xref: /PHP-8.1/ext/fileinfo/libmagic/apprentice.c (revision 3b9173dc)
1 /*
2  * Copyright (c) Ian F. Darwin 1986-1995.
3  * Software written by Ian F. Darwin and others;
4  * maintained 1995-present by Christos Zoulas and others.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice immediately at the beginning of the file, without modification,
11  *    this list of conditions, and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
20  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 /*
29  * apprentice - make one pass through /etc/magic, learning its secrets.
30  */
31 
32 #include "php.h"
33 
34 #include "file.h"
35 
36 #ifndef	lint
37 FILE_RCSID("@(#)$File: apprentice.c,v 1.301 2021/02/23 00:51:11 christos Exp $")
38 #endif	/* lint */
39 
40 #include "magic.h"
41 #include <stdlib.h>
42 
43 #if defined(__hpux) && !defined(HAVE_STRTOULL)
44 #if SIZEOF_LONG == 8
45 # define strtoull strtoul
46 #else
47 # define strtoull __strtoull
48 #endif
49 #endif
50 
51 #ifdef PHP_WIN32
52 #include "win32/unistd.h"
53 #define strtoull _strtoui64
54 #else
55 #ifdef HAVE_UNISTD_H
56 #include <unistd.h>
57 #endif
58 #endif
59 #include <string.h>
60 #include <assert.h>
61 #include <ctype.h>
62 #include <fcntl.h>
63 
64 #ifndef SSIZE_MAX
65 #define MAXMAGIC_SIZE        ((ssize_t)0x7fffffff)
66 #else
67 #define MAXMAGIC_SIZE        SSIZE_MAX
68 #endif
69 
70 
71 #define	EATAB {while (isascii(CAST(unsigned char, *l)) && \
72 		      isspace(CAST(unsigned char, *l)))  ++l;}
73 #define LOWCASE(l) (isupper(CAST(unsigned char, l)) ? \
74 			tolower(CAST(unsigned char, l)) : (l))
75 /*
76  * Work around a bug in headers on Digital Unix.
77  * At least confirmed for: OSF1 V4.0 878
78  */
79 #if defined(__osf__) && defined(__DECC)
80 #ifdef MAP_FAILED
81 #undef MAP_FAILED
82 #endif
83 #endif
84 
85 #ifndef offsetof
86 #define offsetof(STRUCTURE,FIELD) ((int)((char*)&((STRUCTURE*)0)->FIELD))
87 #endif
88 
89 #ifndef MAP_FAILED
90 #define MAP_FAILED (void *) -1
91 #endif
92 
93 #ifndef MAP_FILE
94 #define MAP_FILE 0
95 #endif
96 
97 #define ALLOC_CHUNK	CAST(size_t, 10)
98 #define ALLOC_INCR	CAST(size_t, 200)
99 
100 #define MAP_TYPE_USER	0
101 #define MAP_TYPE_MALLOC	1
102 #define MAP_TYPE_MMAP	2
103 
104 struct magic_entry {
105 	struct magic *mp;
106 	uint32_t cont_count;
107 	uint32_t max_count;
108 };
109 
110 struct magic_entry_set {
111 	struct magic_entry *me;
112 	uint32_t count;
113 	uint32_t max;
114 };
115 
116 struct magic_map {
117 	void *p;
118 	size_t len;
119 	int type;
120 	struct magic *magic[MAGIC_SETS];
121 	uint32_t nmagic[MAGIC_SETS];
122 };
123 
124 int file_formats[FILE_NAMES_SIZE];
125 const size_t file_nformats = FILE_NAMES_SIZE;
126 const char *file_names[FILE_NAMES_SIZE];
127 const size_t file_nnames = FILE_NAMES_SIZE;
128 
129 private int getvalue(struct magic_set *ms, struct magic *, const char **, int);
130 private int hextoint(int);
131 private const char *getstr(struct magic_set *, struct magic *, const char *,
132     int);
133 private int parse(struct magic_set *, struct magic_entry *, const char *,
134     size_t, int);
135 private void eatsize(const char **);
136 private int apprentice_1(struct magic_set *, const char *, int);
137 private size_t apprentice_magic_strength(const struct magic *);
138 private int apprentice_sort(const void *, const void *);
139 private void apprentice_list(struct mlist *, int );
140 private struct magic_map *apprentice_load(struct magic_set *,
141     const char *, int);
142 private struct mlist *mlist_alloc(void);
143 private void mlist_free_all(struct magic_set *);
144 private void mlist_free(struct mlist *);
145 private void byteswap(struct magic *, uint32_t);
146 private void bs1(struct magic *);
147 private uint16_t swap2(uint16_t);
148 private uint32_t swap4(uint32_t);
149 private uint64_t swap8(uint64_t);
150 private char *mkdbname(struct magic_set *, const char *, int);
151 private struct magic_map *apprentice_map(struct magic_set *, const char *);
152 private void apprentice_unmap(struct magic_map *);
153 private int apprentice_compile(struct magic_set *, struct magic_map *,
154     const char *);
155 private int check_format_type(const char *, int, const char **);
156 private int check_format(struct magic_set *, struct magic *);
157 private int get_op(char);
158 private int parse_mime(struct magic_set *, struct magic_entry *, const char *,
159     size_t);
160 private int parse_strength(struct magic_set *, struct magic_entry *,
161     const char *, size_t);
162 private int parse_apple(struct magic_set *, struct magic_entry *, const char *,
163     size_t);
164 private int parse_ext(struct magic_set *, struct magic_entry *, const char *,
165     size_t);
166 
167 
168 private size_t magicsize = sizeof(struct magic);
169 
170 private const char usg_hdr[] = "cont\toffset\ttype\topcode\tmask\tvalue\tdesc";
171 
172 private struct {
173 	const char *name;
174 	size_t len;
175 	int (*fun)(struct magic_set *, struct magic_entry *, const char *,
176 	    size_t);
177 } bang[] = {
178 #define	DECLARE_FIELD(name) { # name, sizeof(# name) - 1, parse_ ## name }
179 	DECLARE_FIELD(mime),
180 	DECLARE_FIELD(apple),
181 	DECLARE_FIELD(ext),
182 	DECLARE_FIELD(strength),
183 #undef	DECLARE_FIELD
184 	{ NULL, 0, NULL }
185 };
186 
187 #include "../data_file.c"
188 
189 struct type_tbl_s {
190 	const char name[16];
191 	const size_t len;
192 	const int type;
193 	const int format;
194 };
195 
196 /*
197  * XXX - the actual Single UNIX Specification says that "long" means "long",
198  * as in the C data type, but we treat it as meaning "4-byte integer".
199  * Given that the OS X version of file 5.04 did the same, I guess that passes
200  * the actual test; having "long" be dependent on how big a "long" is on
201  * the machine running "file" is silly.
202  */
203 static const struct type_tbl_s type_tbl[] = {
204 # define XX(s)		s, (sizeof(s) - 1)
205 # define XX_NULL	"", 0
206 	{ XX("invalid"),	FILE_INVALID,		FILE_FMT_NONE },
207 	{ XX("byte"),		FILE_BYTE,		FILE_FMT_NUM },
208 	{ XX("short"),		FILE_SHORT,		FILE_FMT_NUM },
209 	{ XX("default"),	FILE_DEFAULT,		FILE_FMT_NONE },
210 	{ XX("long"),		FILE_LONG,		FILE_FMT_NUM },
211 	{ XX("string"),		FILE_STRING,		FILE_FMT_STR },
212 	{ XX("date"),		FILE_DATE,		FILE_FMT_STR },
213 	{ XX("beshort"),	FILE_BESHORT,		FILE_FMT_NUM },
214 	{ XX("belong"),		FILE_BELONG,		FILE_FMT_NUM },
215 	{ XX("bedate"),		FILE_BEDATE,		FILE_FMT_STR },
216 	{ XX("leshort"),	FILE_LESHORT,		FILE_FMT_NUM },
217 	{ XX("lelong"),		FILE_LELONG,		FILE_FMT_NUM },
218 	{ XX("ledate"),		FILE_LEDATE,		FILE_FMT_STR },
219 	{ XX("pstring"),	FILE_PSTRING,		FILE_FMT_STR },
220 	{ XX("ldate"),		FILE_LDATE,		FILE_FMT_STR },
221 	{ XX("beldate"),	FILE_BELDATE,		FILE_FMT_STR },
222 	{ XX("leldate"),	FILE_LELDATE,		FILE_FMT_STR },
223 	{ XX("regex"),		FILE_REGEX,		FILE_FMT_STR },
224 	{ XX("bestring16"),	FILE_BESTRING16,	FILE_FMT_STR },
225 	{ XX("lestring16"),	FILE_LESTRING16,	FILE_FMT_STR },
226 	{ XX("search"),		FILE_SEARCH,		FILE_FMT_STR },
227 	{ XX("medate"),		FILE_MEDATE,		FILE_FMT_STR },
228 	{ XX("meldate"),	FILE_MELDATE,		FILE_FMT_STR },
229 	{ XX("melong"),		FILE_MELONG,		FILE_FMT_NUM },
230 	{ XX("quad"),		FILE_QUAD,		FILE_FMT_QUAD },
231 	{ XX("lequad"),		FILE_LEQUAD,		FILE_FMT_QUAD },
232 	{ XX("bequad"),		FILE_BEQUAD,		FILE_FMT_QUAD },
233 	{ XX("qdate"),		FILE_QDATE,		FILE_FMT_STR },
234 	{ XX("leqdate"),	FILE_LEQDATE,		FILE_FMT_STR },
235 	{ XX("beqdate"),	FILE_BEQDATE,		FILE_FMT_STR },
236 	{ XX("qldate"),		FILE_QLDATE,		FILE_FMT_STR },
237 	{ XX("leqldate"),	FILE_LEQLDATE,		FILE_FMT_STR },
238 	{ XX("beqldate"),	FILE_BEQLDATE,		FILE_FMT_STR },
239 	{ XX("float"),		FILE_FLOAT,		FILE_FMT_FLOAT },
240 	{ XX("befloat"),	FILE_BEFLOAT,		FILE_FMT_FLOAT },
241 	{ XX("lefloat"),	FILE_LEFLOAT,		FILE_FMT_FLOAT },
242 	{ XX("double"),		FILE_DOUBLE,		FILE_FMT_DOUBLE },
243 	{ XX("bedouble"),	FILE_BEDOUBLE,		FILE_FMT_DOUBLE },
244 	{ XX("ledouble"),	FILE_LEDOUBLE,		FILE_FMT_DOUBLE },
245 	{ XX("leid3"),		FILE_LEID3,		FILE_FMT_NUM },
246 	{ XX("beid3"),		FILE_BEID3,		FILE_FMT_NUM },
247 	{ XX("indirect"),	FILE_INDIRECT,		FILE_FMT_NUM },
248 	{ XX("qwdate"),		FILE_QWDATE,		FILE_FMT_STR },
249 	{ XX("leqwdate"),	FILE_LEQWDATE,		FILE_FMT_STR },
250 	{ XX("beqwdate"),	FILE_BEQWDATE,		FILE_FMT_STR },
251 	{ XX("name"),		FILE_NAME,		FILE_FMT_NONE },
252 	{ XX("use"),		FILE_USE,		FILE_FMT_NONE },
253 	{ XX("clear"),		FILE_CLEAR,		FILE_FMT_NONE },
254 	{ XX("der"),		FILE_DER,		FILE_FMT_STR },
255 	{ XX("guid"),		FILE_GUID,		FILE_FMT_STR },
256 	{ XX("offset"),		FILE_OFFSET,		FILE_FMT_QUAD },
257 	{ XX_NULL,		FILE_INVALID,		FILE_FMT_NONE },
258 };
259 
260 /*
261  * These are not types, and cannot be preceded by "u" to make them
262  * unsigned.
263  */
264 static const struct type_tbl_s special_tbl[] = {
265 	{ XX("der"),		FILE_DER,		FILE_FMT_STR },
266 	{ XX("name"),		FILE_NAME,		FILE_FMT_STR },
267 	{ XX("use"),		FILE_USE,		FILE_FMT_STR },
268 	{ XX_NULL,		FILE_INVALID,		FILE_FMT_NONE },
269 };
270 # undef XX
271 # undef XX_NULL
272 
273 private int
get_type(const struct type_tbl_s * tbl,const char * l,const char ** t)274 get_type(const struct type_tbl_s *tbl, const char *l, const char **t)
275 {
276 	const struct type_tbl_s *p;
277 
278 	for (p = tbl; p->len; p++) {
279 		if (strncmp(l, p->name, p->len) == 0) {
280 			if (t)
281 				*t = l + p->len;
282 			break;
283 		}
284 	}
285 	return p->type;
286 }
287 
288 private off_t
maxoff_t(void)289 maxoff_t(void) {
290 	if (/*CONSTCOND*/sizeof(off_t) == sizeof(int))
291 		return CAST(off_t, INT_MAX);
292 	if (/*CONSTCOND*/sizeof(off_t) == sizeof(long))
293 		return CAST(off_t, LONG_MAX);
294 	return 0x7fffffff;
295 }
296 
297 private int
get_standard_integer_type(const char * l,const char ** t)298 get_standard_integer_type(const char *l, const char **t)
299 {
300 	int type;
301 
302 	if (isalpha(CAST(unsigned char, l[1]))) {
303 		switch (l[1]) {
304 		case 'C':
305 			/* "dC" and "uC" */
306 			type = FILE_BYTE;
307 			break;
308 		case 'S':
309 			/* "dS" and "uS" */
310 			type = FILE_SHORT;
311 			break;
312 		case 'I':
313 		case 'L':
314 			/*
315 			 * "dI", "dL", "uI", and "uL".
316 			 *
317 			 * XXX - the actual Single UNIX Specification says
318 			 * that "L" means "long", as in the C data type,
319 			 * but we treat it as meaning "4-byte integer".
320 			 * Given that the OS X version of file 5.04 did
321 			 * the same, I guess that passes the actual SUS
322 			 * validation suite; having "dL" be dependent on
323 			 * how big a "long" is on the machine running
324 			 * "file" is silly.
325 			 */
326 			type = FILE_LONG;
327 			break;
328 		case 'Q':
329 			/* "dQ" and "uQ" */
330 			type = FILE_QUAD;
331 			break;
332 		default:
333 			/* "d{anything else}", "u{anything else}" */
334 			return FILE_INVALID;
335 		}
336 		l += 2;
337 	} else if (isdigit(CAST(unsigned char, l[1]))) {
338 		/*
339 		 * "d{num}" and "u{num}"; we only support {num} values
340 		 * of 1, 2, 4, and 8 - the Single UNIX Specification
341 		 * doesn't say anything about whether arbitrary
342 		 * values should be supported, but both the Solaris 10
343 		 * and OS X Mountain Lion versions of file passed the
344 		 * Single UNIX Specification validation suite, and
345 		 * neither of them support values bigger than 8 or
346 		 * non-power-of-2 values.
347 		 */
348 		if (isdigit(CAST(unsigned char, l[2]))) {
349 			/* Multi-digit, so > 9 */
350 			return FILE_INVALID;
351 		}
352 		switch (l[1]) {
353 		case '1':
354 			type = FILE_BYTE;
355 			break;
356 		case '2':
357 			type = FILE_SHORT;
358 			break;
359 		case '4':
360 			type = FILE_LONG;
361 			break;
362 		case '8':
363 			type = FILE_QUAD;
364 			break;
365 		default:
366 			/* XXX - what about 3, 5, 6, or 7? */
367 			return FILE_INVALID;
368 		}
369 		l += 2;
370 	} else {
371 		/*
372 		 * "d" or "u" by itself.
