libclamav.patch

diff --git a/clamscan/clamscan.c b/clamscan/clamscan.c
index c19283b..d1330ab 100644
--- a/clamscan/clamscan.c
+++ b/clamscan/clamscan.c
@@ -55,6 +55,21 @@ void help(void);
 struct s_info info;
 short recursion = 0, printinfected = 0, bell = 0;
 
+static void msg_callback(enum cl_msg severity, const char *fullmsg, const char *msg, void *ctx)
+{
+    switch (severity) {
+    case CL_MSG_ERROR:
+	logg("^cs %s", msg);
+	break;
+    case CL_MSG_WARN:
+	logg("~cs %s", msg);
+	break;
+    default:
+	logg("*cs %s", msg);
+	break;
+    }
+}
+
 int main(int argc, char **argv)
 {
 	int ds, dms, ret;
@@ -147,6 +162,7 @@ int main(int argc, char **argv)
 
     gettimeofday(&t1, NULL);
 
+    cl_set_clcb_msg(msg_callback);
     ret = scanmanager(opts);
 
     if(!optget(opts, "no-summary")->enabled) {
diff --git a/libclamav/matcher-bm.c b/libclamav/matcher-bm.c
index 094fc7f..44582fe 100644
--- a/libclamav/matcher-bm.c
+++ b/libclamav/matcher-bm.c
@@ -244,7 +244,7 @@ void cli_bm_free(struct cli_matcher *root)
     }
 }
 
-int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata)
+int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata, uint32_t* outOff)
 {
 	uint32_t i, j, off, off_min, off_max;
 	uint8_t found, pchain, shift;
@@ -378,6 +378,8 @@ int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **v
 			*virname = p->virname;
 		    if(patt)
 			*patt = p;
+		    if (outOff)
+			*outOff = off;
 		    return CL_VIRUS;
 		}
 		p = p->next;
diff --git a/libclamav/matcher-bm.h b/libclamav/matcher-bm.h
index 9cb45fc..87434cb 100644
--- a/libclamav/matcher-bm.h
+++ b/libclamav/matcher-bm.h
@@ -47,7 +47,7 @@ int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern, const
 int cli_bm_init(struct cli_matcher *root);
 int cli_bm_initoff(const struct cli_matcher *root, struct cli_bm_off *data, const struct cli_target_info *info);
 void cli_bm_freeoff(struct cli_bm_off *data);
-int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata);
+int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata, uint32_t* outoff);
 void cli_bm_free(struct cli_matcher *root);
 
 #endif
diff --git a/libclamav/matcher.c b/libclamav/matcher.c
index 165e995..4f0994a 100644
--- a/libclamav/matcher.c
+++ b/libclamav/matcher.c
@@ -98,6 +98,8 @@ static inline int matcher_run(const struct cli_matcher *root,
     struct filter_match_info info;
     uint32_t orig_length, orig_offset;
     const unsigned char* orig_buffer;
+    struct cli_bm_patt *bmpat = 0;
+    
 
