xref: /PHP-8.2/ext/fileinfo/libmagic/cdf.c (revision c3eeab01)
1 /*-
2  * Copyright (c) 2008 Christos Zoulas
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
15  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
16  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
18  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24  * POSSIBILITY OF SUCH DAMAGE.
25  */
26 /*
27  * Parse Composite Document Files, the format used in Microsoft Office
28  * document files before they switched to zipped XML.
29  * Info from: http://sc.openoffice.org/compdocfileformat.pdf
30  *
31  * N.B. This is the "Composite Document File" format, and not the
32  * "Compound Document Format", nor the "Channel Definition Format".
33  */
34 
35 #include "file.h"
36 
37 #ifndef lint
38 FILE_RCSID("@(#)$File: cdf.c,v 1.116 2019/08/26 14:31:39 christos Exp $")
39 #endif
40 
41 #include <assert.h>
42 #ifdef CDF_DEBUG
43 #include <err.h>
44 #endif
45 #include <stdlib.h>
46 
47 #ifdef PHP_WIN32
48 #include "win32/unistd.h"
49 #else
50 #include <unistd.h>
51 #endif
52 
53 #ifndef UINT32_MAX
54 # define UINT32_MAX (0xffffffff)
55 #endif
56 
57 #include <string.h>
58 #include <time.h>
59 #include <ctype.h>
60 #include <limits.h>
61 
62 #ifndef EFTYPE
63 #define EFTYPE EINVAL
64 #endif
65 
66 #ifndef SIZE_T_MAX
67 #define SIZE_T_MAX CAST(size_t, ~0ULL)
68 #endif
69 
70 #include "cdf.h"
71 
72 #ifdef CDF_DEBUG
73 #define DPRINTF(a) printf a, fflush(stdout)
74 #else
75 #define DPRINTF(a)
76 #endif
77 
78 static union {
79 	char s[4];
80 	uint32_t u;
81 } cdf_bo;
82 
83 #define NEED_SWAP	(cdf_bo.u == CAST(uint32_t, 0x01020304))
84 
85 #define CDF_TOLE8(x)	\
86     (CAST(uint64_t, NEED_SWAP ? _cdf_tole8(x) : CAST(uint64_t, x)))
87 #define CDF_TOLE4(x)	\
88     (CAST(uint32_t, NEED_SWAP ? _cdf_tole4(x) : CAST(uint32_t, x)))
89 #define CDF_TOLE2(x)	\
90     (CAST(uint16_t, NEED_SWAP ? _cdf_tole2(x) : CAST(uint16_t, x)))
91 #define CDF_TOLE(x)	(/*CONSTCOND*/sizeof(x) == 2 ? \
92 			    CDF_TOLE2(CAST(uint16_t, x)) : \
93 			(/*CONSTCOND*/sizeof(x) == 4 ? \
94 			    CDF_TOLE4(CAST(uint32_t, x)) : \
95 			    CDF_TOLE8(CAST(uint64_t, x))))
96 #define CDF_GETUINT32(x, y)	cdf_getuint32(x, y)
97 
98 #define CDF_MALLOC(n) emalloc(n)
99 #define CDF_REALLOC(p, n) erealloc(p, n)
100 #define CDF_CALLOC(n, u) ecalloc(n, u)
101 
102 /*
103  * swap a short
104  */
105 static uint16_t
_cdf_tole2(uint16_t sv)106 _cdf_tole2(uint16_t sv)
107 {
108 	uint16_t rv;
109 	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
110 	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
111 	d[0] = s[1];
112 	d[1] = s[0];
113 	return rv;
114 }
115 
116 /*
117  * swap an int
118  */
119 static uint32_t
_cdf_tole4(uint32_t sv)120 _cdf_tole4(uint32_t sv)
121 {
122 	uint32_t rv;
123 	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
124 	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
125 	d[0] = s[3];
126 	d[1] = s[2];
127 	d[2] = s[1];
128 	d[3] = s[0];
129 	return rv;
130 }
131 
132 /*
133  * swap a quad
134  */
135 static uint64_t
_cdf_tole8(uint64_t sv)136 _cdf_tole8(uint64_t sv)
137 {
138 	uint64_t rv;
139 	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
140 	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
141 	d[0] = s[7];
142 	d[1] = s[6];
143 	d[2] = s[5];
144 	d[3] = s[4];
145 	d[4] = s[3];
146 	d[5] = s[2];
147 	d[6] = s[1];
148 	d[7] = s[0];
149 	return rv;
150 }
151 
152 /*
153  * grab a uint32_t from a possibly unaligned address, and return it in
154  * the native host order.
155  */
156 static uint32_t
cdf_getuint32(const uint8_t * p,size_t offs)157 cdf_getuint32(const uint8_t *p, size_t offs)
158 {
159 	uint32_t rv;
160 	(void)memcpy(&rv, p + offs * sizeof(uint32_t), sizeof(rv));
161 	return CDF_TOLE4(rv);
162 }
163 
164 #define CDF_UNPACK(a)	\
165     (void)memcpy(&(a), &buf[len], sizeof(a)), len += sizeof(a)
166 #define CDF_UNPACKA(a)	\
167     (void)memcpy((a), &buf[len], sizeof(a)), len += sizeof(a)
168 
169 uint16_t
cdf_tole2(uint16_t sv)170 cdf_tole2(uint16_t sv)
171 {
172 	return CDF_TOLE2(sv);
173 }
174 
175 uint32_t
cdf_tole4(uint32_t sv)176 cdf_tole4(uint32_t sv)
177 {
178 	return CDF_TOLE4(sv);
179 }
180 
181 uint64_t
cdf_tole8(uint64_t sv)182 cdf_tole8(uint64_t sv)
183 {
184 	return CDF_TOLE8(sv);
185 }
186 
187 void
cdf_swap_header(cdf_header_t * h)188 cdf_swap_header(cdf_header_t *h)
189 {
190 	size_t i;
191 
192 	h->h_magic = CDF_TOLE8(h->h_magic);
193 	h->h_uuid[0] = CDF_TOLE8(h->h_uuid[0]);
194 	h->h_uuid[1] = CDF_TOLE8(h->h_uuid[1]);
195 	h->h_revision = CDF_TOLE2(h->h_revision);
196 	h->h_version = CDF_TOLE2(h->h_version);
197 	h->h_byte_order = CDF_TOLE2(h->h_byte_order);
198 	h->h_sec_size_p2 = CDF_TOLE2(h->h_sec_size_p2);
199 	h->h_short_sec_size_p2 = CDF_TOLE2(h->h_short_sec_size_p2);
200 	h->h_num_sectors_in_sat = CDF_TOLE4(h->h_num_sectors_in_sat);
201 	h->h_secid_first_directory = CDF_TOLE4(h->h_secid_first_directory);
202 	h->h_min_size_standard_stream =
203 	    CDF_TOLE4(h->h_min_size_standard_stream);
204 	h->h_secid_first_sector_in_short_sat =
205 	    CDF_TOLE4(CAST(uint32_t, h->h_secid_first_sector_in_short_sat));
206 	h->h_num_sectors_in_short_sat =
207 	    CDF_TOLE4(h->h_num_sectors_in_short_sat);
208 	h->h_secid_first_sector_in_master_sat =
209 	    CDF_TOLE4(CAST(uint32_t, h->h_secid_first_sector_in_master_sat));
210 	h->h_num_sectors_in_master_sat =
211 	    CDF_TOLE4(h->h_num_sectors_in_master_sat);
212 	for (i = 0; i < __arraycount(h->h_master_sat); i++) {
213 		h->h_master_sat[i] =
214 		    CDF_TOLE4(CAST(uint32_t, h->h_master_sat[i]));
215 	}
216 }
217 
218 void
cdf_unpack_header(cdf_header_t * h,char * buf)219 cdf_unpack_header(cdf_header_t *h, char *buf)
220 {
221 	size_t i;
222 	size_t len = 0;
223 
224 	CDF_UNPACK(h->h_magic);
225 	CDF_UNPACKA(h->h_uuid);
226 	CDF_UNPACK(h->h_revision);
227 	CDF_UNPACK(h->h_version);
228 	CDF_UNPACK(h->h_byte_order);
229 	CDF_UNPACK(h->h_sec_size_p2);
230 	CDF_UNPACK(h->h_short_sec_size_p2);
231 	CDF_UNPACKA(h->h_unused0);
232 	CDF_UNPACK(h->h_num_sectors_in_sat);
233 	CDF_UNPACK(h->h_secid_first_directory);
234 	CDF_UNPACKA(h->h_unused1);
235 	CDF_UNPACK(h->h_min_size_standard_stream);
236 	CDF_UNPACK(h->h_secid_first_sector_in_short_sat);
237 	CDF_UNPACK(h->h_num_sectors_in_short_sat);
