1 /*
2 * Copyright (c) Ian F. Darwin 1986-1995.
3 * Software written by Ian F. Darwin and others;
4 * maintained 1995-present by Christos Zoulas and others.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice immediately at the beginning of the file, without modification,
11 * this list of conditions, and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
20 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28 /*
29 * apprentice - make one pass through /etc/magic, learning its secrets.
30 */
31
32 #include "php.h"
33
34 #include "file.h"
35
36 #ifndef lint
37 FILE_RCSID("@(#)$File: apprentice.c,v 1.301 2021/02/23 00:51:11 christos Exp $")
38 #endif /* lint */
39
40 #include "magic.h"
41 #include <stdlib.h>
42
43 #if defined(__hpux) && !defined(HAVE_STRTOULL)
44 #if SIZEOF_LONG == 8
45 # define strtoull strtoul
46 #else
47 # define strtoull __strtoull
48 #endif
49 #endif
50
51 #ifdef PHP_WIN32
52 #include "win32/unistd.h"
53 #define strtoull _strtoui64
54 #else
55 #ifdef HAVE_UNISTD_H
56 #include <unistd.h>
57 #endif
58 #endif
59 #include <string.h>
60 #include <assert.h>
61 #include <ctype.h>
62 #include <fcntl.h>
63
64 #ifndef SSIZE_MAX
65 #define MAXMAGIC_SIZE ((ssize_t)0x7fffffff)
66 #else
67 #define MAXMAGIC_SIZE SSIZE_MAX
68 #endif
69
70
71 #define EATAB {while (isascii(CAST(unsigned char, *l)) && \
72 isspace(CAST(unsigned char, *l))) ++l;}
73 #define LOWCASE(l) (isupper(CAST(unsigned char, l)) ? \
74 tolower(CAST(unsigned char, l)) : (l))
75 /*
76 * Work around a bug in headers on Digital Unix.
77 * At least confirmed for: OSF1 V4.0 878
78 */
79 #if defined(__osf__) && defined(__DECC)
80 #ifdef MAP_FAILED
81 #undef MAP_FAILED
82 #endif
83 #endif
84
85 #ifndef offsetof
86 #define offsetof(STRUCTURE,FIELD) ((int)((char*)&((STRUCTURE*)0)->FIELD))
87 #endif
88
89 #ifndef MAP_FAILED
90 #define MAP_FAILED (void *) -1
91 #endif
92
93 #ifndef MAP_FILE
94 #define MAP_FILE 0
95 #endif
96
97 #define ALLOC_CHUNK CAST(size_t, 10)
98 #define ALLOC_INCR CAST(size_t, 200)
99
100 #define MAP_TYPE_USER 0
101 #define MAP_TYPE_MALLOC 1
102 #define MAP_TYPE_MMAP 2
103
104 struct magic_entry {
105 struct magic *mp;
106 uint32_t cont_count;
107 uint32_t max_count;
108 };
109
110 struct magic_entry_set {
111 struct magic_entry *me;
112 uint32_t count;
113 uint32_t max;
114 };
115
116 struct magic_map {
117 void *p;
118 size_t len;
119 int type;
120 struct magic *magic[MAGIC_SETS];
121 uint32_t nmagic[MAGIC_SETS];
122 };
123
124 int file_formats[FILE_NAMES_SIZE];
125 const size_t file_nformats = FILE_NAMES_SIZE;
126 const char *file_names[FILE_NAMES_SIZE];
127 const size_t file_nnames = FILE_NAMES_SIZE;
128
129 private int getvalue(struct magic_set *ms, struct magic *, const char **, int);
130 private int hextoint(int);
131 private const char *getstr(struct magic_set *, struct magic *, const char *,
132 int);
133 private int parse(struct magic_set *, struct magic_entry *, const char *,
134 size_t, int);
135 private void eatsize(const char **);
136 private int apprentice_1(struct magic_set *, const char *, int);
137 private size_t apprentice_magic_strength(const struct magic *);
138 private int apprentice_sort(const void *, const void *);
139 private void apprentice_list(struct mlist *, int );
140 private struct magic_map *apprentice_load(struct magic_set *,
141 const char *, int);
142 private struct mlist *mlist_alloc(void);
143 private void mlist_free_all(struct magic_set *);
144 private void mlist_free(struct mlist *);
145 private void byteswap(struct magic *, uint32_t);
146 private void bs1(struct magic *);
147 private uint16_t swap2(uint16_t);
148 private uint32_t swap4(uint32_t);
149 private uint64_t swap8(uint64_t);
150 private char *mkdbname(struct magic_set *, const char *, int);
151 private struct magic_map *apprentice_map(struct magic_set *, const char *);
152 private void apprentice_unmap(struct magic_map *);
153 private int apprentice_compile(struct magic_set *, struct magic_map *,
154 const char *);
155 private int check_format_type(const char *, int, const char **);
156 private int check_format(struct magic_set *, struct magic *);
157 private int get_op(char);
158 private int parse_mime(struct magic_set *, struct magic_entry *, const char *,
159 size_t);
160 private int parse_strength(struct magic_set *, struct magic_entry *,
161 const char *, size_t);
162 private int parse_apple(struct magic_set *, struct magic_entry *, const char *,
163 size_t);
164 private int parse_ext(struct magic_set *, struct magic_entry *, const char *,
165 size_t);
166
167
168 private size_t magicsize = sizeof(struct magic);
169
170 private const char usg_hdr[] = "cont\toffset\ttype\topcode\tmask\tvalue\tdesc";
171
172 private struct {
173 const char *name;
174 size_t len;
175 int (*fun)(struct magic_set *, struct magic_entry *, const char *,
176 size_t);
177 } bang[] = {
178 #define DECLARE_FIELD(name) { # name, sizeof(# name) - 1, parse_ ## name }
179 DECLARE_FIELD(mime),
180 DECLARE_FIELD(apple),
181 DECLARE_FIELD(ext),
182 DECLARE_FIELD(strength),
183 #undef DECLARE_FIELD
184 { NULL, 0, NULL }
185 };
186
187 #include "../data_file.c"
188
189 struct type_tbl_s {
190 const char name[16];
191 const size_t len;
192 const int type;
193 const int format;
194 };
195
196 /*
197 * XXX - the actual Single UNIX Specification says that "long" means "long",
198 * as in the C data type, but we treat it as meaning "4-byte integer".
199 * Given that the OS X version of file 5.04 did the same, I guess that passes
200 * the actual test; having "long" be dependent on how big a "long" is on
201 * the machine running "file" is silly.
202 */
203 static const struct type_tbl_s type_tbl[] = {
204 # define XX(s) s, (sizeof(s) - 1)
205 # define XX_NULL "", 0
206 { XX("invalid"), FILE_INVALID, FILE_FMT_NONE },
207 { XX("byte"), FILE_BYTE, FILE_FMT_NUM },
208 { XX("short"), FILE_SHORT, FILE_FMT_NUM },
209 { XX("default"), FILE_DEFAULT, FILE_FMT_NONE },
210 { XX("long"), FILE_LONG, FILE_FMT_NUM },
211 { XX("string"), FILE_STRING, FILE_FMT_STR },
212 { XX("date"), FILE_DATE, FILE_FMT_STR },
213 { XX("beshort"), FILE_BESHORT, FILE_FMT_NUM },
214 { XX("belong"), FILE_BELONG, FILE_FMT_NUM },
215 { XX("bedate"), FILE_BEDATE, FILE_FMT_STR },
216 { XX("leshort"), FILE_LESHORT, FILE_FMT_NUM },
217 { XX("lelong"), FILE_LELONG, FILE_FMT_NUM },
218 { XX("ledate"), FILE_LEDATE, FILE_FMT_STR },
219 { XX("pstring"), FILE_PSTRING, FILE_FMT_STR },
220 { XX("ldate"), FILE_LDATE, FILE_FMT_STR },
221 { XX("beldate"), FILE_BELDATE, FILE_FMT_STR },
222 { XX("leldate"), FILE_LELDATE, FILE_FMT_STR },
223 { XX("regex"), FILE_REGEX, FILE_FMT_STR },
224 { XX("bestring16"), FILE_BESTRING16, FILE_FMT_STR },
225 { XX("lestring16"), FILE_LESTRING16, FILE_FMT_STR },
226 { XX("search"), FILE_SEARCH, FILE_FMT_STR },
227 { XX("medate"), FILE_MEDATE, FILE_FMT_STR },
228 { XX("meldate"), FILE_MELDATE, FILE_FMT_STR },
229 { XX("melong"), FILE_MELONG, FILE_FMT_NUM },
230 { XX("quad"), FILE_QUAD, FILE_FMT_QUAD },
231 { XX("lequad"), FILE_LEQUAD, FILE_FMT_QUAD },
232 { XX("bequad"), FILE_BEQUAD, FILE_FMT_QUAD },
233 { XX("qdate"), FILE_QDATE, FILE_FMT_STR },
234 { XX("leqdate"), FILE_LEQDATE, FILE_FMT_STR },
235 { XX("beqdate"), FILE_BEQDATE, FILE_FMT_STR },
236 { XX("qldate"), FILE_QLDATE, FILE_FMT_STR },
237 { XX("leqldate"), FILE_LEQLDATE, FILE_FMT_STR },
238 { XX("beqldate"), FILE_BEQLDATE, FILE_FMT_STR },
239 { XX("float"), FILE_FLOAT, FILE_FMT_FLOAT },
240 { XX("befloat"), FILE_BEFLOAT, FILE_FMT_FLOAT },
241 { XX("lefloat"), FILE_LEFLOAT, FILE_FMT_FLOAT },
242 { XX("double"), FILE_DOUBLE, FILE_FMT_DOUBLE },
243 { XX("bedouble"), FILE_BEDOUBLE, FILE_FMT_DOUBLE },
244 { XX("ledouble"), FILE_LEDOUBLE, FILE_FMT_DOUBLE },
245 { XX("leid3"), FILE_LEID3, FILE_FMT_NUM },
246 { XX("beid3"), FILE_BEID3, FILE_FMT_NUM },
247 { XX("indirect"), FILE_INDIRECT, FILE_FMT_NUM },
248 { XX("qwdate"), FILE_QWDATE, FILE_FMT_STR },
249 { XX("leqwdate"), FILE_LEQWDATE, FILE_FMT_STR },
250 { XX("beqwdate"), FILE_BEQWDATE, FILE_FMT_STR },
251 { XX("name"), FILE_NAME, FILE_FMT_NONE },
252 { XX("use"), FILE_USE, FILE_FMT_NONE },
253 { XX("clear"), FILE_CLEAR, FILE_FMT_NONE },
254 { XX("der"), FILE_DER, FILE_FMT_STR },
255 { XX("guid"), FILE_GUID, FILE_FMT_STR },
256 { XX("offset"), FILE_OFFSET, FILE_FMT_QUAD },
257 { XX_NULL, FILE_INVALID, FILE_FMT_NONE },
258 };
259
260 /*
261 * These are not types, and cannot be preceded by "u" to make them
262 * unsigned.
263 */
264 static const struct type_tbl_s special_tbl[] = {
265 { XX("der"), FILE_DER, FILE_FMT_STR },
266 { XX("name"), FILE_NAME, FILE_FMT_STR },
267 { XX("use"), FILE_USE, FILE_FMT_STR },
268 { XX_NULL, FILE_INVALID, FILE_FMT_NONE },
269 };
270 # undef XX
271 # undef XX_NULL
272
273 private int
get_type(const struct type_tbl_s * tbl,const char * l,const char ** t)274 get_type(const struct type_tbl_s *tbl, const char *l, const char **t)
275 {
276 const struct type_tbl_s *p;
277
278 for (p = tbl; p->len; p++) {
279 if (strncmp(l, p->name, p->len) == 0) {
280 if (t)
281 *t = l + p->len;
282 break;
283 }
284 }
285 return p->type;
286 }
287
288 private off_t
maxoff_t(void)289 maxoff_t(void) {
290 if (/*CONSTCOND*/sizeof(off_t) == sizeof(int))
291 return CAST(off_t, INT_MAX);
292 if (/*CONSTCOND*/sizeof(off_t) == sizeof(long))
293 return CAST(off_t, LONG_MAX);
294 return 0x7fffffff;
295 }
296
297 private int
get_standard_integer_type(const char * l,const char ** t)298 get_standard_integer_type(const char *l, const char **t)
299 {
300 int type;
301
302 if (isalpha(CAST(unsigned char, l[1]))) {
303 switch (l[1]) {
304 case 'C':
305 /* "dC" and "uC" */
306 type = FILE_BYTE;
307 break;
308 case 'S':
309 /* "dS" and "uS" */
310 type = FILE_SHORT;
311 break;
312 case 'I':
313 case 'L':
314 /*
315 * "dI", "dL", "uI", and "uL".
316 *
317 * XXX - the actual Single UNIX Specification says
318 * that "L" means "long", as in the C data type,
319 * but we treat it as meaning "4-byte integer".
320 * Given that the OS X version of file 5.04 did
321 * the same, I guess that passes the actual SUS
322 * validation suite; having "dL" be dependent on
323 * how big a "long" is on the machine running
324 * "file" is silly.
