clamav-0.101.2 / unrar

[Matthias Ferdinand <mf+ml.pkgsrc-users%netzwerkagentursaarland.de@localhost>]

Hi,

there was an update for clamav recently, bringing it to 0.101.2 - thank
you for this!

This update adds

    # Work around build failure PR pkg/54420
    CONFIGURE_ARGS+=       --disable-unrar

to Makefile because of some wrapper problems. The wrappers add a
"-L./.libs" like this

    -dlopen -L./.libs libclamunrar_iface.la

where it should be 

    -dlopen libclamunrar_iface.la

or perhaps 

    -dlopen libclamunrar_iface.la -L./.libs 

(happens also with shell wrappers)

While disabling unrar fixes the build problem, it introduces a security
problem for systems using the new clamav package, as now you can sneak
malware through undetected by wrapping it up in a .rar archive.

As workaround for the build problem I tried the following wrapper around
libtool to move the "-L./.libs" argument to the right, but it worked
only on some systems and not on others (libtool notices being invoked as
.orig and configure then using it directly there).

--
#!/bin/sh

/usr/bin/perl -e 'foreach my $i (1..$#ARGV-2) { if ($ARGV[$i] eq "-dlopen" and $ARGV[$i+1] eq "-L./.libs") { $ARGV[$i+1]=$ARGV[$i+2]; $ARGV[$i+2]="-L./.libs"; print
 STDERR "# modified at pos. $i\n"; } }; exec "/opt/pkgsrc/bin/libtool.orig",@ARGV;' -- ${1+"$@"};
--

My shell fu is not strong enough to do the same in portable shell code
(could then be added as patch to libtool itself, re-executing itself
with args in corrected order).

Perhaps somebody else knows how to do that (or how to fix wrappers).

Regards
Matthias Ferdinand