     if (root->filter) {
 	if(filter_search_ext(root->filter, buffer, length, &info) == -1) {
@@ -124,16 +126,33 @@ static inline int matcher_run(const struct cli_matcher *root,
     offset += pos;
     if (!root->ac_only) {
 	PERF_LOG_TRIES(0, 1, length);
-	if (root->bm_offmode) {
-	    /* Don't use prefiltering for BM offset mode, since BM keeps tracks
-	     * of offsets itself, and doesn't work if we skip chunks of input
-	     * data */
-	    ret = cli_bm_scanbuff(orig_buffer, orig_length, virname, NULL, root, orig_offset, tinfo, offdata);
-	} else {
-	    ret = cli_bm_scanbuff(buffer, length, virname, NULL, root, offset, tinfo, offdata);
-	}
-	if (ret == CL_VIRUS)
-	    return ret;
+	do {
+	    uint32_t retOfff = 1;
+	    //printf ("scanning at offset: %08x\n", offset);
+	    if (root->bm_offmode) {
+		/* Don't use prefiltering for BM offset mode, since BM keeps tracks
+		 * of offsets itself, and doesn't work if we skip chunks of input
+		 * data */
+		ret = cli_bm_scanbuff(orig_buffer, orig_length, virname, &bmpat, root, orig_offset, tinfo, offdata, &retOfff);
+	    } else {
+		ret = cli_bm_scanbuff(buffer, length, virname, &bmpat, root, offset, tinfo, offdata, &retOfff);
+	    }
+	    if (ret == CL_VIRUS) {
+		cli_clamsearch(CL_MSG_WARN, "bm: %08x \t %s\n", offset + retOfff - bmpat->length - bmpat->prefix_length, *virname);
+		// probably not the greates idea
+		retOfff -= (bmpat->length + bmpat->prefix_length - 1);
+	    }
+	    
+	    if (length <= retOfff) {
+		break;
+	    }
+	    offset += retOfff;
+	    length -= retOfff;
+	    buffer += retOfff;
+	    orig_length = length;
+	    orig_buffer = buffer;
+	    orig_offset = offset;
+	} while (ret == CL_VIRUS);
     }
     PERF_LOG_TRIES(acmode, 0, length);
     ret = cli_ac_scanbuff(buffer, length, virname, NULL, acres, root, mdata, offset, ftype, ftoffset, acmode, NULL);
@@ -618,9 +637,26 @@ int cli_lsig_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data *ac
 		continue;
 	    }
 	    if(!root->ac_lsigtable[i]->bc_idx) {
+		int tempi;
+		char linebuf[1024];
+
 		if(ctx->virname)
 		    *ctx->virname = root->ac_lsigtable[i]->virname;
-		return CL_VIRUS;
+		
+		cli_clamsearch(CL_MSG_WARN, "lo: ........ \t %s\n", *ctx->virname);
+		sprintf(linebuf, "\t");
+		for (tempi = 0; tempi < 10; ++tempi) {
+		    if (CLI_OFF_NONE == acdata->lsigsuboff_first[i][tempi]) {
+			sprintf (linebuf+tempi*9+1, " [end]");
+			break;
+		    }
+
+		    sprintf (linebuf+tempi*9+1, "%08x ", acdata->lsigsuboff_first[i][tempi]);
+		}
+		strcat(linebuf, "\n");
+		cli_clamsearch(CL_MSG_INFO_VERBOSE, linebuf);
+		continue;
+		//return CL_VIRUS;
 	    }
 	    if(cli_bytecode_runlsig(ctx, target_info, &ctx->engine->bcs, root->ac_lsigtable[i]->bc_idx, ctx->virname, acdata->lsigcnt[i], acdata->lsigsuboff_first[i], map) == CL_VIRUS) {
 		return CL_VIRUS;
@@ -749,6 +785,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli
 	if(troot) {
 	    ret = matcher_run(troot, buff, bytes, ctx->virname, &tdata, offset, &info, ftype, ftoffset, acmode, acres, map, bm_offmode ? &toff : NULL);
 
+	    ret = CL_CLEAN;
 	    if(ret == CL_VIRUS || ret == CL_EMEM) {
 		if(!ftonly)
 		    cli_ac_freedata(&gdata);
@@ -765,6 +802,7 @@ int cli_fmap_scandesc(cli_ctx *ctx, cli_file_t ftype, uint8_t ftonly, struct cli
 	if(!ftonly) {
 	    ret = matcher_run(groot, buff, bytes, ctx->virname, &gdata, offset, &info, ftype, ftoffset, acmode, acres, map, NULL);
 
+	    ret = CL_CLEAN;
 	    if(ret == CL_VIRUS || ret == CL_EMEM) {
 		cli_ac_freedata(&gdata);
 		if(troot) {
diff --git a/libclamav/others.h b/libclamav/others.h
index de8d841..034f4c6 100644
--- a/libclamav/others.h
+++ b/libclamav/others.h
@@ -437,6 +437,12 @@ static inline void cli_writeint32(char *offset, uint32_t value)
 #define CLI_SAR(n,s) n = CLI_SRS(n,s)
 
 #ifdef __GNUC__
+    void cli_clamsearch(enum cl_msg errCode, const char *str, ...) __attribute__((format(printf, 1, 2)));
+#else
+    void cli_clamsearch(enum cl_msg errCode, const char *str, ...);
+#endif
+
+#ifdef __GNUC__
 void cli_warnmsg(const char *str, ...) __attribute__((format(printf, 1, 2)));
 #else
 void cli_warnmsg(const char *str, ...);
diff --git a/libclamav/others_common.c b/libclamav/others_common.c
index da0146a..6383e85 100644
--- a/libclamav/others_common.c
+++ b/libclamav/others_common.c
@@ -142,6 +142,12 @@ void cl_set_clcb_msg(clcb_msg callback)
     buff[sizeof(buff) - 1] = '\0';			    \
     va_end(args)
 
