← Back to branch summary

~ubuntu-branches/ubuntu/raring/clamav/raring

« back to all changes in this revision

Viewing changes to libclamav/pe.c

  • Committer: Bazaar Package Importer
  • Author(s): Stephen Gran
  • Date: 2008-09-05 17:25:34 UTC
  • mfrom: (0.35.1 lenny)
  • Revision ID: james.westby@ubuntu.com-20080905172534-yi3f8fkye1o7u1r3
http://bugs.debian.org/497662
http://bugs.debian.org/497773
http://bugs.debian.org/496276
http://bugs.debian.org/491760
* New upstream version (closes: #497662, #497773)
  - lots of new options for clamd.conf
  - fixes CVEs CVE-2008-3912, CVE-2008-3913, CVE-2008-3914, and
    CVE-2008-1389
* No longer supports --unzip option, so typo is gone (closes: #496276)
* Translations:
  - sv (thanks Martin Bagge <brother@bsnet.se>) (closes: #491760)

Show diffs side-by-side

added added

removed removed

Lines of Context:
libclamav/pe.c
55
55
#include "upack.h"
56
56
#include "matcher.h"
57
57
#include "matcher-bm.h"
 
58
#include "disasm.h"
58
59
 
59
60
#ifndef O_BINARY
60
61
#define O_BINARY        0
74
75
#define UPX_NRV2B "\x11\xdb\x11\xc9\x01\xdb\x75\x07\x8b\x1e\x83\xee\xfc\x11\xdb\x11\xc9\x11\xc9\x75\x20\x41\x01\xdb"
75
76
#define UPX_NRV2D "\x83\xf0\xff\x74\x78\xd1\xf8\x89\xc5\xeb\x0b\x01\xdb\x75\x07\x8b\x1e\x83\xee\xfc\x11\xdb\x11\xc9"
76
77
#define UPX_NRV2E "\xeb\x52\x31\xc9\x83\xe8\x03\x72\x11\xc1\xe0\x08\x8a\x06\x46\x83\xf0\xff\x74\x75\xd1\xf8\x89\xc5"
 
78
#define UPX_LZMA1 "\x56\x83\xc3\x04\x53\x50\xc7\x03\x03\x00\x02\x00\x90\x90\x90\x55\x57\x56\x53\x83"
 
79
#define UPX_LZMA2 "\x56\x83\xc3\x04\x53\x50\xc7\x03\x03\x00\x02\x00\x90\x90\x90\x90\x90\x55\x57\x56"
77
80
 
78
81
#define EC32(x) le32_to_host(x) /* Convert little endian to host */
79
82
#define EC16(x) le16_to_host(x)
99
102
    return CL_EIO; \
100
103
}
101
104
 
102
 
#define CLI_TMPUNLK() if(!cli_leavetemps_flag) unlink(tempfile)
 
105
#define CLI_TMPUNLK() if(!cli_leavetemps_flag) { \
 
106
    if (cli_unlink(tempfile)) { \
 
107
        free(tempfile); \
 
108
        return CL_EIO; \
 
109
    } \
 
110
}
103
111
 
104
112
#define FSGCASE(NAME,FREESEC) \
105
113
    case 0: /* Unpacked and NOT rebuilt */ \
106
114
        cli_dbgmsg(NAME": Successfully decompressed\n"); \
107
115
        close(ndesc); \
108
 
        unlink(tempfile); \
 
116
        if (cli_unlink(tempfile)) { \
 
117
            free(exe_sections); \
 
118
            free(tempfile); \
 
119
            FREESEC; \
 
120
            return CL_EIO; \
 
121
        } \
109
122
        free(tempfile); \
110
123
        FREESEC; \
111
124
        found = 0; \
116
129
    case 2: \
117
130
        free(spinned); \
118
131
        close(ndesc); \
119
 
