On 2008-12-09 18:51, Thomasz Blaszczyk wrote:
> Thank you for answer,
>
> I have another question. I cannot figure out meaning for ftonly and troot.
> Can I get some explanation for this 2 variables?
>
> They are used in matcher.c [code snipped]:
>
> if(!ftonly && (ret = cli_ac_initdata(&gdata, groot->ac_partsigs,
> groot->ac_lsigs, AC_DEFAULT_TRACKLEN)))
> return ret;
>
ft stands for filetype.
> if(troot) {
> if((ret = cli_ac_initdata(&tdata, troot->ac_partsigs,
> troot->ac_lsigs, AC_DEFAULT_TRACKLEN)))
> return ret;
> }
Look at signatures.pdf again, in the .ndb format each pattern has a
TargetType field, hence a different trie is used for each type.
As for groot, there is a comment explaining what it is:
groot = ctx->engine->root[0]; /* generic signatures */
Best regards,
--Edwin
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