325 */
326 type = FILE_LONG;
327 break;
328 case 'Q':
329 /* "dQ" and "uQ" */
330 type = FILE_QUAD;
331 break;
332 default:
333 /* "d{anything else}", "u{anything else}" */
334 return FILE_INVALID;
335 }
336 l += 2;
337 } else if (isdigit(CAST(unsigned char, l[1]))) {
338 /*
339 * "d{num}" and "u{num}"; we only support {num} values
340 * of 1, 2, 4, and 8 - the Single UNIX Specification
341 * doesn't say anything about whether arbitrary
342 * values should be supported, but both the Solaris 10
343 * and OS X Mountain Lion versions of file passed the
344 * Single UNIX Specification validation suite, and
345 * neither of them support values bigger than 8 or
346 * non-power-of-2 values.
347 */
348 if (isdigit(CAST(unsigned char, l[2]))) {
349 /* Multi-digit, so > 9 */
350 return FILE_INVALID;
351 }
352 switch (l[1]) {
353 case '1':
354 type = FILE_BYTE;
355 break;
356 case '2':
357 type = FILE_SHORT;
358 break;
359 case '4':
360 type = FILE_LONG;
361 break;
362 case '8':
363 type = FILE_QUAD;
364 break;
365 default:
366 /* XXX - what about 3, 5, 6, or 7? */
367 return FILE_INVALID;
368 }
369 l += 2;
370 } else {
371 /*
372 * "d" or "u" by itself.
373 */
374 type = FILE_LONG;
375 ++l;
376 }
377 if (t)
378 *t = l;
379 return type;
380 }
381
382 private void
init_file_tables(void)383 init_file_tables(void)
384 {
385 static int done = 0;
386 const struct type_tbl_s *p;
387
388 if (done)
389 return;
390 done++;
391
392 for (p = type_tbl; p->len; p++) {
393 assert(p->type < FILE_NAMES_SIZE);
394 file_names[p->type] = p->name;
395 file_formats[p->type] = p->format;
396 }
397 assert(p - type_tbl == FILE_NAMES_SIZE);
398 }
399
400 private int
add_mlist(struct mlist * mlp,struct magic_map * map,size_t idx)401 add_mlist(struct mlist *mlp, struct magic_map *map, size_t idx)
402 {
403 struct mlist *ml;
404
405 mlp->map = NULL;
406 if ((ml = CAST(struct mlist *, emalloc(sizeof(*ml)))) == NULL)
407 return -1;
408
409 ml->map = idx == 0 ? map : NULL;
410 ml->magic = map->magic[idx];
411 ml->nmagic = map->nmagic[idx];
412
413 mlp->prev->next = ml;
414 ml->prev = mlp->prev;
415 ml->next = mlp;
416 mlp->prev = ml;
417 return 0;
418 }
419
420 /*
421 * Handle one file or directory.
422 */
423 private int
apprentice_1(struct magic_set * ms,const char * fn,int action)424 apprentice_1(struct magic_set *ms, const char *fn, int action)
425 {
426 struct magic_map *map;
427 #ifndef COMPILE_ONLY
428 struct mlist *ml;
429 size_t i;
430 #endif
431
432 if (magicsize != FILE_MAGICSIZE) {
433 file_error(ms, 0, "magic element size %lu != %lu",
434 CAST(unsigned long, sizeof(*map->magic[0])),
435 CAST(unsigned long, FILE_MAGICSIZE));
436 return -1;
437 }
438
439 if (action == FILE_COMPILE) {
440 map = apprentice_load(ms, fn, action);
441 if (map == NULL)
442 return -1;
443 return apprentice_compile(ms, map, fn);
444 }
445
446 #ifndef COMPILE_ONLY
447 map = apprentice_map(ms, fn);
448 if (map == NULL) {
449 if (ms->flags & MAGIC_CHECK)
450 file_magwarn(ms, "using regular magic file `%s'", fn);
451 map = apprentice_load(ms, fn, action);
452 if (map == NULL)
453 return -1;
454 }
455
456 for (i = 0; i < MAGIC_SETS; i++) {
457 if (add_mlist(ms->mlist[i], map, i) == -1) {
458 /* failed to add to any list, free explicitly */
459 if (i == 0)
460 apprentice_unmap(map);
461 else
462 mlist_free_all(ms);
463 file_oomem(ms, sizeof(*ml));
464 return -1;
465 }
466 }
467
468 if (action == FILE_LIST) {
469 for (i = 0; i < MAGIC_SETS; i++) {
470 printf("Set %" SIZE_T_FORMAT "u:\nBinary patterns:\n",
471 i);
472 apprentice_list(ms->mlist[i], BINTEST);
473 printf("Text patterns:\n");
474 apprentice_list(ms->mlist[i], TEXTTEST);
475 }
476 }
477 return 0;
478 #else
479 return 0;
480 #endif /* COMPILE_ONLY */
481 }
482
483 protected void
file_ms_free(struct magic_set * ms)484 file_ms_free(struct magic_set *ms)
485 {
486 size_t i;
487 if (ms == NULL)
488 return;
489 for (i = 0; i < MAGIC_SETS; i++)
490 mlist_free(ms->mlist[i]);
491 if (ms->o.pbuf) {
492 efree(ms->o.pbuf);
493 }
494 if (ms->o.buf) {
495 efree(ms->o.buf);
496 }
497 if (ms->c.li) {
498 efree(ms->c.li);
499 }
500 efree(ms);
501 }
502
503 protected struct magic_set *
file_ms_alloc(int flags)504 file_ms_alloc(int flags)
505 {
506 struct magic_set *ms;
507 size_t i, len;
508
509 if ((ms = CAST(struct magic_set *, ecalloc(CAST(size_t, 1u),
510 sizeof(struct magic_set)))) == NULL)
511 return NULL;
512
513 if (magic_setflags(ms, flags) == -1) {
514 errno = EINVAL;
515 goto free;
516 }
517
518 ms->o.buf = ms->o.pbuf = NULL;
519 ms->o.blen = 0;
520 len = (ms->c.len = 10) * sizeof(*ms->c.li);
521
522 if ((ms->c.li = CAST(struct level_info *, emalloc(len))) == NULL)
523 goto free;
524
525 ms->event_flags = 0;
526 ms->error = -1;
527 for (i = 0; i < MAGIC_SETS; i++)
528 ms->mlist[i] = NULL;
529 ms->file = "unknown";
530 ms->line = 0;
531 ms->indir_max = FILE_INDIR_MAX;
532 ms->name_max = FILE_NAME_MAX;
533 ms->elf_shnum_max = FILE_ELF_SHNUM_MAX;
534 ms->elf_phnum_max = FILE_ELF_PHNUM_MAX;
535 ms->elf_notes_max = FILE_ELF_NOTES_MAX;
536 ms->regex_max = FILE_REGEX_MAX;
537 ms->bytes_max = FILE_BYTES_MAX;
538 ms->encoding_max = FILE_ENCODING_MAX;
539 return ms;
540 free:
541 efree(ms);
542 return NULL;
543 }
544
545 private void
apprentice_unmap(struct magic_map * map)546 apprentice_unmap(struct magic_map *map)
547 {
548 if (map == NULL)
549 return;
550 if (map->p != php_magic_database) {
551 if (map->p == NULL) {
552 int j;
553 for (j = 0; j < MAGIC_SETS; j++) {
554 if (map->magic[j]) {
555 efree(map->magic[j]);
556 }
557 }
558 } else {
559 efree(map->p);
560 }
561 }
562 efree(map);
563 }
564
565 private struct mlist *
mlist_alloc(void)566 mlist_alloc(void)
567 {
568 struct mlist *mlist;
569 if ((mlist = CAST(struct mlist *, ecalloc(1, sizeof(*mlist)))) == NULL) {
570 return NULL;
571 }
572 mlist->next = mlist->prev = mlist;
573 return mlist;
574 }
575
576 private void
mlist_free_all(struct magic_set * ms)577 mlist_free_all(struct magic_set *ms)
578 {
579 size_t i;
580
581 for (i = 0; i < MAGIC_SETS; i++) {
582 mlist_free(ms->mlist[i]);
583 ms->mlist[i] = NULL;
584 }
585 }
586
587 private void
mlist_free_one(struct mlist * ml)588 mlist_free_one(struct mlist *ml)
589 {
590 if (ml->map)
591 apprentice_unmap(CAST(struct magic_map *, ml->map));
592 efree(ml);
593 }
594
595 private void
mlist_free(struct mlist * mlist)596 mlist_free(struct mlist *mlist)
597 {
598 struct mlist *ml, *next;
599
600 if (mlist == NULL)
601 return;
602
603 for (ml = mlist->next; ml != mlist;) {
604 next = ml->next;
605 mlist_free_one(ml);
606 ml = next;
607 }
608 mlist_free_one(mlist);
609 }
610
611 /* const char *fn: list of magic files and directories */
612 protected int
file_apprentice(struct magic_set * ms,const char * fn,int action)613 file_apprentice(struct magic_set *ms, const char *fn, int action)
614 {
615 char *p, *mfn;
616 int fileerr, errs = -1;
617 size_t i, j;
618
619 (void)file_reset(ms, 0);
620
621 /* XXX disabling default magic loading so the compiled in data is used */
622 #if 0
623 if ((fn = magic_getpath(fn, action)) == NULL)
624 return -1;
625 #endif
626
627 init_file_tables();
628
629 if (fn == NULL)
630 fn = getenv("MAGIC");
631 if (fn == NULL) {
632 for (i = 0; i < MAGIC_SETS; i++) {
633 mlist_free(ms->mlist[i]);
634 if ((ms->mlist[i] = mlist_alloc()) == NULL) {
635 file_oomem(ms, sizeof(*ms->mlist[i]));
636 return -1;
637 }
638 }
639 return apprentice_1(ms, fn, action);
640 }
641
642 if ((mfn = estrdup(fn)) == NULL) {
643 file_oomem(ms, strlen(fn));
644 return -1;
645 }
646
647 for (i = 0; i < MAGIC_SETS; i++) {
648 mlist_free(ms->mlist[i]);
649 if ((ms->mlist[i] = mlist_alloc()) == NULL) {
650 file_oomem(ms, sizeof(*ms->mlist[i]));
651 for (j = 0; j < i; j++) {
652 mlist_free(ms->mlist[j]);
653 ms->mlist[j] = NULL;
654 }
655 efree(mfn);
656 return -1;
657 }
658 }
659 fn = mfn;
660
661 while (fn) {
662 p = strchr(fn, PATHSEP);
663 if (p)
664 *p++ = '\0';
665 if (*fn == '\0')
666 break;
667 fileerr = apprentice_1(ms, fn, action);
668 errs = MAX(errs, fileerr);
669 fn = p;
670 }
671
672 efree(mfn);
673
674 if (errs == -1) {
675 for (i = 0; i < MAGIC_SETS; i++) {
676 mlist_free(ms->mlist[i]);
677 ms->mlist[i] = NULL;
678 }
679 file_error(ms, 0, "could not find any valid magic files!");
680 return -1;
681 }
682
683 #if 0
684 /*
685 * Always leave the database loaded
686 */
687 if (action == FILE_LOAD)
688 return 0;
689
690 for (i = 0; i < MAGIC_SETS; i++) {
691 mlist_free(ms->mlist[i]);
692 ms->mlist[i] = NULL;
693 }
694 #endif
695
696 switch (action) {
697 case FILE_LOAD:
698 case FILE_COMPILE:
699 case FILE_CHECK:
700 case FILE_LIST:
701 return 0;
702 default:
703 file_error(ms, 0, "Invalid action %d", action);
704 return -1;
705 }
706 }
707
708 /*
709 * Compute the real length of a magic expression, for the purposes
710 * of determining how "strong" a magic expression is (approximating
711 * how specific its matches are):
712 * - magic characters count 0 unless escaped.
713 * - [] expressions count 1
714 * - {} expressions count 0
715 * - regular characters or escaped magic characters count 1
716 * - 0 length expressions count as one
717 */
718 private size_t
nonmagic(const char * str)719 nonmagic(const char *str)
720 {
721 const char *p;
722 size_t rv = 0;
723
724 for (p = str; *p; p++)
725 switch (*p) {
726 case '\\': /* Escaped anything counts 1 */
727 if (!*++p)
728 p--;
729 rv++;
730 continue;
731 case '?': /* Magic characters count 0 */
732 case '*':
733 case '.':
734 case '+':
735 case '^':
736 case '$':
737 continue;
738 case '[': /* Bracketed expressions count 1 the ']' */
739 while (*p && *p != ']')
740 p++;
741 p--;
742 continue;
743 case '{': /* Braced expressions count 0 */
744 while (*p && *p != '}')
745 p++;
746 if (!*p)
747 p--;
748 continue;
749 default: /* Anything else counts 1 */
750 rv++;
751 continue;
752 }
753
754 return rv == 0 ? 1 : rv; /* Return at least 1 */
755 }
756
757
758 private size_t
typesize(int type)759 typesize(int type)
760 {
761 switch (type) {
762 case FILE_BYTE:
763 return 1;
764
765 case FILE_SHORT:
766 case FILE_LESHORT:
767 case FILE_BESHORT:
768 return 2;
769
770 case FILE_LONG:
771 case FILE_LELONG:
772 case FILE_BELONG:
773 case FILE_MELONG:
774 return 4;
775
776 case FILE_DATE:
777 case FILE_LEDATE:
778 case FILE_BEDATE:
779 case FILE_MEDATE:
780 case FILE_LDATE:
781 case FILE_LELDATE:
782 case FILE_BELDATE:
783 case FILE_MELDATE:
784 case FILE_FLOAT:
785 case FILE_BEFLOAT:
786 case FILE_LEFLOAT:
787 return 4;
788
789 case FILE_QUAD:
790 case FILE_BEQUAD:
791 case FILE_LEQUAD:
792 case FILE_QDATE:
793 case FILE_LEQDATE:
794 case FILE_BEQDATE:
795 case FILE_QLDATE:
796 case FILE_LEQLDATE:
797 case FILE_BEQLDATE:
798 case FILE_QWDATE:
799 case FILE_LEQWDATE:
800 case FILE_BEQWDATE:
801 case FILE_DOUBLE:
802 case FILE_BEDOUBLE:
803 case FILE_LEDOUBLE:
804 case FILE_OFFSET:
805 return 8;
806
807 case FILE_GUID:
808 return 16;
809
810 default:
811 return FILE_BADSIZE;
812 }
813 }
814
815 /*
816 * Get weight of this magic entry, for sorting purposes.