373 		 */
374 		type = FILE_LONG;
375 		++l;
376 	}
377 	if (t)
378 		*t = l;
379 	return type;
380 }
381 
382 private void
init_file_tables(void)383 init_file_tables(void)
384 {
385 	static int done = 0;
386 	const struct type_tbl_s *p;
387 
388 	if (done)
389 		return;
390 	done++;
391 
392 	for (p = type_tbl; p->len; p++) {
393 		assert(p->type < FILE_NAMES_SIZE);
394 		file_names[p->type] = p->name;
395 		file_formats[p->type] = p->format;
396 	}
397 	assert(p - type_tbl == FILE_NAMES_SIZE);
398 }
399 
400 private int
add_mlist(struct mlist * mlp,struct magic_map * map,size_t idx)401 add_mlist(struct mlist *mlp, struct magic_map *map, size_t idx)
402 {
403 	struct mlist *ml;
404 
405 	mlp->map = NULL;
406 	if ((ml = CAST(struct mlist *, emalloc(sizeof(*ml)))) == NULL)
407 		return -1;
408 
409 	ml->map = idx == 0 ? map : NULL;
410 	ml->magic = map->magic[idx];
411 	ml->nmagic = map->nmagic[idx];
412 
413 	mlp->prev->next = ml;
414 	ml->prev = mlp->prev;
415 	ml->next = mlp;
416 	mlp->prev = ml;
417 	return 0;
418 }
419 
420 /*
421  * Handle one file or directory.
422  */
423 private int
apprentice_1(struct magic_set * ms,const char * fn,int action)424 apprentice_1(struct magic_set *ms, const char *fn, int action)
425 {
426 	struct magic_map *map;
427 #ifndef COMPILE_ONLY
428 	struct mlist *ml;
429 	size_t i;
430 #endif
431 
432 	if (magicsize != FILE_MAGICSIZE) {
433 		file_error(ms, 0, "magic element size %lu != %lu",
434 		    CAST(unsigned long, sizeof(*map->magic[0])),
435 		    CAST(unsigned long, FILE_MAGICSIZE));
436 		return -1;
437 	}
438 
439 	if (action == FILE_COMPILE) {
440 		map = apprentice_load(ms, fn, action);
441 		if (map == NULL)
442 			return -1;
443 		return apprentice_compile(ms, map, fn);
444 	}
445 
446 #ifndef COMPILE_ONLY
447 	map = apprentice_map(ms, fn);
448 	if (map == NULL) {
449 		if (ms->flags & MAGIC_CHECK)
450 			file_magwarn(ms, "using regular magic file `%s'", fn);
451 		map = apprentice_load(ms, fn, action);
452 		if (map == NULL)
453 			return -1;
454 	}
455 
456 	for (i = 0; i < MAGIC_SETS; i++) {
457 		if (add_mlist(ms->mlist[i], map, i) == -1) {
458 			/* failed to add to any list, free explicitly */
459 			if (i == 0)
460 				apprentice_unmap(map);
461 			else
462 				mlist_free_all(ms);
463 			file_oomem(ms, sizeof(*ml));
464 			return -1;
465 		}
466 	}
467 
468 	if (action == FILE_LIST) {
469 		for (i = 0; i < MAGIC_SETS; i++) {
470 			printf("Set %" SIZE_T_FORMAT "u:\nBinary patterns:\n",
471 			    i);
472 			apprentice_list(ms->mlist[i], BINTEST);
473 			printf("Text patterns:\n");
474 			apprentice_list(ms->mlist[i], TEXTTEST);
475 		}
476 	}
477 	return 0;
478 #else
479 	return 0;
480 #endif /* COMPILE_ONLY */
481 }
482 
483 protected void
file_ms_free(struct magic_set * ms)484 file_ms_free(struct magic_set *ms)
485 {
486 	size_t i;
487 	if (ms == NULL)
488 		return;
489 	for (i = 0; i < MAGIC_SETS; i++)
490 		mlist_free(ms->mlist[i]);
491 	if (ms->o.pbuf) {
492 		efree(ms->o.pbuf);
493 	}
494 	if (ms->o.buf) {
495 		efree(ms->o.buf);
496 	}
497 	if (ms->c.li) {
498 		efree(ms->c.li);
499 	}
500 	efree(ms);
501 }
502 
503 protected struct magic_set *
file_ms_alloc(int flags)504 file_ms_alloc(int flags)
505 {
506 	struct magic_set *ms;
507 	size_t i, len;
508 
509 	if ((ms = CAST(struct magic_set *, ecalloc(CAST(size_t, 1u),
510 	    sizeof(struct magic_set)))) == NULL)
511 		return NULL;
512 
513 	if (magic_setflags(ms, flags) == -1) {
514 		errno = EINVAL;
515 		goto free;
516 	}
517 
518 	ms->o.buf = ms->o.pbuf = NULL;
519 	ms->o.blen = 0;
520 	len = (ms->c.len = 10) * sizeof(*ms->c.li);
521 
522 	if ((ms->c.li = CAST(struct level_info *, emalloc(len))) == NULL)
523 		goto free;
524 
525 	ms->event_flags = 0;
526 	ms->error = -1;
527 	for (i = 0; i < MAGIC_SETS; i++)
528 		ms->mlist[i] = NULL;
529 	ms->file = "unknown";
530 	ms->line = 0;
531 	ms->indir_max = FILE_INDIR_MAX;
532 	ms->name_max = FILE_NAME_MAX;
533 	ms->elf_shnum_max = FILE_ELF_SHNUM_MAX;
534 	ms->elf_phnum_max = FILE_ELF_PHNUM_MAX;
535 	ms->elf_notes_max = FILE_ELF_NOTES_MAX;
536 	ms->regex_max = FILE_REGEX_MAX;
537 	ms->bytes_max = FILE_BYTES_MAX;
538 	ms->encoding_max = FILE_ENCODING_MAX;
539 	return ms;
540 free:
541 	efree(ms);
542 	return NULL;
543 }
544 
545 private void
apprentice_unmap(struct magic_map * map)546 apprentice_unmap(struct magic_map *map)
547 {
548 	if (map == NULL)
549 		return;
550 	if (map->p != php_magic_database) {
551 		if (map->p == NULL) {
552 			int j;
553 			for (j = 0; j < MAGIC_SETS; j++) {
554 				if (map->magic[j]) {
555 					efree(map->magic[j]);
556 				}
557 			}
558 		} else {
559 			efree(map->p);
560 		}
561 	}
562 	efree(map);
563 }
564 
565 private struct mlist *
mlist_alloc(void)566 mlist_alloc(void)
567 {
568 	struct mlist *mlist;
569 	if ((mlist = CAST(struct mlist *, ecalloc(1, sizeof(*mlist)))) == NULL) {
570 		return NULL;
571 	}
572 	mlist->next = mlist->prev = mlist;
573 	return mlist;
574 }
575 
576 private void
mlist_free_all(struct magic_set * ms)577 mlist_free_all(struct magic_set *ms)
578 {
579 	size_t i;
580 
581 	for (i = 0; i < MAGIC_SETS; i++) {
582 		mlist_free(ms->mlist[i]);
583 		ms->mlist[i] = NULL;
584 	}
585 }
586 
587 private void
mlist_free_one(struct mlist * ml)588 mlist_free_one(struct mlist *ml)
589 {
590 	if (ml->map)
591 		apprentice_unmap(CAST(struct magic_map *, ml->map));
592 	efree(ml);
593 }
594 
595 private void
mlist_free(struct mlist * mlist)596 mlist_free(struct mlist *mlist)
597 {
598 	struct mlist *ml, *next;
599 
600 	if (mlist == NULL)
601 		return;
602 
603 	for (ml = mlist->next; ml != mlist;) {
604 		next = ml->next;
605 		mlist_free_one(ml);
606 		ml = next;
607 	}
608 	mlist_free_one(mlist);
609 }
610 
611 /* const char *fn: list of magic files and directories */
612 protected int
file_apprentice(struct magic_set * ms,const char * fn,int action)613 file_apprentice(struct magic_set *ms, const char *fn, int action)
614 {
615 	char *p, *mfn;
616 	int fileerr, errs = -1;
617 	size_t i, j;
618 
619 	(void)file_reset(ms, 0);
620 
621 /* XXX disabling default magic loading so the compiled in data is used */
622 #if 0
623 	if ((fn = magic_getpath(fn, action)) == NULL)
624 		return -1;
625 #endif
626 
627 	init_file_tables();
628 
629 	if (fn == NULL)
630 		fn = getenv("MAGIC");
631 	if (fn == NULL) {
632 		for (i = 0; i < MAGIC_SETS; i++) {
633 			mlist_free(ms->mlist[i]);
634 			if ((ms->mlist[i] = mlist_alloc()) == NULL) {
635 				file_oomem(ms, sizeof(*ms->mlist[i]));
636 				return -1;
637 			}
638 		}
639 		return apprentice_1(ms, fn, action);
640 	}
641 
642 	if ((mfn = estrdup(fn)) == NULL) {
643 		file_oomem(ms, strlen(fn));
644 		return -1;
645 	}
646 
647 	for (i = 0; i < MAGIC_SETS; i++) {
648 		mlist_free(ms->mlist[i]);
649 		if ((ms->mlist[i] = mlist_alloc()) == NULL) {
650 			file_oomem(ms, sizeof(*ms->mlist[i]));
651 			for (j = 0; j < i; j++) {
652 				mlist_free(ms->mlist[j]);
653 				ms->mlist[j] = NULL;
654 			}
655 			efree(mfn);
656 			return -1;
657 		}
658 	}
659 	fn = mfn;
660 
661 	while (fn) {
662 		p = strchr(fn, PATHSEP);
663 		if (p)
664 			*p++ = '\0';
665 		if (*fn == '\0')
666 			break;
667 		fileerr = apprentice_1(ms, fn, action);
668 		errs = MAX(errs, fileerr);
669 		fn = p;
670 	}
671 
672 	efree(mfn);
673 
674 	if (errs == -1) {
675 		for (i = 0; i < MAGIC_SETS; i++) {
676 			mlist_free(ms->mlist[i]);
677 			ms->mlist[i] = NULL;
678 		}
679 		file_error(ms, 0, "could not find any valid magic files!");
680 		return -1;
681 	}
682 
683 #if 0
684 	/*
685 	 * Always leave the database loaded
686 	 */
687 	if (action == FILE_LOAD)
688 		return 0;
689 
690 	for (i = 0; i < MAGIC_SETS; i++) {
691 		mlist_free(ms->mlist[i]);
692 		ms->mlist[i] = NULL;
693 	}
694 #endif
695 
696 	switch (action) {
697 	case FILE_LOAD:
698 	case FILE_COMPILE:
699 	case FILE_CHECK:
700 	case FILE_LIST:
701 		return 0;
702 	default:
703 		file_error(ms, 0, "Invalid action %d", action);
704 		return -1;
705 	}
706 }
707 
708 /*
709  * Compute the real length of a magic expression, for the purposes
710  * of determining how "strong" a magic expression is (approximating
711  * how specific its matches are):
712  *	- magic characters count 0 unless escaped.
713  *	- [] expressions count 1
714  *	- {} expressions count 0
715  *	- regular characters or escaped magic characters count 1
716  *	- 0 length expressions count as one
717  */
718 private size_t
nonmagic(const char * str)719 nonmagic(const char *str)
720 {
721 	const char *p;
722 	size_t rv = 0;
723 
724 	for (p = str; *p; p++)
725 		switch (*p) {
726 		case '\\':	/* Escaped anything counts 1 */
727 			if (!*++p)
728 				p--;
729 			rv++;
730 			continue;
731 		case '?':	/* Magic characters count 0 */
732 		case '*':
733 		case '.':
734 		case '+':
735 		case '^':
736 		case '$':
737 			continue;
738 		case '[':	/* Bracketed expressions count 1 the ']' */
739 			while (*p && *p != ']')
740 				p++;
741 			p--;
742 			continue;
743 		case '{':	/* Braced expressions count 0 */
744 			while (*p && *p != '}')
745 				p++;
746 			if (!*p)
747 				p--;
748 			continue;
749 		default:	/* Anything else counts 1 */
750 			rv++;
751 			continue;
752 		}
753 
754 	return rv == 0 ? 1 : rv;	/* Return at least 1 */
755 }
756 
757 
758 private size_t
typesize(int type)759 typesize(int type)
760 {
761 	switch (type) {
762 	case FILE_BYTE:
763 		return 1;
764 
765 	case FILE_SHORT:
766 	case FILE_LESHORT:
767 	case FILE_BESHORT:
768 		return 2;
769 
770 	case FILE_LONG:
771 	case FILE_LELONG:
772 	case FILE_BELONG:
773 	case FILE_MELONG:
774 		return 4;
775 
776 	case FILE_DATE:
777 	case FILE_LEDATE:
778 	case FILE_BEDATE:
779 	case FILE_MEDATE:
780 	case FILE_LDATE:
781 	case FILE_LELDATE:
782 	case FILE_BELDATE:
783 	case FILE_MELDATE:
784 	case FILE_FLOAT:
785 	case FILE_BEFLOAT:
786 	case FILE_LEFLOAT:
787 		return 4;
788 
789 	case FILE_QUAD:
790 	case FILE_BEQUAD:
791 	case FILE_LEQUAD:
792 	case FILE_QDATE:
793 	case FILE_LEQDATE:
794 	case FILE_BEQDATE:
795 	case FILE_QLDATE:
796 	case FILE_LEQLDATE:
797 	case FILE_BEQLDATE:
798 	case FILE_QWDATE:
799 	case FILE_LEQWDATE:
800 	case FILE_BEQWDATE:
801 	case FILE_DOUBLE:
802 	case FILE_BEDOUBLE:
803 	case FILE_LEDOUBLE:
804 	case FILE_OFFSET:
805 		return 8;
806 
807 	case FILE_GUID:
808 		return 16;
809 
810 	default:
811 		return FILE_BADSIZE;
812 	}
813 }
814 
815 /*
816  * Get weight of this magic entry, for sorting purposes.