238 	CDF_UNPACK(h->h_secid_first_sector_in_master_sat);
239 	CDF_UNPACK(h->h_num_sectors_in_master_sat);
240 	for (i = 0; i < __arraycount(h->h_master_sat); i++)
241 		CDF_UNPACK(h->h_master_sat[i]);
242 }
243 
244 void
cdf_swap_dir(cdf_directory_t * d)245 cdf_swap_dir(cdf_directory_t *d)
246 {
247 	d->d_namelen = CDF_TOLE2(d->d_namelen);
248 	d->d_left_child = CDF_TOLE4(CAST(uint32_t, d->d_left_child));
249 	d->d_right_child = CDF_TOLE4(CAST(uint32_t, d->d_right_child));
250 	d->d_storage = CDF_TOLE4(CAST(uint32_t, d->d_storage));
251 	d->d_storage_uuid[0] = CDF_TOLE8(d->d_storage_uuid[0]);
252 	d->d_storage_uuid[1] = CDF_TOLE8(d->d_storage_uuid[1]);
253 	d->d_flags = CDF_TOLE4(d->d_flags);
254 	d->d_created = CDF_TOLE8(CAST(uint64_t, d->d_created));
255 	d->d_modified = CDF_TOLE8(CAST(uint64_t, d->d_modified));
256 	d->d_stream_first_sector = CDF_TOLE4(
257 	    CAST(uint32_t, d->d_stream_first_sector));
258 	d->d_size = CDF_TOLE4(d->d_size);
259 }
260 
261 void
cdf_swap_class(cdf_classid_t * d)262 cdf_swap_class(cdf_classid_t *d)
263 {
264 	d->cl_dword = CDF_TOLE4(d->cl_dword);
265 	d->cl_word[0] = CDF_TOLE2(d->cl_word[0]);
266 	d->cl_word[1] = CDF_TOLE2(d->cl_word[1]);
267 }
268 
269 void
cdf_unpack_dir(cdf_directory_t * d,char * buf)270 cdf_unpack_dir(cdf_directory_t *d, char *buf)
271 {
272 	size_t len = 0;
273 
274 	CDF_UNPACKA(d->d_name);
275 	CDF_UNPACK(d->d_namelen);
276 	CDF_UNPACK(d->d_type);
277 	CDF_UNPACK(d->d_color);
278 	CDF_UNPACK(d->d_left_child);
279 	CDF_UNPACK(d->d_right_child);
280 	CDF_UNPACK(d->d_storage);
281 	CDF_UNPACKA(d->d_storage_uuid);
282 	CDF_UNPACK(d->d_flags);
283 	CDF_UNPACK(d->d_created);
284 	CDF_UNPACK(d->d_modified);
285 	CDF_UNPACK(d->d_stream_first_sector);
286 	CDF_UNPACK(d->d_size);
287 	CDF_UNPACK(d->d_unused0);
288 }
289 
290 int
cdf_zero_stream(cdf_stream_t * scn)291 cdf_zero_stream(cdf_stream_t *scn)
292 {
293 	scn->sst_len = 0;
294 	scn->sst_dirlen = 0;
295 	scn->sst_ss = 0;
296 	efree(scn->sst_tab);
297 	scn->sst_tab = NULL;
298 	return -1;
299 }
300 
301 static size_t
cdf_check_stream(const cdf_stream_t * sst,const cdf_header_t * h)302 cdf_check_stream(const cdf_stream_t *sst, const cdf_header_t *h)
303 {
304 #ifndef NDEBUG
305 	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
306 	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
307 	assert(ss == sst->sst_ss);
308 #endif
309 	return sst->sst_ss;
310 }
311 
312 static int
cdf_check_stream_offset(const cdf_stream_t * sst,const cdf_header_t * h,const void * p,size_t tail,int line)313 cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
314     const void *p, size_t tail, int line)
315 {
316 	const char *b = RCAST(const char *, sst->sst_tab);
317 	const char *e = RCAST(const char *, p) + tail;
318 	size_t ss = cdf_check_stream(sst, h);
319 	/*LINTED*/(void)&line;
320 	if (e >= b && CAST(size_t, e - b) <= ss * sst->sst_len)
321 		return 0;
322 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
323 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
324 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
325 	    ss * sst->sst_len, ss, sst->sst_len));
326 	errno = EFTYPE;
327 	return -1;
328 }
329 
330 static ssize_t
cdf_read(const cdf_info_t * info,zend_off_t off,void * buf,size_t len)331 cdf_read(const cdf_info_t *info, zend_off_t off, void *buf, size_t len)
332 {
333 	size_t siz = CAST(size_t, off + len);
334 
335 	if (CAST(zend_off_t, off + len) != CAST(zend_off_t, siz))
336 		goto out;
337 
338 	if (info->i_buf != NULL && info->i_len >= siz) {
339 		(void)memcpy(buf, &info->i_buf[off], len);
340 		return CAST(ssize_t, len);
341 	}
342 
343 	if (info->i_fd == -1)
344 		goto out;
345 
346 	if (FINFO_LSEEK_FUNC(info->i_fd, off, SEEK_SET) == (zend_off_t)-1)
347 		return -1;
348 
349 	if (FINFO_READ_FUNC(info->i_fd, buf, len) != (ssize_t)len)
350 		return -1;
351 
352 	return CAST(ssize_t, len);
353 out:
354 	errno = EINVAL;
355 	return -1;
356 }
357 
358 int
cdf_read_header(const cdf_info_t * info,cdf_header_t * h)359 cdf_read_header(const cdf_info_t *info, cdf_header_t *h)
360 {
361 	char buf[512];
362 
363 	(void)memcpy(cdf_bo.s, "\01\02\03\04", 4);
364 	if (cdf_read(info, CAST(zend_off_t, 0), buf, sizeof(buf)) == -1)
365 		return -1;
366 	cdf_unpack_header(h, buf);
367 	cdf_swap_header(h);
368 	if (h->h_magic != CDF_MAGIC) {
369 		DPRINTF(("Bad magic %#" INT64_T_FORMAT "x != %#"
370 		    INT64_T_FORMAT "x\n",
371 		    (unsigned long long)h->h_magic,
372 		    (unsigned long long)CDF_MAGIC));
373 		goto out;
374 	}
375 	if (h->h_sec_size_p2 > 20) {
376 		DPRINTF(("Bad sector size %hu\n", h->h_sec_size_p2));
377 		goto out;
378 	}
379 	if (h->h_short_sec_size_p2 > 20) {
380 		DPRINTF(("Bad short sector size %hu\n",
381 		    h->h_short_sec_size_p2));
382 		goto out;
383 	}
384 	return 0;
385 out:
386 	errno = EFTYPE;
387 	return -1;
388 }
389 
390 
391 ssize_t
cdf_read_sector(const cdf_info_t * info,void * buf,size_t offs,size_t len,const cdf_header_t * h,cdf_secid_t id)392 cdf_read_sector(const cdf_info_t *info, void *buf, size_t offs, size_t len,
393     const cdf_header_t *h, cdf_secid_t id)
394 {
395 	size_t ss = CDF_SEC_SIZE(h);
396 	size_t pos;
397 
398 	if (SIZE_T_MAX / ss < CAST(size_t, id))
399 		return -1;
400 
401 	pos = CDF_SEC_POS(h, id);
402 	assert(ss == len);
403 	return cdf_read(info, CAST(off_t, pos), RCAST(char *, buf) + offs, len);
404 }
405 
406 ssize_t
cdf_read_short_sector(const cdf_stream_t * sst,void * buf,size_t offs,size_t len,const cdf_header_t * h,cdf_secid_t id)407 cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs,
408     size_t len, const cdf_header_t *h, cdf_secid_t id)
409 {
410 	size_t ss = CDF_SHORT_SEC_SIZE(h);
411 	size_t pos;
412 
413 	if (SIZE_T_MAX / ss < CAST(size_t, id))
414 		return -1;
415 
416 	pos = CDF_SHORT_SEC_POS(h, id);
417 	assert(ss == len);
418 	if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
419 		DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
420 		    SIZE_T_FORMAT "u\n",
421 		    pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
422 		goto out;
423 	}
424 	(void)memcpy(RCAST(char *, buf) + offs,
425 	    RCAST(const char *, sst->sst_tab) + pos, len);
426 	return len;
427 out:
428 	errno = EFTYPE;
429 	return -1;
430 }
431 
432 /*
433  * Read the sector allocation table.