817 */
818 private size_t
apprentice_magic_strength(const struct magic * m)819 apprentice_magic_strength(const struct magic *m)
820 {
821 #define MULT 10U
822 size_t ts, v;
823 ssize_t val = 2 * MULT; /* baseline strength */
824
825 switch (m->type) {
826 case FILE_DEFAULT: /* make sure this sorts last */
827 if (m->factor_op != FILE_FACTOR_OP_NONE)
828 abort();
829 return 0;
830
831 case FILE_BYTE:
832 case FILE_SHORT:
833 case FILE_LESHORT:
834 case FILE_BESHORT:
835 case FILE_LONG:
836 case FILE_LELONG:
837 case FILE_BELONG:
838 case FILE_MELONG:
839 case FILE_DATE:
840 case FILE_LEDATE:
841 case FILE_BEDATE:
842 case FILE_MEDATE:
843 case FILE_LDATE:
844 case FILE_LELDATE:
845 case FILE_BELDATE:
846 case FILE_MELDATE:
847 case FILE_FLOAT:
848 case FILE_BEFLOAT:
849 case FILE_LEFLOAT:
850 case FILE_QUAD:
851 case FILE_BEQUAD:
852 case FILE_LEQUAD:
853 case FILE_QDATE:
854 case FILE_LEQDATE:
855 case FILE_BEQDATE:
856 case FILE_QLDATE:
857 case FILE_LEQLDATE:
858 case FILE_BEQLDATE:
859 case FILE_QWDATE:
860 case FILE_LEQWDATE:
861 case FILE_BEQWDATE:
862 case FILE_DOUBLE:
863 case FILE_BEDOUBLE:
864 case FILE_LEDOUBLE:
865 case FILE_GUID:
866 case FILE_OFFSET:
867 ts = typesize(m->type);
868 if (ts == FILE_BADSIZE)
869 abort();
870 val += ts * MULT;
871 break;
872
873 case FILE_PSTRING:
874 case FILE_STRING:
875 val += m->vallen * MULT;
876 break;
877
878 case FILE_BESTRING16:
879 case FILE_LESTRING16:
880 val += m->vallen * MULT / 2;
881 break;
882
883 case FILE_SEARCH:
884 if (m->vallen == 0)
885 break;
886 val += m->vallen * MAX(MULT / m->vallen, 1);
887 break;
888
889 case FILE_REGEX:
890 v = nonmagic(m->value.s);
891 val += v * MAX(MULT / v, 1);
892 break;
893
894 case FILE_INDIRECT:
895 case FILE_NAME:
896 case FILE_USE:
897 break;
898
899 case FILE_DER:
900 val += MULT;
901 break;
902
903 default:
904 (void)fprintf(stderr, "Bad type %d\n", m->type);
905 abort();
906 }
907
908 switch (m->reln) {
909 case 'x': /* matches anything penalize */
910 case '!': /* matches almost anything penalize */
911 val = 0;
912 break;
913
914 case '=': /* Exact match, prefer */
915 val += MULT;
916 break;
917
918 case '>':
919 case '<': /* comparison match reduce strength */
920 val -= 2 * MULT;
921 break;
922
923 case '^':
924 case '&': /* masking bits, we could count them too */
925 val -= MULT;
926 break;
927
928 default:
929 (void)fprintf(stderr, "Bad relation %c\n", m->reln);
930 abort();
931 }
932
933 switch (m->factor_op) {
934 case FILE_FACTOR_OP_NONE:
935 break;
936 case FILE_FACTOR_OP_PLUS:
937 val += m->factor;
938 break;
939 case FILE_FACTOR_OP_MINUS:
940 val -= m->factor;
941 break;
942 case FILE_FACTOR_OP_TIMES:
943 val *= m->factor;
944 break;
945 case FILE_FACTOR_OP_DIV:
946 val /= m->factor;
947 break;
948 default:
949 abort();
950 }
951
952 if (val <= 0) /* ensure we only return 0 for FILE_DEFAULT */
953 val = 1;
954
955 /*
956 * Magic entries with no description get a bonus because they depend
957 * on subsequent magic entries to print something.
958 */
959 if (m->desc[0] == '\0')
960 val++;
961 return val;
962 }
963
964 /*
965 * Sort callback for sorting entries by "strength" (basically length)
966 */
967 private int
apprentice_sort(const void * a,const void * b)968 apprentice_sort(const void *a, const void *b)
969 {
970 const struct magic_entry *ma = CAST(const struct magic_entry *, a);
971 const struct magic_entry *mb = CAST(const struct magic_entry *, b);
972 size_t sa = apprentice_magic_strength(ma->mp);
973 size_t sb = apprentice_magic_strength(mb->mp);
974 if (sa == sb)
975 return 0;
976 else if (sa > sb)
977 return -1;
978 else
979 return 1;
980 }
981
982 /*
983 * Shows sorted patterns list in the order which is used for the matching
984 */
985 private void
apprentice_list(struct mlist * mlist,int mode)986 apprentice_list(struct mlist *mlist, int mode)
987 {
988 uint32_t magindex = 0;
989 struct mlist *ml;
990 for (ml = mlist->next; ml != mlist; ml = ml->next) {
991 for (magindex = 0; magindex < ml->nmagic; magindex++) {
992 struct magic *m = &ml->magic[magindex];
993 if ((m->flag & mode) != mode) {
994 /* Skip sub-tests */
995 while (magindex + 1 < ml->nmagic &&
996 ml->magic[magindex + 1].cont_level != 0)
997 ++magindex;
998 continue; /* Skip to next top-level test*/
999 }
1000
1001 /*
1002 * Try to iterate over the tree until we find item with
1003 * description/mimetype.
1004 */
1005 while (magindex + 1 < ml->nmagic &&
1006 ml->magic[magindex + 1].cont_level != 0 &&
1007 *ml->magic[magindex].desc == '\0' &&
1008 *ml->magic[magindex].mimetype == '\0')
1009 magindex++;
1010
1011 printf("Strength = %3" SIZE_T_FORMAT "u@%u: %s [%s]\n",
1012 apprentice_magic_strength(m),
1013 ml->magic[magindex].lineno,
1014 ml->magic[magindex].desc,
1015 ml->magic[magindex].mimetype);
1016 }
1017 }
1018 }
1019
1020 private void
set_test_type(struct magic * mstart,struct magic * m)1021 set_test_type(struct magic *mstart, struct magic *m)
1022 {
1023 switch (m->type) {
1024 case FILE_BYTE:
1025 case FILE_SHORT:
1026 case FILE_LONG:
1027 case FILE_DATE:
1028 case FILE_BESHORT:
1029 case FILE_BELONG:
1030 case FILE_BEDATE:
1031 case FILE_LESHORT:
1032 case FILE_LELONG:
1033 case FILE_LEDATE:
1034 case FILE_LDATE:
1035 case FILE_BELDATE:
1036 case FILE_LELDATE:
1037 case FILE_MEDATE:
1038 case FILE_MELDATE:
1039 case FILE_MELONG:
1040 case FILE_QUAD:
1041 case FILE_LEQUAD:
1042 case FILE_BEQUAD:
1043 case FILE_QDATE:
1044 case FILE_LEQDATE:
1045 case FILE_BEQDATE:
1046 case FILE_QLDATE:
1047 case FILE_LEQLDATE:
1048 case FILE_BEQLDATE:
1049 case FILE_QWDATE:
1050 case FILE_LEQWDATE:
1051 case FILE_BEQWDATE:
1052 case FILE_FLOAT:
1053 case FILE_BEFLOAT:
1054 case FILE_LEFLOAT:
1055 case FILE_DOUBLE:
1056 case FILE_BEDOUBLE:
1057 case FILE_LEDOUBLE:
1058 case FILE_DER:
1059 case FILE_GUID:
1060 case FILE_OFFSET:
1061 mstart->flag |= BINTEST;
1062 break;
1063 case FILE_STRING:
1064 case FILE_PSTRING:
1065 case FILE_BESTRING16:
1066 case FILE_LESTRING16:
1067 /* Allow text overrides */
1068 if (mstart->str_flags & STRING_TEXTTEST)
1069 mstart->flag |= TEXTTEST;
1070 else
1071 mstart->flag |= BINTEST;
1072 break;
1073 case FILE_REGEX:
1074 case FILE_SEARCH:
1075 /* Check for override */
1076 if (mstart->str_flags & STRING_BINTEST)
1077 mstart->flag |= BINTEST;
1078 if (mstart->str_flags & STRING_TEXTTEST)
1079 mstart->flag |= TEXTTEST;
1080
1081 if (mstart->flag & (TEXTTEST|BINTEST))
1082 break;
1083
1084 /* binary test if pattern is not text */
1085 if (file_looks_utf8(m->value.us, CAST(size_t, m->vallen), NULL,
1086 NULL) <= 0)
1087 mstart->flag |= BINTEST;
1088 else
1089 mstart->flag |= TEXTTEST;
1090 break;
1091 case FILE_DEFAULT:
1092 /* can't deduce anything; we shouldn't see this at the
1093 top level anyway */
1094 break;
1095 case FILE_INVALID:
1096 default:
1097 /* invalid search type, but no need to complain here */
1098 break;
1099 }
1100 }
1101
1102 private int
addentry(struct magic_set * ms,struct magic_entry * me,struct magic_entry_set * mset)1103 addentry(struct magic_set *ms, struct magic_entry *me,
1104 struct magic_entry_set *mset)
1105 {
1106 size_t i = me->mp->type == FILE_NAME ? 1 : 0;
1107 if (mset[i].count == mset[i].max) {
1108 struct magic_entry *mp;
1109
1110 mset[i].max += ALLOC_INCR;
1111 if ((mp = CAST(struct magic_entry *,
1112 erealloc(mset[i].me, sizeof(*mp) * mset[i].max))) ==
1113 NULL) {
1114 file_oomem(ms, sizeof(*mp) * mset[i].max);
1115 return -1;
1116 }
1117 (void)memset(&mp[mset[i].count], 0, sizeof(*mp) *
1118 ALLOC_INCR);
1119 mset[i].me = mp;
1120 }
1121 mset[i].me[mset[i].count++] = *me;
1122 memset(me, 0, sizeof(*me));
1123 return 0;
1124 }
1125
1126 /*
1127 * Load and parse one file.