817  */
818 private size_t
apprentice_magic_strength(const struct magic * m)819 apprentice_magic_strength(const struct magic *m)
820 {
821 #define MULT 10U
822 	size_t ts, v;
823 	ssize_t val = 2 * MULT;	/* baseline strength */
824 
825 	switch (m->type) {
826 	case FILE_DEFAULT:	/* make sure this sorts last */
827 		if (m->factor_op != FILE_FACTOR_OP_NONE)
828 			abort();
829 		return 0;
830 
831 	case FILE_BYTE:
832 	case FILE_SHORT:
833 	case FILE_LESHORT:
834 	case FILE_BESHORT:
835 	case FILE_LONG:
836 	case FILE_LELONG:
837 	case FILE_BELONG:
838 	case FILE_MELONG:
839 	case FILE_DATE:
840 	case FILE_LEDATE:
841 	case FILE_BEDATE:
842 	case FILE_MEDATE:
843 	case FILE_LDATE:
844 	case FILE_LELDATE:
845 	case FILE_BELDATE:
846 	case FILE_MELDATE:
847 	case FILE_FLOAT:
848 	case FILE_BEFLOAT:
849 	case FILE_LEFLOAT:
850 	case FILE_QUAD:
851 	case FILE_BEQUAD:
852 	case FILE_LEQUAD:
853 	case FILE_QDATE:
854 	case FILE_LEQDATE:
855 	case FILE_BEQDATE:
856 	case FILE_QLDATE:
857 	case FILE_LEQLDATE:
858 	case FILE_BEQLDATE:
859 	case FILE_QWDATE:
860 	case FILE_LEQWDATE:
861 	case FILE_BEQWDATE:
862 	case FILE_DOUBLE:
863 	case FILE_BEDOUBLE:
864 	case FILE_LEDOUBLE:
865 	case FILE_GUID:
866 	case FILE_OFFSET:
867 		ts = typesize(m->type);
868 		if (ts == FILE_BADSIZE)
869 			abort();
870 		val += ts * MULT;
871 		break;
872 
873 	case FILE_PSTRING:
874 	case FILE_STRING:
875 		val += m->vallen * MULT;
876 		break;
877 
878 	case FILE_BESTRING16:
879 	case FILE_LESTRING16:
880 		val += m->vallen * MULT / 2;
881 		break;
882 
883 	case FILE_SEARCH:
884 		if (m->vallen == 0)
885 			break;
886 		val += m->vallen * MAX(MULT / m->vallen, 1);
887 		break;
888 
889 	case FILE_REGEX:
890 		v = nonmagic(m->value.s);
891 		val += v * MAX(MULT / v, 1);
892 		break;
893 
894 	case FILE_INDIRECT:
895 	case FILE_NAME:
896 	case FILE_USE:
897 		break;
898 
899 	case FILE_DER:
900 		val += MULT;
901 		break;
902 
903 	default:
904 		(void)fprintf(stderr, "Bad type %d\n", m->type);
905 		abort();
906 	}
907 
908 	switch (m->reln) {
909 	case 'x':	/* matches anything penalize */
910 	case '!':       /* matches almost anything penalize */
911 		val = 0;
912 		break;
913 
914 	case '=':	/* Exact match, prefer */
915 		val += MULT;
916 		break;
917 
918 	case '>':
919 	case '<':	/* comparison match reduce strength */
920 		val -= 2 * MULT;
921 		break;
922 
923 	case '^':
924 	case '&':	/* masking bits, we could count them too */
925 		val -= MULT;
926 		break;
927 
928 	default:
929 		(void)fprintf(stderr, "Bad relation %c\n", m->reln);
930 		abort();
931 	}
932 
933 	switch (m->factor_op) {
934 	case FILE_FACTOR_OP_NONE:
935 		break;
936 	case FILE_FACTOR_OP_PLUS:
937 		val += m->factor;
938 		break;
939 	case FILE_FACTOR_OP_MINUS:
940 		val -= m->factor;
941 		break;
942 	case FILE_FACTOR_OP_TIMES:
943 		val *= m->factor;
944 		break;
945 	case FILE_FACTOR_OP_DIV:
946 		val /= m->factor;
947 		break;
948 	default:
949 		abort();
950 	}
951 
952 	if (val <= 0)	/* ensure we only return 0 for FILE_DEFAULT */
953 		val = 1;
954 
955 	/*
956 	 * Magic entries with no description get a bonus because they depend
957 	 * on subsequent magic entries to print something.
958 	 */
959 	if (m->desc[0] == '\0')
960 		val++;
961 	return val;
962 }
963 
964 /*
965  * Sort callback for sorting entries by "strength" (basically length)
966  */
967 private int
apprentice_sort(const void * a,const void * b)968 apprentice_sort(const void *a, const void *b)
969 {
970 	const struct magic_entry *ma = CAST(const struct magic_entry *, a);
971 	const struct magic_entry *mb = CAST(const struct magic_entry *, b);
972 	size_t sa = apprentice_magic_strength(ma->mp);
973 	size_t sb = apprentice_magic_strength(mb->mp);
974 	if (sa == sb)
975 		return 0;
976 	else if (sa > sb)
977 		return -1;
978 	else
979 		return 1;
980 }
981 
982 /*
983  * Shows sorted patterns list in the order which is used for the matching
984  */
985 private void
apprentice_list(struct mlist * mlist,int mode)986 apprentice_list(struct mlist *mlist, int mode)
987 {
988 	uint32_t magindex = 0;
989 	struct mlist *ml;
990 	for (ml = mlist->next; ml != mlist; ml = ml->next) {
991 		for (magindex = 0; magindex < ml->nmagic; magindex++) {
992 			struct magic *m = &ml->magic[magindex];
993 			if ((m->flag & mode) != mode) {
994 				/* Skip sub-tests */
995 				while (magindex + 1 < ml->nmagic &&
996 				       ml->magic[magindex + 1].cont_level != 0)
997 					++magindex;
998 				continue; /* Skip to next top-level test*/
999 			}
1000 
1001 			/*
1002 			 * Try to iterate over the tree until we find item with
1003 			 * description/mimetype.
1004 			 */
1005 			while (magindex + 1 < ml->nmagic &&
1006 			       ml->magic[magindex + 1].cont_level != 0 &&
1007 			       *ml->magic[magindex].desc == '\0' &&
1008 			       *ml->magic[magindex].mimetype == '\0')
1009 				magindex++;
1010 
1011 			printf("Strength = %3" SIZE_T_FORMAT "u@%u: %s [%s]\n",
1012 			    apprentice_magic_strength(m),
1013 			    ml->magic[magindex].lineno,
1014 			    ml->magic[magindex].desc,
1015 			    ml->magic[magindex].mimetype);
1016 		}
1017 	}
1018 }
1019 
1020 private void
set_test_type(struct magic * mstart,struct magic * m)1021 set_test_type(struct magic *mstart, struct magic *m)
1022 {
1023 	switch (m->type) {
1024 	case FILE_BYTE:
1025 	case FILE_SHORT:
1026 	case FILE_LONG:
1027 	case FILE_DATE:
1028 	case FILE_BESHORT:
1029 	case FILE_BELONG:
1030 	case FILE_BEDATE:
1031 	case FILE_LESHORT:
1032 	case FILE_LELONG:
1033 	case FILE_LEDATE:
1034 	case FILE_LDATE:
1035 	case FILE_BELDATE:
1036 	case FILE_LELDATE:
1037 	case FILE_MEDATE:
1038 	case FILE_MELDATE:
1039 	case FILE_MELONG:
1040 	case FILE_QUAD:
1041 	case FILE_LEQUAD:
1042 	case FILE_BEQUAD:
1043 	case FILE_QDATE:
1044 	case FILE_LEQDATE:
1045 	case FILE_BEQDATE:
1046 	case FILE_QLDATE:
1047 	case FILE_LEQLDATE:
1048 	case FILE_BEQLDATE:
1049 	case FILE_QWDATE:
1050 	case FILE_LEQWDATE:
1051 	case FILE_BEQWDATE:
1052 	case FILE_FLOAT:
1053 	case FILE_BEFLOAT:
1054 	case FILE_LEFLOAT:
1055 	case FILE_DOUBLE:
1056 	case FILE_BEDOUBLE:
1057 	case FILE_LEDOUBLE:
1058 	case FILE_DER:
1059 	case FILE_GUID:
1060 	case FILE_OFFSET:
1061 		mstart->flag |= BINTEST;
1062 		break;
1063 	case FILE_STRING:
1064 	case FILE_PSTRING:
1065 	case FILE_BESTRING16:
1066 	case FILE_LESTRING16:
1067 		/* Allow text overrides */
1068 		if (mstart->str_flags & STRING_TEXTTEST)
1069 			mstart->flag |= TEXTTEST;
1070 		else
1071 			mstart->flag |= BINTEST;
1072 		break;
1073 	case FILE_REGEX:
1074 	case FILE_SEARCH:
1075 		/* Check for override */
1076 		if (mstart->str_flags & STRING_BINTEST)
1077 			mstart->flag |= BINTEST;
1078 		if (mstart->str_flags & STRING_TEXTTEST)
1079 			mstart->flag |= TEXTTEST;
1080 
1081 		if (mstart->flag & (TEXTTEST|BINTEST))
1082 			break;
1083 
1084 		/* binary test if pattern is not text */
1085 		if (file_looks_utf8(m->value.us, CAST(size_t, m->vallen), NULL,
1086 		    NULL) <= 0)
1087 			mstart->flag |= BINTEST;
1088 		else
1089 			mstart->flag |= TEXTTEST;
1090 		break;
1091 	case FILE_DEFAULT:
1092 		/* can't deduce anything; we shouldn't see this at the
1093 		   top level anyway */
1094 		break;
1095 	case FILE_INVALID:
1096 	default:
1097 		/* invalid search type, but no need to complain here */
1098 		break;
1099 	}
1100 }
1101 
1102 private int
addentry(struct magic_set * ms,struct magic_entry * me,struct magic_entry_set * mset)1103 addentry(struct magic_set *ms, struct magic_entry *me,
1104    struct magic_entry_set *mset)
1105 {
1106 	size_t i = me->mp->type == FILE_NAME ? 1 : 0;
1107 	if (mset[i].count == mset[i].max) {
1108 		struct magic_entry *mp;
1109 
1110 		mset[i].max += ALLOC_INCR;
1111 		if ((mp = CAST(struct magic_entry *,
1112 		    erealloc(mset[i].me, sizeof(*mp) * mset[i].max))) ==
1113 		    NULL) {
1114 			file_oomem(ms, sizeof(*mp) * mset[i].max);
1115 			return -1;
1116 		}
1117 		(void)memset(&mp[mset[i].count], 0, sizeof(*mp) *
1118 		    ALLOC_INCR);
1119 		mset[i].me = mp;
1120 	}
1121 	mset[i].me[mset[i].count++] = *me;
1122 	memset(me, 0, sizeof(*me));
1123 	return 0;
1124 }
1125 
1126 /*
1127  * Load and parse one file.
1128  */
1129 private void
load_1(struct magic_set * ms,int action,const char * fn,int * errs,struct magic_entry_set * mset)1130 load_1(struct magic_set *ms, int action, const char *fn, int *errs,
1131    struct magic_entry_set *mset)
1132 {
1133 	char buffer[BUFSIZ + 1];
1134 	char *line = NULL;
1135 	size_t len;
1136 	size_t lineno = 0;
1137 	struct magic_entry me;
1138 
1139 	php_stream *stream;
1140 
1141 
1142 	ms->file = fn;
1143 	stream = php_stream_open_wrapper((char *)fn, "rb", REPORT_ERRORS, NULL);
1144 
1145 	if (stream == NULL) {
1146 		if (errno != ENOENT)
1147 			file_error(ms, errno, "cannot read magic file `%s'",
1148 				   fn);
1149 		(*errs)++;
1150 		return;
1151 	}
1152 
1153 	memset(&me, 0, sizeof(me));
1154 	/* read and parse this file */
1155 	for (ms->line = 1; (line = php_stream_get_line(stream, buffer , BUFSIZ, &len)) != NULL; ms->line++) {
1156 		if (len == 0) /* null line, garbage, etc */
1157 			continue;
1158 		if (line[len - 1] == '\n') {
1159 			lineno++;
1160 			line[len - 1] = '\0'; /* delete newline */
1161 		}
1162 		switch (line[0]) {
1163 		case '\0':	/* empty, do not parse */
1164 		case '#':	/* comment, do not parse */
1165 			continue;
1166 		case '!':
1167 			if (line[1] == ':') {
1168 				size_t i;
1169 
1170 				for (i = 0; bang[i].name != NULL; i++) {
1171 					if (CAST(size_t, len - 2) > bang[i].len &&
1172 					    memcmp(bang[i].name, line + 2,
1173 					    bang[i].len) == 0)
1174 						break;
1175 				}
1176 				if (bang[i].name == NULL) {
1177 					file_error(ms, 0,
1178 					    "Unknown !: entry `%s'", line);
1179 					(*errs)++;
1180 					continue;
1181 				}
1182 				if (me.mp == NULL) {
1183 					file_error(ms, 0,
1184 					    "No current entry for :!%s type",
1185 						bang[i].name);
1186 					(*errs)++;
1187 					continue;
1188 				}
1189 				if ((*bang[i].fun)(ms, &me,
1190 				    line + bang[i].len + 2,
1191 				    len - bang[i].len - 2) != 0) {
1192 					(*errs)++;
1193 					continue;
1194 				}
1195 				continue;
1196 			}
1197 			/*FALLTHROUGH*/
1198 		default:
1199 		again:
1200 			switch (parse(ms, &me, line, lineno, action)) {
1201 			case 0:
1202 				continue;
1203 			case 1:
1204 				(void)addentry(ms, &me, mset);
1205 				goto again;
1206 			default:
1207 				(*errs)++;
1208 				break;
1209 			}
1210 		}
1211 	}
1212 	if (me.mp)
1213 		(void)addentry(ms, &me, mset);
1214 	efree(line);
1215 	php_stream_close(stream);
1216 }
1217 
1218 /*
1219  * parse a file or directory of files
1220  * const char *fn: name of magic file or directory
1221  */
1222 private int
cmpstrp(const void * p1,const void * p2)1223 cmpstrp(const void *p1, const void *p2)
1224 {
1225         return strcmp(*RCAST(char *const *, p1), *RCAST(char *const *, p2));
1226 }
1227 
1228 
1229 private uint32_t
set_text_binary(struct magic_set * ms,struct magic_entry * me,uint32_t nme,uint32_t starttest)1230 set_text_binary(struct magic_set *ms, struct magic_entry *me, uint32_t nme,
1231     uint32_t starttest)
1232 {
1233 	static const char text[] = "text";
1234 	static const char binary[] = "binary";
1235 	static const size_t len = sizeof(text);
1236 
1237 	uint32_t i = starttest;
1238 
1239 	do {
1240 		set_test_type(me[starttest].mp, me[i].mp);
1241 		if ((ms->flags & MAGIC_DEBUG) == 0)
1242 			continue;
1243 		(void)fprintf(stderr, "%s%s%s: %s\n",
1244 		    me[i].mp->mimetype,
1245 		    me[i].mp->mimetype[0] == '\0' ? "" : "; ",
1246 		    me[i].mp->desc[0] ? me[i].mp->desc : "(no description)",
