bump copyright for 2022	4 years ago
openioc.h	Bump copyright for 2022	4 years ago
others.c	Add explicit log level parameter to application logging API	4 years ago
others.h	Add explicit log level parameter to application logging API	4 years ago
others_common.c	Add explicit log level parameter to application logging API	4 years ago
packlibs.c	Bump copyright for 2022	4 years ago
packlibs.h	Bump copyright for 2022	4 years ago
partition_intersection.c	Bump copyright for 2022	4 years ago
partition_intersection.h	Bump copyright for 2022	4 years ago
pdf.c	Add explicit log level parameter to application logging API	4 years ago
pdf.h	Bump copyright for 2022	4 years ago
pdfdecode.c	Bump copyright for 2022	4 years ago
pdfdecode.h	Bump copyright for 2022	4 years ago
pdfng.c	Add explicit log level parameter to application logging API	4 years ago
pe.c	Add explicit log level parameter to application logging API	4 years ago
pe.h	Bump copyright for 2022	4 years ago
pe_icons.c	Add explicit log level parameter to application logging API	4 years ago
pe_icons.h	Bump copyright for 2022	4 years ago
pe_structs.h	Add explicit log level parameter to application logging API	4 years ago
perflogging.c	Add explicit log level parameter to application logging API	4 years ago
perflogging.h	Bump copyright for 2022	4 years ago
petite.c	Bump copyright for 2022	4 years ago
petite.h	Bump copyright for 2022	4 years ago
phish_allow_list.c	Bump copyright for 2022	4 years ago
phish_allow_list.h	Bump copyright for 2022	4 years ago
phish_domaincheck_db.c	Bump copyright for 2022	4 years ago
phish_domaincheck_db.h	Bump copyright for 2022	4 years ago
phishcheck.c	Add explicit log level parameter to application logging API	4 years ago
phishcheck.h	Bump copyright for 2022	4 years ago
png.c	Remove Heuristics.PNG.CVE-2010-1205 detection	4 years ago
png.h	Bump copyright for 2022	4 years ago
qsort.c	Add explicit log level parameter to application logging API	4 years ago
queue.h	Add CMake build tooling	5 years ago
readdb.c	Add explicit log level parameter to application logging API	4 years ago
readdb.h	Bump copyright for 2022	4 years ago
rebuildpe.c	Bump copyright for 2022	4 years ago
rebuildpe.h	Bump copyright for 2022	4 years ago
regex_list.c	Add explicit log level parameter to application logging API	4 years ago
regex_list.h	Bump copyright for 2022	4 years ago
regex_pcre.c	Add explicit log level parameter to application logging API	4 years ago
regex_pcre.h	Bump copyright for 2022	4 years ago
regex_suffix.c	Add explicit log level parameter to application logging API	4 years ago
regex_suffix.h	Bump copyright for 2022	4 years ago
rijndael.c	…
rijndael.h	Adding support for Adobe Reader X encryption scheme	6 years ago
rtf.c	Add explicit log level parameter to application logging API	4 years ago
rtf.h	Bump copyright for 2022	4 years ago
scanners.c	Add explicit log level parameter to application logging API	4 years ago
scanners.h	Bump copyright for 2022	4 years ago
sf_base64decode.c	Add explicit log level parameter to application logging API	4 years ago
sf_base64decode.h	Bump copyright for 2022	4 years ago
sis.c	Add explicit log level parameter to application logging API	4 years ago
sis.h	Bump copyright for 2022	4 years ago
special.c	Add explicit log level parameter to application logging API	4 years ago
special.h	Bump copyright for 2022	4 years ago
spin.c	Bump copyright for 2022	4 years ago
spin.h	Bump copyright for 2022	4 years ago
stats.c	Add CMake build tooling	5 years ago
stats.h	…
stats_json.c	Add CMake build tooling	5 years ago
stats_json.h	…