1128 */
1129 private void
load_1(struct magic_set * ms,int action,const char * fn,int * errs,struct magic_entry_set * mset)1130 load_1(struct magic_set *ms, int action, const char *fn, int *errs,
1131 struct magic_entry_set *mset)
1132 {
1133 char buffer[BUFSIZ + 1];
1134 char *line = NULL;
1135 size_t len;
1136 size_t lineno = 0;
1137 struct magic_entry me;
1138
1139 php_stream *stream;
1140
1141
1142 ms->file = fn;
1143 stream = php_stream_open_wrapper((char *)fn, "rb", REPORT_ERRORS, NULL);
1144
1145 if (stream == NULL) {
1146 if (errno != ENOENT)
1147 file_error(ms, errno, "cannot read magic file `%s'",
1148 fn);
1149 (*errs)++;
1150 return;
1151 }
1152
1153 memset(&me, 0, sizeof(me));
1154 /* read and parse this file */
1155 for (ms->line = 1; (line = php_stream_get_line(stream, buffer , BUFSIZ, &len)) != NULL; ms->line++) {
1156 if (len == 0) /* null line, garbage, etc */
1157 continue;
1158 if (line[len - 1] == '\n') {
1159 lineno++;
1160 line[len - 1] = '\0'; /* delete newline */
1161 }
1162 switch (line[0]) {
1163 case '\0': /* empty, do not parse */
1164 case '#': /* comment, do not parse */
1165 continue;
1166 case '!':
1167 if (line[1] == ':') {
1168 size_t i;
1169
1170 for (i = 0; bang[i].name != NULL; i++) {
1171 if (CAST(size_t, len - 2) > bang[i].len &&
1172 memcmp(bang[i].name, line + 2,
1173 bang[i].len) == 0)
1174 break;
1175 }
1176 if (bang[i].name == NULL) {
1177 file_error(ms, 0,
1178 "Unknown !: entry `%s'", line);
1179 (*errs)++;
1180 continue;
1181 }
1182 if (me.mp == NULL) {
1183 file_error(ms, 0,
1184 "No current entry for :!%s type",
1185 bang[i].name);
1186 (*errs)++;
1187 continue;
1188 }
1189 if ((*bang[i].fun)(ms, &me,
1190 line + bang[i].len + 2,
1191 len - bang[i].len - 2) != 0) {
1192 (*errs)++;
1193 continue;
1194 }
1195 continue;
1196 }
1197 /*FALLTHROUGH*/
1198 default:
1199 again:
1200 switch (parse(ms, &me, line, lineno, action)) {
1201 case 0:
1202 continue;
1203 case 1:
1204 (void)addentry(ms, &me, mset);
1205 goto again;
1206 default:
1207 (*errs)++;
1208 break;
1209 }
1210 }
1211 }
1212 if (me.mp)
1213 (void)addentry(ms, &me, mset);
1214 efree(line);
1215 php_stream_close(stream);
1216 }
1217
1218 /*
1219 * parse a file or directory of files
1220 * const char *fn: name of magic file or directory
1221 */
1222 private int
cmpstrp(const void * p1,const void * p2)1223 cmpstrp(const void *p1, const void *p2)
1224 {
1225 return strcmp(*RCAST(char *const *, p1), *RCAST(char *const *, p2));
1226 }
1227
1228
1229 private uint32_t
set_text_binary(struct magic_set * ms,struct magic_entry * me,uint32_t nme,uint32_t starttest)1230 set_text_binary(struct magic_set *ms, struct magic_entry *me, uint32_t nme,
1231 uint32_t starttest)
1232 {
1233 static const char text[] = "text";
1234 static const char binary[] = "binary";
1235 static const size_t len = sizeof(text);
1236
1237 uint32_t i = starttest;
1238
1239 do {
1240 set_test_type(me[starttest].mp, me[i].mp);
1241 if ((ms->flags & MAGIC_DEBUG) == 0)
1242 continue;
1243 (void)fprintf(stderr, "%s%s%s: %s\n",
1244 me[i].mp->mimetype,
1245 me[i].mp->mimetype[0] == '\0' ? "" : "; ",
1246 me[i].mp->desc[0] ? me[i].mp->desc : "(no description)",
1247 me[i].mp->flag & BINTEST ? binary : text);
1248 if (me[i].mp->flag & BINTEST) {
1249 char *p = strstr(me[i].mp->desc, text);
1250 if (p && (p == me[i].mp->desc ||
1251 isspace(CAST(unsigned char, p[-1]))) &&
1252 (p + len - me[i].mp->desc == MAXstring
1253 || (p[len] == '\0' ||
1254 isspace(CAST(unsigned char, p[len])))))
1255 (void)fprintf(stderr, "*** Possible "
1256 "binary test for text type\n");
1257 }
1258 } while (++i < nme && me[i].mp->cont_level != 0);
1259 return i;
1260 }
1261
1262 private void
set_last_default(struct magic_set * ms,struct magic_entry * me,uint32_t nme)1263 set_last_default(struct magic_set *ms, struct magic_entry *me, uint32_t nme)
1264 {
1265 uint32_t i;
1266 for (i = 0; i < nme; i++) {
1267 if (me[i].mp->cont_level == 0 &&
1268 me[i].mp->type == FILE_DEFAULT) {
1269 while (++i < nme)
1270 if (me[i].mp->cont_level == 0)
1271 break;
1272 if (i != nme) {
1273 /* XXX - Ugh! */
1274 ms->line = me[i].mp->lineno;
1275 file_magwarn(ms,
1276 "level 0 \"default\" did not sort last");
1277 }
1278 return;
1279 }
1280 }
1281 }
1282
1283 private int
coalesce_entries(struct magic_set * ms,struct magic_entry * me,uint32_t nme,struct magic ** ma,uint32_t * nma)1284 coalesce_entries(struct magic_set *ms, struct magic_entry *me, uint32_t nme,
1285 struct magic **ma, uint32_t *nma)
1286 {
1287 uint32_t i, mentrycount = 0;
1288 size_t slen;
1289
1290 for (i = 0; i < nme; i++)
1291 mentrycount += me[i].cont_count;
1292
1293 slen = sizeof(**ma) * mentrycount;
1294 if ((*ma = CAST(struct magic *, emalloc(slen))) == NULL) {
1295 file_oomem(ms, slen);
1296 return -1;
1297 }
1298
1299 mentrycount = 0;
1300 for (i = 0; i < nme; i++) {
1301 (void)memcpy(*ma + mentrycount, me[i].mp,
1302 me[i].cont_count * sizeof(**ma));
1303 mentrycount += me[i].cont_count;
1304 }
1305 *nma = mentrycount;
1306 return 0;
1307 }
1308
1309 private void
magic_entry_free(struct magic_entry * me,uint32_t nme)1310 magic_entry_free(struct magic_entry *me, uint32_t nme)
1311 {
1312 uint32_t i;
1313 if (me == NULL)
1314 return;
1315 for (i = 0; i < nme; i++)
1316 efree(me[i].mp);
1317 efree(me);
1318 }
1319
1320 private struct magic_map *
apprentice_load(struct magic_set * ms,const char * fn,int action)1321 apprentice_load(struct magic_set *ms, const char *fn, int action)
1322 {
1323 int errs = 0;
1324 uint32_t i, j;
1325 size_t files = 0, maxfiles = 0;
1326 char **filearr = NULL;
1327 zend_stat_t st = {0};
1328 struct magic_map *map;
1329 struct magic_entry_set mset[MAGIC_SETS];
1330 php_stream *dir;
1331 php_stream_dirent d;
1332
1333
1334 memset(mset, 0, sizeof(mset));
1335 ms->flags |= MAGIC_CHECK; /* Enable checks for parsed files */
1336
1337
1338 if ((map = CAST(struct magic_map *, ecalloc(1, sizeof(*map)))) == NULL)
1339 {
1340 file_oomem(ms, sizeof(*map));
1341 return NULL;
1342 }
1343 map->type = MAP_TYPE_MALLOC;
1344
1345 /* print silly verbose header for USG compat. */
1346 if (action == FILE_CHECK)
1347 (void)fprintf(stderr, "%s\n", usg_hdr);
1348
1349 /* load directory or file */
1350 /* FIXME: Read file names and sort them to prevent
1351 non-determinism. See Debian bug #488562. */
1352 if (php_sys_stat(fn, &st) == 0 && S_ISDIR(st.st_mode)) {
1353 int mflen;
1354 char mfn[MAXPATHLEN];
1355
1356 dir = php_stream_opendir((char *)fn, REPORT_ERRORS, NULL);
1357 if (!dir) {
1358 errs++;
1359 goto out;
1360 }
1361 while (php_stream_readdir(dir, &d)) {
1362 if ((mflen = snprintf(mfn, sizeof(mfn), "%s/%s", fn, d.d_name)) < 0) {
1363 file_oomem(ms,
1364 strlen(fn) + strlen(d.d_name) + 2);
1365 errs++;
1366 php_stream_closedir(dir);
1367 goto out;
1368 }
1369 if (zend_stat(mfn, &st) == -1 || !S_ISREG(st.st_mode)) {
1370 continue;
1371 }
1372 if (files >= maxfiles) {
1373 size_t mlen;
1374 maxfiles = (maxfiles + 1) * 2;
1375 mlen = maxfiles * sizeof(*filearr);
1376 if ((filearr = CAST(char **,
1377 erealloc(filearr, mlen))) == NULL) {
1378 file_oomem(ms, mlen);
1379 php_stream_closedir(dir);
1380 errs++;
1381 goto out;
1382 }
1383 }
1384 filearr[files++] = estrndup(mfn, (mflen > sizeof(mfn) - 1)? sizeof(mfn) - 1: mflen);
1385 }
1386 php_stream_closedir(dir);
1387 if (filearr) {
1388 qsort(filearr, files, sizeof(*filearr), cmpstrp);
1389 for (i = 0; i < files; i++) {
1390 load_1(ms, action, filearr[i], &errs, mset);
1391 efree(filearr[i]);
1392 }
1393 efree(filearr);
1394 }
1395 } else
1396 load_1(ms, action, fn, &errs, mset);
1397 if (errs)
1398 goto out;
1399
1400 for (j = 0; j < MAGIC_SETS; j++) {
1401 /* Set types of tests */
1402 for (i = 0; i < mset[j].count; ) {
1403 if (mset[j].me[i].mp->cont_level != 0) {
1404 i++;
1405 continue;
1406 }
1407 i = set_text_binary(ms, mset[j].me, mset[j].count, i);
1408 }
1409 if (mset[j].me)
1410 qsort(mset[j].me, mset[j].count, sizeof(*mset[j].me),
1411 apprentice_sort);
1412
1413 /*
1414 * Make sure that any level 0 "default" line is last
1415 * (if one exists).
1416 */
1417 set_last_default(ms, mset[j].me, mset[j].count);
1418
1419 /* coalesce per file arrays into a single one, if needed */
1420 if (mset[j].count == 0)
1421 continue;
1422
1423 if (coalesce_entries(ms, mset[j].me, mset[j].count,
1424 &map->magic[j], &map->nmagic[j]) == -1) {
1425 errs++;
1426 goto out;
1427 }
1428 }
1429
1430 out:
1431 for (j = 0; j < MAGIC_SETS; j++)
1432 magic_entry_free(mset[j].me, mset[j].count);
1433
1434 if (errs) {
1435 apprentice_unmap(map);
1436 return NULL;
1437 }
1438 return map;
1439 }
1440
1441 /*
1442 * extend the sign bit if the comparison is to be signed
1443 */
1444 protected uint64_t
file_signextend(struct magic_set * ms,struct magic * m,uint64_t v)1445 file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
1446 {
1447 if (!(m->flag & UNSIGNED)) {
1448 switch(m->type) {
1449 /*
1450 * Do not remove the casts below. They are
1451 * vital. When later compared with the data,
1452 * the sign extension must have happened.
