Skip to content

Commit 967bf4b

Browse files
val-msval-ms
committed
Fix OpenSSL 1 compatibility issue, plus minor improvements
For OpenSSL 1, `EVP_get_digestbyname()` will fail with "sha2-*" algorithm names. Must use "sha256", etc. I made a shim that does the conversion, and I made an improvement to ignore case when converting alg names to our hash type enumeration. Other fixes for a few warnings.
1 parent b34ea5e commit 967bf4b

9 files changed

Lines changed: 118 additions & 48 deletions

File tree

‎examples/ex_scan_callbacks.c‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -364,23 +364,19 @@ script_context_t *read_script_commands(const char *script_filepath)
364364
long script_size = ftell(script_file);
365365
if (script_size < 0) {
366366
printf("Error reading script file %s\n", script_filepath);
367-
fclose(script_file);
368367
goto done;
369368
}
370369

371370
fseek(script_file, 0, SEEK_SET);
372371
script_contents = calloc(script_size + 1, sizeof(char));
373372
if (!script_contents) {
374373
printf("Memory allocation failed for script contents\n");
375-
fclose(script_file);
376374
goto done;
377375
}
378376

379377
size_t bytes_read = fread(script_contents, 1, script_size, script_file);
380378
if (bytes_read != (size_t)script_size) {
381379
printf("Error reading script file %s\n", script_filepath);
382-
free(script_contents);
383-
fclose(script_file);
384380
status = 2;
385381
goto done;
386382
}
@@ -445,8 +441,6 @@ script_context_t *read_script_commands(const char *script_filepath)
445441
/**
446442
* @brief Check if the data matches the given hash.
447443
*
448-
* Note: Not bothering with md5 because clamav.h API does not provide it. 🤯
449-
*
450444
* @param data The data to check.
451445
* @param len The length of the data.
452446
* @param hash_type The type of hash (e.g., "md5", "sha1", "sha256").

‎libclamav/asn1.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -526,7 +526,7 @@ static int asn1_getnum(const char *s)
526526
return (s[0] - '0') * 10 + (s[1] - '0');
527527
}
528528

529-
static int asn1_get_time(fmap_t *map, const void **asn1data, unsigned int *size, time_t *tm)
529+
static int asn1_get_time(fmap_t *map, const void **asn1data, unsigned int *size, int64_t *tm)
530530
{
531531
struct cli_asn1 obj;
532532
int ret = asn1_get_obj(map, *asn1data, size, &obj);
@@ -1134,7 +1134,7 @@ static int asn1_get_x509(fmap_t *map, const void **asn1data, unsigned int *size,
11341134
return ret;
11351135
}
11361136

1137-
static int asn1_parse_countersignature(fmap_t *map, const void **asn1data, unsigned int *size, crtmgr *cmgr, const uint8_t *message, const unsigned int message_size, time_t not_before, time_t not_after)
1137+
static int asn1_parse_countersignature(fmap_t *map, const void **asn1data, unsigned int *size, crtmgr *cmgr, const uint8_t *message, const unsigned int message_size, int64_t not_before, int64_t not_after)
11381138
{
11391139

11401140
struct cli_asn1 asn1, deep, deeper;
@@ -1311,7 +1311,7 @@ static int asn1_parse_countersignature(fmap_t *map, const void **asn1data, unsig
13111311
break;
13121312
case 2: /* signingTime */
13131313
{
1314-
time_t sigdate; /* FIXME shall i use it?! */
1314+
int64_t sigdate; /* FIXME shall i use it?! */
13151315
if (asn1_get_time(map, &deeper.content, &deep.size, &sigdate)) {
13161316
cli_dbgmsg("asn1_parse_countersignature: an error occurred when getting the time\n");
13171317
deep.size = 1;

‎libclamav/crypto.c‎

Lines changed: 57 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,12 @@ extern cl_error_t cl_hash_data_ex(
194194
cl_error_t status = CL_ERROR;
195195

196196
EVP_MD_CTX *ctx = NULL;
197-
EVP_MD *md = NULL;
197+
198+
#if OPENSSL_VERSION_MAJOR >= 3
199+
EVP_MD *md = NULL;
200+
#else
201+
const EVP_MD *md = NULL;
202+
#endif
198203

