java/src/org/openantivirus/engine/censor StringFinder.java,1.2,1.3
Kurt Huwig <[email protected]> Sat, 22 May 2004 12:22:29 +0000
| Newsgroups | gmane.comp.security.virus.openantivirus.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/openantivirus/java/src/org/openantivirus/engine/censor
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv9747/src/org/openantivirus/engine/censor
Modified Files:
StringFinder.java
Log Message:
Bugfix: some patterns were not detected due to bad optimizing
Speed improvements on multipart patterns
Index: StringFinder.java
===================================================================
RCS file: /cvsroot/openantivirus/java/src/org/openantivirus/engine/censor/StringFinder.java,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -d -r1.2 -r1.3
--- StringFinder.java 20 May 2004 13:02:25 -0000 1.2
+++ StringFinder.java 22 May 2004 12:22:27 -0000 1.3
@@ -26,6 +26,8 @@
*/
package org.openantivirus.engine.censor;
+import java.util.*;
+
import org.openantivirus.engine.credo.*;
/**
@@ -36,87 +38,192 @@
* @version $Revision$
*/
public class StringFinder {
- private StringSearch stringSearch;
+ private final StringSearch stringSearch;
+ private int multipartCount = 0;
public StringFinder(StringSearch stringSearch) {
this.stringSearch = stringSearch;
}
- public void addString(WildcardPattern wp,
- int offset,
- PositionFoundListener pfl) {
+ public void addString(String sPattern,
+ final int offset,
+ final PositionFoundListener pfl) {
+ final byte[] pattern = new WildcardPattern(sPattern).pattern;
+ final byte[] searchPattern = new byte[pattern.length - offset];
+ System.arraycopy(pattern, offset,
+ searchPattern, 0, searchPattern.length);
+ stringSearch.addString(searchPattern, new PositionFoundListener() {
+ public void positionFound(PositionFoundEvent pfe)
+ throws MalwareFoundException {
+ if (checkString(pattern, offset, pfe)) {
+ adjustPosition(offset, pattern, pfe);
+ pfl.positionFound(pfe);
+ }
+ }
+
+ });
+ }
+
+ public void addWildcardString(final WildcardPattern wp,
+ final int offset,
+ final PositionFoundListener pfl) {
final byte[] searchPattern = new byte[wp.pattern.length - offset];
System.arraycopy(wp.pattern, offset,
searchPattern, 0, searchPattern.length);
- stringSearch.addString(searchPattern,
- new PartialStringFoundListener(wp.pattern,
- wp.skipList,
- offset,
- pfl));
+ stringSearch.addString(searchPattern, new PositionFoundListener() {
+ public void positionFound(PositionFoundEvent pfe)
+ throws MalwareFoundException {
+ if (checkWildcardString(wp, offset, pfe)) {
+ adjustPosition(offset, wp.pattern, pfe);
+ pfl.positionFound(pfe);
+ }
+ }
+ });
}
- private static class PartialStringFoundListener
- implements PositionFoundListener {
- private byte[] abPattern;
- private int [] skipList;
- private int offset;
- private PositionFoundListener pfl;
+ public void addMultipartString(String pattern,
+ String offsets,
+ final PositionFoundListener pfl) {
+ final StringTokenizer stOffsets = new StringTokenizer(offsets, "*");
+ final int partCount = stOffsets.countTokens();
+ final int multipartId = multipartCount++;
- public PartialStringFoundListener(byte[] abPattern,
- int[] skipList,
- int offset,
- PositionFoundListener pfl) {
- this.abPattern = abPattern;
- this.skipList = skipList;
- this.offset = offset;
- this.pfl = pfl;
+ int part = 1;
+ for (StringTokenizer stPatterns = new StringTokenizer(pattern, "*");
+ stPatterns.hasMoreTokens();
+ part++) {
+
+ final WildcardPattern subPattern =
+ new WildcardPattern(stPatterns.nextToken());
+ final int subOffset = Integer.parseInt(stOffsets.nextToken());
+
