source: clamav/trunk/libclamav/matcher-hash.c@ 319

Last change on this file since 319 was 319, checked in by Yuri Dario, 14 years ago

clamav: update trunk to 0.97.
File size: 7.0 KB
Line 
1/*
2 * Copyright (C) 2010 Sourcefire, Inc.
3 *
4 * Authors: aCaB
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
18 * MA 02110-1301, USA.
19 */
20
21#include "matcher.h"
22#include "others.h"
23#include "str.h"
24
25#include <string.h>
26#include <stdlib.h>
27
28
29int hm_addhash(struct cli_matcher *root, const char *hash, uint32_t size, const char *virusname) {
30 const struct cli_htu32_element *item;
31 struct cli_sz_hash *szh;
32 struct cli_htu32 *ht;
33 enum CLI_HASH_TYPE type;
34 uint8_t binhash[32];
35 int hashlen, i;
36
37 if(!root || !hash) {
38 cli_errmsg("hm_addhash: NULL root or hash\n");
39 return CL_ENULLARG;
40 }
41
42 if(!size || size == (uint32_t)-1) {
43 cli_errmsg("hm_addhash: null or invalid size (%u)\n", size);
44 return CL_EARG;
45 }
46
47 hashlen = strlen(hash);
48 switch(hashlen) {
49 case 32:
50 type = CLI_HASH_MD5;
51 break;
52 case 40:
53 type = CLI_HASH_SHA1;
54 break;
55 case 64:
56 type = CLI_HASH_SHA256;
57 break;
58 default:
59 cli_errmsg("hm_addhash: invalid hash %s -- FIXME!\n", hash);
60 return CL_EARG;
61 }
62 if(cli_hex2str_to(hash, (char *)binhash, hashlen)) {
63 cli_errmsg("hm_addhash: invalid hash %s\n", hash);
64 return CL_EARG;
65 }
66
67 hashlen /= 2;
68 ht = &root->hm.sizehashes[type];
69 if(!root->hm.sizehashes[type].capacity) {
70 i = cli_htu32_init(ht, 64, root->mempool);
71 if(i) return i;
72 }
73
74 item = cli_htu32_find(ht, size);
75 if(!item) {
76 struct cli_htu32_element htitem;
77 szh = mpool_calloc(root->mempool, 1, sizeof(*szh));
78 if(!szh) {
79 cli_errmsg("hm_addhash: failed to allocate size hash\n");
80 return CL_EMEM;
81 }
82
83 htitem.key = size;
84 htitem.data.as_ptr = szh;
85 i = cli_htu32_insert(ht, &htitem, root->mempool);
86 if(i) {
87 cli_errmsg("ht_addhash: failed to add item to hashtab");
88 mpool_free(root->mempool, szh);
89 return i;
90 }
91 } else
92 szh = (struct cli_sz_hash *)item->data.as_ptr;
93
94 szh->items++;
95
96 szh->hash_array = mpool_realloc2(root->mempool, szh->hash_array, hashlen * szh->items);
97 if(!szh->hash_array) {
98 cli_errmsg("ht_add: failed to grow hash array to %u entries\n", szh->items);
99 szh->items=0;
100 mpool_free(root->mempool, szh->virusnames);
101 szh->virusnames = NULL;
102 return CL_EMEM;
103 }
104
105 szh->virusnames = mpool_realloc2(root->mempool, szh->virusnames, sizeof(*szh->virusnames) * szh->items);
106 if(!szh->virusnames) {
107 cli_errmsg("ht_add: failed to grow virusname array to %u entries\n", szh->items);
108 szh->items=0;
109 mpool_free(root->mempool, szh->hash_array);
110 szh->hash_array = NULL;
111 return CL_EMEM;
112 }
113
114 memcpy(&szh->hash_array[(szh->items-1) * hashlen], binhash, hashlen);
115 szh->virusnames[(szh->items-1)] = virusname;
116
117 return 0;
118}
119
120
121
122static const unsigned int hashlen[] = {
123 16, /* CLI_HASH_MD5 */
124 20, /* CLI_HASH_SHA1 */
125 32, /* CLI_HASH_SHA256 */
126};
127
128
129static inline int hm_cmp(const uint8_t *itm, const uint8_t *ref, unsigned int keylen) {
130 uint32_t i = *(uint32_t *)itm, r = *(uint32_t *)ref;
131 if(i!=r)
132 return (i<r) * 2 -1;
133 return memcmp(&itm[4], &ref[4], keylen - 4);
134}
135
136void hm_sort(struct cli_sz_hash *szh, size_t l, size_t r, unsigned int keylen) {
137 uint8_t piv[32], tmph[32];
138 size_t l1, r1;
139
140 const char *tmpv;
141
142 if(l + 1 >= r)
143 return;
144
145 l1 = l+1, r1 = r;