        unlink(tempfile); \
 
132
        if (cli_unlink(tempfile)) { \
 
133
            free(exe_sections); \
 
134
            free(tempfile); \
 
135
            return CL_EIO; \
 
136
        } \
120
137
        cli_dbgmsg("PESpin: Size exceeded\n"); \
121
138
        free(tempfile); \
122
139
        break; \
130
147
            cli_dbgmsg(NAME": Unpacked and rebuilt executable\n"); \
131
148
        cli_multifree FREEME; \
132
149
        free(exe_sections); \
133
 
        fsync(ndesc); \
134
150
        lseek(ndesc, 0, SEEK_SET); \
135
151
        cli_dbgmsg("***** Scanning rebuilt PE file *****\n"); \
136
152
        if(cli_magic_scandesc(ndesc, ctx) == CL_VIRUS) { \
149
165
    default: \
150
166
        cli_dbgmsg(NAME": Unpacking failed\n"); \
151
167
        close(ndesc); \
152
 
        unlink(tempfile); \
 
168
        if (cli_unlink(tempfile)) { \
 
169
            free(exe_sections); \
 
170
            free(tempfile); \
 
171
            cli_multifree FREEME; \
 
172
            return CL_EIO; \
 
173
        } \
153
174
        cli_multifree FREEME; \
154
175
        free(tempfile); \
155
176
    }
236
257
                cli_dbgmsg("Can't write to file\n");
237
258
                lseek(desc, pos, SEEK_SET);
238
259
                close(ndesc);
239
 
                unlink(file);
 
260
                cli_unlink(file);
240
261
                return -1;
241
262
            }
242
263
            break;
245
266
                cli_dbgmsg("Can't write to file\n");
246
267
                lseek(desc, pos, SEEK_SET);
247
268
                close(ndesc);
248
 
                unlink(file);
 
269
                cli_unlink(file);
249
270
                return -1;
250
271
            }
251
272
        }
874
895
    lseek(desc, ep, SEEK_SET);
875
896
    epsize = cli_readn(desc, epbuff, 4096);
876
897
 
 
898
    CLI_UNPTEMP("DISASM",(exe_sections,0));
 
899
    disasmbuf(epbuff, epsize, ndesc);
 
900
    lseek(ndesc, 0, SEEK_SET);
 
901
    ret = cli_scandesc(ndesc, ctx, CL_TYPE_PE_DISASM, 1, NULL, AC_SCAN_VIR);
 
902
    close(ndesc);
 
903
    CLI_TMPUNLK();
 
904
    free(tempfile);
 
905
    if(ret == CL_VIRUS) {
 
906
        free(exe_sections);
 
907
        return ret;
 
908
    }
 
909
 
877
910
    /* Attempt to detect some popular polymorphic viruses */
878
911
 
879
912
    /* W32.Parite.B */
1712
1745
            }
1713
1746
        }
1714
1747
 
 
1748
        if(cli_memstr(UPX_LZMA2, 20, epbuff + 0x2f, 20)) {
 
1749
          uint32_t strictdsize=cli_readint32(epbuff+0x21);
 
1750
          if(strictdsize<=dsize)
 
1751
            upx_success = upx_inflatelzma(src, ssize, dest, &strictdsize, exe_sections[i].rva, exe_sections[i + 1].rva, vep) >=0;
 
1752
        } else if (cli_memstr(UPX_LZMA1, 20, epbuff + 0x39, 20)) {
 
1753
          uint32_t strictdsize=cli_readint32(epbuff+0x2b);
 
1754
          if(strictdsize<=dsize)
 
1755
            upx_success = upx_inflatelzma(src, ssize, dest, &strictdsize, exe_sections[i].rva, exe_sections[i + 1].rva, vep) >=0;
 
1756
        }
 
1757
 
1715
1758
        if(!upx_success) {
1716
1759
            cli_dbgmsg("UPX: All decompressors failed\n");
1717
1760
            free(src);
1734
1777
        }
1735
1778
 
1736
1779
        free(dest);
1737
 
        fsync(ndesc);
1738
1780
        lseek(ndesc, 0, SEEK_SET);
1739
1781
 
1740
1782
        if(cli_leavetemps_flag)