1247 		    me[i].mp->flag & BINTEST ? binary : text);
1248 		if (me[i].mp->flag & BINTEST) {
1249 			char *p = strstr(me[i].mp->desc, text);
1250 			if (p && (p == me[i].mp->desc ||
1251 			    isspace(CAST(unsigned char, p[-1]))) &&
1252 			    (p + len - me[i].mp->desc == MAXstring
1253 			    || (p[len] == '\0' ||
1254 			    isspace(CAST(unsigned char, p[len])))))
1255 				(void)fprintf(stderr, "*** Possible "
1256 				    "binary test for text type\n");
1257 		}
1258 	} while (++i < nme && me[i].mp->cont_level != 0);
1259 	return i;
1260 }
1261 
1262 private void
set_last_default(struct magic_set * ms,struct magic_entry * me,uint32_t nme)1263 set_last_default(struct magic_set *ms, struct magic_entry *me, uint32_t nme)
1264 {
1265 	uint32_t i;
1266 	for (i = 0; i < nme; i++) {
1267 		if (me[i].mp->cont_level == 0 &&
1268 		    me[i].mp->type == FILE_DEFAULT) {
1269 			while (++i < nme)
1270 				if (me[i].mp->cont_level == 0)
1271 					break;
1272 			if (i != nme) {
1273 				/* XXX - Ugh! */
1274 				ms->line = me[i].mp->lineno;
1275 				file_magwarn(ms,
1276 				    "level 0 \"default\" did not sort last");
1277 			}
1278 			return;
1279 		}
1280 	}
1281 }
1282 
1283 private int
coalesce_entries(struct magic_set * ms,struct magic_entry * me,uint32_t nme,struct magic ** ma,uint32_t * nma)1284 coalesce_entries(struct magic_set *ms, struct magic_entry *me, uint32_t nme,
1285     struct magic **ma, uint32_t *nma)
1286 {
1287 	uint32_t i, mentrycount = 0;
1288 	size_t slen;
1289 
1290 	for (i = 0; i < nme; i++)
1291 		mentrycount += me[i].cont_count;
1292 
1293 	slen = sizeof(**ma) * mentrycount;
1294 	if ((*ma = CAST(struct magic *, emalloc(slen))) == NULL) {
1295 		file_oomem(ms, slen);
1296 		return -1;
1297 	}
1298 
1299 	mentrycount = 0;
1300 	for (i = 0; i < nme; i++) {
1301 		(void)memcpy(*ma + mentrycount, me[i].mp,
1302 		    me[i].cont_count * sizeof(**ma));
1303 		mentrycount += me[i].cont_count;
1304 	}
1305 	*nma = mentrycount;
1306 	return 0;
1307 }
1308 
1309 private void
magic_entry_free(struct magic_entry * me,uint32_t nme)1310 magic_entry_free(struct magic_entry *me, uint32_t nme)
1311 {
1312 	uint32_t i;
1313 	if (me == NULL)
1314 		return;
1315 	for (i = 0; i < nme; i++)
1316 		efree(me[i].mp);
1317 	efree(me);
1318 }
1319 
1320 private struct magic_map *
apprentice_load(struct magic_set * ms,const char * fn,int action)1321 apprentice_load(struct magic_set *ms, const char *fn, int action)
1322 {
1323 	int errs = 0;
1324 	uint32_t i, j;
1325 	size_t files = 0, maxfiles = 0;
1326 	char **filearr = NULL;
1327 	zend_stat_t st;
1328 	struct magic_map *map;
1329 	struct magic_entry_set mset[MAGIC_SETS];
1330 	php_stream *dir;
1331 	php_stream_dirent d;
1332 
1333 
1334 	memset(mset, 0, sizeof(mset));
1335 	ms->flags |= MAGIC_CHECK;	/* Enable checks for parsed files */
1336 
1337 
1338 	if ((map = CAST(struct magic_map *, ecalloc(1, sizeof(*map)))) == NULL)
1339 	{
1340 		file_oomem(ms, sizeof(*map));
1341 		return NULL;
1342 	}
1343 	map->type = MAP_TYPE_MALLOC;
1344 
1345 	/* print silly verbose header for USG compat. */
1346 	if (action == FILE_CHECK)
1347 		(void)fprintf(stderr, "%s\n", usg_hdr);
1348 
1349 	/* load directory or file */
1350 	/* FIXME: Read file names and sort them to prevent
1351 	   non-determinism. See Debian bug #488562. */
1352 	if (php_sys_stat(fn, &st) == 0 && S_ISDIR(st.st_mode)) {
1353 		int mflen;
1354 		char mfn[MAXPATHLEN];
1355 
1356 		dir = php_stream_opendir((char *)fn, REPORT_ERRORS, NULL);
1357 		if (!dir) {
1358 			errs++;
1359 			goto out;
1360 		}
1361 		while (php_stream_readdir(dir, &d)) {
1362 			if ((mflen = snprintf(mfn, sizeof(mfn), "%s/%s", fn, d.d_name)) < 0) {
1363 				file_oomem(ms,
1364 				strlen(fn) + strlen(d.d_name) + 2);
1365 				errs++;
1366 				php_stream_closedir(dir);
1367 				goto out;
1368 			}
1369 			if (zend_stat(mfn, &st) == -1 || !S_ISREG(st.st_mode)) {
1370 				continue;
1371 			}
1372 			if (files >= maxfiles) {
1373 				size_t mlen;
1374 				maxfiles = (maxfiles + 1) * 2;
1375 				mlen = maxfiles * sizeof(*filearr);
1376 				if ((filearr = CAST(char **,
1377 				    erealloc(filearr, mlen))) == NULL) {
1378 					file_oomem(ms, mlen);
1379 					php_stream_closedir(dir);
1380 					errs++;
1381 					goto out;
1382 				}
1383 			}
1384 			filearr[files++] = estrndup(mfn, (mflen > sizeof(mfn) - 1)? sizeof(mfn) - 1: mflen);
1385 		}
1386 		php_stream_closedir(dir);
1387 		if (filearr) {
1388 			qsort(filearr, files, sizeof(*filearr), cmpstrp);
1389 			for (i = 0; i < files; i++) {
1390 				load_1(ms, action, filearr[i], &errs, mset);
1391 				efree(filearr[i]);
1392 			}
1393 			efree(filearr);
1394 		}
1395 	} else
1396 		load_1(ms, action, fn, &errs, mset);
1397 	if (errs)
1398 		goto out;
1399 
1400 	for (j = 0; j < MAGIC_SETS; j++) {
1401 		/* Set types of tests */
1402 		for (i = 0; i < mset[j].count; ) {
1403 			if (mset[j].me[i].mp->cont_level != 0) {
1404 				i++;
1405 				continue;
1406 			}
1407 			i = set_text_binary(ms, mset[j].me, mset[j].count, i);
1408 		}
1409 		if (mset[j].me)
1410 			qsort(mset[j].me, mset[j].count, sizeof(*mset[j].me),
1411 			    apprentice_sort);
1412 
1413 		/*
1414 		 * Make sure that any level 0 "default" line is last
1415 		 * (if one exists).
1416 		 */
1417 		set_last_default(ms, mset[j].me, mset[j].count);
1418 
1419 		/* coalesce per file arrays into a single one, if needed */
1420 		if (mset[j].count == 0)
1421 			continue;
1422 
1423 		if (coalesce_entries(ms, mset[j].me, mset[j].count,
1424 		    &map->magic[j], &map->nmagic[j]) == -1) {
1425 			errs++;
1426 			goto out;
1427 		}
1428 	}
1429 
1430 out:
1431 	for (j = 0; j < MAGIC_SETS; j++)
1432 		magic_entry_free(mset[j].me, mset[j].count);
1433 
1434 	if (errs) {
1435 		apprentice_unmap(map);
1436 		return NULL;
1437 	}
1438 	return map;
1439 }
1440 
1441 /*
1442  * extend the sign bit if the comparison is to be signed
1443  */
1444 protected uint64_t
file_signextend(struct magic_set * ms,struct magic * m,uint64_t v)1445 file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
1446 {
1447 	if (!(m->flag & UNSIGNED)) {
1448 		switch(m->type) {
1449 		/*
1450 		 * Do not remove the casts below.  They are
1451 		 * vital.  When later compared with the data,
1452 		 * the sign extension must have happened.
1453 		 */
1454 		case FILE_BYTE:
1455 			v = CAST(signed char,  v);
1456 			break;
1457 		case FILE_SHORT:
1458 		case FILE_BESHORT:
1459 		case FILE_LESHORT:
1460 			v = CAST(short, v);
1461 			break;
1462 		case FILE_DATE:
1463 		case FILE_BEDATE:
1464 		case FILE_LEDATE:
1465 		case FILE_MEDATE:
1466 		case FILE_LDATE:
1467 		case FILE_BELDATE:
1468 		case FILE_LELDATE:
1469 		case FILE_MELDATE:
1470 		case FILE_LONG:
1471 		case FILE_BELONG:
1472 		case FILE_LELONG:
1473 		case FILE_MELONG:
1474 		case FILE_FLOAT:
1475 		case FILE_BEFLOAT:
1476 		case FILE_LEFLOAT:
1477 			v = CAST(int32_t, v);
1478 			break;
1479 		case FILE_QUAD:
1480 		case FILE_BEQUAD:
1481 		case FILE_LEQUAD:
1482 		case FILE_QDATE:
1483 		case FILE_QLDATE:
1484 		case FILE_QWDATE:
1485 		case FILE_BEQDATE:
1486 		case FILE_BEQLDATE:
1487 		case FILE_BEQWDATE:
1488 		case FILE_LEQDATE:
1489 		case FILE_LEQLDATE:
1490 		case FILE_LEQWDATE:
1491 		case FILE_DOUBLE:
1492 		case FILE_BEDOUBLE:
1493 		case FILE_LEDOUBLE:
1494 		case FILE_OFFSET:
1495 			v = CAST(int64_t, v);
1496 			break;
1497 		case FILE_STRING:
1498 		case FILE_PSTRING:
1499 		case FILE_BESTRING16:
1500 		case FILE_LESTRING16:
1501 		case FILE_REGEX:
1502 		case FILE_SEARCH:
1503 		case FILE_DEFAULT:
1504 		case FILE_INDIRECT:
1505 		case FILE_NAME:
1506 		case FILE_USE:
1507 		case FILE_CLEAR:
1508 		case FILE_DER:
1509 		case FILE_GUID:
1510 			break;
1511 		default:
1512 			if (ms->flags & MAGIC_CHECK)
1513 			    file_magwarn(ms, "cannot happen: m->type=%d\n",
1514 				    m->type);
1515 			return FILE_BADSIZE;
1516 		}
1517 	}
1518 	return v;
1519 }
1520 
1521 private int
string_modifier_check(struct magic_set * ms,struct magic * m)1522 string_modifier_check(struct magic_set *ms, struct magic *m)
1523 {
1524 	if ((ms->flags & MAGIC_CHECK) == 0)
1525 		return 0;
1526 
1527 	if ((m->type != FILE_REGEX || (m->str_flags & REGEX_LINE_COUNT) == 0) &&
1528 	    (m->type != FILE_PSTRING && (m->str_flags & PSTRING_LEN) != 0)) {
1529 		file_magwarn(ms,
1530 		    "'/BHhLl' modifiers are only allowed for pascal strings\n");
1531 		return -1;
1532 	}
1533 	switch (m->type) {
1534 	case FILE_BESTRING16:
1535 	case FILE_LESTRING16:
1536 		if (m->str_flags != 0) {
1537 			file_magwarn(ms,
1538 			    "no modifiers allowed for 16-bit strings\n");
1539 			return -1;
1540 		}
1541 		break;
1542 	case FILE_STRING:
1543 	case FILE_PSTRING:
1544 		if ((m->str_flags & REGEX_OFFSET_START) != 0) {
1545 			file_magwarn(ms,
1546 			    "'/%c' only allowed on regex and search\n",
1547 			    CHAR_REGEX_OFFSET_START);
1548 			return -1;
1549 		}
1550 		break;
1551 	case FILE_SEARCH:
1552 		if (m->str_range == 0) {
1553 			file_magwarn(ms,
1554 			    "missing range; defaulting to %d\n",
1555                             STRING_DEFAULT_RANGE);
1556 			m->str_range = STRING_DEFAULT_RANGE;
1557 			return -1;
1558 		}
1559 		break;
1560 	case FILE_REGEX:
1561 		if ((m->str_flags & STRING_COMPACT_WHITESPACE) != 0) {
1562 			file_magwarn(ms, "'/%c' not allowed on regex\n",
1563 			    CHAR_COMPACT_WHITESPACE);
1564 			return -1;
1565 		}
1566 		if ((m->str_flags & STRING_COMPACT_OPTIONAL_WHITESPACE) != 0) {
1567 			file_magwarn(ms, "'/%c' not allowed on regex\n",
1568 			    CHAR_COMPACT_OPTIONAL_WHITESPACE);
1569 			return -1;
1570 		}
1571 		break;
1572 	default:
1573 		file_magwarn(ms, "coding error: m->type=%d\n",
1574 		    m->type);
1575 		return -1;
1576 	}
1577 	return 0;
1578 }
1579 
1580 private int
get_op(char c)1581 get_op(char c)
1582 {
1583 	switch (c) {
1584 	case '&':
1585 		return FILE_OPAND;
1586 	case '|':
1587 		return FILE_OPOR;
1588 	case '^':
1589 		return FILE_OPXOR;
1590 	case '+':
1591 		return FILE_OPADD;
1592 	case '-':
1593 		return FILE_OPMINUS;
1594 	case '*':
1595 		return FILE_OPMULTIPLY;
1596 	case '/':
1597 		return FILE_OPDIVIDE;
1598 	case '%':
1599 		return FILE_OPMODULO;
1600 	default:
1601 		return -1;
1602 	}
1603 }
1604 
1605 #ifdef ENABLE_CONDITIONALS
1606 private int
get_cond(const char * l,const char ** t)1607 get_cond(const char *l, const char **t)
1608 {
1609 	static const struct cond_tbl_s {
1610 		char name[8];
1611 		size_t len;
1612 		int cond;
1613 	} cond_tbl[] = {
1614 		{ "if",		2,	COND_IF },
1615 		{ "elif",	4,	COND_ELIF },
1616 		{ "else",	4,	COND_ELSE },
1617 		{ "",		0,	COND_NONE },
1618 	};
1619 	const struct cond_tbl_s *p;
1620 
1621 	for (p = cond_tbl; p->len; p++) {
1622 		if (strncmp(l, p->name, p->len) == 0 &&
1623 		    isspace(CAST(unsigned char, l[p->len]))) {
1624 			if (t)
1625 				*t = l + p->len;
1626 			break;
1627 		}
1628 	}
1629 	return p->cond;
1630 }
1631 
1632 private int
check_cond(struct magic_set * ms,int cond,uint32_t cont_level)1633 check_cond(struct magic_set *ms, int cond, uint32_t cont_level)
1634 {
1635 	int last_cond;
1636 	last_cond = ms->c.li[cont_level].last_cond;
1637 
1638 	switch (cond) {
1639 	case COND_IF:
1640 		if (last_cond != COND_NONE && last_cond != COND_ELIF) {
1641 			if (ms->flags & MAGIC_CHECK)
1642 				file_magwarn(ms, "syntax error: `if'");
1643 			return -1;
1644 		}
1645 		last_cond = COND_IF;
1646 		break;
1647 
1648 	case COND_ELIF:
1649 		if (last_cond != COND_IF && last_cond != COND_ELIF) {
1650 			if (ms->flags & MAGIC_CHECK)
1651 				file_magwarn(ms, "syntax error: `elif'");
1652 			return -1;
1653 		}