146
147 memcpy(piv, &szh->hash_array[keylen * l], keylen);
148 while(l1 < r1) {
149 if(hm_cmp(&szh->hash_array[keylen * l1], piv, keylen) > 0) {
150 r1--;
151 memcpy(tmph, &szh->hash_array[keylen * l1], keylen);
152 tmpv = szh->virusnames[l1];
153 memcpy(&szh->hash_array[keylen * l1], &szh->hash_array[keylen * r1], keylen);
154 szh->virusnames[l1] = szh->virusnames[r1];
155 memcpy(&szh->hash_array[keylen * r1], tmph, keylen);
156 szh->virusnames[r1] = tmpv;
157 } else
158 l1++;
159 }
160
161 l1--;
162 if(l1!=l) {
163 memcpy(tmph, &szh->hash_array[keylen * l1], keylen);
164 tmpv = szh->virusnames[l1];
165 memcpy(&szh->hash_array[keylen * l1], &szh->hash_array[keylen * l], keylen);
166 szh->virusnames[l1] = szh->virusnames[l];
167 memcpy(&szh->hash_array[keylen * l], tmph, keylen);
168 szh->virusnames[l] = tmpv;
169 }
170
171 hm_sort(szh, l, l1, keylen);
172 hm_sort(szh, r1, r, keylen);
173}
174
175
176void hm_flush(struct cli_matcher *root) {
177 enum CLI_HASH_TYPE type;
178
179 if(!root)
180 return;
181
182 for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++) {
183 struct cli_htu32 *ht = &root->hm.sizehashes[type];
184 const struct cli_htu32_element *item = NULL;
185
186 if(!root->hm.sizehashes[type].capacity)
187 continue;
188
189 while((item = cli_htu32_next(ht, item))) {
190 struct cli_sz_hash *szh = (struct cli_sz_hash *)item->data.as_ptr;
191 unsigned int keylen = hashlen[type];
192
193 if(szh->items > 1)
194 hm_sort(szh, 0, szh->items, keylen);
195 }
196 }
197}
198
199
200int cli_hm_have_size(const struct cli_matcher *root, enum CLI_HASH_TYPE type, uint32_t size) {
201 return (size && size != 0xffffffff && root && root->hm.sizehashes[type].capacity && cli_htu32_find(&root->hm.sizehashes[type], size));
202}
203
204int cli_hm_scan(const unsigned char *digest, uint32_t size, const char **virname, const struct cli_matcher *root, enum CLI_HASH_TYPE type) {
205 const struct cli_htu32_element *item;
206 unsigned int keylen;
207 struct cli_sz_hash *szh;
208 size_t l, r;
209
210 if(!digest || !size || size == 0xffffffff || !root || !root->hm.sizehashes[type].capacity)
211 return CL_CLEAN;
212
213 item = cli_htu32_find(&root->hm.sizehashes[type], size);
214 if(!item)
215 return CL_CLEAN;
216
217 szh = (struct cli_sz_hash *)item->data.as_ptr;
218 keylen = hashlen[type];
219
220 l = 0;
221 r = szh->items;
222 while(l <= r) {
223 size_t c = (l + r) / 2;
224 int res = hm_cmp(digest, &szh->hash_array[keylen * c], keylen);
225
226 if(res < 0) {
227 if(!c)
228 break;
229 r = c - 1;
230 } else if(res > 0)
231 l = c + 1;
232 else {
233 if(virname)
234 *virname = szh->virusnames[c];
235 return CL_VIRUS;
236 }
237 }
238 return CL_CLEAN;
239}
240
241void hm_free(struct cli_matcher *root) {
242 enum CLI_HASH_TYPE type;
243
244 if(!root)
245 return;
246
247 for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++) {
248 struct cli_htu32 *ht = &root->hm.sizehashes[type];
249 const struct cli_htu32_element *item = NULL;
250
251 if(!root->hm.sizehashes[type].capacity)
252 continue;
253
254 while((item = cli_htu32_next(ht, item))) {
255 struct cli_sz_hash *szh = (struct cli_sz_hash *)item->data.as_ptr;
256 unsigned int keylen = hashlen[type];
257
258 mpool_free(root->mempool, szh->hash_array);
259 while(szh->items)
260 mpool_free(root->mempool, (void *)szh->virusnames[--szh->items]);
261 mpool_free(root->mempool, szh->virusnames);
262 mpool_free(root->mempool, szh);
263 }
264 cli_htu32_free(ht, root->mempool);
265 }
266}
267
Note: See TracBrowser for help on using the repository browser.