bb11915 - Fix for whitelisting bytecode signatures. Patch by Georgy S…

…alnikov.
Cisco-Talos · Oct 13, 2017 · b2f5986 · b2f5986
1 parent 7dbfe24
commit b2f5986
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -48,6 +48,7 @@ Marc Deslauriers
 Mark Allan
 Andreas Schulze
 Jonas Zaddach
+Georgy Salnikov
 
 --
 The ClamAV team (http://www.clamav.net/about.html#credits)
diff --git a/libclamav/readdb.c b/libclamav/readdb.c
@@ -772,7 +772,13 @@ static char *cli_signorm(const char *signame)
 
     nsz = strlen(signame);
 
-    if (nsz > 11) {
+    if (nsz > 3 && signame[nsz-1] == '}') {
+        char *pt = strstr(signame, ".{");
+        if (pt)         /* strip the ".{ }" clause at the end of signame */
+            nsz = pt - signame;
+        else
+            return NULL;
+    } else if (nsz > 11) {
         if (!strncmp(signame+nsz-11, ".UNOFFICIAL", 11))
             nsz -= 11;
         else