1453 */
1454 case FILE_BYTE:
1455 v = CAST(signed char, v);
1456 break;
1457 case FILE_SHORT:
1458 case FILE_BESHORT:
1459 case FILE_LESHORT:
1460 v = CAST(short, v);
1461 break;
1462 case FILE_DATE:
1463 case FILE_BEDATE:
1464 case FILE_LEDATE:
1465 case FILE_MEDATE:
1466 case FILE_LDATE:
1467 case FILE_BELDATE:
1468 case FILE_LELDATE:
1469 case FILE_MELDATE:
1470 case FILE_LONG:
1471 case FILE_BELONG:
1472 case FILE_LELONG:
1473 case FILE_MELONG:
1474 case FILE_FLOAT:
1475 case FILE_BEFLOAT:
1476 case FILE_LEFLOAT:
1477 v = CAST(int32_t, v);
1478 break;
1479 case FILE_QUAD:
1480 case FILE_BEQUAD:
1481 case FILE_LEQUAD:
1482 case FILE_QDATE:
1483 case FILE_QLDATE:
1484 case FILE_QWDATE:
1485 case FILE_BEQDATE:
1486 case FILE_BEQLDATE:
1487 case FILE_BEQWDATE:
1488 case FILE_LEQDATE:
1489 case FILE_LEQLDATE:
1490 case FILE_LEQWDATE:
1491 case FILE_DOUBLE:
1492 case FILE_BEDOUBLE:
1493 case FILE_LEDOUBLE:
1494 case FILE_OFFSET:
1495 v = CAST(int64_t, v);
1496 break;
1497 case FILE_STRING:
1498 case FILE_PSTRING:
1499 case FILE_BESTRING16:
1500 case FILE_LESTRING16:
1501 case FILE_REGEX:
1502 case FILE_SEARCH:
1503 case FILE_DEFAULT:
1504 case FILE_INDIRECT:
1505 case FILE_NAME:
1506 case FILE_USE:
1507 case FILE_CLEAR:
1508 case FILE_DER:
1509 case FILE_GUID:
1510 break;
1511 default:
1512 if (ms->flags & MAGIC_CHECK)
1513 file_magwarn(ms, "cannot happen: m->type=%d\n",
1514 m->type);
1515 return FILE_BADSIZE;
1516 }
1517 }
1518 return v;
1519 }
1520
1521 private int
string_modifier_check(struct magic_set * ms,struct magic * m)1522 string_modifier_check(struct magic_set *ms, struct magic *m)
1523 {
1524 if ((ms->flags & MAGIC_CHECK) == 0)
1525 return 0;
1526
1527 if ((m->type != FILE_REGEX || (m->str_flags & REGEX_LINE_COUNT) == 0) &&
1528 (m->type != FILE_PSTRING && (m->str_flags & PSTRING_LEN) != 0)) {
1529 file_magwarn(ms,
1530 "'/BHhLl' modifiers are only allowed for pascal strings\n");
1531 return -1;
1532 }
1533 switch (m->type) {
1534 case FILE_BESTRING16:
1535 case FILE_LESTRING16:
1536 if (m->str_flags != 0) {
1537 file_magwarn(ms,
1538 "no modifiers allowed for 16-bit strings\n");
1539 return -1;
1540 }
1541 break;
1542 case FILE_STRING:
1543 case FILE_PSTRING:
1544 if ((m->str_flags & REGEX_OFFSET_START) != 0) {
1545 file_magwarn(ms,
1546 "'/%c' only allowed on regex and search\n",
1547 CHAR_REGEX_OFFSET_START);
1548 return -1;
1549 }
1550 break;
1551 case FILE_SEARCH:
1552 if (m->str_range == 0) {
1553 file_magwarn(ms,
1554 "missing range; defaulting to %d\n",
1555 STRING_DEFAULT_RANGE);
1556 m->str_range = STRING_DEFAULT_RANGE;
1557 return -1;
1558 }
1559 break;
1560 case FILE_REGEX:
1561 if ((m->str_flags & STRING_COMPACT_WHITESPACE) != 0) {
1562 file_magwarn(ms, "'/%c' not allowed on regex\n",
1563 CHAR_COMPACT_WHITESPACE);
1564 return -1;
1565 }
1566 if ((m->str_flags & STRING_COMPACT_OPTIONAL_WHITESPACE) != 0) {
1567 file_magwarn(ms, "'/%c' not allowed on regex\n",
1568 CHAR_COMPACT_OPTIONAL_WHITESPACE);
1569 return -1;
1570 }
1571 break;
1572 default:
1573 file_magwarn(ms, "coding error: m->type=%d\n",
1574 m->type);
1575 return -1;
1576 }
1577 return 0;
1578 }
1579
1580 private int
get_op(char c)1581 get_op(char c)
1582 {
1583 switch (c) {
1584 case '&':
1585 return FILE_OPAND;
1586 case '|':
1587 return FILE_OPOR;
1588 case '^':
1589 return FILE_OPXOR;
1590 case '+':
1591 return FILE_OPADD;
1592 case '-':
1593 return FILE_OPMINUS;
1594 case '*':
1595 return FILE_OPMULTIPLY;
1596 case '/':
1597 return FILE_OPDIVIDE;
1598 case '%':
1599 return FILE_OPMODULO;
1600 default:
1601 return -1;
1602 }
1603 }
1604
1605 #ifdef ENABLE_CONDITIONALS
1606 private int
get_cond(const char * l,const char ** t)1607 get_cond(const char *l, const char **t)
1608 {
1609 static const struct cond_tbl_s {
1610 char name[8];
1611 size_t len;
1612 int cond;
1613 } cond_tbl[] = {
1614 { "if", 2, COND_IF },
1615 { "elif", 4, COND_ELIF },
1616 { "else", 4, COND_ELSE },
1617 { "", 0, COND_NONE },
1618 };
1619 const struct cond_tbl_s *p;
1620
1621 for (p = cond_tbl; p->len; p++) {
1622 if (strncmp(l, p->name, p->len) == 0 &&
1623 isspace(CAST(unsigned char, l[p->len]))) {
1624 if (t)
1625 *t = l + p->len;
1626 break;
1627 }
1628 }
1629 return p->cond;
1630 }
1631
1632 private int
check_cond(struct magic_set * ms,int cond,uint32_t cont_level)1633 check_cond(struct magic_set *ms, int cond, uint32_t cont_level)
1634 {
1635 int last_cond;
1636 last_cond = ms->c.li[cont_level].last_cond;
1637
1638 switch (cond) {
1639 case COND_IF:
1640 if (last_cond != COND_NONE && last_cond != COND_ELIF) {
1641 if (ms->flags & MAGIC_CHECK)
1642 file_magwarn(ms, "syntax error: `if'");
1643 return -1;
1644 }
1645 last_cond = COND_IF;
1646 break;
1647
1648 case COND_ELIF:
1649 if (last_cond != COND_IF && last_cond != COND_ELIF) {
1650 if (ms->flags & MAGIC_CHECK)
1651 file_magwarn(ms, "syntax error: `elif'");
1652 return -1;
1653 }
1654 last_cond = COND_ELIF;
1655 break;
1656
1657 case COND_ELSE:
1658 if (last_cond != COND_IF && last_cond != COND_ELIF) {
1659 if (ms->flags & MAGIC_CHECK)
1660 file_magwarn(ms, "syntax error: `else'");
1661 return -1;
1662 }
1663 last_cond = COND_NONE;
1664 break;
1665
1666 case COND_NONE:
1667 last_cond = COND_NONE;
1668 break;
1669 }
1670
1671 ms->c.li[cont_level].last_cond = last_cond;
1672 return 0;
1673 }
1674 #endif /* ENABLE_CONDITIONALS */
1675
1676 private int
parse_indirect_modifier(struct magic_set * ms,struct magic * m,const char ** lp)1677 parse_indirect_modifier(struct magic_set *ms, struct magic *m, const char **lp)
1678 {
1679 const char *l = *lp;
1680
1681 while (!isspace(CAST(unsigned char, *++l)))
1682 switch (*l) {
1683 case CHAR_INDIRECT_RELATIVE:
1684 m->str_flags |= INDIRECT_RELATIVE;
1685 break;
1686 default:
1687 if (ms->flags & MAGIC_CHECK)
1688 file_magwarn(ms, "indirect modifier `%c' "
1689 "invalid", *l);
1690 *lp = l;
1691 return -1;
1692 }
1693 *lp = l;
1694 return 0;
1695 }
1696
1697 private void
parse_op_modifier(struct magic_set * ms,struct magic * m,const char ** lp,int op)1698 parse_op_modifier(struct magic_set *ms, struct magic *m, const char **lp,
1699 int op)
1700 {
1701 const char *l = *lp;
1702 char *t;
1703 uint64_t val;
1704
1705 ++l;
1706 m->mask_op |= op;
1707 val = CAST(uint64_t, strtoull(l, &t, 0));
1708 l = t;
1709 m->num_mask = file_signextend(ms, m, val);
1710 eatsize(&l);
1711 *lp = l;
1712 }
1713
1714 private int
parse_string_modifier(struct magic_set * ms,struct magic * m,const char ** lp)1715 parse_string_modifier(struct magic_set *ms, struct magic *m, const char **lp)
1716 {
1717 const char *l = *lp;
1718 char *t;
1719 int have_range = 0;
1720
1721 while (!isspace(CAST(unsigned char, *++l))) {
1722 switch (*l) {
1723 case '0': case '1': case '2':
1724 case '3': case '4': case '5':
1725 case '6': case '7': case '8':
1726 case '9':
1727 if (have_range && (ms->flags & MAGIC_CHECK))
1728 file_magwarn(ms, "multiple ranges");
1729 have_range = 1;
1730 m->str_range = CAST(uint32_t, strtoul(l, &t, 0));
1731 if (m->str_range == 0)
1732 file_magwarn(ms, "zero range");
1733 l = t - 1;
1734 break;
1735 case CHAR_COMPACT_WHITESPACE:
1736 m->str_flags |= STRING_COMPACT_WHITESPACE;
1737 break;
1738 case CHAR_COMPACT_OPTIONAL_WHITESPACE:
1739 m->str_flags |= STRING_COMPACT_OPTIONAL_WHITESPACE;
1740 break;
1741 case CHAR_IGNORE_LOWERCASE:
1742 m->str_flags |= STRING_IGNORE_LOWERCASE;
1743 break;
1744 case CHAR_IGNORE_UPPERCASE:
1745 m->str_flags |= STRING_IGNORE_UPPERCASE;
1746 break;
1747 case CHAR_REGEX_OFFSET_START:
1748 m->str_flags |= REGEX_OFFSET_START;
1749 break;
1750 case CHAR_BINTEST:
1751 m->str_flags |= STRING_BINTEST;
1752 break;
1753 case CHAR_TEXTTEST:
1754 m->str_flags |= STRING_TEXTTEST;
1755 break;
1756 case CHAR_TRIM:
1757 m->str_flags |= STRING_TRIM;
1758 break;
1759 case CHAR_PSTRING_1_LE:
1760 #define SET_LENGTH(a) m->str_flags = (m->str_flags & ~PSTRING_LEN) | (a)
1761 if (m->type != FILE_PSTRING)
1762 goto bad;
1763 SET_LENGTH(PSTRING_1_LE);
1764 break;
1765 case CHAR_PSTRING_2_BE:
1766 if (m->type != FILE_PSTRING)
1767 goto bad;
1768 SET_LENGTH(PSTRING_2_BE);
1769 break;
1770 case CHAR_PSTRING_2_LE:
1771 if (m->type != FILE_PSTRING)
1772 goto bad;
1773 SET_LENGTH(PSTRING_2_LE);
1774 break;
1775 case CHAR_PSTRING_4_BE:
1776 if (m->type != FILE_PSTRING)
1777 goto bad;
1778 SET_LENGTH(PSTRING_4_BE);
1779 break;
1780 case CHAR_PSTRING_4_LE:
1781 switch (m->type) {
1782 case FILE_PSTRING:
1783 case FILE_REGEX:
1784 break;
1785 default:
1786 goto bad;
1787 }
1788 SET_LENGTH(PSTRING_4_LE);
1789 break;
1790 case CHAR_PSTRING_LENGTH_INCLUDES_ITSELF:
1791 if (m->type != FILE_PSTRING)
1792 goto bad;
1793 m->str_flags |= PSTRING_LENGTH_INCLUDES_ITSELF;
1794 break;
1795 default:
1796 bad:
1797 if (ms->flags & MAGIC_CHECK)
1798 file_magwarn(ms, "string modifier `%c' "
1799 "invalid", *l);
1800 goto out;
1801 }
1802 /* allow multiple '/' for readability */
1803 if (l[1] == '/' && !isspace(CAST(unsigned char, l[2])))
1804 l++;
1805 }
1806 if (string_modifier_check(ms, m) == -1)
1807 goto out;
1808 *lp = l;
1809 return 0;
1810 out:
1811 *lp = l;
1812 return -1;
1813 }
1814
1815 /*
1816 * parse one line from magic file, put into magic[index++] if valid
1817 */
1818 private int
parse(struct magic_set * ms,struct magic_entry * me,const char * line,size_t lineno,int action)1819 parse(struct magic_set *ms, struct magic_entry *me, const char *line,
1820 size_t lineno, int action)
1821 {
1822 #ifdef ENABLE_CONDITIONALS
1823 static uint32_t last_cont_level = 0;
1824 #endif
1825 size_t i;
1826 struct magic *m;
1827 const char *l = line;
1828 char *t;
1829 int op;
1830 uint32_t cont_level;
1831 int32_t diff;
1832
1833 cont_level = 0;
1834
1835 /*
1836 * Parse the offset.
1837 */
1838 while (*l == '>') {
1839 ++l; /* step over */
1840 cont_level++;
1841 }
1842 #ifdef ENABLE_CONDITIONALS
1843 if (cont_level == 0 || cont_level > last_cont_level)
1844 if (file_check_mem(ms, cont_level) == -1)
1845 return -1;
1846 last_cont_level = cont_level;
1847 #endif
1848 if (cont_level != 0) {
1849 if (me->mp == NULL) {
1850 file_magerror(ms, "No current entry for continuation");
1851 return -1;
1852 }
1853 if (me->cont_count == 0) {
1854 file_magerror(ms, "Continuations present with 0 count");
1855 return -1;
1856 }
1857 m = &me->mp[me->cont_count - 1];
1858 diff = CAST(int32_t, cont_level) - CAST(int32_t, m->cont_level);
1859 if (diff > 1)
1860 file_magwarn(ms, "New continuation level %u is more "
1861 "than one larger than current level %u", cont_level,
1862 m->cont_level);
1863 if (me->cont_count == me->max_count) {
1864 struct magic *nm;
1865 size_t cnt = me->max_count + ALLOC_CHUNK;
1866 if ((nm = CAST(struct magic *, erealloc(me->mp,
1867 sizeof(*nm) * cnt))) == NULL) {
1868 file_oomem(ms, sizeof(*nm) * cnt);
1869 return -1;
1870 }
1871 me->mp = nm;
1872 me->max_count = CAST(uint32_t, cnt);
1873 }
1874 m = &me->mp[me->cont_count++];
1875 (void)memset(m, 0, sizeof(*m));
1876 m->cont_level = cont_level;
1877 } else {
1878 static const size_t len = sizeof(*m) * ALLOC_CHUNK;
1879 if (me->mp != NULL)
1880 return 1;
1881 if ((m = CAST(struct magic *, emalloc(len))) == NULL) {
1882 file_oomem(ms, len);
1883 return -1;
1884 }
1885 me->mp = m;
1886 me->max_count = ALLOC_CHUNK;
1887 (void)memset(m, 0, sizeof(*m));
1888 m->factor_op = FILE_FACTOR_OP_NONE;
1889 m->cont_level = 0;
1890 me->cont_count = 1;
1891 }
1892 m->lineno = CAST(uint32_t, lineno);
1893
1894 if (*l == '&') { /* m->cont_level == 0 checked below. */
1895 ++l; /* step over */
1896 m->flag |= OFFADD;
1897 }
1898 if (*l == '(') {
1899 ++l; /* step over */
1900 m->flag |= INDIR;
1901 if (m->flag & OFFADD)
1902 m->flag = (m->flag & ~OFFADD) | INDIROFFADD;
1903
1904 if (*l == '&') { /* m->cont_level == 0 checked below */
1905 ++l; /* step over */
1906 m->flag |= OFFADD;
1907 }
1908 }
1909 /* Indirect offsets are not valid at level 0. */
1910 if (m->cont_level == 0 && (m->flag & (OFFADD | INDIROFFADD))) {
1911 if (ms->flags & MAGIC_CHECK)
1912 file_magwarn(ms, "relative offset at level 0");
1913 return -1;
1914 }
1915
1916 /* get offset, then skip over it */
1917 if (*l == '-') {
1918 ++l; /* step over */
1919 m->flag |= OFFNEGATIVE;
1920 }
1921 m->offset = CAST(int32_t, strtol(l, &t, 0));
1922 if (l == t) {
1923 if (ms->flags & MAGIC_CHECK)
1924 file_magwarn(ms, "offset `%s' invalid", l);
1925 return -1;
1926 }
1927
1928 l = t;
1929
1930 if (m->flag & INDIR) {
1931 m->in_type = FILE_LONG;
1932 m->in_offset = 0;
1933 m->in_op = 0;
1934 /*
1935 * read [.,lbs][+-]nnnnn)
1936 */
1937 if (*l == '.' || *l == ',') {
1938 if (*l == ',')
1939 m->in_op |= FILE_OPSIGNED;
1940 l++;
1941 switch (*l) {
1942 case 'l':
1943 m->in_type = FILE_LELONG;
1944 break;
1945 case 'L':
1946 m->in_type = FILE_BELONG;
1947 break;
1948 case 'm':
1949 m->in_type = FILE_MELONG;
1950 break;
1951 case 'h':
1952 case 's':
1953 m->in_type = FILE_LESHORT;
1954 break;
1955 case 'H':
1956 case 'S':
1957 m->in_type = FILE_BESHORT;
1958 break;
1959 case 'c':
1960 case 'b':
1961 case 'C':
1962 case 'B':
1963 m->in_type = FILE_BYTE;
1964 break;
1965 case 'e':
1966 case 'f':
1967 case 'g':
1968 m->in_type = FILE_LEDOUBLE;
1969 break;
1970 case 'E':
1971 case 'F':
1972 case 'G':
1973 m->in_type = FILE_BEDOUBLE;
1974 break;
1975 case 'i':
1976 m->in_type = FILE_LEID3;
1977 break;
1978 case 'I':
1979 m->in_type = FILE_BEID3;
1980 break;
1981 case 'q':
1982 m->in_type = FILE_LEQUAD;
1983 break;
1984 case 'Q':
1985 m->in_type = FILE_BEQUAD;
1986 break;
1987 default:
1988 if (ms->flags & MAGIC_CHECK)
1989 file_magwarn(ms,
1990 "indirect offset type `%c' invalid",
1991 *l);
1992 return -1;
1993 }
1994 l++;
1995 }
1996
1997 if (*l == '~') {
1998 m->in_op |= FILE_OPINVERSE;
1999 l++;
2000 }
2001 if ((op = get_op(*l)) != -1) {
2002 m->in_op |= op;
2003 l++;
2004 }
2005 if (*l == '(') {
2006 m->in_op |= FILE_OPINDIRECT;
2007 l++;
2008 }
2009 if (isdigit(CAST(unsigned char, *l)) || *l == '-') {
2010 m->in_offset = CAST(int32_t, strtol(l, &t, 0));
2011 if (l == t) {
2012 if (ms->flags & MAGIC_CHECK)
2013 file_magwarn(ms,
2014 "in_offset `%s' invalid", l);
2015 return -1;
2016 }
2017 l = t;
2018 }
2019 if (*l++ != ')' ||
2020 ((m->in_op & FILE_OPINDIRECT) && *l++ != ')')) {
2021 if (ms->flags & MAGIC_CHECK)
2022 file_magwarn(ms,
2023 "missing ')' in indirect offset");
2024 return -1;
2025 }
2026 }
2027 EATAB;
2028
2029 #ifdef ENABLE_CONDITIONALS
2030 m->cond = get_cond(l, &l);
2031 if (check_cond(ms, m->cond, cont_level) == -1)
2032 return -1;
2033
2034 EATAB;
2035 #endif
2036
2037 /*
2038 * Parse the type.
