From clamav-devel-bounces@lists.clamav.net  Wed Sep  5 04:39:27 2007
Return-Path: <clamav-devel-bounces@lists.clamav.net>
X-Original-To: list@tad.clamav.net
Delivered-To: list@tad.clamav.net
X-Virus-Scanned: Debian amavisd-new at tad.clamav.net
Received: from tad.clamav.net ([127.0.0.1])
	by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 2ClbGVPLUUg7; Wed,  5 Sep 2007 04:39:26 +0200 (CEST)
Received: from tad.clamav.net (localhost.localdomain [127.0.0.1])
	by tad.clamav.net (Postfix) with ESMTP id 2CC2F354066;
	Wed,  5 Sep 2007 04:39:26 +0200 (CEST)
X-Original-To: clamav-devel@tad.clamav.net
Delivered-To: clamav-devel@tad.clamav.net
X-Virus-Scanned: Debian amavisd-new at tad.clamav.net
Received: from tad.clamav.net ([127.0.0.1])
	by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id WBtgC3x58yqA for <clamav-devel@tad.clamav.net>;
	Wed,  5 Sep 2007 04:39:21 +0200 (CEST)
Received: from rv-out-0910.google.com (rv-out-0910.google.com [209.85.198.186])
	by tad.clamav.net (Postfix) with ESMTP id DE41A354064
	for <clamav-devel@lists.clamav.net>;
	Wed,  5 Sep 2007 04:39:20 +0200 (CEST)
Received: by rv-out-0910.google.com with SMTP id k20so1320698rvb
	for <clamav-devel@lists.clamav.net>;
	Tue, 04 Sep 2007 19:39:20 -0700 (PDT)
Received: by 10.141.202.12 with SMTP id e12mr2600979rvq.1188959959818;
	Tue, 04 Sep 2007 19:39:19 -0700 (PDT)
Received: from db-jiangfengbin ( [219.131.196.66])
	by mx.google.com with ESMTPS id k19sm8504282rvb.2007.09.04.19.39.17
	(version=SSLv3 cipher=OTHER); Tue, 04 Sep 2007 19:39:18 -0700 (PDT)
Date: Wed, 5 Sep 2007 10:39:02 +0800
From: "Leo Jiang" <root@trojan-shield.com>
To: "clamav-devel" <clamav-devel@lists.clamav.net>
Message-ID: <200709051038584075531@trojan-shield.com>
Organization: Leo Labs
X-mailer: Foxmail 6, 8, 105, 25 [cn]
Mime-Version: 1.0
Subject: [Clamav-devel] About BM_MIN_LENGTH and BM_BLOCK_SIZE in mater-bm.c
X-BeenThere: clamav-devel@lists.clamav.net
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ClamAV Development <clamav-devel@lists.clamav.net>
List-Id: ClamAV Development <clamav-devel.lists.clamav.net>
List-Unsubscribe: <http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel>,
	<mailto:clamav-devel-request@lists.clamav.net?subject=unsubscribe>
List-Post: <mailto:clamav-devel@lists.clamav.net>
List-Help: <mailto:clamav-devel-request@lists.clamav.net?subject=help>
List-Subscribe: <http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-devel>,
	<mailto:clamav-devel-request@lists.clamav.net?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: clamav-devel-bounces@lists.clamav.net
Errors-To: clamav-devel-bounces@lists.clamav.net

Hi,

Now in codes both of BM_MIN_LENGTH and BM_BLOCK_SIZE is zero. (In file "matcher-bm.c")

So in function "cli_bm_addpatt"

These codes:

for (i = BM_MIN_LENGTH - BM_BLOCK_SIZE; i >= 0; i--) 
{
	idx = HASH(pt[i], pt[i + 1], pt[i + 2]);
	root->bm_shift[idx] = MIN(root->bm_shift[idx], BM_MIN_LENGTH - BM_BLOCK_SIZE - i);
}

i = BM_MIN_LENGTH - BM_BLOCK_SIZE;
idx = HASH(pt[i], pt[i + 1], pt[i + 2]);

equals:

idx = HASH(pt[0], pt[1], pt[2]);
root->bm_shift[idx] = 0;

In my option one BM virus signature was load will using more instructions.
More big the database is, more slow while loading it.

And now bm_shift[] only have 2 value, one is 1 and another is 0. 
But in codes it using a int32_t type.
I think it should using a unsigned char instead of int32_t.
This will reduce a lot of memory, and it's very useful in a embedded system.


Best regards,
Leo Jiang <Leo.J@live.com>


_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