199204
size_t required_hash_len;
200205
uint8_t *new_hash = NULL;
@@ -212,13 +217,13 @@ extern cl_error_t cl_hash_data_ex(
212217
#if OPENSSL_VERSION_MAJOR >= 3
213218
if (flags & CL_HASH_FLAG_FIPS_BYPASS) {
214219
/* Bypass FIPS restrictions the OpenSSL 3.0 way */
215-
md = EVP_MD_fetch(NULL, alg, "-fips");
220+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), "-fips");
216221
} else {
217222
/* Use FIPS compliant algorithms */
218-
md = EVP_MD_fetch(NULL, alg, NULL);
223+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), NULL);
219224
}
220225
#else
221-
md = EVP_get_digestbyname(alg);
226+
md = EVP_get_digestbyname(to_openssl_alg(alg));
222227
#endif
223228
if (NULL == md) {
224229
cli_errmsg("cl_hash_data_ex: Unsupported hash algorithm: %s\n", alg);
@@ -332,10 +337,14 @@ extern cl_error_t cl_hash_init_ex(
332337
uint32_t flags,
333338
cl_hash_ctx_t **ctx_out)
334339
{
335-
336340
cl_error_t status = CL_ERROR;
337341
EVP_MD_CTX *ctx = NULL;
338-
EVP_MD *md = NULL;
342+
343+
#if OPENSSL_VERSION_MAJOR >= 3
344+
EVP_MD *md = NULL;
345+
#else
346+
const EVP_MD *md = NULL;
347+
#endif
339348

340349
if (NULL == alg || NULL == ctx_out) {
341350
cli_errmsg("cl_hash_init_ex: Invalid arguments\n");
@@ -346,13 +355,13 @@ extern cl_error_t cl_hash_init_ex(
346355
#if OPENSSL_VERSION_MAJOR >= 3
347356
if (flags & CL_HASH_FLAG_FIPS_BYPASS) {
348357
/* Bypass FIPS restrictions the OpenSSL 3.0 way */
349-
md = EVP_MD_fetch(NULL, alg, "-fips");
358+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), "-fips");
350359
} else {
351360
/* Use FIPS compliant algorithms */
352-
md = EVP_MD_fetch(NULL, alg, NULL);
361+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), NULL);
353362
}
354363
#else
355-
md = EVP_get_digestbyname(alg);
364+
md = EVP_get_digestbyname(to_openssl_alg(alg));
356365
#endif
357366
if (NULL == md) {
358367
cli_errmsg("cl_hash_data_ex: Unsupported hash algorithm: %s\n", alg);
@@ -551,7 +560,12 @@ extern cl_error_t cl_hash_file_fd_ex(
551560
STATBUF sb;
552561

553562
EVP_MD_CTX *ctx = NULL;
554-
EVP_MD *md = NULL;
563+
564+
#if OPENSSL_VERSION_MAJOR >= 3
565+
EVP_MD *md = NULL;
566+
#else
567+
const EVP_MD *md = NULL;
568+
#endif
555569

556570
size_t required_hash_len;
557571
uint8_t *new_hash = NULL;
@@ -596,13 +610,13 @@ extern cl_error_t cl_hash_file_fd_ex(
596610
#if OPENSSL_VERSION_MAJOR >= 3
597611
if (flags & CL_HASH_FLAG_FIPS_BYPASS) {
598612
/* Bypass FIPS restrictions the OpenSSL 3.0 way */
599-
md = EVP_MD_fetch(NULL, alg, "-fips");
613+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), "-fips");
600614
} else {
601615
/* Use FIPS compliant algorithms */
602-
md = EVP_MD_fetch(NULL, alg, NULL);
616+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), NULL);
603617
}
604618
#else
605-
md = EVP_get_digestbyname(alg);
619+
md = EVP_get_digestbyname(to_openssl_alg(alg));
606620
#endif
607621
if (NULL == md) {
608622
cli_errmsg("cl_hash_data_ex: Unsupported hash algorithm: %s\n", alg);
@@ -723,16 +737,22 @@ unsigned char *cl_hash_data(const char *alg, const void *buf, size_t len, unsign
723737
EVP_MD_CTX *ctx;
724738
unsigned char *ret;
725739
size_t mdsz;
726-
EVP_MD *md;
740+
741+
#if OPENSSL_VERSION_MAJOR >= 3
742+
EVP_MD *md = NULL;
743+
#else
744+
const EVP_MD *md = NULL;
745+
#endif
746+
727747
unsigned int i;
728748
size_t cur;
729749
bool win_exception = false;
730750