434  */
435 int
cdf_read_sat(const cdf_info_t * info,cdf_header_t * h,cdf_sat_t * sat)436 cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
437 {
438 	size_t i, j, k;
439 	size_t ss = CDF_SEC_SIZE(h);
440 	cdf_secid_t *msa, mid, sec;
441 	size_t nsatpersec = (ss / sizeof(mid)) - 1;
442 
443 	for (i = 0; i < __arraycount(h->h_master_sat); i++)
444 		if (h->h_master_sat[i] == CDF_SECID_FREE)
445 			break;
446 
447 #define CDF_SEC_LIMIT (UINT32_MAX / (64 * ss))
448 	if ((nsatpersec > 0 &&
449 	    h->h_num_sectors_in_master_sat > CDF_SEC_LIMIT / nsatpersec) ||
450 	    i > CDF_SEC_LIMIT) {
451 		DPRINTF(("Number of sectors in master SAT too big %u %"
452 		    SIZE_T_FORMAT "u\n", h->h_num_sectors_in_master_sat, i));
453 		errno = EFTYPE;
454 		return -1;
455 	}
456 
457 	sat->sat_len = h->h_num_sectors_in_master_sat * nsatpersec + i;
458 	DPRINTF(("sat_len = %" SIZE_T_FORMAT "u ss = %" SIZE_T_FORMAT "u\n",
459 	    sat->sat_len, ss));
460 	if ((sat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(sat->sat_len, ss)))
461 	    == NULL)
462 		return -1;
463 
464 	for (i = 0; i < __arraycount(h->h_master_sat); i++) {
465 		if (h->h_master_sat[i] < 0)
466 			break;
467 		if (cdf_read_sector(info, sat->sat_tab, ss * i, ss, h,
468 		    h->h_master_sat[i]) != CAST(ssize_t, ss)) {
469 			DPRINTF(("Reading sector %d", h->h_master_sat[i]));
470 			goto out1;
471 		}
472 	}
473 
474 	if ((msa = CAST(cdf_secid_t *, CDF_CALLOC(1, ss))) == NULL)
475 		goto out1;
476 
477 	mid = h->h_secid_first_sector_in_master_sat;
478 	for (j = 0; j < h->h_num_sectors_in_master_sat; j++) {
479 		if (mid < 0)
480 			goto out;
481 		if (j >= CDF_LOOP_LIMIT) {
482 			DPRINTF(("Reading master sector loop limit"));
483 			goto out3;
484 		}
485 		if (cdf_read_sector(info, msa, 0, ss, h, mid) !=
486 		    CAST(ssize_t, ss)) {
487 			DPRINTF(("Reading master sector %d", mid));
488 			goto out2;
489 		}
490 		for (k = 0; k < nsatpersec; k++, i++) {
491 			sec = CDF_TOLE4(CAST(uint32_t, msa[k]));
492 			if (sec < 0)
493 				goto out;
494 			if (i >= sat->sat_len) {
495 			    DPRINTF(("Out of bounds reading MSA %"
496 				SIZE_T_FORMAT "u >= %" SIZE_T_FORMAT "u",
497 				i, sat->sat_len));
498 			    goto out3;
499 			}
500 			if (cdf_read_sector(info, sat->sat_tab, ss * i, ss, h,
501 			    sec) != CAST(ssize_t, ss)) {
502 				DPRINTF(("Reading sector %d",
503 				    CDF_TOLE4(msa[k])));
504 				goto out2;
505 			}
506 		}
507 		mid = CDF_TOLE4(CAST(uint32_t, msa[nsatpersec]));
508 	}
509 out:
510 	sat->sat_len = i;
511 	efree(msa);
512 	return 0;
513 out3:
514 	errno = EFTYPE;
515 out2:
516 	efree(msa);
517 out1:
518 	efree(sat->sat_tab);
519 	return -1;
520 }
521 
522 size_t
cdf_count_chain(const cdf_sat_t * sat,cdf_secid_t sid,size_t size)523 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
524 {
525 	size_t i, j;
526 	cdf_secid_t maxsector = CAST(cdf_secid_t, (sat->sat_len * size)
527 	    / sizeof(maxsector));
528 
529 	DPRINTF(("Chain:"));
530 	if (sid == CDF_SECID_END_OF_CHAIN) {
531 		/* 0-length chain. */
532 		DPRINTF((" empty\n"));
533 		return 0;
534 	}
535 
536 	for (j = i = 0; sid >= 0; i++, j++) {
537 		DPRINTF((" %d", sid));
538 		if (j >= CDF_LOOP_LIMIT) {
539 			DPRINTF(("Counting chain loop limit"));
540 			goto out;
541 		}
542 		if (sid >= maxsector) {
543 			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
544 			goto out;
545 		}
546 		sid = CDF_TOLE4(CAST(uint32_t, sat->sat_tab[sid]));
547 	}
548 	if (i == 0) {
549 		DPRINTF((" none, sid: %d\n", sid));
550 		goto out;
551 
552 	}
553 	DPRINTF(("\n"));
554 	return i;
555 out:
556 	errno = EFTYPE;
557 	return CAST(size_t, -1);
558 }
559 
560 int
cdf_read_long_sector_chain(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,cdf_secid_t sid,size_t len,cdf_stream_t * scn)561 cdf_read_long_sector_chain(const cdf_info_t *info, const cdf_header_t *h,
562     const cdf_sat_t *sat, cdf_secid_t sid, size_t len, cdf_stream_t *scn)
563 {
564 	size_t ss = CDF_SEC_SIZE(h), i, j;
565 	ssize_t nr;
566 	scn->sst_tab = NULL;
567 	scn->sst_len = cdf_count_chain(sat, sid, ss);
568 	scn->sst_dirlen = MAX(h->h_min_size_standard_stream, len);
569 	scn->sst_ss = ss;
570 
571 	if (sid == CDF_SECID_END_OF_CHAIN || len == 0)
572 		return cdf_zero_stream(scn);
573 
574 	if (scn->sst_len == CAST(size_t, -1))
575 		goto out;
576 
577 	scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
578 	if (scn->sst_tab == NULL)
579 		return cdf_zero_stream(scn);
580 
581 	for (j = i = 0; sid >= 0; i++, j++) {
582 		if (j >= CDF_LOOP_LIMIT) {
583 			DPRINTF(("Read long sector chain loop limit"));
584 			goto out;
585 		}
586 		if (i >= scn->sst_len) {
587 			DPRINTF(("Out of bounds reading long sector chain "
588 			    "%" SIZE_T_FORMAT "u > %" SIZE_T_FORMAT "u\n", i,
589 			    scn->sst_len));
590 			goto out;
591 		}
592 		if ((nr = cdf_read_sector(info, scn->sst_tab, i * ss, ss, h,
593 		    sid)) != CAST(ssize_t, ss)) {
594 			if (i == scn->sst_len - 1 && nr > 0) {
595 				/* Last sector might be truncated */
596 				return 0;
597 			}
598 			DPRINTF(("Reading long sector chain %d", sid));
599 			goto out;
600 		}
601 		sid = CDF_TOLE4(CAST(uint32_t, sat->sat_tab[sid]));
602 	}
603 	return 0;
604 out:
605 	errno = EFTYPE;
606 	return cdf_zero_stream(scn);
607 }
608 
609 int
cdf_read_short_sector_chain(const cdf_header_t * h,const cdf_sat_t * ssat,const cdf_stream_t * sst,cdf_secid_t sid,size_t len,cdf_stream_t * scn)610 cdf_read_short_sector_chain(const cdf_header_t *h,
611     const cdf_sat_t *ssat, const cdf_stream_t *sst,
612     cdf_secid_t sid, size_t len, cdf_stream_t *scn)
613 {
614 	size_t ss = CDF_SHORT_SEC_SIZE(h), i, j;
615 	scn->sst_tab = NULL;
616 	scn->sst_len = cdf_count_chain(ssat, sid, CDF_SEC_SIZE(h));
617 	scn->sst_dirlen = len;
618 	scn->sst_ss = ss;
619 
620 	if (scn->sst_len == CAST(size_t, -1))
621 		goto out;
622 
623 	scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
624 	if (scn->sst_tab == NULL)
625 		return cdf_zero_stream(scn);
626 
627 	for (j = i = 0; sid >= 0; i++, j++) {
628 		if (j >= CDF_LOOP_LIMIT) {
629 			DPRINTF(("Read short sector chain loop limit"));
630 			goto out;
631 		}
632 		if (i >= scn->sst_len) {
633 			DPRINTF(("Out of bounds reading short sector chain "
634 			    "%" SIZE_T_FORMAT "u > %" SIZE_T_FORMAT "u\n",
635 			    i, scn->sst_len));
636 			goto out;
637 		}
638 		if (cdf_read_short_sector(sst, scn->sst_tab, i * ss, ss, h,
639 		    sid) != CAST(ssize_t, ss)) {