+void cli_clamsearch(enum cl_msg errCode, const char *str, ...)
+{
+    MSGCODE(buff, len, "cs ");
+    msg_callback(errCode, buff, buff+len, cli_getctx());
+}
+
 void cli_warnmsg(const char *str, ...)
 {
     MSGCODE(buff, len, "LibClamAV Warning: ");
diff --git a/libclamav/phishcheck.c b/libclamav/phishcheck.c
index cbfafd4..5a72463 100644
--- a/libclamav/phishcheck.c
+++ b/libclamav/phishcheck.c
@@ -1214,7 +1214,7 @@ static int hash_match(const struct regex_matcher *rlist, const char *host, size_
 		    return CL_SUCCESS;
 	    }
 #endif
-	    if (cli_bm_scanbuff(sha256_dig, 32, &virname, NULL, &rlist->sha256_hashes,0,NULL,NULL) == CL_VIRUS) {
+	    if (cli_bm_scanbuff(sha256_dig, 32, &virname, NULL, &rlist->sha256_hashes,0,NULL,NULL, NULL) == CL_VIRUS) {
 		cli_dbgmsg("This hash matched: %s\n", h);
 		switch(*virname) {
 		    case 'W':
diff --git a/libclamav/readdb.c b/libclamav/readdb.c
index db5be2b..db1ec2f 100644
--- a/libclamav/readdb.c
+++ b/libclamav/readdb.c
@@ -487,7 +487,7 @@ static int cli_chkign(const struct cli_matcher *ignored, const char *signame, co
     if(!ignored || !signame || !entry)
 	return 0;
 
-    if(cli_bm_scanbuff((const unsigned char *) signame, strlen(signame), &md5_expected, NULL, ignored, 0, NULL, NULL) == CL_VIRUS) {
+    if(cli_bm_scanbuff((const unsigned char *) signame, strlen(signame), &md5_expected, NULL, ignored, 0, NULL, NULL,NULL) == CL_VIRUS) {
 	if(md5_expected) {
 	    cli_md5_init(&md5ctx);
             cli_md5_update(&md5ctx, entry, strlen(entry));
diff --git a/libclamav/regex_list.c b/libclamav/regex_list.c
index 3333a43..a513da5 100644
--- a/libclamav/regex_list.c
+++ b/libclamav/regex_list.c
@@ -357,7 +357,7 @@ static int add_hash(struct regex_matcher *matcher, char* pattern, const char fl,
 
 	if (fl != 'W' && pat->length == 32 &&
 	    cli_hashset_contains(&matcher->sha256_pfx_set, cli_readint32(pat->pattern)) &&
-	    cli_bm_scanbuff(pat->pattern, 32, &vname, NULL, &matcher->sha256_hashes,0,NULL,NULL) == CL_VIRUS) {
+	    cli_bm_scanbuff(pat->pattern, 32, &vname, NULL, &matcher->sha256_hashes,0,NULL,NULL,NULL) == CL_VIRUS) {
 	    if (*vname == 'W') {
 		/* hash is whitelisted in local.gdb */
 		cli_dbgmsg("Skipping hash %s\n", pattern);
diff --git a/libclamav/scanners.c b/libclamav/scanners.c
index ea755fc..390bda5 100644
--- a/libclamav/scanners.c
+++ b/libclamav/scanners.c
@@ -1879,8 +1879,8 @@ static int cli_scanraw(cli_ctx *ctx, cli_file_t type, uint8_t typercg, cli_file_
 	fmap_t *map = *ctx->fmap;
 	cli_file_t current_container_type = ctx->container_type;
 	size_t current_container_size = ctx->container_size;
-
-
+	struct cli_ac_result *acResults=0;
+	
     if(ctx->engine->maxreclevel && ctx->recursion >= ctx->engine->maxreclevel)
         return CL_EMAXREC;
 
@@ -1888,7 +1888,28 @@ static int cli_scanraw(cli_ctx *ctx, cli_file_t type, uint8_t typercg, cli_file_
     if(typercg)
 	acmode |= AC_SCAN_FT;
 