1654 		last_cond = COND_ELIF;
1655 		break;
1656 
1657 	case COND_ELSE:
1658 		if (last_cond != COND_IF && last_cond != COND_ELIF) {
1659 			if (ms->flags & MAGIC_CHECK)
1660 				file_magwarn(ms, "syntax error: `else'");
1661 			return -1;
1662 		}
1663 		last_cond = COND_NONE;
1664 		break;
1665 
1666 	case COND_NONE:
1667 		last_cond = COND_NONE;
1668 		break;
1669 	}
1670 
1671 	ms->c.li[cont_level].last_cond = last_cond;
1672 	return 0;
1673 }
1674 #endif /* ENABLE_CONDITIONALS */
1675 
1676 private int
parse_indirect_modifier(struct magic_set * ms,struct magic * m,const char ** lp)1677 parse_indirect_modifier(struct magic_set *ms, struct magic *m, const char **lp)
1678 {
1679 	const char *l = *lp;
1680 
1681 	while (!isspace(CAST(unsigned char, *++l)))
1682 		switch (*l) {
1683 		case CHAR_INDIRECT_RELATIVE:
1684 			m->str_flags |= INDIRECT_RELATIVE;
1685 			break;
1686 		default:
1687 			if (ms->flags & MAGIC_CHECK)
1688 				file_magwarn(ms, "indirect modifier `%c' "
1689 					"invalid", *l);
1690 			*lp = l;
1691 			return -1;
1692 		}
1693 	*lp = l;
1694 	return 0;
1695 }
1696 
1697 private void
parse_op_modifier(struct magic_set * ms,struct magic * m,const char ** lp,int op)1698 parse_op_modifier(struct magic_set *ms, struct magic *m, const char **lp,
1699     int op)
1700 {
1701 	const char *l = *lp;
1702 	char *t;
1703 	uint64_t val;
1704 
1705 	++l;
1706 	m->mask_op |= op;
1707 	val = CAST(uint64_t, strtoull(l, &t, 0));
1708 	l = t;
1709 	m->num_mask = file_signextend(ms, m, val);
1710 	eatsize(&l);
1711 	*lp = l;
1712 }
1713 
1714 private int
parse_string_modifier(struct magic_set * ms,struct magic * m,const char ** lp)1715 parse_string_modifier(struct magic_set *ms, struct magic *m, const char **lp)
1716 {
1717 	const char *l = *lp;
1718 	char *t;
1719 	int have_range = 0;
1720 
1721 	while (!isspace(CAST(unsigned char, *++l))) {
1722 		switch (*l) {
1723 		case '0':  case '1':  case '2':
1724 		case '3':  case '4':  case '5':
1725 		case '6':  case '7':  case '8':
1726 		case '9':
1727 			if (have_range && (ms->flags & MAGIC_CHECK))
1728 				file_magwarn(ms, "multiple ranges");
1729 			have_range = 1;
1730 			m->str_range = CAST(uint32_t, strtoul(l, &t, 0));
1731 			if (m->str_range == 0)
1732 				file_magwarn(ms, "zero range");
1733 			l = t - 1;
1734 			break;
1735 		case CHAR_COMPACT_WHITESPACE:
1736 			m->str_flags |= STRING_COMPACT_WHITESPACE;
1737 			break;
1738 		case CHAR_COMPACT_OPTIONAL_WHITESPACE:
1739 			m->str_flags |= STRING_COMPACT_OPTIONAL_WHITESPACE;
1740 			break;
1741 		case CHAR_IGNORE_LOWERCASE:
1742 			m->str_flags |= STRING_IGNORE_LOWERCASE;
1743 			break;
1744 		case CHAR_IGNORE_UPPERCASE:
1745 			m->str_flags |= STRING_IGNORE_UPPERCASE;
1746 			break;
1747 		case CHAR_REGEX_OFFSET_START:
1748 			m->str_flags |= REGEX_OFFSET_START;
1749 			break;
1750 		case CHAR_BINTEST:
1751 			m->str_flags |= STRING_BINTEST;
1752 			break;
1753 		case CHAR_TEXTTEST:
1754 			m->str_flags |= STRING_TEXTTEST;
1755 			break;
1756 		case CHAR_TRIM:
1757 			m->str_flags |= STRING_TRIM;
1758 			break;
1759 		case CHAR_PSTRING_1_LE:
1760 #define SET_LENGTH(a) m->str_flags = (m->str_flags & ~PSTRING_LEN) | (a)
1761 			if (m->type != FILE_PSTRING)
1762 				goto bad;
1763 			SET_LENGTH(PSTRING_1_LE);
1764 			break;
1765 		case CHAR_PSTRING_2_BE:
1766 			if (m->type != FILE_PSTRING)
1767 				goto bad;
1768 			SET_LENGTH(PSTRING_2_BE);
1769 			break;
1770 		case CHAR_PSTRING_2_LE:
1771 			if (m->type != FILE_PSTRING)
1772 				goto bad;
1773 			SET_LENGTH(PSTRING_2_LE);
1774 			break;
1775 		case CHAR_PSTRING_4_BE:
1776 			if (m->type != FILE_PSTRING)
1777 				goto bad;
1778 			SET_LENGTH(PSTRING_4_BE);
1779 			break;
1780 		case CHAR_PSTRING_4_LE:
1781 			switch (m->type) {
1782 			case FILE_PSTRING:
1783 			case FILE_REGEX:
1784 				break;
1785 			default:
1786 				goto bad;
1787 			}
1788 			SET_LENGTH(PSTRING_4_LE);
1789 			break;
1790 		case CHAR_PSTRING_LENGTH_INCLUDES_ITSELF:
1791 			if (m->type != FILE_PSTRING)
1792 				goto bad;
1793 			m->str_flags |= PSTRING_LENGTH_INCLUDES_ITSELF;
1794 			break;
1795 		default:
1796 		bad:
1797 			if (ms->flags & MAGIC_CHECK)
1798 				file_magwarn(ms, "string modifier `%c' "
1799 					"invalid", *l);
1800 			goto out;
1801 		}
1802 		/* allow multiple '/' for readability */
1803 		if (l[1] == '/' && !isspace(CAST(unsigned char, l[2])))
1804 			l++;
1805 	}
1806 	if (string_modifier_check(ms, m) == -1)
1807 		goto out;
1808 	*lp = l;
1809 	return 0;
1810 out:
1811 	*lp = l;
1812 	return -1;
1813 }
1814 
1815 /*
1816  * parse one line from magic file, put into magic[index++] if valid
1817  */
1818 private int
parse(struct magic_set * ms,struct magic_entry * me,const char * line,size_t lineno,int action)1819 parse(struct magic_set *ms, struct magic_entry *me, const char *line,
1820     size_t lineno, int action)
1821 {
1822 #ifdef ENABLE_CONDITIONALS
1823 	static uint32_t last_cont_level = 0;
1824 #endif
1825 	size_t i;
1826 	struct magic *m;
1827 	const char *l = line;
1828 	char *t;
1829 	int op;
1830 	uint32_t cont_level;
1831 	int32_t diff;
1832 
1833 	cont_level = 0;
1834 
1835 	/*
1836 	 * Parse the offset.
1837 	 */
1838 	while (*l == '>') {
1839 		++l;		/* step over */
1840 		cont_level++;
1841 	}
1842 #ifdef ENABLE_CONDITIONALS
1843 	if (cont_level == 0 || cont_level > last_cont_level)
1844 		if (file_check_mem(ms, cont_level) == -1)
1845 			return -1;
1846 	last_cont_level = cont_level;
1847 #endif
1848 	if (cont_level != 0) {
1849 		if (me->mp == NULL) {
1850 			file_magerror(ms, "No current entry for continuation");
1851 			return -1;
1852 		}
1853 		if (me->cont_count == 0) {
1854 			file_magerror(ms, "Continuations present with 0 count");
1855 			return -1;
1856 		}
1857 		m = &me->mp[me->cont_count - 1];
1858 		diff = CAST(int32_t, cont_level) - CAST(int32_t, m->cont_level);
1859 		if (diff > 1)
1860 			file_magwarn(ms, "New continuation level %u is more "
1861 			    "than one larger than current level %u", cont_level,
1862 			    m->cont_level);
1863 		if (me->cont_count == me->max_count) {
1864 			struct magic *nm;
1865 			size_t cnt = me->max_count + ALLOC_CHUNK;
1866 			if ((nm = CAST(struct magic *, erealloc(me->mp,
1867 			    sizeof(*nm) * cnt))) == NULL) {
1868 				file_oomem(ms, sizeof(*nm) * cnt);
1869 				return -1;
1870 			}
1871 			me->mp = nm;
1872 			me->max_count = CAST(uint32_t, cnt);
1873 		}
1874 		m = &me->mp[me->cont_count++];
1875 		(void)memset(m, 0, sizeof(*m));
1876 		m->cont_level = cont_level;
1877 	} else {
1878 		static const size_t len = sizeof(*m) * ALLOC_CHUNK;
1879 		if (me->mp != NULL)
1880 			return 1;
1881 		if ((m = CAST(struct magic *, emalloc(len))) == NULL) {
1882 			file_oomem(ms, len);
1883 			return -1;
1884 		}
1885 		me->mp = m;
1886 		me->max_count = ALLOC_CHUNK;
1887 		(void)memset(m, 0, sizeof(*m));
1888 		m->factor_op = FILE_FACTOR_OP_NONE;
1889 		m->cont_level = 0;
1890 		me->cont_count = 1;
1891 	}
1892 	m->lineno = CAST(uint32_t, lineno);
1893 
1894 	if (*l == '&') {  /* m->cont_level == 0 checked below. */
1895                 ++l;            /* step over */
1896                 m->flag |= OFFADD;
1897         }
1898 	if (*l == '(') {
1899 		++l;		/* step over */
1900 		m->flag |= INDIR;
1901 		if (m->flag & OFFADD)
1902 			m->flag = (m->flag & ~OFFADD) | INDIROFFADD;
1903 
1904 		if (*l == '&') {  /* m->cont_level == 0 checked below */
1905 			++l;            /* step over */
1906 			m->flag |= OFFADD;
1907 		}
1908 	}
1909 	/* Indirect offsets are not valid at level 0. */
1910 	if (m->cont_level == 0 && (m->flag & (OFFADD | INDIROFFADD))) {
1911 		if (ms->flags & MAGIC_CHECK)
1912 			file_magwarn(ms, "relative offset at level 0");
1913 		return -1;
1914 	}
1915 
1916 	/* get offset, then skip over it */
1917 	if (*l == '-') {
1918 		++l;            /* step over */
1919 		m->flag |= OFFNEGATIVE;
1920 	}
1921 	m->offset = CAST(int32_t, strtol(l, &t, 0));
1922         if (l == t) {
1923 		if (ms->flags & MAGIC_CHECK)
1924 			file_magwarn(ms, "offset `%s' invalid", l);
1925 		return -1;
1926 	}
1927 
1928         l = t;
1929 
1930 	if (m->flag & INDIR) {
1931 		m->in_type = FILE_LONG;
1932 		m->in_offset = 0;
1933 		m->in_op = 0;
1934 		/*
1935 		 * read [.,lbs][+-]nnnnn)
1936 		 */
1937 		if (*l == '.' || *l == ',') {
1938 			if (*l == ',')
1939 				m->in_op |= FILE_OPSIGNED;
1940 			l++;
1941 			switch (*l) {
1942 			case 'l':
1943 				m->in_type = FILE_LELONG;
1944 				break;
1945 			case 'L':
1946 				m->in_type = FILE_BELONG;
1947 				break;
1948 			case 'm':
1949 				m->in_type = FILE_MELONG;
1950 				break;
1951 			case 'h':
1952 			case 's':
1953 				m->in_type = FILE_LESHORT;
1954 				break;
1955 			case 'H':
1956 			case 'S':
1957 				m->in_type = FILE_BESHORT;
1958 				break;
1959 			case 'c':
1960 			case 'b':
1961 			case 'C':
1962 			case 'B':
1963 				m->in_type = FILE_BYTE;
1964 				break;
1965 			case 'e':
1966 			case 'f':
1967 			case 'g':
1968 				m->in_type = FILE_LEDOUBLE;
1969 				break;
1970 			case 'E':
1971 			case 'F':
1972 			case 'G':
1973 				m->in_type = FILE_BEDOUBLE;
1974 				break;
1975 			case 'i':
1976 				m->in_type = FILE_LEID3;
1977 				break;
1978 			case 'I':
1979 				m->in_type = FILE_BEID3;
1980 				break;
1981 			case 'q':
1982 				m->in_type = FILE_LEQUAD;
1983 				break;
1984 			case 'Q':
1985 				m->in_type = FILE_BEQUAD;
1986 				break;
1987 			default:
1988 				if (ms->flags & MAGIC_CHECK)
1989 					file_magwarn(ms,
1990 					    "indirect offset type `%c' invalid",
1991 					    *l);
1992 				return -1;
1993 			}
1994 			l++;
1995 		}
1996 
1997 		if (*l == '~') {
1998 			m->in_op |= FILE_OPINVERSE;
1999 			l++;
2000 		}
2001 		if ((op = get_op(*l)) != -1) {
2002 			m->in_op |= op;
2003 			l++;
2004 		}
2005 		if (*l == '(') {
2006 			m->in_op |= FILE_OPINDIRECT;
2007 			l++;
2008 		}
2009 		if (isdigit(CAST(unsigned char, *l)) || *l == '-') {
2010 			m->in_offset = CAST(int32_t, strtol(l, &t, 0));
2011 			if (l == t) {
2012 				if (ms->flags & MAGIC_CHECK)
2013 					file_magwarn(ms,
2014 					    "in_offset `%s' invalid", l);
2015 				return -1;
2016 			}
2017 			l = t;
2018 		}
2019 		if (*l++ != ')' ||
2020 		    ((m->in_op & FILE_OPINDIRECT) && *l++ != ')')) {
2021 			if (ms->flags & MAGIC_CHECK)
2022 				file_magwarn(ms,
2023 				    "missing ')' in indirect offset");
2024 			return -1;
2025 		}
2026 	}
2027 	EATAB;
2028 
2029 #ifdef ENABLE_CONDITIONALS
2030 	m->cond = get_cond(l, &l);
2031 	if (check_cond(ms, m->cond, cont_level) == -1)
2032 		return -1;
2033 
2034 	EATAB;
2035 #endif
2036 
2037 	/*
2038 	 * Parse the type.
2039 	 */
2040 	if (*l == 'u') {
2041 		/*
2042 		 * Try it as a keyword type prefixed by "u"; match what
2043 		 * follows the "u".  If that fails, try it as an SUS
2044 		 * integer type.
2045 		 */
2046 		m->type = get_type(type_tbl, l + 1, &l);
2047 		if (m->type == FILE_INVALID) {
2048 			/*
2049 			 * Not a keyword type; parse it as an SUS type,
2050 			 * 'u' possibly followed by a number or C/S/L.
2051 			 */
2052 			m->type = get_standard_integer_type(l, &l);
2053 		}
2054 		/* It's unsigned. */
2055 		if (m->type != FILE_INVALID)
2056 			m->flag |= UNSIGNED;
2057 	} else {
2058 		/*
2059 		 * Try it as a keyword type.  If that fails, try it as
2060 		 * an SUS integer type if it begins with "d" or as an
2061 		 * SUS string type if it begins with "s".  In any case,
2062 		 * it's not unsigned.
2063 		 */
2064 		m->type = get_type(type_tbl, l, &l);
2065 		if (m->type == FILE_INVALID) {
2066 			/*
2067 			 * Not a keyword type; parse it as an SUS type,
2068 			 * either 'd' possibly followed by a number or
2069 			 * C/S/L, or just 's'.