2039 */
2040 if (*l == 'u') {
2041 /*
2042 * Try it as a keyword type prefixed by "u"; match what
2043 * follows the "u". If that fails, try it as an SUS
2044 * integer type.
2045 */
2046 m->type = get_type(type_tbl, l + 1, &l);
2047 if (m->type == FILE_INVALID) {
2048 /*
2049 * Not a keyword type; parse it as an SUS type,
2050 * 'u' possibly followed by a number or C/S/L.
2051 */
2052 m->type = get_standard_integer_type(l, &l);
2053 }
2054 /* It's unsigned. */
2055 if (m->type != FILE_INVALID)
2056 m->flag |= UNSIGNED;
2057 } else {
2058 /*
2059 * Try it as a keyword type. If that fails, try it as
2060 * an SUS integer type if it begins with "d" or as an
2061 * SUS string type if it begins with "s". In any case,
2062 * it's not unsigned.
2063 */
2064 m->type = get_type(type_tbl, l, &l);
2065 if (m->type == FILE_INVALID) {
2066 /*
2067 * Not a keyword type; parse it as an SUS type,
2068 * either 'd' possibly followed by a number or
2069 * C/S/L, or just 's'.
2070 */
2071 if (*l == 'd')
2072 m->type = get_standard_integer_type(l, &l);
2073 else if (*l == 's'
2074 && !isalpha(CAST(unsigned char, l[1]))) {
2075 m->type = FILE_STRING;
2076 ++l;
2077 }
2078 }
2079 }
2080
2081 if (m->type == FILE_INVALID) {
2082 /* Not found - try it as a special keyword. */
2083 m->type = get_type(special_tbl, l, &l);
2084 }
2085
2086 if (m->type == FILE_INVALID) {
2087 if (ms->flags & MAGIC_CHECK)
2088 file_magwarn(ms, "type `%s' invalid", l);
2089 return -1;
2090 }
2091
2092 if (m->type == FILE_NAME && cont_level != 0) {
2093 if (ms->flags & MAGIC_CHECK)
2094 file_magwarn(ms, "`name%s' entries can only be "
2095 "declared at top level", l);
2096 return -1;
2097 }
2098
2099 /* New-style anding: "0 byte&0x80 =0x80 dynamically linked" */
2100 /* New and improved: ~ & | ^ + - * / % -- exciting, isn't it? */
2101
2102 m->mask_op = 0;
2103 if (*l == '~') {
2104 if (!IS_LIBMAGIC_STRING(m->type))
2105 m->mask_op |= FILE_OPINVERSE;
2106 else if (ms->flags & MAGIC_CHECK)
2107 file_magwarn(ms, "'~' invalid for string types");
2108 ++l;
2109 }
2110 m->str_range = 0;
2111 m->str_flags = m->type == FILE_PSTRING ? PSTRING_1_LE : 0;
2112 if ((op = get_op(*l)) != -1) {
2113 if (IS_LIBMAGIC_STRING(m->type)) {
2114 int r;
2115
2116 if (op != FILE_OPDIVIDE) {
2117 if (ms->flags & MAGIC_CHECK)
2118 file_magwarn(ms,
2119 "invalid string/indirect op: "
2120 "`%c'", *t);
2121 return -1;
2122 }
2123
2124 if (m->type == FILE_INDIRECT)
2125 r = parse_indirect_modifier(ms, m, &l);
2126 else
2127 r = parse_string_modifier(ms, m, &l);
2128 if (r == -1)
2129 return -1;
2130 } else
2131 parse_op_modifier(ms, m, &l, op);
2132 }
2133
2134 /*
2135 * We used to set mask to all 1's here, instead let's just not do
2136 * anything if mask = 0 (unless you have a better idea)
2137 */
2138 EATAB;
2139
2140 switch (*l) {
2141 case '>':
2142 case '<':
2143 m->reln = *l;
2144 ++l;
2145 if (*l == '=') {
2146 if (ms->flags & MAGIC_CHECK) {
2147 file_magwarn(ms, "%c= not supported",
2148 m->reln);
2149 return -1;
2150 }
2151 ++l;
2152 }
2153 break;
2154 /* Old-style anding: "0 byte &0x80 dynamically linked" */
2155 case '&':
2156 case '^':
2157 case '=':
2158 m->reln = *l;
2159 ++l;
2160 if (*l == '=') {
2161 /* HP compat: ignore &= etc. */
2162 ++l;
2163 }
2164 break;
2165 case '!':
2166 m->reln = *l;
2167 ++l;
2168 break;
2169 default:
2170 m->reln = '='; /* the default relation */
2171 if (*l == 'x' && ((isascii(CAST(unsigned char, l[1])) &&
2172 isspace(CAST(unsigned char, l[1]))) || !l[1])) {
2173 m->reln = *l;
2174 ++l;
2175 }
2176 break;
2177 }
2178 /*
2179 * Grab the value part, except for an 'x' reln.
2180 */
2181 if (m->reln != 'x' && getvalue(ms, m, &l, action))
2182 return -1;
2183
2184 /*
2185 * TODO finish this macro and start using it!
2186 * #define offsetcheck {if (offset > ms->bytes_max -1)
2187 * magwarn("offset too big"); }
2188 */
2189
2190 /*
2191 * Now get last part - the description
2192 */
2193 EATAB;
2194 if (l[0] == '\b') {
2195 ++l;
2196 m->flag |= NOSPACE;
2197 } else if ((l[0] == '\\') && (l[1] == 'b')) {
2198 ++l;
2199 ++l;
2200 m->flag |= NOSPACE;
2201 }
2202 for (i = 0; (m->desc[i++] = *l++) != '\0' && i < sizeof(m->desc); )
2203 continue;
2204 if (i == sizeof(m->desc)) {
2205 m->desc[sizeof(m->desc) - 1] = '\0';
2206 if (ms->flags & MAGIC_CHECK)
2207 file_magwarn(ms, "description `%s' truncated", m->desc);
2208 }
2209
2210 /*
2211 * We only do this check while compiling, or if any of the magic
2212 * files were not compiled.
2213 */
2214 if (ms->flags & MAGIC_CHECK) {
2215 if (check_format(ms, m) == -1)
2216 return -1;
2217 }
2218 #ifndef COMPILE_ONLY
2219 if (action == FILE_CHECK) {
2220 file_mdump(m);
2221 }
2222 #endif
2223 m->mimetype[0] = '\0'; /* initialise MIME type to none */
2224 return 0;
2225 }
2226
2227 /*
2228 * parse a STRENGTH annotation line from magic file, put into magic[index - 1]
2229 * if valid
2230 */
2231 private int
parse_strength(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2232 parse_strength(struct magic_set *ms, struct magic_entry *me, const char *line,
2233 size_t len)
2234 {
2235 const char *l = line;
2236 char *el;
2237 unsigned long factor;
2238 struct magic *m = &me->mp[0];
2239
2240 if (m->factor_op != FILE_FACTOR_OP_NONE) {
2241 file_magwarn(ms,
2242 "Current entry already has a strength type: %c %d",
2243 m->factor_op, m->factor);
2244 return -1;
2245 }
2246 if (m->type == FILE_NAME) {
2247 file_magwarn(ms, "%s: Strength setting is not supported in "
2248 "\"name\" magic entries", m->value.s);
2249 return -1;
2250 }
2251 EATAB;
2252 switch (*l) {
2253 case FILE_FACTOR_OP_NONE:
2254 case FILE_FACTOR_OP_PLUS:
2255 case FILE_FACTOR_OP_MINUS:
2256 case FILE_FACTOR_OP_TIMES:
2257 case FILE_FACTOR_OP_DIV:
2258 m->factor_op = *l++;
2259 break;
2260 default:
2261 file_magwarn(ms, "Unknown factor op `%c'", *l);
2262 return -1;
2263 }
2264 EATAB;
2265 factor = strtoul(l, &el, 0);
2266 if (factor > 255) {
2267 file_magwarn(ms, "Too large factor `%lu'", factor);
2268 goto out;
2269 }
2270 if (*el && !isspace(CAST(unsigned char, *el))) {
2271 file_magwarn(ms, "Bad factor `%s'", l);
2272 goto out;
2273 }
2274 m->factor = CAST(uint8_t, factor);
2275 if (m->factor == 0 && m->factor_op == FILE_FACTOR_OP_DIV) {
2276 file_magwarn(ms, "Cannot have factor op `%c' and factor %u",
2277 m->factor_op, m->factor);
2278 goto out;
2279 }
2280 return 0;
2281 out:
2282 m->factor_op = FILE_FACTOR_OP_NONE;
2283 m->factor = 0;
2284 return -1;
2285 }
2286
2287 private int
goodchar(unsigned char x,const char * extra)2288 goodchar(unsigned char x, const char *extra)
2289 {
2290 return (isascii(x) && isalnum(x)) || strchr(extra, x);
2291 }
2292
2293 private int
parse_extra(struct magic_set * ms,struct magic_entry * me,const char * line,size_t llen,zend_off_t off,size_t len,const char * name,const char * extra,int nt)2294 parse_extra(struct magic_set *ms, struct magic_entry *me, const char *line,
2295 size_t llen, zend_off_t off, size_t len, const char *name, const char *extra, int nt)
2296 {
2297 size_t i;
2298 const char *l = line;
2299 struct magic *m = &me->mp[me->cont_count == 0 ? 0 : me->cont_count - 1];
2300 char *buf = CAST(char *, CAST(void *, m)) + off;
2301
2302 if (buf[0] != '\0') {
2303 len = nt ? strlen(buf) : len;
2304 file_magwarn(ms, "Current entry already has a %s type "
2305 "`%.*s', new type `%s'", name, CAST(int, len), buf, l);
2306 return -1;
2307 }
2308
2309 if (*m->desc == '\0') {
2310 file_magwarn(ms, "Current entry does not yet have a "
2311 "description for adding a %s type", name);
2312 return -1;
2313 }
2314
2315 EATAB;
2316 for (i = 0; *l && i < llen && i < len && goodchar(*l, extra);
2317 buf[i++] = *l++)
2318 continue;
2319
2320 if (i == len && *l) {
2321 if (nt)
2322 buf[len - 1] = '\0';
2323 if (ms->flags & MAGIC_CHECK)
2324 file_magwarn(ms, "%s type `%s' truncated %"
2325 SIZE_T_FORMAT "u", name, line, i);
2326 } else {
2327 if (!isspace(CAST(unsigned char, *l)) && !goodchar(*l, extra))
2328 file_magwarn(ms, "%s type `%s' has bad char '%c'",
2329 name, line, *l);
2330 if (nt)
2331 buf[i] = '\0';
2332 }
2333
2334 if (i > 0)
2335 return 0;
2336
2337 file_magerror(ms, "Bad magic entry '%s'", line);
2338 return -1;
2339 }
2340
2341 /*
2342 * Parse an Apple CREATOR/TYPE annotation from magic file and put it into
2343 * magic[index - 1]
2344 */
2345 private int
parse_apple(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2346 parse_apple(struct magic_set *ms, struct magic_entry *me, const char *line,
2347 size_t len)
2348 {
2349 struct magic *m = &me->mp[0];
2350
2351 return parse_extra(ms, me, line, len,
2352 CAST(off_t, offsetof(struct magic, apple)),
2353 sizeof(m->apple), "APPLE", "!+-./?", 0);
2354 }
2355
2356 /*
2357 * Parse a comma-separated list of extensions
2358 */
2359 private int
parse_ext(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2360 parse_ext(struct magic_set *ms, struct magic_entry *me, const char *line,
2361 size_t len)
2362 {
2363 struct magic *m = &me->mp[0];
2364
2365 return parse_extra(ms, me, line, len,
2366 CAST(off_t, offsetof(struct magic, ext)),
2367 sizeof(m->ext), "EXTENSION", ",!+-/@?_$", 0);
2368 }
2369
2370 /*
2371 * parse a MIME annotation line from magic file, put into magic[index - 1]
2372 * if valid
2373 */
2374 private int
parse_mime(struct magic_set * ms,struct magic_entry * me,const char * line,size_t len)2375 parse_mime(struct magic_set *ms, struct magic_entry *me, const char *line,
2376 size_t len)
2377 {
2378 struct magic *m = &me->mp[0];
2379
2380 return parse_extra(ms, me, line, len,
2381 CAST(off_t, offsetof(struct magic, mimetype)),
2382 sizeof(m->mimetype), "MIME", "+-/.$?:{}", 1);
2383 }
2384
2385 private int
check_format_type(const char * ptr,int type,const char ** estr)2386 check_format_type(const char *ptr, int type, const char **estr)
2387 {
2388 int quad = 0, h;
2389 size_t len, cnt;
2390 if (*ptr == '\0') {
2391 /* Missing format string; bad */
2392 *estr = "missing format spec";
2393 return -1;
2394 }
2395
2396 switch (file_formats[type]) {
2397 case FILE_FMT_QUAD:
2398 quad = 1;
2399 /*FALLTHROUGH*/
2400 case FILE_FMT_NUM:
2401 if (quad == 0) {
2402 switch (type) {
2403 case FILE_BYTE:
2404 h = 2;
2405 break;
2406 case FILE_SHORT:
2407 case FILE_BESHORT:
2408 case FILE_LESHORT:
2409 h = 1;
2410 break;
2411 case FILE_LONG:
2412 case FILE_BELONG:
2413 case FILE_LELONG:
2414 case FILE_MELONG:
2415 case FILE_LEID3:
2416 case FILE_BEID3:
2417 case FILE_INDIRECT:
2418 h = 0;
2419 break;
2420 default:
2421 abort();
2422 }
2423 } else
2424 h = 0;
2425 if (*ptr == '-')
2426 ptr++;
2427 if (*ptr == '.')
