From 523e4264e02bedf77c19d45cd3fe6908539f06a7 Mon Sep 17 00:00:00 2001
From: Kevin Lin <klin@sourcefire.com>
Date: Thu, 17 Dec 2015 16:16:04 -0500
Subject: [PATCH] msxml_parser: add MSXML_JSON_MULTI option for tracking
 multiple entries for same key

---
 libclamav/msxml_parser.c | 15 +++++++++++++++
 libclamav/msxml_parser.h | 19 ++++++++++---------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/libclamav/msxml_parser.c b/libclamav/msxml_parser.c
index cc792e63f..0fe069a17 100644
--- a/libclamav/msxml_parser.c
+++ b/libclamav/msxml_parser.c
@@ -260,6 +260,21 @@ static int msxml_parse_element(struct msxml_ctx *mxctx, xmlTextReaderPtr reader,
                 cli_msxmlmsg("msxml_parse_element: retrieved json object [Count]\n");
             }
 
+            /* check if multiple entries are allowed */
+            if (thisjobj && (keyinfo->type & MSXML_JSON_MULTI)) {
+                /* replace this object with an array entry object */
+                json_object *multi = cli_jsonarray(thisjobj, "Multi");
+                if (!multi) {
+                    return CL_EMEM;
+                }
+                cli_msxmlmsg("msxml_parse_element: generated or retrieved json multi array\n");
+
+                thisjobj = cli_jsonobj(multi, NULL);
+                if (!thisjobj)
+                    return CL_EMEM;
+                cli_msxmlmsg("msxml_parse_element: generated json multi entry object\n");
+            }
+
             /* handle attributes */
             if (thisjobj && (keyinfo->type & MSXML_JSON_ATTRIB)) {
                 state = xmlTextReaderHasAttributes(reader);
diff --git a/libclamav/msxml_parser.h b/libclamav/msxml_parser.h
index d06327b13..6abceb4d1 100644
--- a/libclamav/msxml_parser.h
+++ b/libclamav/msxml_parser.h
@@ -50,19 +50,20 @@ struct attrib_entry {
 
 struct key_entry {
 /* how */
-#define MSXML_IGNORE         0x00
-#define MSXML_IGNORE_ELEM    0x01
-#define MSXML_SCAN_CB        0x02
-#define MSXML_SCAN_B64       0x04
+#define MSXML_IGNORE          0x0
+#define MSXML_IGNORE_ELEM     0x1
+#define MSXML_SCAN_CB         0x2
+#define MSXML_SCAN_B64        0x4
 /* where */
-#define MSXML_JSON_ROOT      0x08
-#define MSXML_JSON_WRKPTR    0x10
+#define MSXML_JSON_ROOT       0x8
+#define MSXML_JSON_WRKPTR     0x10
+#define MSXML_JSON_MULTI      0x20
 
 #define MSXML_JSON_TRACK (MSXML_JSON_ROOT | MSXML_JSON_WRKPTR)
 /* what */
-#define MSXML_JSON_COUNT     0x20
-#define MSXML_JSON_VALUE     0x40
-#define MSXML_JSON_ATTRIB    0x80
+#define MSXML_JSON_COUNT      0x40
+#define MSXML_JSON_VALUE      0x80
+#define MSXML_JSON_ATTRIB     0x100
 
     const char *key;
     const char *name;