Re: Problem solved, bug in sophie found

mustafa atakan <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Is the same problem/solution pair also portable to the trophie 
implementation?

Markus Stumpf wrote:

>On Wed, Jan 21, 2004 at 10:19:36PM +0100, Maciej Uhlig wrote:
>  
>
>>do you happen to know the meaning of all possible option values for Sophos
>>options?
>>    
>>
>
>0 = off
>1 = on
>for Grp* you can have values > 1. They represent "invalid".
>This is not an error, but means "none of the configuration options in the
>group will be altered", whatever that means.
>
>All individual options only take 0 or 1 as valid settings. All
>individual options are U32, but 
>    MaxRecursionDepth	U16
>    IdeDir		STR
>    VirusDataDir	STR
>    VirusDataName	STR
>
>Hmmm ... there is a SOPHOS_TYPE_OPTION_GROUP and the Grp* values
>should probably be of that type.
>
>Ok, I think I have found a bug in sophie.
>sophie sets the Grp* options using a SOPHOS_TYPE_U32, but adding the
>line
>    if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP;
>make my problems go away.
>Now sophie even recognizes the Troj/Sefex-A if "Mime: 0" is set.
>
>The problem is in  sophie_init.c
>In function
>    sophie_set_engine_config()
>look for
>    /* Crap... */
>    if (STRNCMP(option, "MaxRecursionDepth", 17))
>	stype = SOPHOS_TYPE_U16;
>    else
>	stype = SOPHOS_TYPE_U32;
>and add the following line
>    if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP;
>
>recompile, reinstall.
>
>	\Maex
>
>  
>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.