2428 ptr++;
2429 if (*ptr == '#')
2430 ptr++;
2431 #define CHECKLEN() do { \
2432 for (len = cnt = 0; isdigit(CAST(unsigned char, *ptr)); ptr++, cnt++) \
2433 len = len * 10 + (*ptr - '0'); \
2434 if (cnt > 5 || len > 1024) \
2435 goto toolong; \
2436 } while (/*CONSTCOND*/0)
2437
2438 CHECKLEN();
2439 if (*ptr == '.')
2440 ptr++;
2441 CHECKLEN();
2442 if (quad) {
2443 if (*ptr++ != 'l')
2444 goto invalid;
2445 if (*ptr++ != 'l')
2446 goto invalid;
2447 }
2448
2449 switch (*ptr++) {
2450 #ifdef STRICT_FORMAT /* "long" formats are int formats for us */
2451 /* so don't accept the 'l' modifier */
2452 case 'l':
2453 switch (*ptr++) {
2454 case 'i':
2455 case 'd':
2456 case 'u':
2457 case 'o':
2458 case 'x':
2459 case 'X':
2460 if (h == 0)
2461 return 0;
2462 /*FALLTHROUGH*/
2463 default:
2464 goto invalid;
2465 }
2466
2467 /*
2468 * Don't accept h and hh modifiers. They make writing
2469 * magic entries more complicated, for very little benefit
2470 */
2471 case 'h':
2472 if (h-- <= 0)
2473 goto invalid;
2474 switch (*ptr++) {
2475 case 'h':
2476 if (h-- <= 0)
2477 goto invalid;
2478 switch (*ptr++) {
2479 case 'i':
2480 case 'd':
2481 case 'u':
2482 case 'o':
2483 case 'x':
2484 case 'X':
2485 return 0;
2486 default:
2487 goto invalid;
2488 }
2489 case 'i':
2490 case 'd':
2491 case 'u':
2492 case 'o':
2493 case 'x':
2494 case 'X':
2495 if (h == 0)
2496 return 0;
2497 /*FALLTHROUGH*/
2498 default:
2499 goto invalid;
2500 }
2501 #endif
2502 case 'c':
2503 if (h == 2)
2504 return 0;
2505 goto invalid;
2506 case 'i':
2507 case 'd':
2508 case 'u':
2509 case 'o':
2510 case 'x':
2511 case 'X':
2512 #ifdef STRICT_FORMAT
2513 if (h == 0)
2514 return 0;
2515 /*FALLTHROUGH*/
2516 #else
2517 return 0;
2518 #endif
2519 default:
2520 goto invalid;
2521 }
2522
2523 case FILE_FMT_FLOAT:
2524 case FILE_FMT_DOUBLE:
2525 if (*ptr == '-')
2526 ptr++;
2527 if (*ptr == '.')
2528 ptr++;
2529 CHECKLEN();
2530 if (*ptr == '.')
2531 ptr++;
2532 CHECKLEN();
2533 switch (*ptr++) {
2534 case 'e':
2535 case 'E':
2536 case 'f':
2537 case 'F':
2538 case 'g':
2539 case 'G':
2540 return 0;
2541
2542 default:
2543 goto invalid;
2544 }
2545
2546
2547 case FILE_FMT_STR:
2548 if (*ptr == '-')
2549 ptr++;
2550 while (isdigit(CAST(unsigned char, *ptr)))
2551 ptr++;
2552 if (*ptr == '.') {
2553 ptr++;
2554 while (isdigit(CAST(unsigned char , *ptr)))
2555 ptr++;
2556 }
2557
2558 switch (*ptr++) {
2559 case 's':
2560 return 0;
2561 default:
2562 goto invalid;
2563 }
2564
2565 default:
2566 /* internal error */
2567 abort();
2568 }
2569 invalid:
2570 *estr = "not valid";
2571 toolong:
2572 *estr = "too long";
2573 return -1;
2574 }
2575
2576 /*
2577 * Check that the optional printf format in description matches
2578 * the type of the magic.
2579 */
2580 private int
check_format(struct magic_set * ms,struct magic * m)2581 check_format(struct magic_set *ms, struct magic *m)
2582 {
2583 char *ptr;
2584 const char *estr;
2585
2586 for (ptr = m->desc; *ptr; ptr++)
2587 if (*ptr == '%')
2588 break;
2589 if (*ptr == '\0') {
2590 /* No format string; ok */
2591 return 1;
2592 }
2593
2594 assert(file_nformats == file_nnames);
2595
2596 if (m->type >= file_nformats) {
2597 file_magwarn(ms, "Internal error inconsistency between "
2598 "m->type and format strings");
2599 return -1;
2600 }
2601 if (file_formats[m->type] == FILE_FMT_NONE) {
2602 file_magwarn(ms, "No format string for `%s' with description "
2603 "`%s'", m->desc, file_names[m->type]);
2604 return -1;
2605 }
2606
2607 ptr++;
2608 if (check_format_type(ptr, m->type, &estr) == -1) {
2609 /*
2610 * TODO: this error message is unhelpful if the format
2611 * string is not one character long
2612 */
2613 file_magwarn(ms, "Printf format is %s for type "
2614 "`%s' in description `%s'", estr,
2615 file_names[m->type], m->desc);
2616 return -1;
2617 }
2618
2619 for (; *ptr; ptr++) {
2620 if (*ptr == '%') {
2621 file_magwarn(ms,
2622 "Too many format strings (should have at most one) "
2623 "for `%s' with description `%s'",
2624 file_names[m->type], m->desc);
2625 return -1;
2626 }
2627 }
2628 return 0;
2629 }
2630
2631 /*
2632 * Read a numeric value from a pointer, into the value union of a magic
2633 * pointer, according to the magic type. Update the string pointer to point
2634 * just after the number read. Return 0 for success, non-zero for failure.
2635 */
2636 private int
getvalue(struct magic_set * ms,struct magic * m,const char ** p,int action)2637 getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
2638 {
2639 char *ep;
2640 uint64_t ull;
2641
2642 switch (m->type) {
2643 case FILE_BESTRING16:
2644 case FILE_LESTRING16:
2645 case FILE_STRING:
2646 case FILE_PSTRING:
2647 case FILE_REGEX:
2648 case FILE_SEARCH:
2649 case FILE_NAME:
2650 case FILE_USE:
2651 case FILE_DER:
2652 *p = getstr(ms, m, *p, action == FILE_COMPILE);
2653 if (*p == NULL) {
2654 if (ms->flags & MAGIC_CHECK)
2655 file_magwarn(ms, "cannot get string from `%s'",
2656 m->value.s);
2657 return -1;
2658 }
2659 if (m->type == FILE_REGEX) {
2660 zend_string *pattern;
2661 int options = 0;
2662 pcre_cache_entry *pce;
2663
2664 pattern = convert_libmagic_pattern(m->value.s, strlen(m->value.s), options);
2665
2666 if ((pce = pcre_get_compiled_regex_cache(pattern)) == NULL) {
2667 zend_string_release(pattern);
2668 return -1;
2669 }
2670 zend_string_release(pattern);
2671
2672 return 0;
2673 }
2674 return 0;
2675 default:
2676 if (m->reln == 'x')
2677 return 0;
2678 break;
2679 }
2680
2681 switch (m->type) {
2682 case FILE_FLOAT:
2683 case FILE_BEFLOAT:
2684 case FILE_LEFLOAT:
2685 errno = 0;
2686 #ifdef HAVE_STRTOF
2687 m->value.f = strtof(*p, &ep);
2688 #else
2689 m->value.f = (float)strtod(*p, &ep);
2690 #endif
2691 if (errno == 0)
2692 *p = ep;
2693 return 0;
2694 case FILE_DOUBLE:
2695 case FILE_BEDOUBLE:
2696 case FILE_LEDOUBLE:
2697 errno = 0;
2698 m->value.d = strtod(*p, &ep);
2699 if (errno == 0)
2700 *p = ep;
2701 return 0;
2702 case FILE_GUID:
2703 if (file_parse_guid(*p, m->value.guid) == -1)
2704 return -1;
2705 *p += FILE_GUID_SIZE - 1;
2706 return 0;
2707 default:
2708 errno = 0;
2709 ull = CAST(uint64_t, strtoull(*p, &ep, 0));
2710 m->value.q = file_signextend(ms, m, ull);
2711 if (*p == ep) {
2712 file_magwarn(ms, "Unparsable number `%s'", *p);
2713 } else {
2714 size_t ts = typesize(m->type);
2715 uint64_t x;
2716 const char *q;
2717
2718 if (ts == FILE_BADSIZE) {
2719 file_magwarn(ms,
2720 "Expected numeric type got `%s'",
2721 type_tbl[m->type].name);
2722 }
2723 for (q = *p; isspace(CAST(unsigned char, *q)); q++)
2724 continue;
2725 if (*q == '-')
2726 ull = -CAST(int64_t, ull);
2727 switch (ts) {
2728 case 1:
2729 x = CAST(uint64_t, ull & ~0xffULL);
2730 break;
2731 case 2:
2732 x = CAST(uint64_t, ull & ~0xffffULL);
2733 break;
2734 case 4:
2735 x = CAST(uint64_t, ull & ~0xffffffffULL);
2736 break;
2737 case 8:
2738 x = 0;
2739 break;
2740 default:
2741 abort();
2742 }
2743 if (x) {
2744 file_magwarn(ms, "Overflow for numeric"
2745 " type `%s' value %#" PRIx64,
2746 type_tbl[m->type].name, ull);
2747 }
2748 }
2749 if (errno == 0) {
2750 *p = ep;
2751 eatsize(p);
2752 }
2753 return 0;
2754 }
2755 }
2756
2757 /*
2758 * Convert a string containing C character escapes. Stop at an unescaped
2759 * space or tab.
2760 * Copy the converted version to "m->value.s", and the length in m->vallen.
2761 * Return updated scan pointer as function result. Warn if set.