640 			DPRINTF(("Reading short sector chain %d", sid));
641 			goto out;
642 		}
643 		sid = CDF_TOLE4(CAST(uint32_t, ssat->sat_tab[sid]));
644 	}
645 	return 0;
646 out:
647 	errno = EFTYPE;
648 	return cdf_zero_stream(scn);
649 }
650 
651 int
cdf_read_sector_chain(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,const cdf_sat_t * ssat,const cdf_stream_t * sst,cdf_secid_t sid,size_t len,cdf_stream_t * scn)652 cdf_read_sector_chain(const cdf_info_t *info, const cdf_header_t *h,
653     const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
654     cdf_secid_t sid, size_t len, cdf_stream_t *scn)
655 {
656 
657 	if (len < h->h_min_size_standard_stream && sst->sst_tab != NULL)
658 		return cdf_read_short_sector_chain(h, ssat, sst, sid, len,
659 		    scn);
660 	else
661 		return cdf_read_long_sector_chain(info, h, sat, sid, len, scn);
662 }
663 
664 int
cdf_read_dir(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,cdf_dir_t * dir)665 cdf_read_dir(const cdf_info_t *info, const cdf_header_t *h,
666     const cdf_sat_t *sat, cdf_dir_t *dir)
667 {
668 	size_t i, j;
669 	size_t ss = CDF_SEC_SIZE(h), ns, nd;
670 	char *buf;
671 	cdf_secid_t sid = h->h_secid_first_directory;
672 
673 	ns = cdf_count_chain(sat, sid, ss);
674 	if (ns == CAST(size_t, -1))
675 		return -1;
676 
677 	nd = ss / CDF_DIRECTORY_SIZE;
678 
679 	dir->dir_len = ns * nd;
680 	dir->dir_tab = CAST(cdf_directory_t *,
681 	    CDF_CALLOC(dir->dir_len, sizeof(dir->dir_tab[0])));
682 	if (dir->dir_tab == NULL)
683 		return -1;
684 
685 	if ((buf = CAST(char *, CDF_MALLOC(ss))) == NULL) {
686 		efree(dir->dir_tab);
687 		return -1;
688 	}
689 
690 	for (j = i = 0; i < ns; i++, j++) {
691 		if (j >= CDF_LOOP_LIMIT) {
692 			DPRINTF(("Read dir loop limit"));
693 			goto out;
694 		}
695 		if (cdf_read_sector(info, buf, 0, ss, h, sid) !=
696 		    CAST(ssize_t, ss)) {
697 			DPRINTF(("Reading directory sector %d", sid));
698 			goto out;
699 		}
700 		for (j = 0; j < nd; j++) {
701 			cdf_unpack_dir(&dir->dir_tab[i * nd + j],
702 			    &buf[j * CDF_DIRECTORY_SIZE]);
703 		}
704 		sid = CDF_TOLE4(CAST(uint32_t, sat->sat_tab[sid]));
705 	}
706 	if (NEED_SWAP)
707 		for (i = 0; i < dir->dir_len; i++)
708 			cdf_swap_dir(&dir->dir_tab[i]);
709 	efree(buf);
710 	return 0;
711 out:
712 	efree(dir->dir_tab);
713 	efree(buf);
714 	errno = EFTYPE;
715 	return -1;
716 }
717 
718 
719 int
cdf_read_ssat(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,cdf_sat_t * ssat)720 cdf_read_ssat(const cdf_info_t *info, const cdf_header_t *h,
721     const cdf_sat_t *sat, cdf_sat_t *ssat)
722 {
723 	size_t i, j;
724 	size_t ss = CDF_SEC_SIZE(h);
725 	cdf_secid_t sid = h->h_secid_first_sector_in_short_sat;
726 
727 	ssat->sat_tab = NULL;
728 	ssat->sat_len = cdf_count_chain(sat, sid, ss);
729 	if (ssat->sat_len == CAST(size_t, -1))
730 		goto out;
731 
732 	ssat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(ssat->sat_len, ss));
733 	if (ssat->sat_tab == NULL)
734 		goto out1;
735 
736 	for (j = i = 0; sid >= 0; i++, j++) {
737 		if (j >= CDF_LOOP_LIMIT) {
738 			DPRINTF(("Read short sat sector loop limit"));
739 			goto out;
740 		}
741 		if (i >= ssat->sat_len) {
742 			DPRINTF(("Out of bounds reading short sector chain "
743 			    "%" SIZE_T_FORMAT "u > %" SIZE_T_FORMAT "u\n", i,
744 			    ssat->sat_len));
745 			goto out;
746 		}
747 		if (cdf_read_sector(info, ssat->sat_tab, i * ss, ss, h, sid) !=
748 		    CAST(ssize_t, ss)) {
749 			DPRINTF(("Reading short sat sector %d", sid));
750 			goto out1;
751 		}
752 		sid = CDF_TOLE4(CAST(uint32_t, sat->sat_tab[sid]));
753 	}
754 	return 0;
755 out:
756 	errno = EFTYPE;
757 out1:
758 	efree(ssat->sat_tab);
759 	return -1;
760 }
761 
762 int
cdf_read_short_stream(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,const cdf_dir_t * dir,cdf_stream_t * scn,const cdf_directory_t ** root)763 cdf_read_short_stream(const cdf_info_t *info, const cdf_header_t *h,
764     const cdf_sat_t *sat, const cdf_dir_t *dir, cdf_stream_t *scn,
765     const cdf_directory_t **root)
766 {
767 	size_t i;
768 	const cdf_directory_t *d;
769 
770 	*root = NULL;
771 	for (i = 0; i < dir->dir_len; i++)
772 		if (dir->dir_tab[i].d_type == CDF_DIR_TYPE_ROOT_STORAGE)
773 			break;
774 
775 	/* If the it is not there, just fake it; some docs don't have it */
776 	if (i == dir->dir_len) {
777 		DPRINTF(("Cannot find root storage dir\n"));
778 		goto out;
779 	}
780 	d = &dir->dir_tab[i];
781 	*root = d;
782 
783 	/* If the it is not there, just fake it; some docs don't have it */
784 	if (d->d_stream_first_sector < 0) {
785 		DPRINTF(("No first secror in dir\n"));
786 		goto out;
787 	}
788 
789 	return cdf_read_long_sector_chain(info, h, sat,
790 	    d->d_stream_first_sector, d->d_size, scn);
791 out:
792 	scn->sst_tab = NULL;
793 	(void)cdf_zero_stream(scn);
794 	return 0;
795 }
796 
797 static int
cdf_namecmp(const char * d,const uint16_t * s,size_t l)798 cdf_namecmp(const char *d, const uint16_t *s, size_t l)
799 {
800 	for (; l--; d++, s++)
801 		if (*d != CDF_TOLE2(*s))
802 			return CAST(unsigned char, *d) - CDF_TOLE2(*s);
803 	return 0;
804 }
805 
806 int
cdf_read_doc_summary_info(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,const cdf_sat_t * ssat,const cdf_stream_t * sst,const cdf_dir_t * dir,cdf_stream_t * scn)807 cdf_read_doc_summary_info(const cdf_info_t *info, const cdf_header_t *h,
808     const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
809     const cdf_dir_t *dir, cdf_stream_t *scn)
810 {
811 	return cdf_read_user_stream(info, h, sat, ssat, sst, dir,
812 	    "\05DocumentSummaryInformation", scn);
813 }
814 
815 int
cdf_read_summary_info(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,const cdf_sat_t * ssat,const cdf_stream_t * sst,const cdf_dir_t * dir,cdf_stream_t * scn)816 cdf_read_summary_info(const cdf_info_t *info, const cdf_header_t *h,
817     const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
818     const cdf_dir_t *dir, cdf_stream_t *scn)
819 {
820 	return cdf_read_user_stream(info, h, sat, ssat, sst, dir,
821 	    "\05SummaryInformation", scn);
822 }
823 
824 int
cdf_read_user_stream(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,const cdf_sat_t * ssat,const cdf_stream_t * sst,const cdf_dir_t * dir,const char * name,cdf_stream_t * scn)825 cdf_read_user_stream(const cdf_info_t *info, const cdf_header_t *h,
826     const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
827     const cdf_dir_t *dir, const char *name, cdf_stream_t *scn)
828 {
