[Pkg-clamav-commits] [SCM] Debian repository for ClamAV branch, debian/unstable, updated. debian/0.95+dfsg-1-6156-g094ec9b

[Tomasz Kojm]

The following commit has been merged in the debian/unstable branch:
commit 95ac9effe4ab26a22ac59b8a9db0fcbe034067da
Author: Tomasz Kojm <tkojm at clamav.net>
Date:   Thu Sep 10 20:18:04 2009 +0200

    libclamav/matcher-ac.c: alternatives can now be negated: !(aa|bb|cc)

diff --git a/ChangeLog b/ChangeLog
index 3bcf18e..e4e7863 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Thu Sep 10 20:16:45 CEST 2009 (tk)
+----------------------------------
+ * libclamav/matcher-ac.c: alternatives can now be negated: !(aa|bb|cc)
+
 Mon Sep  7 15:03:11 CEST 2009 (tk)
 ----------------------------------
  * libclamav/matcher-bm.c: fix uninitialized value warning
diff --git a/docs/signatures.pdf b/docs/signatures.pdf
index f8098d7..e338689 100644
Binary files a/docs/signatures.pdf and b/docs/signatures.pdf differ
diff --git a/docs/signatures.tex b/docs/signatures.tex
index 0c2fed5..e5c5e5f 100644
--- a/docs/signatures.tex
+++ b/docs/signatures.tex
@@ -121,6 +121,8 @@ How do I look in hex?
 	Match between $n$ and $m$ bytes ($m > n$).
 	\item \verb+(aa|bb|cc|..)+\\
 	Match aa or bb or cc..
+	\item \verb+!(aa|bb|cc|..)+\\
+	Match any byte except aa and bb and cc..
 	\item \verb+HEXSIG[x-y]aa+ or \verb+aa[x-y]HEXSIG+\\
 	Match aa anchored to a hex-signature, see
 	\url{https://wwws.clamav.net/bugzilla/show_bug.cgi?id=776} for
diff --git a/libclamav/matcher-ac.c b/libclamav/matcher-ac.c
index d71ed88..16879fb 100644
--- a/libclamav/matcher-ac.c
+++ b/libclamav/matcher-ac.c
@@ -661,12 +661,12 @@ int cli_ac_chklsig(const char *expr, const char *end, uint32_t *lsigcnt, unsigne
 	    break;							\
 									\
 	case CLI_MATCH_ALTERNATIVE:					\
-	    match = 0;							\
 	    alt = pattern->alttable[altcnt];				\
+	    match = alt->negative;					\
 	    if(alt->chmode) {						\
 		for(j = 0; j < alt->num; j++) {				\
 		    if(alt->str[j] == b) {				\
-			match = 1;					\
+			match = !alt->negative;				\
 			break;						\
 		    } else if(alt->str[j] > b)				\
 			break;						\
@@ -675,7 +675,7 @@ int cli_ac_chklsig(const char *expr, const char *end, uint32_t *lsigcnt, unsigne
 		while(alt) {						\
 		    if(bp + alt->len <= length) {			\
 			if(!memcmp(&buffer[bp], alt->str, alt->len)) {	\
-			    match = 1;					\
+			    match = !alt->negative;			\
 			    bp += alt->len - 1;				\
 			    break;					\
 			}						\
@@ -1304,25 +1304,29 @@ int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hex
 		error = CL_EMALFDB;
 		break;
 	    }
-
+	    newalt = (struct cli_ac_alt *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_alt));
+	    if(!newalt) {
+		cli_errmsg("cli_ac_addsig: Can't allocate newalt\n");
+		error = CL_EMEM;
+		break;
+	    }
+	    if(pt >= hexcpy + 2) {
+		if(pt[-2] == '!') {
+		    newalt->negative = 1;
+		    pt[-2] = 0;
+		}
+	    }
 	    strcat(hexnew, start);
 	    strcat(hexnew, "()");
 
 	    if(!(start = strchr(pt, ')'))) {
+		mpool_free(root->mempool, newalt);
 		error = CL_EMALFDB;
 		break;
 	    }
 	    *start++ = 0;
 
-	    newalt = (struct cli_ac_alt *) mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_alt));
-	    if(!newalt) {
-		cli_errmsg("cli_ac_addsig: Can't allocate newalt\n");
-		error = CL_EMEM;
-		break;
-	    }
-
 	    new->alt++;
-
 	    newtable = (struct cli_ac_alt **) mpool_realloc(root->mempool, new->alttable, new->alt * sizeof(struct cli_ac_alt *));
 	    if(!newtable) {
 		new->alt--;
diff --git a/libclamav/matcher-ac.h b/libclamav/matcher-ac.h
index b28b7f5..4bcbd6e 100644
--- a/libclamav/matcher-ac.h
+++ b/libclamav/matcher-ac.h
@@ -42,7 +42,7 @@ struct cli_ac_alt {
     unsigned char *str;
     struct cli_ac_alt *next;
     uint16_t len, num;
-    uint8_t chmode;
+    uint8_t chmode, negative;
 };
 
 struct cli_ac_patt {

-- 
Debian repository for ClamAV