+ final byte[] searchPattern =
+ new byte[subPattern.pattern.length - subOffset];
+ System.arraycopy(subPattern.pattern, subOffset,
+ searchPattern, 0, searchPattern.length);
+
+ final int partId = part;
+ stringSearch.addString(searchPattern, new PositionFoundListener() {
+ public void positionFound(PositionFoundEvent pfe)
+ throws MalwareFoundException {
+ int[] foundParts = pfe.entry.foundParts;
+ if (foundParts == null) {
+ foundParts = new int[multipartCount];
+ pfe.entry.foundParts = foundParts;
+ }
+
+ final int foundPart = foundParts[multipartId];
+ if (foundPart != partId - 1) {
+ return;
+ }
+
+ if (checkWildcardString(subPattern, subOffset, pfe)) {
+ if (partId == partCount) {
+ pfl.positionFound(new PositionFoundEvent(
+ pfe.entry,
+ -1,
+ null,
+ -1,
+ -1,
+ -1,
+ -1));
+ } else {
+ pfe.entry.foundParts[multipartId] = partId;
+ }
+ }
+ }
+ });
}
- public void positionFound(PositionFoundEvent pfe)
- throws MalwareFoundException {
- if (pfe.fileOffset < offset) {
- return;
+ }
+
+ protected static void adjustPosition(int offset,
+ byte[] pattern,
+ PositionFoundEvent pfe) {
+ pfe.bufferOffset -= offset;
+ pfe.fileOffset -= offset;
+ pfe.length = pattern.length;
+ pfe.prefix -= offset;
+ pfe.suffix += pattern.length - offset - 2;
+ }
+
+ public static boolean checkString(byte[] pattern,
+ int offset,
+ PositionFoundEvent pfe) {
+ if (pfe.fileOffset < offset) {
+ return false;
+ }
+
+ int iBufferPos = pfe.bufferOffset - offset;
+ if (iBufferPos < 0) {
+ iBufferPos += pfe.buffer.length;
+ }
+
+ final int iSuffixEnd = pfe.bufferOffset + pfe.suffix;
+
+ for (int i = 0; i < pattern.length; i++) {
+ if (iBufferPos == iSuffixEnd) {
+ return false;
}
- final byte[] abBuffer = pfe.buffer;
-
- int iBufferPos = pfe.bufferOffset - offset;
- if (iBufferPos < 0) {
- iBufferPos += abBuffer.length;
+ if (pattern[i] != pfe.buffer[iBufferPos]) {
+ return false;
}
- final int iSuffixEnd = pfe.bufferOffset + pfe.suffix;
+ iBufferPos++;
+ if (iBufferPos == pfe.buffer.length) {
+ iBufferPos -= pfe.buffer.length;
+ }
+ }
+
+ return true;
+ }
- int skipIndex = 0;
- int skipCount = skipList[0];
- for (int i = 0; i < abPattern.length; i++) {
- if (iBufferPos == iSuffixEnd) {
- return;
- }
-
- if (skipCount == 0) {
- skipCount = skipList[++skipIndex];
- i += skipCount;
- iBufferPos += skipCount;
- if (iBufferPos >= abBuffer.length) {
- iBufferPos -= abBuffer.length;
- }
- skipCount = skipList[++skipIndex];
- }
-
- skipCount--;
-
- if (abPattern[i] != abBuffer[iBufferPos]) {
- return;
- }
-
- iBufferPos++;
- if (iBufferPos == abBuffer.length) {
- iBufferPos -= abBuffer.length;
+
+ public static boolean checkWildcardString(WildcardPattern wp,
+ int offset,
+ PositionFoundEvent pfe) {
+ if (pfe.fileOffset < offset) {
+ return false;
+ }
+
+ int iBufferPos = pfe.bufferOffset - offset;
+ if (iBufferPos < 0) {
+ iBufferPos += pfe.buffer.length;
+ }
+
+ final int iSuffixEnd = pfe.bufferOffset + pfe.suffix;
+
+ int skipIndex = 0;
+ int skipCount = wp.skipList[0];
+ for (int i = 0; i < wp.pattern.length; i++) {
+ if (iBufferPos == iSuffixEnd) {
+ return false;
+ }
+
+ if (skipCount == 0) {
+ skipCount = wp.skipList[++skipIndex];
+ i += skipCount;
+ iBufferPos += skipCount;
+ if (iBufferPos >= pfe.buffer.length) {
+ iBufferPos -= pfe.buffer.length;
}
+ skipCount = wp.skipList[++skipIndex];
}
- pfl.positionFound(pfe);
+ skipCount--;
+
+ if (wp.pattern[i] != pfe.buffer[iBufferPos]) {
+ return false;
+ }
+
+ iBufferPos++;
+ if (iBufferPos == pfe.buffer.length) {
+ iBufferPos -= pfe.buffer.length;
+ }
}
+
+ return true;
}
+
}
-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click