Merge from master into 4.next

[exim.git] / src / src / malware.c

diff --git a/src/src/malware.c b/src/src/malware.c
index 9dd241b8c84f0d62cf9c9aff7be8992ec3dbb10e..b36bf0d6442e09cfc004b606936fc0ec67b8d956 100644 (file)
--- a/src/src/malware.c
+++ b/src/src/malware.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 /* Code for calling virus (malware) scanners. Called from acl.c. */
 
@@ -106,7 +108,7 @@ BOOL malware_ok = FALSE;
 the scan directory normally for that case, but look into rigging up the
 needed header variables if not already set on the command-line? */
 extern int spool_mbox_ok;
-extern uschar spooled_message_id[17];
+extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
 
 
 
@@ -628,7 +630,7 @@ if (!malware_ok)
            sock);
          }
 
-       if (!(drweb_fbuf = (uschar *) malloc (fsize_uint)))
+       if (!(drweb_fbuf = US malloc(fsize_uint)))
          {
          (void)close(drweb_fd);
          return m_errlog_defer_3(scanent, NULL,
@@ -657,7 +659,6 @@ if (!malware_ok)
            "unable to send file body to socket (%s)", scanner_options),
            sock);
          }
-       (void)close(drweb_fd);
        }
       else
        {
@@ -1002,7 +1003,9 @@ if (!malware_ok)
              kav_re = kav_re_inf;
              }
 
-           /* read report, linewise */
+           /* read report, linewise.  Using size from stream to read amount of data
+           from same stream is safe enough. */
+           /* coverity[tainted_data] */
            while (kav_reportlen > 0)
              {
              if ((bread = recv_line(sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
@@ -1304,11 +1307,8 @@ if (!malware_ok)
          /* parse options */
          /*XXX should these options be common over scanner types? */
          if (clamd_option(cd, sublist, &subsep) != OK)
-           {
            return m_errlog_defer(scanent, NULL,
              string_sprintf("bad option '%s'", scanner_options));
-           continue;
-           }
 
          cv[num_servers++] = cd;
          if (num_servers >= MAX_CLAMD_SERVERS)
@@ -1488,7 +1488,7 @@ if (!malware_ok)
          }
        lseek(clam_fd, 0, SEEK_SET);
 
-       if (!(clamav_fbuf = (uschar *) malloc (fsize_uint)))
+       if (!(clamav_fbuf = US malloc(fsize_uint)))
          {
          CLOSE_SOCKDATA; (void)close(clam_fd);
          return m_errlog_defer_3(scanent, NULL,
@@ -1949,15 +1949,15 @@ Returns:      Exim message processing code (OK, FAIL, DEFER, ...)
 int
 malware(const uschar * malware_re, int timeout)
 {
-  uschar * scan_filename;
-  int ret;
+uschar * scan_filename;
+int ret;
 
-  scan_filename = string_sprintf("%s/scan/%s/%s.eml",
-                   spool_directory, message_id, message_id);
-  ret = malware_internal(malware_re, scan_filename, timeout, FALSE);
-  if (ret == DEFER) av_failed = TRUE;
+scan_filename = string_sprintf("%s/scan/%s/%s.eml",
+                 spool_directory, message_id, message_id);
+ret = malware_internal(malware_re, scan_filename, timeout, FALSE);
+if (ret == DEFER) av_failed = TRUE;
 
-  return ret;
+return ret;
 }
 
 
@@ -1979,32 +1979,35 @@ Returns:        Exim message processing code (OK, FAIL, DEFER, ...)
 int
 malware_in_file(uschar *eml_filename)
 {
-  uschar message_id_buf[64];
-  int ret;
-
-  /* spool_mbox() assumes various parameters exist, when creating
-  the relevant directory and the email within */
-  (void) string_format(message_id_buf, sizeof(message_id_buf),
-      "dummy-%d", vaguely_random_number(INT_MAX));
-  message_id = message_id_buf;
-  sender_address = US"malware-sender@example.net";
-  return_path = US"";
-  recipients_list = NULL;
-  receive_add_recipient(US"malware-victim@example.net", -1);
-  enable_dollar_recipients = TRUE;
-
-  ret = malware_internal(US"*", eml_filename, 0,  TRUE);
-
-  Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
-  spool_mbox_ok = 1;
-  /* don't set no_mbox_unspool; at present, there's no way for it to become
-  set, but if that changes, then it should apply to these tests too */
-  unspool_mbox();
-
-  /* silence static analysis tools */
-  message_id = NULL;
-
-  return ret;
+uschar message_id_buf[64];
+int ret;
+
+/* spool_mbox() assumes various parameters exist, when creating
+the relevant directory and the email within */
+
+(void) string_format(message_id_buf, sizeof(message_id_buf),
+    "dummy-%d", vaguely_random_number(INT_MAX));
+message_id = message_id_buf;
+sender_address = US"malware-sender@example.net";
+return_path = US"";
+recipients_list = NULL;
+receive_add_recipient(US"malware-victim@example.net", -1);
+enable_dollar_recipients = TRUE;
+
+ret = malware_internal(US"*", eml_filename, 0,  TRUE);
+
+Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
+spool_mbox_ok = 1;
+
+/* don't set no_mbox_unspool; at present, there's no way for it to become
+set, but if that changes, then it should apply to these tests too */
+
+unspool_mbox();
+
+/* silence static analysis tools */
+message_id = NULL;
+
+return ret;
 }