731751
#if OPENSSL_VERSION_MAJOR >= 3
732752
/* Bypass FIPS restrictions the OpenSSL 3.0 way */
733-
md = EVP_MD_fetch(NULL, alg, "-fips");
753+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), "-fips");
734754
#else
735-
md = EVP_get_digestbyname(alg);
755+
md = EVP_get_digestbyname(to_openssl_alg(alg));
736756
#endif
737757
if (!(md))
738758
return NULL;
@@ -844,14 +864,20 @@ unsigned char *cl_hash_data(const char *alg, const void *buf, size_t len, unsign
844864
unsigned char *cl_hash_file_fd(int fd, const char *alg, unsigned int *olen)
845865
{
846866
EVP_MD_CTX *ctx;
847-
EVP_MD *md;
867+
868+
#if OPENSSL_VERSION_MAJOR >= 3
869+
EVP_MD *md = NULL;
870+
#else
871+
const EVP_MD *md = NULL;
872+
#endif
873+
848874
unsigned char *res;
849875

850876
#if OPENSSL_VERSION_MAJOR >= 3
851877
/* Bypass FIPS restrictions the OpenSSL 3.0 way */
852-
md = EVP_MD_fetch(NULL, alg, "-fips");
878+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), "-fips");
853879
#else
854-
md = EVP_get_digestbyname(alg);
880+
md = EVP_get_digestbyname(to_openssl_alg(alg));
855881
#endif
856882
if (!(md))
857883
return NULL;
@@ -996,7 +1022,7 @@ int cl_verify_signature_hash(EVP_PKEY *pkey, const char *alg, unsigned char *sig
9961022
const EVP_MD *md;
9971023
size_t mdsz;
9981024

999-
md = EVP_get_digestbyname(alg);
1025+
md = EVP_get_digestbyname(to_openssl_alg(alg));
10001026
if (!(md))
10011027
return -1;
10021028

@@ -1036,7 +1062,7 @@ int cl_verify_signature_fd(EVP_PKEY *pkey, const char *alg, unsigned char *sig,
10361062
if (!(digest))
10371063
return -1;
10381064

1039-
md = EVP_get_digestbyname(alg);
1065+
md = EVP_get_digestbyname(to_openssl_alg(alg));
10401066
if (!(md)) {
10411067
free(digest);
10421068
return -1;
@@ -1100,7 +1126,7 @@ int cl_verify_signature(EVP_PKEY *pkey, const char *alg, unsigned char *sig, uns
11001126
return -1;
11011127
}
11021128

1103-
md = EVP_get_digestbyname(alg);
1129+
md = EVP_get_digestbyname(to_openssl_alg(alg));
11041130
if (!(md)) {
11051131
free(digest);
11061132
if (decode)
@@ -1314,7 +1340,7 @@ unsigned char *cl_sign_data(EVP_PKEY *pkey, const char *alg, unsigned char *hash
13141340
unsigned int siglen;
13151341
unsigned char *sig;
13161342

1317-
md = EVP_get_digestbyname(alg);
1343+
md = EVP_get_digestbyname(to_openssl_alg(alg));
13181344
if (!(md))
13191345
return NULL;
13201346

@@ -1730,13 +1756,18 @@ X509_CRL *cl_load_crl(const char *file)
17301756
void *cl_hash_init(const char *alg)
17311757
{
17321758
EVP_MD_CTX *ctx;
1733-
EVP_MD *md;
1759+
1760+
#if OPENSSL_VERSION_MAJOR >= 3
1761+
EVP_MD *md = NULL;
1762+
#else
1763+
const EVP_MD *md = NULL;
1764+
#endif
17341765

