Hi, Xavier & list--
I second about false positive, I had several PS and PDF files that has being
detected as a false positive.
I had to desactivate this in my mail server farm.
Xavier
Xavier, just fyi--I added the lines below to work around the problem,
then rebuilt [this is version 0.96]. Clamav still passes all tests with
make check, and it still seems to do its job when I scan the source
directory, in addition to lessening the false positives on ps/pdf/xml
files and datestamps... I think I'll keep it.
... Then again I, er, wouldn't apply the patch willy-nilly to your
mailservers' installations though. ;]
Does anyone have a more efficient/proper solution?
--- libclamav/dlp.c 2010-04-27 10:12:26.000000000 -0700
+++ libclamav/dlp.c.ssnpatch 2010-04-27 10:11:49.000000000 -0700
@@ -312,6 +312,16 @@
if(numbuf[3] != '-' || numbuf[6] != '-')
return 0;
+ /* check each number if numeric */
+ char areastr[4]="...";
+ char grstr[3]="..";
+ char serstr[5]="....";
+ strncpy(areastr,numbuf,3);
+ strncpy(grstr,numbuf+4,2);
+ strncpy(serstr,numbuf+7,4);
+ if((!cli_isnumber(areastr)) || (!cli_isnumber(grstr)) ||
(!cli_isnumber(serstr)))
+ return 0;
+
if(sscanf((const char *) numbuf,
"%3d-%2d-%4d",
&area_number,
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