2070 			 */
2071 			if (*l == 'd')
2072 				m->type = get_standard_integer_type(l, &l);
2073 			else if (*l == 's'
2074 			    && !isalpha(CAST(unsigned char, l[1]))) {
2075 				m->type = FILE_STRING;
2076 				++l;
2077 			}
2078 		}
2079 	}
2080 
2081 	if (m->type == FILE_INVALID) {
2082 		/* Not found - try it as a special keyword. */
2083 		m->type = get_type(special_tbl, l, &l);
2084 	}
2085 
2086 	if (m->type == FILE_INVALID) {
2087 		if (ms->flags & MAGIC_CHECK)
2088 			file_magwarn(ms, "type `%s' invalid", l);
2089 		return -1;
2090 	}
2091 
2092 	if (m->type == FILE_NAME && cont_level != 0) {
2093 		if (ms->flags & MAGIC_CHECK)
2094 			file_magwarn(ms, "`name%s' entries can only be "
2095 			    "declared at top level", l);
2096 		return -1;
2097 	}
2098 
2099 	/* New-style anding: "0 byte&0x80 =0x80 dynamically linked" */
2100 	/* New and improved: ~ & | ^ + - * / % -- exciting, isn't it? */
2101 
2102 	m->mask_op = 0;
2103 	if (*l == '~') {
2104 		if (!IS_LIBMAGIC_STRING(m->type))
2105 			m->mask_op |= FILE_OPINVERSE;
2106 		else if (ms->flags & MAGIC_CHECK)
2107 			file_magwarn(ms, "'~' invalid for string types");
2108 		++l;
2109 	}
2110 	m->str_range = 0;
2111 	m->str_flags = m->type == FILE_PSTRING ? PSTRING_1_LE : 0;
2112 	if ((op = get_op(*l)) != -1) {
2113 		if (IS_LIBMAGIC_STRING(m->type)) {
2114 			int r;
2115 
2116 			if (op != FILE_OPDIVIDE) {
2117 				if (ms->flags & MAGIC_CHECK)
2118 					file_magwarn(ms,
2119 					    "invalid string/indirect op: "
2120 					    "`%c'", *t);
2121 				return -1;
2122 			}
2123 
2124 			if (m->type == FILE_INDIRECT)
2125 				r = parse_indirect_modifier(ms, m, &l);
2126 			else
2127 				r = parse_string_modifier(ms, m, &l);
2128 			if (r == -1)
2129 				return -1;
2130 		} else
2131 			parse_op_modifier(ms, m, &l, op);
2132 	}
2133 
2134 	/*
2135 	 * We used to set mask to all 1's here, instead let's just not do
2136 	 * anything if mask = 0 (unless you have a better idea)
2137 	 */
2138 	EATAB;
2139 
2140 	switch (*l) {
2141 	case '>':
2142 	case '<':
2143   		m->reln = *l;
2144   		++l;
2145 		if (*l == '=') {
2146 			if (ms->flags & MAGIC_CHECK) {
2147 				file_magwarn(ms, "%c= not supported",
2148 				    m->reln);
2149 				return -1;
2150 			}
2151 		   ++l;
2152 		}
2153 		break;
2154 	/* Old-style anding: "0 byte &0x80 dynamically linked" */
2155 	case '&':
2156 	case '^':
2157 	case '=':
2158   		m->reln = *l;
2159   		++l;
2160 		if (*l == '=') {
2161 		   /* HP compat: ignore &= etc. */
2162 		   ++l;
2163 		}
2164 		break;
2165 	case '!':
2166 		m->reln = *l;
2167 		++l;
2168 		break;
2169 	default:
2170   		m->reln = '=';	/* the default relation */
2171 		if (*l == 'x' && ((isascii(CAST(unsigned char, l[1])) &&
2172 		    isspace(CAST(unsigned char, l[1]))) || !l[1])) {
2173 			m->reln = *l;
2174 			++l;
2175 		}
2176 		break;
2177 	}
2178 	/*
2179 	 * Grab the value part, except for an 'x' reln.
2180 	 */
2181 	if (m->reln != 'x' && getvalue(ms, m, &l, action))
2182 		return -1;
2183 
2184 	/*
2185 	 * TODO finish this macro and start using it!
2186 	 * #define offsetcheck {if (offset > ms->bytes_max -1)
2187 	 *	magwarn("offset too big"); }
2188 	 */
2189 
2190 	/*
2191 	 * Now get last part - the description
2192 	 */
2193 	EATAB;
2194 	if (l[0] == '\b') {
2195 		++l;
2196 		m->flag |= NOSPACE;
2197 	} else if ((l[0] == '\\') && (l[1] == 'b')) {
2198 		++l;
2199 		++l;
2200 		m->flag |= NOSPACE;
2201 	}
2202 	for (i = 0; (m->desc[i++] = *l++) != '\0' && i < sizeof(m->desc); )
2203 		continue;
2204 	if (i == sizeof(m->desc)) {
2205 		m->desc[sizeof(m->desc) - 1] = '\0';
2206 		if (ms->flags & MAGIC_CHECK)
2207 			file_magwarn(ms, "description `%s' truncated", m->desc);
2208 	}
2209 
2210         /*
2211 	 * We only do this check while compiling, or if any of the magic
2212 	 * files were not compiled.
2213          */
2214         if (ms->flags & MAGIC_CHECK) {
2215 		if (check_format(ms, m) == -1)
2216 			return -1;
2217 	}
2218 #ifndef COMPILE_ONLY
2219 	if (action == FILE_CHECK) {
2220 		file_mdump(m);
2221 	}
2222 #endif
2223 	m->mimetype[0] = '\0';		/* initialise MIME type to none */
2224 	return 0;
2225 }
2226 
2227 /*
2228  * parse a STRENGTH annotation line from magic file, put into magic[index - 1]
2229  * if valid
2230  */
2231 private int
parse_strength(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2232 parse_strength(struct magic_set *ms, struct magic_entry *me, const char *line,
2233     size_t len)
2234 {
2235 	const char *l = line;
2236 	char *el;
2237 	unsigned long factor;
2238 	struct magic *m = &me->mp[0];
2239 
2240 	if (m->factor_op != FILE_FACTOR_OP_NONE) {
2241 		file_magwarn(ms,
2242 		    "Current entry already has a strength type: %c %d",
2243 		    m->factor_op, m->factor);
2244 		return -1;
2245 	}
2246 	if (m->type == FILE_NAME) {
2247 		file_magwarn(ms, "%s: Strength setting is not supported in "
2248 		    "\"name\" magic entries", m->value.s);
2249 		return -1;
2250 	}
2251 	EATAB;
2252 	switch (*l) {
2253 	case FILE_FACTOR_OP_NONE:
2254 	case FILE_FACTOR_OP_PLUS:
2255 	case FILE_FACTOR_OP_MINUS:
2256 	case FILE_FACTOR_OP_TIMES:
2257 	case FILE_FACTOR_OP_DIV:
2258 		m->factor_op = *l++;
2259 		break;
2260 	default:
2261 		file_magwarn(ms, "Unknown factor op `%c'", *l);
2262 		return -1;
2263 	}
2264 	EATAB;
2265 	factor = strtoul(l, &el, 0);
2266 	if (factor > 255) {
2267 		file_magwarn(ms, "Too large factor `%lu'", factor);
2268 		goto out;
2269 	}
2270 	if (*el && !isspace(CAST(unsigned char, *el))) {
2271 		file_magwarn(ms, "Bad factor `%s'", l);
2272 		goto out;
2273 	}
2274 	m->factor = CAST(uint8_t, factor);
2275 	if (m->factor == 0 && m->factor_op == FILE_FACTOR_OP_DIV) {
2276 		file_magwarn(ms, "Cannot have factor op `%c' and factor %u",
2277 		    m->factor_op, m->factor);
2278 		goto out;
2279 	}
2280 	return 0;
2281 out:
2282 	m->factor_op = FILE_FACTOR_OP_NONE;
2283 	m->factor = 0;
2284 	return -1;
2285 }
2286 
2287 private int
goodchar(unsigned char x,const char * extra)2288 goodchar(unsigned char x, const char *extra)
2289 {
2290 	return (isascii(x) && isalnum(x)) || strchr(extra, x);
2291 }
2292 
2293 private int
parse_extra(struct magic_set * ms,struct magic_entry * me,const char * line,size_t llen,zend_off_t off,size_t len,const char * name,const char * extra,int nt)2294 parse_extra(struct magic_set *ms, struct magic_entry *me, const char *line,
2295     size_t llen, zend_off_t off, size_t len, const char *name, const char *extra, int nt)
2296 {
2297 	size_t i;
2298 	const char *l = line;
2299 	struct magic *m = &me->mp[me->cont_count == 0 ? 0 : me->cont_count - 1];
2300 	char *buf = CAST(char *, CAST(void *, m)) + off;
2301 
2302 	if (buf[0] != '\0') {
2303 		len = nt ? strlen(buf) : len;
2304 		file_magwarn(ms, "Current entry already has a %s type "
2305 		    "`%.*s', new type `%s'", name, CAST(int, len), buf, l);
2306 		return -1;
2307 	}
2308 
2309 	if (*m->desc == '\0') {
2310 		file_magwarn(ms, "Current entry does not yet have a "
2311 		    "description for adding a %s type", name);
2312 		return -1;
2313 	}
2314 
2315 	EATAB;
2316 	for (i = 0; *l && i < llen && i < len && goodchar(*l, extra);
2317 	    buf[i++] = *l++)
2318 		continue;
2319 
2320 	if (i == len && *l) {
2321 		if (nt)
2322 			buf[len - 1] = '\0';
2323 		if (ms->flags & MAGIC_CHECK)
2324 			file_magwarn(ms, "%s type `%s' truncated %"
2325 			    SIZE_T_FORMAT "u", name, line, i);
2326 	} else {
2327 		if (!isspace(CAST(unsigned char, *l)) && !goodchar(*l, extra))
2328 			file_magwarn(ms, "%s type `%s' has bad char '%c'",
2329 			    name, line, *l);
2330 		if (nt)
2331 			buf[i] = '\0';
2332 	}
2333 
2334 	if (i > 0)
2335 		return 0;
2336 
2337 	file_magerror(ms, "Bad magic entry '%s'", line);
2338 	return -1;
2339 }
2340 
2341 /*
2342  * Parse an Apple CREATOR/TYPE annotation from magic file and put it into
2343  * magic[index - 1]
2344  */
2345 private int
parse_apple(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2346 parse_apple(struct magic_set *ms, struct magic_entry *me, const char *line,
2347     size_t len)
2348 {
2349 	struct magic *m = &me->mp[0];
2350 
2351 	return parse_extra(ms, me, line, len,
2352 	    CAST(off_t, offsetof(struct magic, apple)),
2353 	    sizeof(m->apple), "APPLE", "!+-./?", 0);
2354 }
2355 
2356 /*
2357  * Parse a comma-separated list of extensions
2358  */
2359 private int
parse_ext(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2360 parse_ext(struct magic_set *ms, struct magic_entry *me, const char *line,
2361     size_t len)
2362 {
2363 	struct magic *m = &me->mp[0];
2364 
2365 	return parse_extra(ms, me, line, len,
2366 	    CAST(off_t, offsetof(struct magic, ext)),
2367 	    sizeof(m->ext), "EXTENSION", ",!+-/@?_$", 0);
2368 }
2369 
2370 /*
2371  * parse a MIME annotation line from magic file, put into magic[index - 1]
2372  * if valid
2373  */
2374 private int
parse_mime(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2375 parse_mime(struct magic_set *ms, struct magic_entry *me, const char *line,
2376     size_t len)
2377 {
2378 	struct magic *m = &me->mp[0];
2379 
2380 	return parse_extra(ms, me, line, len,
2381 	    CAST(off_t, offsetof(struct magic, mimetype)),
2382 	    sizeof(m->mimetype), "MIME", "+-/.$?:{}", 1);
2383 }
2384 
2385 private int
check_format_type(const char * ptr,int type,const char ** estr)2386 check_format_type(const char *ptr, int type, const char **estr)
2387 {
2388 	int quad = 0, h;
2389 	size_t len, cnt;
2390 	if (*ptr == '\0') {
2391 		/* Missing format string; bad */
2392 		*estr = "missing format spec";
2393 		return -1;
2394 	}
2395 
2396 	switch (file_formats[type]) {
2397 	case FILE_FMT_QUAD:
2398 		quad = 1;
2399 		/*FALLTHROUGH*/
2400 	case FILE_FMT_NUM:
2401 		if (quad == 0) {
2402 			switch (type) {
2403 			case FILE_BYTE:
2404 				h = 2;
2405 				break;
2406 			case FILE_SHORT:
2407 			case FILE_BESHORT:
2408 			case FILE_LESHORT:
2409 				h = 1;
2410 				break;
2411 			case FILE_LONG:
2412 			case FILE_BELONG:
2413 			case FILE_LELONG:
2414 			case FILE_MELONG:
2415 			case FILE_LEID3:
2416 			case FILE_BEID3:
2417 			case FILE_INDIRECT:
2418 				h = 0;
2419 				break;
2420 			default:
2421 				abort();
2422 			}
2423 		} else
2424 			h = 0;
2425 		if (*ptr == '-')
2426 			ptr++;
2427 		if (*ptr == '.')
2428 			ptr++;
2429 		if (*ptr == '#')
2430 			ptr++;
2431 #define CHECKLEN() do { \
2432 	for (len = cnt = 0; isdigit(CAST(unsigned char, *ptr)); ptr++, cnt++) \
2433 		len = len * 10 + (*ptr - '0'); \
2434 	if (cnt > 5 || len > 1024) \
2435 		goto toolong; \
2436 } while (/*CONSTCOND*/0)
2437 
2438 		CHECKLEN();
2439 		if (*ptr == '.')
2440 			ptr++;
2441 		CHECKLEN();
2442 		if (quad) {
2443 			if (*ptr++ != 'l')
2444 				goto invalid;
2445 			if (*ptr++ != 'l')
2446 				goto invalid;
2447 		}
2448 
2449 		switch (*ptr++) {
2450 #ifdef STRICT_FORMAT 	/* "long" formats are int formats for us */
2451 		/* so don't accept the 'l' modifier */
2452 		case 'l':
2453 			switch (*ptr++) {
2454 			case 'i':
2455 			case 'd':
2456 			case 'u':
2457 			case 'o':
2458 			case 'x':
2459 			case 'X':
2460 				if (h == 0)
2461 					return 0;
2462 				/*FALLTHROUGH*/
2463 			default:
2464 				goto invalid;
2465 			}
2466 
2467 		/*
2468 		 * Don't accept h and hh modifiers. They make writing
2469 		 * magic entries more complicated, for very little benefit
2470 		 */
2471 		case 'h':
2472 			if (h-- <= 0)
2473 				goto invalid;
2474 			switch (*ptr++) {
2475 			case 'h':
2476 				if (h-- <= 0)
2477 					goto invalid;
2478 				switch (*ptr++) {
2479 				case 'i':
2480 				case 'd':
2481 				case 'u':
2482 				case 'o':
2483 				case 'x':
2484 				case 'X':
2485 					return 0;
2486 				default:
2487 					goto invalid;
2488 				}
2489 			case 'i':
2490 			case 'd':
2491 			case 'u':
2492 			case 'o':
2493 			case 'x':
2494 			case 'X':
2495 				if (h == 0)
2496 					return 0;
2497 				/*FALLTHROUGH*/
2498 			default:
2499 				goto invalid;
2500 			}
2501 #endif
2502 		case 'c':
2503 			if (h == 2)
2504 				return 0;
2505 			goto invalid;
2506 		case 'i':
2507 		case 'd':
2508 		case 'u':
2509 		case 'o':
2510 		case 'x':
2511 		case 'X':
2512 #ifdef STRICT_FORMAT
2513 			if (h == 0)
2514 				return 0;
2515 			/*FALLTHROUGH*/
2516 #else
2517 			return 0;
2518 #endif
2519 		default:
2520 			goto invalid;
2521 		}
2522 
2523 	case FILE_FMT_FLOAT:
2524 	case FILE_FMT_DOUBLE:
2525 		if (*ptr == '-')
2526 			ptr++;
2527 		if (*ptr == '.')
2528 			ptr++;
2529 		CHECKLEN();
2530 		if (*ptr == '.')
