X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=src%2Frootcheck%2Fcheck_rc_trojans.c;h=1ee24efa8cbc929f0e9d9e1d96193fb6bc28bf02;hp=40b16edccad6cbb782733bbb3d0ad6b396a3a9c8;hb=6ef2f786c6c8ead94841b5f93baf9f43421f08c8;hpb=301048b51990573e58a30dc4a5bb4ec285cad554 diff --git a/src/rootcheck/check_rc_trojans.c b/src/rootcheck/check_rc_trojans.c index 40b16ed..1ee24ef 100755 --- a/src/rootcheck/check_rc_trojans.c +++ b/src/rootcheck/check_rc_trojans.c @@ -1,4 +1,5 @@ -/* @(#) $Id$ */ +/* @(#) $Id: ./src/rootcheck/check_rc_trojans.c, 2011/09/08 dcid Exp $ + */ /* Copyright (C) 2009 Trend Micro Inc. * All right reserved. @@ -9,7 +10,7 @@ * Foundation */ - + #include "shared.h" #include "rootcheck.h" @@ -53,7 +54,7 @@ void check_rc_trojans(char *basedir, FILE *fp) /* Normalizing line */ nbuf = normalize_string(buf); - + if(*nbuf == '\0' || *nbuf == '#') { @@ -69,7 +70,7 @@ void check_rc_trojans(char *basedir, FILE *fp) { continue; } - + *string_to_look = '\0'; string_to_look++; @@ -80,26 +81,26 @@ void check_rc_trojans(char *basedir, FILE *fp) } *message = '\0'; message++; - + string_to_look = normalize_string(string_to_look); file = normalize_string(file); message = normalize_string(message); - - + + if(*file == '\0' || *string_to_look == '\0') { continue; } - + _total++; - - + + /* Trying with all possible paths */ while(all_paths[i] != NULL) { if(*file != '/') { - snprintf(file_path, OS_SIZE_1024, "%s/%s/%s",basedir, + snprintf(file_path, OS_SIZE_1024, "%s/%s/%s",basedir, all_paths[i], file); } @@ -108,15 +109,15 @@ void check_rc_trojans(char *basedir, FILE *fp) strncpy(file_path, file, OS_SIZE_1024); file_path[OS_SIZE_1024 -1] = '\0'; } - + /* Checking if entry is found */ if(is_file(file_path) && os_string(file_path, string_to_look)) { char op_msg[OS_SIZE_1024 +1]; _errors = 1; - + snprintf(op_msg, OS_SIZE_1024, "Trojaned version of file " - "'%s' detected. Signature used: '%s' (%s).", + "'%s' detected. Signature used: '%s' (%s).", file_path, string_to_look, *message == '\0'? @@ -131,7 +132,7 @@ void check_rc_trojans(char *basedir, FILE *fp) } i++; } - continue; + continue; }