Add parser for ALZ archives

Cisco-Talos · Apr 13, 2024 · 06ef85a · 06ef85a
1 parent 1a26d54
commit 06ef85a
Show file tree

Hide file tree

Showing 21 changed files with 904 additions and 193 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/libclamav/dconf.c b/libclamav/dconf.c
@@ -108,6 +108,7 @@ static struct dconf_module modules[] = {
     {"ARCHIVE", "EGG", ARCH_CONF_EGG, 1},
     {"ARCHIVE", "UDF", ARCH_CONF_UDF, 1},
     {"ARCHIVE", "LHA", ARCH_CONF_LHA_LZH, 1},
+    {"ARCHIVE", "ALZ", ARCH_CONF_ALZ, 1},
 
     {"DOCUMENT", "HTML", DOC_CONF_HTML, 1},
     {"DOCUMENT", "RTF", DOC_CONF_RTF, 1},

diff --git a/libclamav/dconf.h b/libclamav/dconf.h
@@ -98,6 +98,7 @@ struct cli_dconf {
 #define ARCH_CONF_EGG     0x4000000
 #define ARCH_CONF_UDF     0x8000000
 #define ARCH_CONF_LHA_LZH 0x10000000
+#define ARCH_CONF_ALZ     0x20000000
 
 /* Document flags */
 #define DOC_CONF_HTML         0x1

diff --git a/libclamav/filetypes.c b/libclamav/filetypes.c
@@ -138,6 +138,7 @@ static const struct ftmap_s {
     { "CL_TYPE_EGG",                CL_TYPE_EGG             },
     { "CL_TYPE_EGGSFX",             CL_TYPE_EGGSFX          },
     { "CL_TYPE_UDF",                CL_TYPE_UDF             },
+    { "CL_TYPE_ALZ",                CL_TYPE_ALZ             },
     { "CL_TYPE_ONENOTE",            CL_TYPE_ONENOTE         },
     { "CL_TYPE_PYTHON_COMPILED",    CL_TYPE_PYTHON_COMPILED },
     { "CL_TYPE_LHA_LZH",            CL_TYPE_LHA_LZH         },

diff --git a/libclamav/filetypes.h b/libclamav/filetypes.h
@@ -126,6 +126,7 @@ typedef enum cli_file {
     CL_TYPE_MHTML,
     CL_TYPE_LNK,
     CL_TYPE_UDF,
+    CL_TYPE_ALZ,
     CL_TYPE_OTHER,  /* on-the-fly, used for target 14 (OTHER) */
     CL_TYPE_IGNORED /* please don't add anything below */
 } cli_file_t;

diff --git a/libclamav/filetypes_int.h b/libclamav/filetypes_int.h
@@ -301,5 +301,6 @@ static const char *ftypes_int[] = {
     "1:2:2d6c68(30|31|32|33|34|35|36|37|64|78)2d:LHA or LZH archive:CL_TYPE_ANY:CL_TYPE_LHA_LZH:210",
     "1:2:2d6c7a(73|34|35)2d:LHA archive using .LZS extension:CL_TYPE_ANY:CL_TYPE_LHA_LZH:210",
     "1:2:2d706d302d:LHA archive using PMarc (.PMA) extension:CL_TYPE_ANY:CL_TYPE_LHA_LZH:210",
+    "0:0:414c5a01:ALZ:CL_TYPE_ANY:CL_TYPE_ALZ:210", 
     NULL};
 #endif
diff --git a/libclamav/scanners.c b/libclamav/scanners.c
@@ -4550,6 +4550,11 @@ cl_error_t cli_magic_scan(cli_ctx *ctx, cli_file_t type)
             if (SCAN_PARSE_ONENOTE && (DCONF_ARCH & DOC_CONF_ONENOTE))
                 ret = scan_onenote(ctx);
             break;
+        case CL_TYPE_ALZ:
+            if (SCAN_PARSE_ARCHIVE && (DCONF_ARCH & ARCH_CONF_ALZ)) {
+                ret = cli_scanalz(ctx);
+            }
+            break;
 
         case CL_TYPE_LHA_LZH:
             if (SCAN_PARSE_ARCHIVE && (DCONF_ARCH & ARCH_CONF_LHA_LZH))

diff --git a/libclamav_rust/Cargo.toml b/libclamav_rust/Cargo.toml
@@ -22,6 +22,9 @@ unicode-segmentation = "1.10"
 bindgen = "0.65"
 onenote_parser = { git = "https://github.com/Cisco-Talos/onenote.rs.git", branch = "CLAM-2329-new-from-slice" }
 hex-literal = "0.4"
+inflate = "0.4"
+bzip2-rs = "0.1"
+byteorder = "1.5"
 delharc = "0.5"
 
 [lib]

diff --git a/libclamav_rust/cbindgen.toml b/libclamav_rust/cbindgen.toml
@@ -37,6 +37,7 @@ include = [
   "evidence::evidence_add_indicator",
   "evidence::IndicatorType",
   "scanners::scan_onenote",
+  "scanners::cli_scanalz",
 ]
 
 # prefix = "CAPI_"