17351766
#if OPENSSL_VERSION_MAJOR >= 3
17361767
/* Bypass FIPS restrictions the OpenSSL 3.0 way */
1737-
md = EVP_MD_fetch(NULL, alg, "-fips");
1768+
md = EVP_MD_fetch(NULL, to_openssl_alg(alg), "-fips");
17381769
#else
1739-
md = EVP_get_digestbyname(alg);
1770+
md = EVP_get_digestbyname(to_openssl_alg(alg));
17401771
#endif
17411772
if (!(md))
17421773
return NULL;

‎libclamav/filetypes.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ const struct ooxml_ftcodes {
327327
} \
328328
} while (0)
329329

330-
cli_file_t cli_determine_fmap_type(cli_ctx *ctx, cli_file_t basetype)
330+
cli_file_t cli_determine_fmap_type(cli_ctx_t ctx_t, cli_file_t basetype)
331331
{
332332
unsigned char buffer[MAGIC_BUFFER_SIZE];
333333
const unsigned char *buff;
@@ -337,6 +337,7 @@ cli_file_t cli_determine_fmap_type(cli_ctx *ctx, cli_file_t basetype)
337337
cli_file_t ret = CL_TYPE_BINARY_DATA;
338338
struct cli_matcher *root;
339339
struct cli_ac_data mdata;
340+
cli_ctx *ctx = (cli_ctx *)ctx_t;
340341

341342
if (!ctx || !ctx->engine || !ctx->fmap) {
342343
cli_errmsg("cli_determine_fmap_type: engine == NULL\n");

‎libclamav/filetypes.h‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@
2525
#include <sys/types.h>
2626

2727
#include "clamav.h"
28-
29-
typedef struct cli_ctx_tag cli_ctx;
28+
#include "other_types.h"
3029

3130
#define CL_FILE_MBUFF_SIZE 1024
3231
#define CL_PART_MBUFF_SIZE 1028
@@ -176,7 +175,7 @@ const char *cli_ftname(cli_file_t code);
176175
void cli_ftfree(const struct cl_engine *engine);
177176
cli_file_t cli_compare_ftm_file(const unsigned char *buf, size_t buflen, const struct cl_engine *engine);
178177
cli_file_t cli_compare_ftm_partition(const unsigned char *buf, size_t buflen, const struct cl_engine *engine);
179-
cli_file_t cli_determine_fmap_type(cli_ctx *ctx, cli_file_t basetype);
178+
cli_file_t cli_determine_fmap_type(cli_ctx_t ctx, cli_file_t basetype);
180179
int cli_addtypesigs(struct cl_engine *engine);
181180

182181
#endif

‎libclamav/hfsplus.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,7 @@ static cl_error_t hfsplus_scanfile(cli_ctx *ctx, hfsPlusVolumeHeader *volHeader,
360360
ext = 0;
361361
/* Dump file, extent by extent */
362362
do {
363-
uint32_t currBlock, endBlock, outputSize = 0;
363+
uint32_t currBlock, endBlock;
364364
if (targetSize == 0) {
365365
cli_dbgmsg("hfsplus_scanfile: output complete\n");
366366
break;
@@ -423,7 +423,6 @@ static cl_error_t hfsplus_scanfile(cli_ctx *ctx, hfsPlusVolumeHeader *volHeader,
423423
}
424424

425425
targetSize -= to_write;
426-
outputSize += to_write;
427426
currBlock++;
428427

429428
if (targetSize == 0) {

‎libclamav/matcher-hash-types.h‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,22 @@ typedef enum cli_hash_type {
3535
/**
3636
* @brief Get the name of the hash type as a string.
3737
*
38-
* Note: using the name OpenSSL uses for the hash type.
39-
*
4038
* @param type The hash type.
4139
* @return char* The name of the hash type.
4240
*/
4341
const char* cli_hash_name(cli_hash_type_t type);
4442

43+
/**
44+
* @brief Get OpenSSL's name of the hash type as a string.
45+
*
46+
* Needed because older versions of OpenSSL aren't familiar with "sha2-256",
47+
* "sha2-384", and "sha2-512".
48+
*
49+
* @param alg The name of the hash algorithm.
50+
* @return char* The OpenSSL name of the hash algorithm.
51+
*/
52+
const char *to_openssl_alg(const char *alg);
53+
4554
/**
4655
* @brief Get the size of the hash type.
4756
*

0 commit comments

Comments
 (0)