On 1/1/07, Török Edvin <[EMAIL PROTECTED]> wrote:
> > I think there is a bug in the cli_ac_addpatt() function. > > in my kernel module version of clamav, I check for wildcard charactersIs it based on 0.88.x? 0.90 has an improved ac engine. > > there are 2 examples I found in the clamav db for signatures that have > a wildcard character as the 2nd bytes of the pattern: > > Trojan.Bat.DeltreeY-3:0:*:...{-1}2f(59|79)... > Trojan.IRC-Script-28:0:*:6e??... Should work in 0.90rc.
I checked the 0.90RC2 code. as far as I can tell, there is a bug and it is still in there: cli_add_patt() does: next = pos->trans[((unsigned char) pattern->pattern[i]) & 0xff]; which is futile is case pattern[i] == CLI_ALT or CLI_IGN Amir. _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