-    ret = cli_fmap_scandesc(ctx, type == CL_TYPE_TEXT_ASCII ? 0 : type, 0, &ftoffset, acmode, NULL, refhash);
+    cli_clamsearch(CL_MSG_WARN, "clamsrch Multi-Sig searcher results\n");
+    ret = cli_fmap_scandesc(ctx, type == CL_TYPE_TEXT_ASCII ? 0 : type, 0, &ftoffset, acmode, &acResults, refhash);
+    if (acResults) {
+	struct cli_ac_result* acResultsTemp = acResults;
+	struct cli_ac_result **acResultsReversed=0;
+	size_t acIdx, acCounter = 0;
+
+	while (acResultsTemp) {
+	    acCounter++;
+	    acResultsTemp = acResultsTemp->next;
+	}
+	acResultsReversed = cli_calloc(acCounter, sizeof(struct cli_ac_result*));
+	acResultsTemp = acResults;
+	acIdx = acCounter-1;
+	while (acResultsTemp) {
+	    acResultsReversed[acIdx--] = acResultsTemp;
+	    acResultsTemp = acResultsTemp->next;
+	}
+	for (acIdx = 0; acIdx < acCounter; ++acIdx) {
+	    cli_clamsearch(CL_MSG_WARN, "ac: %08x \t %s\n", acResultsReversed[acIdx]->offset, acResultsReversed[acIdx]->virname);
+	}
+    }
     perf_stop(ctx, PERFT_RAW);
 
     if(ret >= CL_TYPENO) {
@@ -2204,6 +2225,8 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
     ctx->hook_lsig_matches = NULL;
 
     if(!ctx->options || (ctx->recursion == ctx->engine->maxreclevel)) { /* raw mode (stdin, etc.) or last level of recursion */
+	struct cli_ac_result *acResults=0;
+
 	if(ctx->recursion == ctx->engine->maxreclevel)
 	    cli_dbgmsg("cli_magic_scandesc: Hit recursion limit, only scanning raw file\n");
 	else
@@ -2211,7 +2234,29 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)
 
 	CALL_PRESCAN_CB(cb_pre_scan);
 	/* ret_from_magicscan can be used below here*/
-	if((ret = cli_fmap_scandesc(ctx, 0, 0, NULL, AC_SCAN_VIR, NULL, hash)) == CL_VIRUS)
+	ret = cli_fmap_scandesc(ctx, 0, 0, NULL, AC_SCAN_VIR, &acResults, hash);
+	if (acResults) {
+	    struct cli_ac_result **acResultsReversed=0;
+	    struct cli_ac_result *acResultsTemp = acResults;
+	    size_t acIdx, acCounter = 0;
+	    
+	    while (acResultsTemp) {
+		acCounter++;
+		acResultsTemp = acResultsTemp->next;
+	    }
+	    acResultsReversed = cli_calloc(acCounter, sizeof(struct cli_ac_result*));
+	    acResultsTemp = acResults;
+	    acIdx = acCounter-1;
+	    while (acResultsTemp) {
+		acResultsReversed[acIdx--] = acResultsTemp;
+		acResultsTemp = acResultsTemp->next;
+	    }
+	    for (acIdx = 0; acIdx < acCounter; ++acIdx) {
+		cli_clamsearch(CL_MSG_WARN, "ac: %08x \t %s\n", acResultsReversed[acIdx]->offset, acResultsReversed[acIdx]->virname);
+	    }
+	}
+
+	if (CL_VIRUS == ret)
 	    cli_dbgmsg("%s found in descriptor %d\n", *ctx->virname, fmap_fd(*ctx->fmap));
 	else if(ret == CL_CLEAN) {
 	    if(ctx->recursion != ctx->engine->maxreclevel)
diff --git a/win32/clamav-config.h b/win32/clamav-config.h
index 563e50b..e2faa68 100644
--- a/win32/clamav-config.h
+++ b/win32/clamav-config.h
@@ -93,7 +93,8 @@
 /* #undef FDPASS_NEED_XOPEN */
 
 /* file i/o buffer size */
-#define FILEBUFF 8192
+#define FILEBUFF (8192*4)
+//8192
 
 /* FPU byte ordering matches CPU */
 #define FPU_WORDS_BIGENDIAN 0