829 	const cdf_directory_t *d;
830 	int i = cdf_find_stream(dir, name, CDF_DIR_TYPE_USER_STREAM);
831 
832 	if (i <= 0) {
833 		memset(scn, 0, sizeof(*scn));
834 		return -1;
835 	}
836 
837 	d = &dir->dir_tab[i - 1];
838 	return cdf_read_sector_chain(info, h, sat, ssat, sst,
839 	    d->d_stream_first_sector, d->d_size, scn);
840 }
841 
842 int
cdf_find_stream(const cdf_dir_t * dir,const char * name,int type)843 cdf_find_stream(const cdf_dir_t *dir, const char *name, int type)
844 {
845 	size_t i, name_len = strlen(name) + 1;
846 
847 	for (i = dir->dir_len; i > 0; i--)
848 		if (dir->dir_tab[i - 1].d_type == type &&
849 		    cdf_namecmp(name, dir->dir_tab[i - 1].d_name, name_len)
850 		    == 0)
851 			break;
852 	if (i > 0)
853 		return CAST(int, i);
854 
855 	DPRINTF(("Cannot find type %d `%s'\n", type, name));
856 	errno = ESRCH;
857 	return 0;
858 }
859 
860 #define CDF_SHLEN_LIMIT (UINT32_MAX / 64)
861 #define CDF_PROP_LIMIT (UINT32_MAX / (64 * sizeof(cdf_property_info_t)))
862 
863 static const void *
cdf_offset(const void * p,size_t l)864 cdf_offset(const void *p, size_t l)
865 {
866 	return CAST(const void *, CAST(const uint8_t *, p) + l);
867 }
868 
869 static const uint8_t *
cdf_get_property_info_pos(const cdf_stream_t * sst,const cdf_header_t * h,const uint8_t * p,const uint8_t * e,size_t i)870 cdf_get_property_info_pos(const cdf_stream_t *sst, const cdf_header_t *h,
871     const uint8_t *p, const uint8_t *e, size_t i)
872 {
873 	size_t tail = (i << 1) + 1;
874 	size_t ofs;
875 	const uint8_t *q;
876 
877 	if (p >= e) {
878 		DPRINTF(("Past end %p < %p\n", e, p));
879 		return NULL;
880 	}
881 	if (cdf_check_stream_offset(sst, h, p, (tail + 1) * sizeof(uint32_t),
882 	    __LINE__) == -1)
883 		return NULL;
884 	ofs = CDF_GETUINT32(p, tail);
885 	q = CAST(const uint8_t *, cdf_offset(CAST(const void *, p),
886 	    ofs - 2 * sizeof(uint32_t)));
887 
888 	if (q < p) {
889 		DPRINTF(("Wrapped around %p < %p\n", q, p));
890 		return NULL;
891 	}
892 
893 	if (q >= e) {
894 		DPRINTF(("Ran off the end %p >= %p\n", q, e));
895 		return NULL;
896 	}
897 	return q;
898 }
899 
900 static cdf_property_info_t *
cdf_grow_info(cdf_property_info_t ** info,size_t * maxcount,size_t incr)901 cdf_grow_info(cdf_property_info_t **info, size_t *maxcount, size_t incr)
902 {
903 	cdf_property_info_t *inp;
904 	size_t newcount = *maxcount + incr;
905 
906 	if (newcount > CDF_PROP_LIMIT) {
907 		DPRINTF(("exceeded property limit %" SIZE_T_FORMAT "u > %"
908 		    SIZE_T_FORMAT "u\n", newcount, CDF_PROP_LIMIT));
909 		goto out;
910 	}
911 	inp = CAST(cdf_property_info_t *,
912 	    CDF_REALLOC(*info, newcount * sizeof(*inp)));
913 	if (inp == NULL)
914 		goto out;
915 
916 	*info = inp;
917 	*maxcount = newcount;
918 	return inp;
919 out:
920 	efree(*info);
921 	*maxcount = 0;
922 	*info = NULL;
923 	return NULL;
924 }
925 
926 static int
cdf_copy_info(cdf_property_info_t * inp,const void * p,const void * e,size_t len)927 cdf_copy_info(cdf_property_info_t *inp, const void *p, const void *e,
928     size_t len)
929 {
930 	if (inp->pi_type & CDF_VECTOR)
931 		return 0;
932 
933 	if (CAST(size_t, CAST(const char *, e) - CAST(const char *, p)) < len)
934 		return 0;
935 
936 	(void)memcpy(&inp->pi_val, p, len);
937 
938 	switch (len) {
939 	case 2:
940 		inp->pi_u16 = CDF_TOLE2(inp->pi_u16);
941 		break;
942 	case 4:
943 		inp->pi_u32 = CDF_TOLE4(inp->pi_u32);
944 		break;
945 	case 8:
946 		inp->pi_u64 = CDF_TOLE8(inp->pi_u64);
947 		break;
948 	default:
949 		abort();
950 	}
951 	return 1;
952 }
953 
954 int
cdf_read_property_info(const cdf_stream_t * sst,const cdf_header_t * h,uint32_t offs,cdf_property_info_t ** info,size_t * count,size_t * maxcount)955 cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
956     uint32_t offs, cdf_property_info_t **info, size_t *count, size_t *maxcount)
957 {
958 	const cdf_section_header_t *shp;
959 	cdf_section_header_t sh;
960 	const uint8_t *p, *q, *e;
961 	size_t i, o4, nelements, j, slen, left;
962 	cdf_property_info_t *inp;
963 
964 	if (offs > UINT32_MAX / 4) {
965 		errno = EFTYPE;
966 		goto out;
967 	}
968 	shp = CAST(const cdf_section_header_t *,
969 	    cdf_offset(sst->sst_tab, offs));
970 	if (cdf_check_stream_offset(sst, h, shp, sizeof(*shp), __LINE__) == -1)
971 		goto out;
972 	sh.sh_len = CDF_TOLE4(shp->sh_len);
973 	if (sh.sh_len > CDF_SHLEN_LIMIT) {
974 		errno = EFTYPE;
975 		goto out;
976 	}
977 
978 	if (cdf_check_stream_offset(sst, h, shp, sh.sh_len, __LINE__) == -1)
979 		goto out;
980 
981 	sh.sh_properties = CDF_TOLE4(shp->sh_properties);
982 	DPRINTF(("section len: %u properties %u\n", sh.sh_len,
983 	    sh.sh_properties));
984 	if (sh.sh_properties > CDF_PROP_LIMIT)
985 		goto out;
986 	inp = cdf_grow_info(info, maxcount, sh.sh_properties);
987 	if (inp == NULL)
988 		goto out;
989 	inp += *count;
990 	*count += sh.sh_properties;
991 	p = CAST(const uint8_t *, cdf_offset(sst->sst_tab, offs + sizeof(sh)));
992 	e = CAST(const uint8_t *, cdf_offset(shp, sh.sh_len));
993 	if (p >= e || cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
994 		goto out;
995 
996 	for (i = 0; i < sh.sh_properties; i++) {
997 		if ((q = cdf_get_property_info_pos(sst, h, p, e, i)) == NULL)
998 			goto out;
999 		inp[i].pi_id = CDF_GETUINT32(p, i << 1);
1000 		left = CAST(size_t, e - q);
1001 		if (left < sizeof(uint32_t)) {
1002 			DPRINTF(("short info (no type)_\n"));
1003 			goto out;
1004 		}
1005 		inp[i].pi_type = CDF_GETUINT32(q, 0);
1006 		DPRINTF(("%" SIZE_T_FORMAT "u) id=%#x type=%#x offs=%#tx,%#x\n",
1007 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
1008 		if (inp[i].pi_type & CDF_VECTOR) {
1009 			if (left < sizeof(uint32_t) * 2) {
1010 				DPRINTF(("missing CDF_VECTOR length\n"));
1011 				goto out;
1012 			}
1013 			nelements = CDF_GETUINT32(q, 1);
1014 			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
1015 				DPRINTF(("CDF_VECTOR with nelements == %"
1016 				    SIZE_T_FORMAT "u\n", nelements));
1017 				goto out;
1018 			}
1019 			slen = 2;
1020 		} else {
1021 			nelements = 1;
1022 			slen = 1;
1023 		}
1024 		o4 = slen * sizeof(uint32_t);
1025 		if (inp[i].pi_type & (CDF_ARRAY|CDF_BYREF|CDF_RESERVED))
1026 			goto unknown;
1027 		switch (inp[i].pi_type & CDF_TYPEMASK) {
1028 		case CDF_NULL:
1029 		case CDF_EMPTY:
1030 			break;
1031 		case CDF_SIGNED16:
1032 			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int16_t)))
1033 				goto unknown;
1034 			break;
1035 		case CDF_SIGNED32:
1036 		case CDF_BOOL:
1037 		case CDF_UNSIGNED32:
1038 		case CDF_FLOAT:
1039 			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int32_t)))
1040 				goto unknown;
1041 			break;
1042 		case CDF_SIGNED64:
1043 		case CDF_UNSIGNED64:
1044 		case CDF_DOUBLE:
1045 		case CDF_FILETIME:
1046 			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int64_t)))
1047 				goto unknown;
1048 			break;
1049 		case CDF_LENGTH32_STRING:
1050 		case CDF_LENGTH32_WSTRING:
1051 			if (nelements > 1) {
1052 				size_t nelem = inp - *info;
1053 				inp = cdf_grow_info(info, maxcount, nelements);
1054 				if (inp == NULL)
1055 					goto out;
1056 				inp += nelem;
1057 			}
1058 			for (j = 0; j < nelements && i < sh.sh_properties;
1059 			    j++, i++)
1060 			{
1061 				uint32_t l;
1062 
1063 				if (o4 + sizeof(uint32_t) > left)
1064 					goto out;
1065 
1066 				l = CDF_GETUINT32(q, slen);
1067 				o4 += sizeof(uint32_t);
1068 				if (o4 + l > left)
1069 					goto out;
1070 
1071 				inp[i].pi_str.s_len = l;
1072 				inp[i].pi_str.s_buf = CAST(const char *,
1073 				    CAST(const void *, &q[o4]));
1074 
1075 				DPRINTF(("o=%" SIZE_T_FORMAT "u l=%d(%"
1076 				    SIZE_T_FORMAT "u), t=%" SIZE_T_FORMAT
1077 				    "u s=%s\n", o4, l, CDF_ROUND(l, sizeof(l)),
1078 				    left, inp[i].pi_str.s_buf));
1079 
1080 				if (l & 1)
1081 					l++;
1082 
1083 				slen += l >> 1;
1084 				o4 = slen * sizeof(uint32_t);
1085 			}
1086 			i--;
1087 			break;
1088 		case CDF_CLIPBOARD:
1089 			if (inp[i].pi_type & CDF_VECTOR)
1090 				goto unknown;
1091 			break;
1092 		default:
1093 		unknown:
1094 			memset(&inp[i].pi_val, 0, sizeof(inp[i].pi_val));
1095 			DPRINTF(("Don't know how to deal with %#x\n",
1096 			    inp[i].pi_type));
1097 			break;
1098 		}
1099 	}
1100 	return 0;
1101 out:
1102 	efree(*info);
1103 	*info = NULL;
1104 	*count = 0;
1105 	*maxcount = 0;
1106 	errno = EFTYPE;
1107 	return -1;
1108 }
1109 
1110 int
cdf_unpack_summary_info(const cdf_stream_t * sst,const cdf_header_t * h,cdf_summary_info_header_t * ssi,cdf_property_info_t ** info,size_t * count)1111 cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
1112     cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
1113 {
1114 	size_t maxcount;
1115 	const cdf_summary_info_header_t *si =
1116 	    CAST(const cdf_summary_info_header_t *, sst->sst_tab);
1117 	const cdf_section_declaration_t *sd =
1118 	    CAST(const cdf_section_declaration_t *, RCAST(const void *,
1119 	    RCAST(const char *, sst->sst_tab)
1120 	    + CDF_SECTION_DECLARATION_OFFSET));
1121 
1122 	if (cdf_check_stream_offset(sst, h, si, sizeof(*si), __LINE__) == -1 ||
1123 	    cdf_check_stream_offset(sst, h, sd, sizeof(*sd), __LINE__) == -1)
1124 		return -1;
1125 	ssi->si_byte_order = CDF_TOLE2(si->si_byte_order);
1126 	ssi->si_os_version = CDF_TOLE2(si->si_os_version);
1127 	ssi->si_os = CDF_TOLE2(si->si_os);
1128 	ssi->si_class = si->si_class;
1129 	cdf_swap_class(&ssi->si_class);
1130 	ssi->si_count = CDF_TOLE4(si->si_count);
1131 	*count = 0;
1132 	maxcount = 0;
1133 	*info = NULL;
1134 	if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
1135 	    count, &maxcount) == -1)
1136 		return -1;
1137 	return 0;
1138 }
1139 
1140 
1141 #define extract_catalog_field(t, f, l) \
1142     if (b + l + sizeof(cep->f) > eb) { \
1143 	    cep->ce_namlen = 0; \
1144 	    break; \
1145     } \
1146     memcpy(&cep->f, b + (l), sizeof(cep->f)); \
1147     ce[i].f = CAST(t, CDF_TOLE(cep->f))
1148 
1149 int
cdf_unpack_catalog(const cdf_header_t * h,const cdf_stream_t * sst,cdf_catalog_t ** cat)1150 cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
1151     cdf_catalog_t **cat)
1152 {
1153 	size_t ss = cdf_check_stream(sst, h);
1154 	const char *b = CAST(const char *, sst->sst_tab);
1155 	const char *nb, *eb = b + ss * sst->sst_len;
1156 	size_t nr, i, j, k;
1157 	cdf_catalog_entry_t *ce;
1158 	uint16_t reclen;
1159 	const uint16_t *np;
1160 
1161 	for (nr = 0;; nr++) {
1162 		memcpy(&reclen, b, sizeof(reclen));
1163 		reclen = CDF_TOLE2(reclen);
1164 		if (reclen == 0)
1165 			break;
1166 		b += reclen;
1167 		if (b > eb)
1168 		    break;
1169 	}
1170 	if (nr == 0)
1171 		return -1;
1172 	nr--;
1173 	*cat = CAST(cdf_catalog_t *,
1174 	    CDF_MALLOC(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
1175 	if (*cat == NULL)
1176 		return -1;
1177 	ce = (*cat)->cat_e;
1178 	memset(ce, 0, nr * sizeof(*ce));
1179 	b = CAST(const char *, sst->sst_tab);
1180 	for (j = i = 0; i < nr; b += reclen) {
1181 		cdf_catalog_entry_t *cep = &ce[j];
1182 		uint16_t rlen;
1183 
1184 		extract_catalog_field(uint16_t, ce_namlen, 0);
1185 		extract_catalog_field(uint16_t, ce_num, 4);
1186 		extract_catalog_field(uint64_t, ce_timestamp, 8);
1187 		reclen = cep->ce_namlen;
1188 
1189 		if (reclen < 14) {
1190 			cep->ce_namlen = 0;
1191 			continue;
1192 		}
1193 
1194 		cep->ce_namlen = __arraycount(cep->ce_name) - 1;
1195 		rlen = reclen - 14;
1196 		if (cep->ce_namlen > rlen)
1197 			cep->ce_namlen = rlen;
1198 
1199 		np = CAST(const uint16_t *, CAST(const void *, (b + 16)));
1200 		nb = CAST(const char *, CAST(const void *,
1201 		    (np + cep->ce_namlen)));
1202 		if (nb > eb) {
1203 			cep->ce_namlen = 0;
1204 			break;
1205 		}
1206 
1207 		for (k = 0; k < cep->ce_namlen; k++)
1208 			cep->ce_name[k] = np[k]; /* XXX: CDF_TOLE2? */
1209 		cep->ce_name[cep->ce_namlen] = 0;
1210 		j = i;
1211 		i++;
1212 	}
1213 	(*cat)->cat_num = j;
1214 	return 0;
1215 }
1216 
1217 int
cdf_print_classid(char * buf,size_t buflen,const cdf_classid_t * id)1218 cdf_print_classid(char *buf, size_t buflen, const cdf_classid_t *id)
1219 {
1220 	return snprintf(buf, buflen, "%.8x-%.4x-%.4x-%.2x%.2x-"
1221 	    "%.2x%.2x%.2x%.2x%.2x%.2x", id->cl_dword, id->cl_word[0],
1222 	    id->cl_word[1], id->cl_two[0], id->cl_two[1], id->cl_six[0],
1223 	    id->cl_six[1], id->cl_six[2], id->cl_six[3], id->cl_six[4],
1224 	    id->cl_six[5]);
1225 }
1226 
1227 static const struct {
1228 	uint32_t v;
1229 	const char *n;
1230 } vn[] = {
1231 	{ CDF_PROPERTY_CODE_PAGE, "Code page" },
1232 	{ CDF_PROPERTY_TITLE, "Title" },
1233 	{ CDF_PROPERTY_SUBJECT, "Subject" },
1234 	{ CDF_PROPERTY_AUTHOR, "Author" },
1235 	{ CDF_PROPERTY_KEYWORDS, "Keywords" },
1236 	{ CDF_PROPERTY_COMMENTS, "Comments" },
1237 	{ CDF_PROPERTY_TEMPLATE, "Template" },
1238 	{ CDF_PROPERTY_LAST_SAVED_BY, "Last Saved By" },
1239 	{ CDF_PROPERTY_REVISION_NUMBER, "Revision Number" },
1240 	{ CDF_PROPERTY_TOTAL_EDITING_TIME, "Total Editing Time" },