str.c	Add explicit log level parameter to application logging API	4 years ago
str.h	Bump copyright for 2022	4 years ago
strlcat.c	…
swf.c	Bump copyright for 2022	4 years ago
swf.h	Bump copyright for 2022	4 years ago
table.c	Add explicit log level parameter to application logging API	4 years ago
table.h	Bump copyright for 2022	4 years ago
text.c	Add explicit log level parameter to application logging API	4 years ago
text.h	Bump copyright for 2022	4 years ago
textdet.c	Add explicit log level parameter to application logging API	4 years ago
textdet.h	Bump copyright for 2022	4 years ago
textnorm.c	Update vendored TomsFastMath code to 0.13.1	4 years ago
textnorm.h	Bump copyright for 2022	4 years ago
tiff.c	Add explicit log level parameter to application logging API	4 years ago
tiff.h	Bump copyright for 2022	4 years ago
tnef.c	Add explicit log level parameter to application logging API	4 years ago
tnef.h	Bump copyright for 2022	4 years ago
type_desc.h	Bump copyright for 2022	4 years ago
unarj.c	Add explicit log level parameter to application logging API	4 years ago
unarj.h	Bump copyright for 2022	4 years ago
uniq.c	Bump copyright for 2022	4 years ago
uniq.h	Bump copyright for 2022	4 years ago
unsp.c	Bump copyright for 2022	4 years ago
unsp.h	Bump copyright for 2022	4 years ago
untar.c	Add explicit log level parameter to application logging API	4 years ago
untar.h	Bump copyright for 2022	4 years ago
unzip.c	Bump copyright for 2022	4 years ago
unzip.h	Bump copyright for 2022	4 years ago
upack.c	Add explicit log level parameter to application logging API	4 years ago
upack.h	Bump copyright for 2022	4 years ago
upx.c	Add explicit log level parameter to application logging API	4 years ago
upx.h	Bump copyright for 2022	4 years ago
uuencode.c	Bump copyright for 2022	4 years ago
uuencode.h	Bump copyright for 2022	4 years ago
vba_extract.c	Add explicit log level parameter to application logging API	4 years ago
vba_extract.h	Bump copyright for 2022	4 years ago
version.c	…
version.h.in	Add CMake build tooling	5 years ago
wwunpack.c	Bump copyright for 2022	4 years ago
wwunpack.h	Bump copyright for 2022	4 years ago
www.c	Bump copyright for 2022	4 years ago
www.h	…
xar.c	Bump copyright for 2022	4 years ago
xar.h	Bump copyright for 2022	4 years ago
xdp.c	Update vendored TomsFastMath code to 0.13.1	4 years ago
xdp.h	Record names of extracted files	6 years ago
xlm_extract.c	Add explicit log level parameter to application logging API	4 years ago
xlm_extract.h	Add explicit log level parameter to application logging API	4 years ago
xz_iface.c	Add explicit log level parameter to application logging API	4 years ago
xz_iface.h	Bump copyright for 2022	4 years ago
yara_arena.c	…
yara_arena.h	…
yara_clam.h	Bump copyright for 2022	4 years ago
yara_compiler.c	Add explicit log level parameter to application logging API	4 years ago
yara_compiler.h	…
yara_exec.c	Yara: Fix crash with partially loaded yara files	4 years ago
yara_exec.h	Yara: Fix crash with partially loaded yara files	4 years ago
yara_grammar.c	CMake: Remove Flex & Bison hard build dependency	5 years ago
yara_grammar.h	CMake: Remove Flex & Bison hard build dependency	5 years ago
yara_grammar.y	Bump copyright for 2022	4 years ago
yara_hash.c	…
yara_hash.h	…
yara_lexer.c	Rust bindgen: Only generate if CMake MAINTAINER_MODE is ON	4 years ago
yara_lexer.h	…
yara_lexer.l	Bump copyright for 2022	4 years ago
yara_parser.c	Add explicit log level parameter to application logging API	4 years ago
yara_parser.h	…
yc.c	Bump copyright for 2022	4 years ago
yc.h	Bump copyright for 2022	4 years ago