2531 			ptr++;
2532 		CHECKLEN();
2533 		switch (*ptr++) {
2534 		case 'e':
2535 		case 'E':
2536 		case 'f':
2537 		case 'F':
2538 		case 'g':
2539 		case 'G':
2540 			return 0;
2541 
2542 		default:
2543 			goto invalid;
2544 		}
2545 
2546 
2547 	case FILE_FMT_STR:
2548 		if (*ptr == '-')
2549 			ptr++;
2550 		while (isdigit(CAST(unsigned char, *ptr)))
2551 			ptr++;
2552 		if (*ptr == '.') {
2553 			ptr++;
2554 			while (isdigit(CAST(unsigned char , *ptr)))
2555 				ptr++;
2556 		}
2557 
2558 		switch (*ptr++) {
2559 		case 's':
2560 			return 0;
2561 		default:
2562 			goto invalid;
2563 		}
2564 
2565 	default:
2566 		/* internal error */
2567 		abort();
2568 	}
2569 invalid:
2570 	*estr = "not valid";
2571 toolong:
2572 	*estr = "too long";
2573 	return -1;
2574 }
2575 
2576 /*
2577  * Check that the optional printf format in description matches
2578  * the type of the magic.
2579  */
2580 private int
check_format(struct magic_set * ms,struct magic * m)2581 check_format(struct magic_set *ms, struct magic *m)
2582 {
2583 	char *ptr;
2584 	const char *estr;
2585 
2586 	for (ptr = m->desc; *ptr; ptr++)
2587 		if (*ptr == '%')
2588 			break;
2589 	if (*ptr == '\0') {
2590 		/* No format string; ok */
2591 		return 1;
2592 	}
2593 
2594 	assert(file_nformats == file_nnames);
2595 
2596 	if (m->type >= file_nformats) {
2597 		file_magwarn(ms, "Internal error inconsistency between "
2598 		    "m->type and format strings");
2599 		return -1;
2600 	}
2601 	if (file_formats[m->type] == FILE_FMT_NONE) {
2602 		file_magwarn(ms, "No format string for `%s' with description "
2603 		    "`%s'", m->desc, file_names[m->type]);
2604 		return -1;
2605 	}
2606 
2607 	ptr++;
2608 	if (check_format_type(ptr, m->type, &estr) == -1) {
2609 		/*
2610 		 * TODO: this error message is unhelpful if the format
2611 		 * string is not one character long
2612 		 */
2613 		file_magwarn(ms, "Printf format is %s for type "
2614 		    "`%s' in description `%s'", estr,
2615 		    file_names[m->type], m->desc);
2616 		return -1;
2617 	}
2618 
2619 	for (; *ptr; ptr++) {
2620 		if (*ptr == '%') {
2621 			file_magwarn(ms,
2622 			    "Too many format strings (should have at most one) "
2623 			    "for `%s' with description `%s'",
2624 			    file_names[m->type], m->desc);
2625 			return -1;
2626 		}
2627 	}
2628 	return 0;
2629 }
2630 
2631 /*
2632  * Read a numeric value from a pointer, into the value union of a magic
2633  * pointer, according to the magic type.  Update the string pointer to point
2634  * just after the number read.  Return 0 for success, non-zero for failure.
2635  */
2636 private int
getvalue(struct magic_set * ms,struct magic * m,const char ** p,int action)2637 getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
2638 {
2639 	char *ep;
2640 	uint64_t ull;
2641 
2642 	switch (m->type) {
2643 	case FILE_BESTRING16:
2644 	case FILE_LESTRING16:
2645 	case FILE_STRING:
2646 	case FILE_PSTRING:
2647 	case FILE_REGEX:
2648 	case FILE_SEARCH:
2649 	case FILE_NAME:
2650 	case FILE_USE:
2651 	case FILE_DER:
2652 		*p = getstr(ms, m, *p, action == FILE_COMPILE);
2653 		if (*p == NULL) {
2654 			if (ms->flags & MAGIC_CHECK)
2655 				file_magwarn(ms, "cannot get string from `%s'",
2656 				    m->value.s);
2657 			return -1;
2658 		}
2659 		if (m->type == FILE_REGEX) {
2660 			zend_string *pattern;
2661 			int options = 0;
2662 			pcre_cache_entry *pce;
2663 
2664 			pattern = convert_libmagic_pattern(m->value.s, strlen(m->value.s), options);
2665 
2666 			if ((pce = pcre_get_compiled_regex_cache(pattern)) == NULL) {
2667 				zend_string_release(pattern);
2668 				return -1;
2669 			}
2670 			zend_string_release(pattern);
2671 
2672 			return 0;
2673 		}
2674 		return 0;
2675 	default:
2676 		if (m->reln == 'x')
2677 			return 0;
2678 		break;
2679 	}
2680 
2681 	switch (m->type) {
2682 	case FILE_FLOAT:
2683 	case FILE_BEFLOAT:
2684 	case FILE_LEFLOAT:
2685 		errno = 0;
2686 #ifdef HAVE_STRTOF
2687 		m->value.f = strtof(*p, &ep);
2688 #else
2689 		m->value.f = (float)strtod(*p, &ep);
2690 #endif
2691 		if (errno == 0)
2692 			*p = ep;
2693 		return 0;
2694 	case FILE_DOUBLE:
2695 	case FILE_BEDOUBLE:
2696 	case FILE_LEDOUBLE:
2697 		errno = 0;
2698 		m->value.d = strtod(*p, &ep);
2699 		if (errno == 0)
2700 			*p = ep;
2701 		return 0;
2702 	case FILE_GUID:
2703 		if (file_parse_guid(*p, m->value.guid) == -1)
2704 			return -1;
2705 		*p += FILE_GUID_SIZE - 1;
2706 		return 0;
2707 	default:
2708 		errno = 0;
2709 		ull = CAST(uint64_t, strtoull(*p, &ep, 0));
2710 		m->value.q = file_signextend(ms, m, ull);
2711 		if (*p == ep) {
2712 			file_magwarn(ms, "Unparsable number `%s'", *p);
2713 		} else {
2714 			size_t ts = typesize(m->type);
2715 			uint64_t x;
2716 			const char *q;
2717 
2718 			if (ts == FILE_BADSIZE) {
2719 				file_magwarn(ms,
2720 				    "Expected numeric type got `%s'",
2721 				    type_tbl[m->type].name);
2722 			}
2723 			for (q = *p; isspace(CAST(unsigned char, *q)); q++)
2724 				continue;
2725 			if (*q == '-')
2726 				ull = -CAST(int64_t, ull);
2727 			switch (ts) {
2728 			case 1:
2729 				x = CAST(uint64_t, ull & ~0xffULL);
2730 				break;
2731 			case 2:
2732 				x = CAST(uint64_t, ull & ~0xffffULL);
2733 				break;
2734 			case 4:
2735 				x = CAST(uint64_t, ull & ~0xffffffffULL);
2736 				break;
2737 			case 8:
2738 				x = 0;
2739 				break;
2740 			default:
2741 				abort();
2742 			}
2743 			if (x) {
2744 				file_magwarn(ms, "Overflow for numeric"
2745 				    " type `%s' value %#" PRIx64,
2746 				    type_tbl[m->type].name, ull);
2747 			}
2748 		}
2749 		if (errno == 0) {
2750 			*p = ep;
2751 			eatsize(p);
2752 		}
2753 		return 0;
2754 	}
2755 }
2756 
2757 /*
2758  * Convert a string containing C character escapes.  Stop at an unescaped
2759  * space or tab.
2760  * Copy the converted version to "m->value.s", and the length in m->vallen.
2761  * Return updated scan pointer as function result. Warn if set.
2762  */
2763 private const char *
getstr(struct magic_set * ms,struct magic * m,const char * s,int warn)2764 getstr(struct magic_set *ms, struct magic *m, const char *s, int warn)
2765 {
2766 	const char *origs = s;
2767 	char	*p = m->value.s;
2768 	size_t  plen = sizeof(m->value.s);
2769 	char 	*origp = p;
2770 	char	*pmax = p + plen - 1;
2771 	int	c;
2772 	int	val;
2773 
2774 	while ((c = *s++) != '\0') {
2775 		if (isspace(CAST(unsigned char, c)))
2776 			break;
2777 		if (p >= pmax) {
2778 			file_error(ms, 0, "string too long: `%s'", origs);
2779 			return NULL;
2780 		}
2781 		if (c == '\\') {
2782 			switch(c = *s++) {
2783 
2784 			case '\0':
2785 				if (warn)
2786 					file_magwarn(ms, "incomplete escape");
2787 				s--;
2788 				goto out;
2789 
2790 			case '\t':
2791 				if (warn) {
2792 					file_magwarn(ms,
2793 					    "escaped tab found, use \\t instead");
2794 					warn = 0;	/* already did */
2795 				}
2796 				/*FALLTHROUGH*/
2797 			default:
2798 				if (warn) {
2799 					if (isprint(CAST(unsigned char, c))) {
2800 						/* Allow escaping of
2801 						 * ``relations'' */
2802 						if (strchr("<>&^=!", c) == NULL
2803 						    && (m->type != FILE_REGEX ||
2804 						    strchr("[]().*?^$|{}", c)
2805 						    == NULL)) {
2806 							file_magwarn(ms, "no "
2807 							    "need to escape "
2808 							    "`%c'", c);
2809 						}
2810 					} else {
2811 						file_magwarn(ms,
2812 						    "unknown escape sequence: "
2813 						    "\\%03o", c);
2814 					}
2815 				}
2816 				/*FALLTHROUGH*/
2817 			/* space, perhaps force people to use \040? */
2818 			case ' ':
2819 #if 0
2820 			/*
2821 			 * Other things people escape, but shouldn't need to,
2822 			 * so we disallow them
2823 			 */
2824 			case '\'':
2825 			case '"':
2826 			case '?':
2827 #endif
2828 			/* Relations */
2829 			case '>':
2830 			case '<':
2831 			case '&':
2832 			case '^':
2833 			case '=':
2834 			case '!':
2835 			/* and baskslash itself */
2836 			case '\\':
2837 				*p++ = CAST(char, c);
2838 				break;
2839 
2840 			case 'a':
2841 				*p++ = '\a';
2842 				break;
2843 
2844 			case 'b':
2845 				*p++ = '\b';
2846 				break;
2847 
2848 			case 'f':
2849 				*p++ = '\f';
2850 				break;
2851 
2852 			case 'n':
2853 				*p++ = '\n';
2854 				break;
2855 
2856 			case 'r':
2857 				*p++ = '\r';
2858 				break;
2859 
2860 			case 't':
2861 				*p++ = '\t';
2862 				break;
2863 
2864 			case 'v':
2865 				*p++ = '\v';
2866 				break;
2867 
2868 			/* \ and up to 3 octal digits */
2869 			case '0':
2870 			case '1':
2871 			case '2':
2872 			case '3':
2873 			case '4':
2874 			case '5':
2875 			case '6':
2876 			case '7':
2877 				val = c - '0';
2878 				c = *s++;  /* try for 2 */
2879 				if (c >= '0' && c <= '7') {
2880 					val = (val << 3) | (c - '0');
2881 					c = *s++;  /* try for 3 */
2882 					if (c >= '0' && c <= '7')
2883 						val = (val << 3) | (c-'0');
2884 					else
2885 						--s;
2886 				}
2887 				else
2888 					--s;
2889 				*p++ = CAST(char, val);
2890 				break;
2891 
2892 			/* \x and up to 2 hex digits */
2893 			case 'x':
2894 				val = 'x';	/* Default if no digits */
2895 				c = hextoint(*s++);	/* Get next char */
2896 				if (c >= 0) {
2897 					val = c;
2898 					c = hextoint(*s++);
2899 					if (c >= 0)
2900 						val = (val << 4) + c;
2901 					else
2902 						--s;
2903 				} else
2904 					--s;
2905 				*p++ = CAST(char, val);
2906 				break;
2907 			}
2908 		} else
2909 			*p++ = CAST(char, c);
2910 	}
2911 	--s;
2912 out:
2913 	*p = '\0';
2914 	m->vallen = CAST(unsigned char, (p - origp));
2915 	if (m->type == FILE_PSTRING) {
2916 		size_t l =  file_pstring_length_size(ms, m);
2917 		if (l == FILE_BADSIZE)
2918 			return NULL;
2919 		m->vallen += CAST(unsigned char, l);
2920 	}
2921 	return s;
2922 }
2923 
2924 
2925 /* Single hex char to int; -1 if not a hex char. */
2926 private int
hextoint(int c)2927 hextoint(int c)
2928 {
2929 	if (!isascii(CAST(unsigned char, c)))
2930 		return -1;
2931 	if (isdigit(CAST(unsigned char, c)))
2932 		return c - '0';
2933 	if ((c >= 'a') && (c <= 'f'))
2934 		return c + 10 - 'a';
2935 	if (( c>= 'A') && (c <= 'F'))
2936 		return c + 10 - 'A';
2937 	return -1;
2938 }
2939 
2940 
2941 /*
2942  * Print a string containing C character escapes.
2943  */
2944 protected void
file_showstr(FILE * fp,const char * s,size_t len)2945 file_showstr(FILE *fp, const char *s, size_t len)
2946 {
2947 	char	c;
2948 
2949 	for (;;) {
2950 		if (len == FILE_BADSIZE) {
2951 			c = *s++;
2952 			if (c == '\0')
2953 				break;
2954 		}
2955 		else  {
2956 			if (len-- == 0)
2957 				break;
2958 			c = *s++;
2959 		}
2960 		if (c >= 040 && c <= 0176)	/* TODO isprint && !iscntrl */
2961 			(void) fputc(c, fp);
2962 		else {
2963 			(void) fputc('\\', fp);
2964 			switch (c) {
2965 			case '\a':
2966 				(void) fputc('a', fp);
2967 				break;
2968 
2969 			case '\b':
2970 				(void) fputc('b', fp);
2971 				break;
2972 
2973 			case '\f':
2974 				(void) fputc('f', fp);
2975 				break;
2976 
2977 			case '\n':
2978 				(void) fputc('n', fp);
2979 				break;
2980 
2981 			case '\r':
2982 				(void) fputc('r', fp);
2983 				break;
2984 
2985 			case '\t':
2986 				(void) fputc('t', fp);
2987 				break;
2988 
2989 			case '\v':
2990 				(void) fputc('v', fp);
2991 				break;
2992 
2993 			default:
2994 				(void) fprintf(fp, "%.3o", c & 0377);
2995 				break;
2996 			}
2997 		}
2998 	}
2999 }
3000 
3001 /*
3002  * eatsize(): Eat the size spec from a number [eg. 10UL]
3003  */
3004 private void
eatsize(const char ** p)3005 eatsize(const char **p)
3006 {
3007 	const char *l = *p;
3008 
3009 	if (LOWCASE(*l) == 'u')
3010 		l++;
3011 
3012 	switch (LOWCASE(*l)) {
3013 	case 'l':    /* long */
3014 	case 's':    /* short */
3015 	case 'h':    /* short */
3016 	case 'b':    /* char/byte */
3017 	case 'c':    /* char/byte */
3018 		l++;
3019 		/*FALLTHROUGH*/
3020 	default:
3021 		break;
3022 	}
3023 
3024 	*p = l;
3025 }
3026 
3027 /*
3028  * handle a compiled file.