1241 	{ CDF_PROPERTY_LAST_PRINTED, "Last Printed" },
1242 	{ CDF_PROPERTY_CREATE_TIME, "Create Time/Date" },
1243 	{ CDF_PROPERTY_LAST_SAVED_TIME, "Last Saved Time/Date" },
1244 	{ CDF_PROPERTY_NUMBER_OF_PAGES, "Number of Pages" },
1245 	{ CDF_PROPERTY_NUMBER_OF_WORDS, "Number of Words" },
1246 	{ CDF_PROPERTY_NUMBER_OF_CHARACTERS, "Number of Characters" },
1247 	{ CDF_PROPERTY_THUMBNAIL, "Thumbnail" },
1248 	{ CDF_PROPERTY_NAME_OF_APPLICATION, "Name of Creating Application" },
1249 	{ CDF_PROPERTY_SECURITY, "Security" },
1250 	{ CDF_PROPERTY_LOCALE_ID, "Locale ID" },
1251 };
1252 
1253 int
cdf_print_property_name(char * buf,size_t bufsiz,uint32_t p)1254 cdf_print_property_name(char *buf, size_t bufsiz, uint32_t p)
1255 {
1256 	size_t i;
1257 
1258 	for (i = 0; i < __arraycount(vn); i++)
1259 		if (vn[i].v == p)
1260 			return snprintf(buf, bufsiz, "%s", vn[i].n);
1261 	return snprintf(buf, bufsiz, "%#x", p);
1262 }
1263 
1264 int
cdf_print_elapsed_time(char * buf,size_t bufsiz,cdf_timestamp_t ts)1265 cdf_print_elapsed_time(char *buf, size_t bufsiz, cdf_timestamp_t ts)
1266 {
1267 	int len = 0;
1268 	int days, hours, mins, secs;
1269 
1270 	ts /= CDF_TIME_PREC;
1271 	secs = CAST(int, ts % 60);
1272 	ts /= 60;
1273 	mins = CAST(int, ts % 60);
1274 	ts /= 60;
1275 	hours = CAST(int, ts % 24);
1276 	ts /= 24;
1277 	days = CAST(int, ts);
1278 
1279 	if (days) {
1280 		len += snprintf(buf + len, bufsiz - len, "%dd+", days);
1281 		if (CAST(size_t, len) >= bufsiz)
1282 			return len;
1283 	}
1284 
1285 	if (days || hours) {
1286 		len += snprintf(buf + len, bufsiz - len, "%.2d:", hours);
1287 		if (CAST(size_t, len) >= bufsiz)
1288 			return len;
1289 	}
1290 
1291 	len += snprintf(buf + len, bufsiz - len, "%.2d:", mins);
1292 	if (CAST(size_t, len) >= bufsiz)
1293 		return len;
1294 
1295 	len += snprintf(buf + len, bufsiz - len, "%.2d", secs);
1296 	return len;
1297 }
1298 
1299 char *
cdf_u16tos8(char * buf,size_t len,const uint16_t * p)1300 cdf_u16tos8(char *buf, size_t len, const uint16_t *p)
1301 {
1302 	size_t i;
1303 	for (i = 0; i < len && p[i]; i++)
1304 		buf[i] = CAST(char, p[i]);
1305 	buf[i] = '\0';
1306 	return buf;
1307 }
1308 
1309 #ifdef CDF_DEBUG
1310 void
cdf_dump_header(const cdf_header_t * h)1311 cdf_dump_header(const cdf_header_t *h)
1312 {
1313 	size_t i;
1314 
1315 #define DUMP(a, b) (void)fprintf(stderr, "%40.40s = " a "\n", # b, h->h_ ## b)
1316 #define DUMP2(a, b) (void)fprintf(stderr, "%40.40s = " a " (" a ")\n", # b, \
1317     h->h_ ## b, 1 << h->h_ ## b)
1318 	DUMP("%d", revision);
1319 	DUMP("%d", version);
1320 	DUMP("%#x", byte_order);
1321 	DUMP2("%d", sec_size_p2);
1322 	DUMP2("%d", short_sec_size_p2);
1323 	DUMP("%d", num_sectors_in_sat);
1324 	DUMP("%d", secid_first_directory);
1325 	DUMP("%d", min_size_standard_stream);
1326 	DUMP("%d", secid_first_sector_in_short_sat);
1327 	DUMP("%d", num_sectors_in_short_sat);
1328 	DUMP("%d", secid_first_sector_in_master_sat);
1329 	DUMP("%d", num_sectors_in_master_sat);
1330 	for (i = 0; i < __arraycount(h->h_master_sat); i++) {
1331 		if (h->h_master_sat[i] == CDF_SECID_FREE)
1332 			break;
1333 		(void)fprintf(stderr, "%35.35s[%.3" SIZE_T_FORMAT "u] = %d\n",
1334 		    "master_sat", i, h->h_master_sat[i]);
1335 	}
1336 }
1337 
1338 void
cdf_dump_sat(const char * prefix,const cdf_sat_t * sat,size_t size)1339 cdf_dump_sat(const char *prefix, const cdf_sat_t *sat, size_t size)
1340 {
1341 	size_t i, j, s = size / sizeof(cdf_secid_t);
1342 
1343 	for (i = 0; i < sat->sat_len; i++) {
1344 		(void)fprintf(stderr, "%s[%" SIZE_T_FORMAT "u]:\n%.6"
1345 		    SIZE_T_FORMAT "u: ", prefix, i, i * s);
1346 		for (j = 0; j < s; j++) {
1347 			(void)fprintf(stderr, "%5d, ",
1348 			    CDF_TOLE4(sat->sat_tab[s * i + j]));
1349 			if ((j + 1) % 10 == 0)
1350 				(void)fprintf(stderr, "\n%.6" SIZE_T_FORMAT
1351 				    "u: ", i * s + j + 1);
1352 		}
1353 		(void)fprintf(stderr, "\n");
1354 	}
1355 }
1356 
1357 void
cdf_dump(const void * v,size_t len)1358 cdf_dump(const void *v, size_t len)
1359 {
1360 	size_t i, j;
1361 	const unsigned char *p = v;
1362 	char abuf[16];
1363 
1364 	(void)fprintf(stderr, "%.4x: ", 0);
1365 	for (i = 0, j = 0; i < len; i++, p++) {
1366 		(void)fprintf(stderr, "%.2x ", *p);
1367 		abuf[j++] = isprint(*p) ? *p : '.';
1368 		if (j == 16) {
1369 			j = 0;
1370 			abuf[15] = '\0';
1371 			(void)fprintf(stderr, "%s\n%.4" SIZE_T_FORMAT "x: ",
1372 			    abuf, i + 1);
1373 		}
1374 	}
1375 	(void)fprintf(stderr, "\n");
1376 }
1377 
1378 void
cdf_dump_stream(const cdf_stream_t * sst)1379 cdf_dump_stream(const cdf_stream_t *sst)
1380 {
1381 	size_t ss = sst->sst_ss;
1382 	cdf_dump(sst->sst_tab, ss * sst->sst_len);
1383 }
1384 
1385 void
cdf_dump_dir(const cdf_info_t * info,const cdf_header_t * h,const cdf_sat_t * sat,const cdf_sat_t * ssat,const cdf_stream_t * sst,const cdf_dir_t * dir)1386 cdf_dump_dir(const cdf_info_t *info, const cdf_header_t *h,
1387     const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
1388     const cdf_dir_t *dir)
1389 {
1390 	size_t i, j;
1391 	cdf_directory_t *d;
1392 	char name[__arraycount(d->d_name)];
1393 	cdf_stream_t scn;
1394 	struct timeval ts;
1395 
1396 	static const char *types[] = { "empty", "user storage",
1397 	    "user stream", "lockbytes", "property", "root storage" };
1398 
1399 	for (i = 0; i < dir->dir_len; i++) {
1400 		char buf[26];
1401 		d = &dir->dir_tab[i];
1402 		for (j = 0; j < sizeof(name); j++)
1403 			name[j] = (char)CDF_TOLE2(d->d_name[j]);
1404 		(void)fprintf(stderr, "Directory %" SIZE_T_FORMAT "u: %s\n",
1405 		    i, name);
1406 		if (d->d_type < __arraycount(types))
1407 			(void)fprintf(stderr, "Type: %s\n", types[d->d_type]);
1408 		else
1409 			(void)fprintf(stderr, "Type: %d\n", d->d_type);
1410 		(void)fprintf(stderr, "Color: %s\n",
1411 		    d->d_color ? "black" : "red");
1412 		(void)fprintf(stderr, "Left child: %d\n", d->d_left_child);
1413 		(void)fprintf(stderr, "Right child: %d\n", d->d_right_child);
1414 		(void)fprintf(stderr, "Flags: %#x\n", d->d_flags);
1415 		cdf_timestamp_to_timespec(&ts, d->d_created);
1416 		(void)fprintf(stderr, "Created %s", cdf_ctime(&ts.tv_sec, buf));
1417 		cdf_timestamp_to_timespec(&ts, d->d_modified);
1418 		(void)fprintf(stderr, "Modified %s",
1419 		    cdf_ctime(&ts.tv_sec, buf));
1420 		(void)fprintf(stderr, "Stream %d\n", d->d_stream_first_sector);
1421 		(void)fprintf(stderr, "Size %d\n", d->d_size);
1422 		switch (d->d_type) {
1423 		case CDF_DIR_TYPE_USER_STORAGE:
1424 			(void)fprintf(stderr, "Storage: %d\n", d->d_storage);
1425 			break;
1426 		case CDF_DIR_TYPE_USER_STREAM:
1427 			if (sst == NULL)
1428 				break;
1429 			if (cdf_read_sector_chain(info, h, sat, ssat, sst,
1430 			    d->d_stream_first_sector, d->d_size, &scn) == -1) {
1431 				warn("Can't read stream for %s at %d len %d",
1432 				    name, d->d_stream_first_sector, d->d_size);
1433 				break;
1434 			}
1435 			cdf_dump_stream(&scn);
1436 			efree(scn.sst_tab);
1437 			break;
1438 		default:
1439 			break;
1440 		}
1441 
1442 	}
1443 }
1444 
1445 void
cdf_dump_property_info(const cdf_property_info_t * info,size_t count)1446 cdf_dump_property_info(const cdf_property_info_t *info, size_t count)
1447 {
1448 	cdf_timestamp_t tp;
1449 	struct timeval ts;
1450 	char buf[64];
1451 	size_t i, j;
1452 
1453 	for (i = 0; i < count; i++) {
1454 		cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
1455 		(void)fprintf(stderr, "%" SIZE_T_FORMAT "u) %s: ", i, buf);
1456 		switch (info[i].pi_type) {
1457 		case CDF_NULL:
1458 			break;
1459 		case CDF_SIGNED16:
1460 			(void)fprintf(stderr, "signed 16 [%hd]\n",
1461 			    info[i].pi_s16);
1462 			break;
1463 		case CDF_SIGNED32:
1464 			(void)fprintf(stderr, "signed 32 [%d]\n",
1465 			    info[i].pi_s32);
1466 			break;
1467 		case CDF_UNSIGNED32:
1468 			(void)fprintf(stderr, "unsigned 32 [%u]\n",
1469 			    info[i].pi_u32);
1470 			break;
1471 		case CDF_FLOAT:
1472 			(void)fprintf(stderr, "float [%g]\n",
1473 			    info[i].pi_f);
1474 			break;
1475 		case CDF_DOUBLE:
1476 			(void)fprintf(stderr, "double [%g]\n",
1477 			    info[i].pi_d);
1478 			break;
1479 		case CDF_LENGTH32_STRING:
1480 			(void)fprintf(stderr, "string %u [%.*s]\n",
1481 			    info[i].pi_str.s_len,
1482 			    info[i].pi_str.s_len, info[i].pi_str.s_buf);
1483 			break;
1484 		case CDF_LENGTH32_WSTRING:
1485 			(void)fprintf(stderr, "string %u [",
1486 			    info[i].pi_str.s_len);
1487 			for (j = 0; j < info[i].pi_str.s_len - 1; j++)
1488 			    (void)fputc(info[i].pi_str.s_buf[j << 1], stderr);
1489 			(void)fprintf(stderr, "]\n");
1490 			break;
1491 		case CDF_FILETIME:
1492 			tp = info[i].pi_tp;
1493 			if (tp < 1000000000000000LL) {
1494 				cdf_print_elapsed_time(buf, sizeof(buf), tp);
1495 				(void)fprintf(stderr, "timestamp %s\n", buf);
1496 			} else {
1497 				char tbuf[26];
1498 				cdf_timestamp_to_timespec(&ts, tp);
1499 				(void)fprintf(stderr, "timestamp %s",
1500 				    cdf_ctime(&ts.tv_sec, tbuf));
1501 			}
1502 			break;
1503 		case CDF_CLIPBOARD:
1504 			(void)fprintf(stderr, "CLIPBOARD %u\n", info[i].pi_u32);
1505 			break;
1506 		default:
1507 			DPRINTF(("Don't know how to deal with %#x\n",
1508 			    info[i].pi_type));
1509 			break;
1510 		}
1511 	}
1512 }
1513 
1514 
1515 void
cdf_dump_summary_info(const cdf_header_t * h,const cdf_stream_t * sst)1516 cdf_dump_summary_info(const cdf_header_t *h, const cdf_stream_t *sst)
1517 {
1518 	char buf[128];
1519 	cdf_summary_info_header_t ssi;
1520 	cdf_property_info_t *info;
1521 	size_t count;
1522 
1523 	(void)&h;
1524 	if (cdf_unpack_summary_info(sst, h, &ssi, &info, &count) == -1)
1525 		return;
1526 	(void)fprintf(stderr, "Endian: %#x\n", ssi.si_byte_order);
1527 	(void)fprintf(stderr, "Os Version %d.%d\n", ssi.si_os_version & 0xff,
1528 	    ssi.si_os_version >> 8);
1529 	(void)fprintf(stderr, "Os %d\n", ssi.si_os);
1530 	cdf_print_classid(buf, sizeof(buf), &ssi.si_class);
1531 	(void)fprintf(stderr, "Class %s\n", buf);
1532 	(void)fprintf(stderr, "Count %d\n", ssi.si_count);
1533 	cdf_dump_property_info(info, count);
1534 	efree(info);
1535 }
1536 
1537 
1538 void
cdf_dump_catalog(const cdf_header_t * h,const cdf_stream_t * sst)1539 cdf_dump_catalog(const cdf_header_t *h, const cdf_stream_t *sst)
1540 {
1541 	cdf_catalog_t *cat;
1542 	cdf_unpack_catalog(h, sst, &cat);
1543 	const cdf_catalog_entry_t *ce = cat->cat_e;
1544 	struct timespec ts;
1545 	char tbuf[64], sbuf[256];
1546 	size_t i;
1547 
1548 	printf("Catalog:\n");
1549 	for (i = 0; i < cat->cat_num; i++) {
1550 		cdf_timestamp_to_timespec(&ts, ce[i].ce_timestamp);
1551 		printf("\t%d %s %s", ce[i].ce_num,
1552 		    cdf_u16tos8(sbuf, ce[i].ce_namlen, ce[i].ce_name),
1553 		    cdf_ctime(&ts.tv_sec, tbuf));
1554 	}
1555 	efree(cat);
1556 }
1557 
1558 #endif
1559 
1560 #ifdef TEST
1561 int
main(int argc,char * argv[])1562 main(int argc, char *argv[])
1563 {
1564 	int i;
1565 	cdf_header_t h;
1566 	cdf_sat_t sat, ssat;
1567 	cdf_stream_t sst, scn;
1568 	cdf_dir_t dir;
1569 	cdf_info_t info;
1570 	const cdf_directory_t *root;
1571 #ifdef __linux__
1572 #define getprogname() __progname
1573 	extern char *__progname;
1574 #endif
1575 	if (argc < 2) {
1576 		(void)fprintf(stderr, "Usage: %s <filename>\n", getprogname());
1577 		return -1;
1578 	}
1579 
1580 	info.i_buf = NULL;
1581 	info.i_len = 0;
1582 	for (i = 1; i < argc; i++) {
1583 		if ((info.i_fd = open(argv[1], O_RDONLY)) == -1)
1584 			err(EXIT_FAILURE, "Cannot open `%s'", argv[1]);
1585 
1586 		if (cdf_read_header(&info, &h) == -1)
1587 			err(EXIT_FAILURE, "Cannot read header");
1588 #ifdef CDF_DEBUG
1589 		cdf_dump_header(&h);
1590 #endif
1591 
1592 		if (cdf_read_sat(&info, &h, &sat) == -1)
1593 			err(EXIT_FAILURE, "Cannot read sat");
1594 #ifdef CDF_DEBUG
1595 		cdf_dump_sat("SAT", &sat, CDF_SEC_SIZE(&h));
1596 #endif
1597 
1598 		if (cdf_read_ssat(&info, &h, &sat, &ssat) == -1)
1599 			err(EXIT_FAILURE, "Cannot read ssat");
1600 #ifdef CDF_DEBUG
1601 		cdf_dump_sat("SSAT", &ssat, CDF_SHORT_SEC_SIZE(&h));
1602 #endif
1603 
1604 		if (cdf_read_dir(&info, &h, &sat, &dir) == -1)
1605 			err(EXIT_FAILURE, "Cannot read dir");
1606 
1607 		if (cdf_read_short_stream(&info, &h, &sat, &dir, &sst, &root)
1608 		    == -1)
1609 			err(EXIT_FAILURE, "Cannot read short stream");
1610 #ifdef CDF_DEBUG
1611 		cdf_dump_stream(&sst);
1612 #endif
1613 
1614 #ifdef CDF_DEBUG
1615 		cdf_dump_dir(&info, &h, &sat, &ssat, &sst, &dir);
1616 #endif
1617 
1618 
1619 		if (cdf_read_summary_info(&info, &h, &sat, &ssat, &sst, &dir,
1620 		    &scn) == -1)
1621 			warn("Cannot read summary info");
1622 #ifdef CDF_DEBUG
1623 		else
1624 			cdf_dump_summary_info(&h, &scn);
1625 #endif
1626 		if (cdf_read_user_stream(&info, &h, &sat, &ssat, &sst,
1627 		    &dir, "Catalog", &scn) == -1)
1628 			warn("Cannot read catalog");
1629 #ifdef CDF_DEBUG
1630 		else
1631 			cdf_dump_catalog(&h, &scn);
1632 #endif
1633 
1634 		(void)close(info.i_fd);
1635 	}
1636 
1637 	return 0;
1638 }
1639 #endif
1640