3029  */
3030 
3031 private struct magic_map *
apprentice_map(struct magic_set * ms,const char * fn)3032 apprentice_map(struct magic_set *ms, const char *fn)
3033 {
3034 	uint32_t *ptr;
3035 	uint32_t version, entries = 0, nentries;
3036 	int needsbyteswap;
3037 	char *dbname = NULL;
3038 	struct magic_map *map;
3039 	size_t i;
3040 	php_stream *stream = NULL;
3041 	php_stream_statbuf st;
3042 
3043 
3044 
3045 	if ((map = CAST(struct magic_map *, ecalloc(1, sizeof(*map)))) == NULL) {
3046 		file_oomem(ms, sizeof(*map));
3047 		return NULL;
3048 	}
3049 
3050 	if (fn == NULL) {
3051 		map->p = (void *)&php_magic_database;
3052 		goto internal_loaded;
3053 	}
3054 
3055 #ifdef PHP_WIN32
3056 	/* Don't bother on windows with php_stream_open_wrapper,
3057 	return to give apprentice_load() a chance. */
3058 	if (php_stream_stat_path_ex((char *)fn, 0, &st, NULL) == SUCCESS) {
3059                if (st.sb.st_mode & S_IFDIR) {
3060                        goto error;
3061                }
3062        }
3063 #endif
3064 
3065 	dbname = mkdbname(ms, fn, 0);
3066 	if (dbname == NULL)
3067 		goto error;
3068 
3069 	stream = php_stream_open_wrapper((char *)fn, "rb", REPORT_ERRORS, NULL);
3070 
3071 	if (!stream) {
3072 		goto error;
3073 	}
3074 
3075 #ifndef PHP_WIN32
3076 	if (php_stream_stat(stream, &st) < 0) {
3077 		file_error(ms, errno, "cannot stat `%s'", dbname);
3078 		goto error;
3079 	}
3080 #endif
3081 	if (st.sb.st_size < 8 || st.sb.st_size > maxoff_t()) {
3082 		file_error(ms, 0, "file `%s' is too %s", dbname,
3083 		    st.sb.st_size < 8 ? "small" : "large");
3084 		goto error;
3085 	}
3086 
3087 	map->type = MAP_TYPE_MALLOC;
3088 	map->len = CAST(size_t, st.sb.st_size);
3089 	map->p = CAST(void *, emalloc(map->len));
3090 
3091 	if (php_stream_read(stream, map->p, (size_t)st.sb.st_size) != (size_t)st.sb.st_size) {
3092 		file_badread(ms);
3093 		goto error;
3094 	}
3095 
3096 	php_stream_close(stream);
3097 	stream = NULL;
3098 
3099 internal_loaded:
3100 	ptr = (uint32_t *)(void *)map->p;
3101 	if (*ptr != MAGICNO) {
3102 		if (swap4(*ptr) != MAGICNO) {
3103 			file_error(ms, 0, "bad magic in `%s'", dbname);
3104 			goto error;
3105 		}
3106 		needsbyteswap = 1;
3107 	} else
3108 		needsbyteswap = 0;
3109 	if (needsbyteswap)
3110 		version = swap4(ptr[1]);
3111 	else
3112 		version = ptr[1];
3113 	if (version != VERSIONNO) {
3114 		file_error(ms, 0, "File %d supports only version %d magic "
3115 		    "files. `%s' is version %d", MAGIC_VERSION,
3116 		    VERSIONNO, dbname, version);
3117 		goto error;
3118 	}
3119 
3120 	/* php_magic_database is a const, performing writes will segfault. This is for big-endian
3121 	machines only, PPC and Sparc specifically. Consider static variable or MINIT in
3122 	future. */
3123 	if (needsbyteswap && fn == NULL) {
3124 		map->p = emalloc(sizeof(php_magic_database));
3125 		map->p = memcpy(map->p, php_magic_database, sizeof(php_magic_database));
3126 	}
3127 
3128 	if (NULL != fn) {
3129 		nentries = (uint32_t)(st.sb.st_size / sizeof(struct magic));
3130 		entries = (uint32_t)(st.sb.st_size / sizeof(struct magic));
3131 		if ((zend_off_t)(entries * sizeof(struct magic)) != st.sb.st_size) {
3132 			file_error(ms, 0, "Size of `%s' %llu is not a multiple of %zu",
3133 				dbname, (unsigned long long)st.sb.st_size,
3134 				sizeof(struct magic));
3135 			goto error;
3136 		}
3137 	}
3138 	map->magic[0] = CAST(struct magic *, map->p) + 1;
3139 	nentries = 0;
3140 	for (i = 0; i < MAGIC_SETS; i++) {
3141 		if (needsbyteswap)
3142 			map->nmagic[i] = swap4(ptr[i + 2]);
3143 		else
3144 			map->nmagic[i] = ptr[i + 2];
3145 		if (i != MAGIC_SETS - 1)
3146 			map->magic[i + 1] = map->magic[i] + map->nmagic[i];
3147 		nentries += map->nmagic[i];
3148 	}
3149 	if (NULL != fn && entries != nentries + 1) {
3150 		file_error(ms, 0, "Inconsistent entries in `%s' %u != %u",
3151 		    dbname, entries, nentries + 1);
3152 		goto error;
3153 	}
3154 	if (needsbyteswap)
3155 		for (i = 0; i < MAGIC_SETS; i++)
3156 			byteswap(map->magic[i], map->nmagic[i]);
3157 
3158 	if (dbname) {
3159 		efree(dbname);
3160 	}
3161 	return map;
3162 
3163 error:
3164 	if (stream) {
3165 		php_stream_close(stream);
3166 	}
3167 	apprentice_unmap(map);
3168 	if (dbname) {
3169 		efree(dbname);
3170 	}
3171 	return NULL;
3172 }
3173 
3174 /*
3175  * handle an mmaped file.
3176  */
3177 private int
apprentice_compile(struct magic_set * ms,struct magic_map * map,const char * fn)3178 apprentice_compile(struct magic_set *ms, struct magic_map *map, const char *fn)
3179 {
3180 	static const size_t nm = sizeof(*map->nmagic) * MAGIC_SETS;
3181 	static const size_t m = sizeof(**map->magic);
3182 	size_t len;
3183 	char *dbname;
3184 	int rv = -1;
3185 	uint32_t i;
3186 	union {
3187 		struct magic m;
3188 		uint32_t h[2 + MAGIC_SETS];
3189 	} hdr;
3190 	php_stream *stream;
3191 
3192 	dbname = mkdbname(ms, fn, 1);
3193 
3194 	if (dbname == NULL)
3195 		goto out;
3196 
3197 	/* wb+ == O_WRONLY|O_CREAT|O_TRUNC|O_BINARY */
3198 	stream = php_stream_open_wrapper((char *)fn, "wb+", REPORT_ERRORS, NULL);
3199 
3200 	if (!stream) {
3201 		file_error(ms, errno, "cannot open `%s'", dbname);
3202 		goto out;
3203 	}
3204 	memset(&hdr, 0, sizeof(hdr));
3205 	hdr.h[0] = MAGICNO;
3206 	hdr.h[1] = VERSIONNO;
3207 	memcpy(hdr.h + 2, map->nmagic, nm);
3208 
3209 	if (php_stream_write(stream,(const char *)&hdr, sizeof(hdr)) != (ssize_t)sizeof(hdr)) {
3210 		file_error(ms, errno, "error writing `%s'", dbname);
3211 		goto out;
3212 	}
3213 
3214 	for (i = 0; i < MAGIC_SETS; i++) {
3215 		len = m * map->nmagic[i];
3216 		if (php_stream_write(stream, (const char *)map->magic[i], len) != (ssize_t)len) {
3217 			file_error(ms, errno, "error writing `%s'", dbname);
3218 			goto out;
3219 		}
3220 	}
3221 
3222 	if (stream) {
3223 		php_stream_close(stream);
3224 	}
3225 	rv = 0;
3226 out:
3227 	efree(dbname);
3228 	return rv;
3229 }
3230 
3231 private const char ext[] = ".mgc";
3232 /*
3233  * make a dbname
3234  */
3235 private char *
mkdbname(struct magic_set * ms,const char * fn,int strip)3236 mkdbname(struct magic_set *ms, const char *fn, int strip)
3237 {
3238 	const char *p, *q;
3239 	char *buf;
3240 
3241 	if (strip) {
3242 		if ((p = strrchr(fn, '/')) != NULL)
3243 			fn = ++p;
3244 	}
3245 
3246 	for (q = fn; *q; q++)
3247 		continue;
3248 	/* Look for .mgc */
3249 	for (p = ext + sizeof(ext) - 1; p >= ext && q >= fn; p--, q--)
3250 		if (*p != *q)
3251 			break;
3252 
3253 	/* Did not find .mgc, restore q */
3254 	if (p >= ext)
3255 		while (*q)
3256 			q++;
3257 
3258 	q++;
3259 	/* Compatibility with old code that looked in .mime */
3260 	if (ms->flags & MAGIC_MIME) {
3261 		spprintf(&buf, MAXPATHLEN, "%.*s.mime%s", CAST(int, q - fn), fn, ext);
3262 #ifdef PHP_WIN32
3263 		if (VCWD_ACCESS(buf, R_OK) == 0) {
3264 #else
3265 		if (VCWD_ACCESS(buf, R_OK) != -1) {
3266 #endif
3267 			ms->flags &= MAGIC_MIME_TYPE;
3268 			return buf;
3269 		}
3270 		efree(buf);
3271 	}
3272 	spprintf(&buf, MAXPATHLEN, "%.*s%s", CAST(int, q - fn), fn, ext);
3273 
3274 	/* Compatibility with old code that looked in .mime */
3275 	if (strstr(fn, ".mime") != NULL)
3276 		ms->flags &= MAGIC_MIME_TYPE;
3277 	return buf;
3278 }
3279 
3280 /*
3281  * Byteswap an mmap'ed file if needed
3282  */
3283 private void
3284 byteswap(struct magic *magic, uint32_t nmagic)
3285 {
3286 	uint32_t i;
3287 	for (i = 0; i < nmagic; i++)
3288 		bs1(&magic[i]);
3289 }
3290 
3291 /*
3292  * swap a short
3293  */
3294 private uint16_t
3295 swap2(uint16_t sv)
3296 {
3297 	uint16_t rv;
3298 	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
3299 	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
3300 	d[0] = s[1];
3301 	d[1] = s[0];
3302 	return rv;
3303 }
3304 
3305 /*
3306  * swap an int
3307  */
3308 private uint32_t
3309 swap4(uint32_t sv)
3310 {
3311 	uint32_t rv;
3312 	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
3313 	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
3314 	d[0] = s[3];
3315 	d[1] = s[2];
3316 	d[2] = s[1];
3317 	d[3] = s[0];
3318 	return rv;
3319 }
3320 
3321 /*
3322  * swap a quad
3323  */
3324 private uint64_t
3325 swap8(uint64_t sv)
3326 {
3327 	uint64_t rv;
3328 	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
3329 	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
3330 #if 0
3331 	d[0] = s[3];
3332 	d[1] = s[2];
3333 	d[2] = s[1];
3334 	d[3] = s[0];
3335 	d[4] = s[7];
3336 	d[5] = s[6];
3337 	d[6] = s[5];
3338 	d[7] = s[4];
3339 #else
3340 	d[0] = s[7];
3341 	d[1] = s[6];
3342 	d[2] = s[5];
3343 	d[3] = s[4];
3344 	d[4] = s[3];
3345 	d[5] = s[2];
3346 	d[6] = s[1];
3347 	d[7] = s[0];
3348 #endif
3349 	return rv;
3350 }
3351 
3352 /*
3353  * byteswap a single magic entry
3354  */
3355 private void
3356 bs1(struct magic *m)
3357 {
3358 	m->cont_level = swap2(m->cont_level);
3359 	m->offset = swap4(CAST(uint32_t, m->offset));
3360 	m->in_offset = swap4(CAST(uint32_t, m->in_offset));
3361 	m->lineno = swap4(CAST(uint32_t, m->lineno));
3362 	if (IS_LIBMAGIC_STRING(m->type)) {
3363 		m->str_range = swap4(m->str_range);
3364 		m->str_flags = swap4(m->str_flags);
3365 	}
3366 	else {
3367 		m->value.q = swap8(m->value.q);
3368 		m->num_mask = swap8(m->num_mask);
3369 	}
3370 }
3371 
3372 protected size_t
3373 file_pstring_length_size(struct magic_set *ms, const struct magic *m)
3374 {
3375 	switch (m->str_flags & PSTRING_LEN) {
3376 	case PSTRING_1_LE:
3377 		return 1;
3378 	case PSTRING_2_LE:
3379 	case PSTRING_2_BE:
3380 		return 2;
3381 	case PSTRING_4_LE:
3382 	case PSTRING_4_BE:
3383 		return 4;
3384 	default:
3385 		file_error(ms, 0, "corrupt magic file "
3386 		    "(bad pascal string length %d)",
3387 		    m->str_flags & PSTRING_LEN);
3388 		return FILE_BADSIZE;
3389 	}
3390 }
3391 protected size_t
3392 file_pstring_get_length(struct magic_set *ms, const struct magic *m,
3393     const char *ss)
3394 {
3395 	size_t len = 0;
3396 	const unsigned char *s = RCAST(const unsigned char *, ss);
3397 	unsigned int s3, s2, s1, s0;
3398 
3399 	switch (m->str_flags & PSTRING_LEN) {
3400 	case PSTRING_1_LE:
3401 		len = *s;
3402 		break;
3403 	case PSTRING_2_LE:
3404 		s0 = s[0];
3405 		s1 = s[1];
3406 		len = (s1 << 8) | s0;
3407 		break;
3408 	case PSTRING_2_BE:
3409 		s0 = s[0];
3410 		s1 = s[1];
3411 		len = (s0 << 8) | s1;
3412 		break;
3413 	case PSTRING_4_LE:
3414 		s0 = s[0];
3415 		s1 = s[1];
3416 		s2 = s[2];
3417 		s3 = s[3];
3418 		len = (s3 << 24) | (s2 << 16) | (s1 << 8) | s0;
3419 		break;
3420 	case PSTRING_4_BE:
3421 		s0 = s[0];
3422 		s1 = s[1];
3423 		s2 = s[2];
3424 		s3 = s[3];
3425 		len = (s0 << 24) | (s1 << 16) | (s2 << 8) | s3;
3426 		break;
3427 	default:
3428 		file_error(ms, 0, "corrupt magic file "
3429 		    "(bad pascal string length %d)",
3430 		    m->str_flags & PSTRING_LEN);
3431 		return FILE_BADSIZE;
3432 	}
3433 
3434 	if (m->str_flags & PSTRING_LENGTH_INCLUDES_ITSELF) {
3435 		size_t l = file_pstring_length_size(ms, m);
3436 		if (l == FILE_BADSIZE)
3437 			return l;
3438 		len -= l;
3439 	}
3440 
3441 	return len;
3442 }
3443 
3444 protected int
3445 file_magicfind(struct magic_set *ms, const char *name, struct mlist *v)
3446 {
3447 	uint32_t i, j;
3448 	struct mlist *mlist, *ml;
3449 
3450 	mlist = ms->mlist[1];
3451 
3452 	for (ml = mlist->next; ml != mlist; ml = ml->next) {
3453 		struct magic *ma = ml->magic;
3454 		uint32_t nma = ml->nmagic;
3455 		for (i = 0; i < nma; i++) {
3456 			if (ma[i].type != FILE_NAME)
3457 				continue;
3458 			if (strcmp(ma[i].value.s, name) == 0) {
3459 				v->magic = &ma[i];
3460 				for (j = i + 1; j < nma; j++)
3461 				    if (ma[j].cont_level == 0)
3462 					    break;
3463 				v->nmagic = j - i;
3464 				return 0;
3465 			}
3466 		}
3467 	}
3468 	return -1;
3469 }
3470