2762 */
2763 private const char *
getstr(struct magic_set * ms,struct magic * m,const char * s,int warn)2764 getstr(struct magic_set *ms, struct magic *m, const char *s, int warn)
2765 {
2766 const char *origs = s;
2767 char *p = m->value.s;
2768 size_t plen = sizeof(m->value.s);
2769 char *origp = p;
2770 char *pmax = p + plen - 1;
2771 int c;
2772 int val;
2773
2774 while ((c = *s++) != '\0') {
2775 if (isspace(CAST(unsigned char, c)))
2776 break;
2777 if (p >= pmax) {
2778 file_error(ms, 0, "string too long: `%s'", origs);
2779 return NULL;
2780 }
2781 if (c == '\\') {
2782 switch(c = *s++) {
2783
2784 case '\0':
2785 if (warn)
2786 file_magwarn(ms, "incomplete escape");
2787 s--;
2788 goto out;
2789
2790 case '\t':
2791 if (warn) {
2792 file_magwarn(ms,
2793 "escaped tab found, use \\t instead");
2794 warn = 0; /* already did */
2795 }
2796 /*FALLTHROUGH*/
2797 default:
2798 if (warn) {
2799 if (isprint(CAST(unsigned char, c))) {
2800 /* Allow escaping of
2801 * ``relations'' */
2802 if (strchr("<>&^=!", c) == NULL
2803 && (m->type != FILE_REGEX ||
2804 strchr("[]().*?^$|{}", c)
2805 == NULL)) {
2806 file_magwarn(ms, "no "
2807 "need to escape "
2808 "`%c'", c);
2809 }
2810 } else {
2811 file_magwarn(ms,
2812 "unknown escape sequence: "
2813 "\\%03o", c);
2814 }
2815 }
2816 /*FALLTHROUGH*/
2817 /* space, perhaps force people to use \040? */
2818 case ' ':
2819 #if 0
2820 /*
2821 * Other things people escape, but shouldn't need to,
2822 * so we disallow them
2823 */
2824 case '\'':
2825 case '"':
2826 case '?':
2827 #endif
2828 /* Relations */
2829 case '>':
2830 case '<':
2831 case '&':
2832 case '^':
2833 case '=':
2834 case '!':
2835 /* and baskslash itself */
2836 case '\\':
2837 *p++ = CAST(char, c);
2838 break;
2839
2840 case 'a':
2841 *p++ = '\a';
2842 break;
2843
2844 case 'b':
2845 *p++ = '\b';
2846 break;
2847
2848 case 'f':
2849 *p++ = '\f';
2850 break;
2851
2852 case 'n':
2853 *p++ = '\n';
2854 break;
2855
2856 case 'r':
2857 *p++ = '\r';
2858 break;
2859
2860 case 't':
2861 *p++ = '\t';
2862 break;
2863
2864 case 'v':
2865 *p++ = '\v';
2866 break;
2867
2868 /* \ and up to 3 octal digits */
2869 case '0':
2870 case '1':
2871 case '2':
2872 case '3':
2873 case '4':
2874 case '5':
2875 case '6':
2876 case '7':
2877 val = c - '0';
2878 c = *s++; /* try for 2 */
2879 if (c >= '0' && c <= '7') {
2880 val = (val << 3) | (c - '0');
2881 c = *s++; /* try for 3 */
2882 if (c >= '0' && c <= '7')
2883 val = (val << 3) | (c-'0');
2884 else
2885 --s;
2886 }
2887 else
2888 --s;
2889 *p++ = CAST(char, val);
2890 break;
2891
2892 /* \x and up to 2 hex digits */
2893 case 'x':
2894 val = 'x'; /* Default if no digits */
2895 c = hextoint(*s++); /* Get next char */
2896 if (c >= 0) {
2897 val = c;
2898 c = hextoint(*s++);
2899 if (c >= 0)
2900 val = (val << 4) + c;
2901 else
2902 --s;
2903 } else
2904 --s;
2905 *p++ = CAST(char, val);
2906 break;
2907 }
2908 } else
2909 *p++ = CAST(char, c);
2910 }
2911 --s;
2912 out:
2913 *p = '\0';
2914 m->vallen = CAST(unsigned char, (p - origp));
2915 if (m->type == FILE_PSTRING) {
2916 size_t l = file_pstring_length_size(ms, m);
2917 if (l == FILE_BADSIZE)
2918 return NULL;
2919 m->vallen += CAST(unsigned char, l);
2920 }
2921 return s;
2922 }
2923
2924
2925 /* Single hex char to int; -1 if not a hex char. */
2926 private int
hextoint(int c)2927 hextoint(int c)
2928 {
2929 if (!isascii(CAST(unsigned char, c)))
2930 return -1;
2931 if (isdigit(CAST(unsigned char, c)))
2932 return c - '0';
2933 if ((c >= 'a') && (c <= 'f'))
2934 return c + 10 - 'a';
2935 if (( c>= 'A') && (c <= 'F'))
2936 return c + 10 - 'A';
2937 return -1;
2938 }
2939
2940
2941 /*
2942 * Print a string containing C character escapes.
2943 */
2944 protected void
file_showstr(FILE * fp,const char * s,size_t len)2945 file_showstr(FILE *fp, const char *s, size_t len)
2946 {
2947 char c;
2948
2949 for (;;) {
2950 if (len == FILE_BADSIZE) {
2951 c = *s++;
2952 if (c == '\0')
2953 break;
2954 }
2955 else {
2956 if (len-- == 0)
2957 break;
2958 c = *s++;
2959 }
2960 if (c >= 040 && c <= 0176) /* TODO isprint && !iscntrl */
2961 (void) fputc(c, fp);
2962 else {
2963 (void) fputc('\\', fp);
2964 switch (c) {
2965 case '\a':
2966 (void) fputc('a', fp);
2967 break;
2968
2969 case '\b':
2970 (void) fputc('b', fp);
2971 break;
2972
2973 case '\f':
2974 (void) fputc('f', fp);
2975 break;
2976
2977 case '\n':
2978 (void) fputc('n', fp);
2979 break;
2980
2981 case '\r':
2982 (void) fputc('r', fp);
2983 break;
2984
2985 case '\t':
2986 (void) fputc('t', fp);
2987 break;
2988
2989 case '\v':
2990 (void) fputc('v', fp);
2991 break;
2992
2993 default:
2994 (void) fprintf(fp, "%.3o", c & 0377);
2995 break;
2996 }
2997 }
2998 }
2999 }
3000
3001 /*
3002 * eatsize(): Eat the size spec from a number [eg. 10UL]
3003 */
3004 private void
eatsize(const char ** p)3005 eatsize(const char **p)
3006 {
3007 const char *l = *p;
3008
3009 if (LOWCASE(*l) == 'u')
3010 l++;
3011
3012 switch (LOWCASE(*l)) {
3013 case 'l': /* long */
3014 case 's': /* short */
3015 case 'h': /* short */
3016 case 'b': /* char/byte */
3017 case 'c': /* char/byte */
3018 l++;
3019 /*FALLTHROUGH*/
3020 default:
3021 break;
3022 }
3023
3024 *p = l;
3025 }
3026
3027 /*
3028 * handle a compiled file.
3029 */
3030
3031 private struct magic_map *
apprentice_map(struct magic_set * ms,const char * fn)3032 apprentice_map(struct magic_set *ms, const char *fn)
3033 {
3034 uint32_t *ptr;
3035 uint32_t version, entries = 0, nentries;
3036 int needsbyteswap;
3037 char *dbname = NULL;
3038 struct magic_map *map;
3039 size_t i;
3040 php_stream *stream = NULL;
3041 php_stream_statbuf st;
3042
3043
3044
3045 if ((map = CAST(struct magic_map *, ecalloc(1, sizeof(*map)))) == NULL) {
3046 file_oomem(ms, sizeof(*map));
3047 return NULL;
3048 }
3049
3050 if (fn == NULL) {
3051 map->p = (void *)&php_magic_database;
3052 goto internal_loaded;
3053 }
3054
3055 #ifdef PHP_WIN32
3056 /* Don't bother on windows with php_stream_open_wrapper,
3057 return to give apprentice_load() a chance. */
3058 if (php_stream_stat_path_ex((char *)fn, 0, &st, NULL) == SUCCESS) {
3059 if (st.sb.st_mode & S_IFDIR) {
3060 goto error;
3061 }
3062 }
3063 #endif
3064
3065 dbname = mkdbname(ms, fn, 0);
3066 if (dbname == NULL)
3067 goto error;
3068
3069 stream = php_stream_open_wrapper((char *)fn, "rb", REPORT_ERRORS, NULL);
3070
3071 if (!stream) {
3072 goto error;
3073 }
3074
3075 #ifndef PHP_WIN32
3076 if (php_stream_stat(stream, &st) < 0) {
3077 file_error(ms, errno, "cannot stat `%s'", dbname);
3078 goto error;
3079 }
3080 #endif
3081 if (st.sb.st_size < 8 || st.sb.st_size > maxoff_t()) {
3082 file_error(ms, 0, "file `%s' is too %s", dbname,
3083 st.sb.st_size < 8 ? "small" : "large");
3084 goto error;
3085 }
3086
3087 map->type = MAP_TYPE_MALLOC;
3088 map->len = CAST(size_t, st.sb.st_size);
3089 map->p = CAST(void *, emalloc(map->len));
3090
3091 if (php_stream_read(stream, map->p, (size_t)st.sb.st_size) != (size_t)st.sb.st_size) {
3092 file_badread(ms);
3093 goto error;
3094 }
3095
3096 php_stream_close(stream);
3097 stream = NULL;
3098
3099 internal_loaded:
3100 ptr = (uint32_t *)(void *)map->p;
3101 if (*ptr != MAGICNO) {
3102 if (swap4(*ptr) != MAGICNO) {
3103 file_error(ms, 0, "bad magic in `%s'", dbname);
3104 goto error;
3105 }
3106 needsbyteswap = 1;
3107 } else
3108 needsbyteswap = 0;
3109 if (needsbyteswap)
3110 version = swap4(ptr[1]);
3111 else
3112 version = ptr[1];
3113 if (version != VERSIONNO) {
3114 file_error(ms, 0, "File %d supports only version %d magic "
3115 "files. `%s' is version %d", MAGIC_VERSION,
3116 VERSIONNO, dbname, version);
3117 goto error;
3118 }
3119
3120 /* php_magic_database is a const, performing writes will segfault. This is for big-endian
3121 machines only, PPC and Sparc specifically. Consider static variable or MINIT in
3122 future. */
3123 if (needsbyteswap && fn == NULL) {
3124 map->p = emalloc(sizeof(php_magic_database));
3125 map->p = memcpy(map->p, php_magic_database, sizeof(php_magic_database));
3126 }
3127
3128 if (NULL != fn) {
3129 nentries = (uint32_t)(st.sb.st_size / sizeof(struct magic));
3130 entries = (uint32_t)(st.sb.st_size / sizeof(struct magic));
3131 if ((zend_off_t)(entries * sizeof(struct magic)) != st.sb.st_size) {
3132 file_error(ms, 0, "Size of `%s' %llu is not a multiple of %zu",
3133 dbname, (unsigned long long)st.sb.st_size,
3134 sizeof(struct magic));
3135 goto error;
3136 }
3137 }
3138 map->magic[0] = CAST(struct magic *, map->p) + 1;
3139 nentries = 0;
3140 for (i = 0; i < MAGIC_SETS; i++) {
3141 if (needsbyteswap)
3142 map->nmagic[i] = swap4(ptr[i + 2]);
3143 else
3144 map->nmagic[i] = ptr[i + 2];
3145 if (i != MAGIC_SETS - 1)
3146 map->magic[i + 1] = map->magic[i] + map->nmagic[i];
3147 nentries += map->nmagic[i];
3148 }
3149 if (NULL != fn && entries != nentries + 1) {
3150 file_error(ms, 0, "Inconsistent entries in `%s' %u != %u",
3151 dbname, entries, nentries + 1);
3152 goto error;
3153 }
3154 if (needsbyteswap)
3155 for (i = 0; i < MAGIC_SETS; i++)
3156 byteswap(map->magic[i], map->nmagic[i]);
3157
3158 if (dbname) {
3159 efree(dbname);
3160 }
3161 return map;
3162
3163 error:
3164 if (stream) {
3165 php_stream_close(stream);
3166 }
3167 apprentice_unmap(map);
3168 if (dbname) {
3169 efree(dbname);
3170 }
3171 return NULL;
3172 }
3173
3174 /*
3175 * handle an mmaped file.
3176 */
3177 private int
apprentice_compile(struct magic_set * ms,struct magic_map * map,const char * fn)3178 apprentice_compile(struct magic_set *ms, struct magic_map *map, const char *fn)
3179 {
3180 static const size_t nm = sizeof(*map->nmagic) * MAGIC_SETS;
3181 static const size_t m = sizeof(**map->magic);
3182 size_t len;
3183 char *dbname;
3184 int rv = -1;
3185 uint32_t i;
3186 union {
3187 struct magic m;
3188 uint32_t h[2 + MAGIC_SETS];
3189 } hdr;
3190 php_stream *stream;
3191
3192 dbname = mkdbname(ms, fn, 1);
3193
3194 if (dbname == NULL)
3195 goto out;
3196
3197 /* wb+ == O_WRONLY|O_CREAT|O_TRUNC|O_BINARY */
3198 stream = php_stream_open_wrapper((char *)fn, "wb+", REPORT_ERRORS, NULL);
3199
3200 if (!stream) {
3201 file_error(ms, errno, "cannot open `%s'", dbname);
3202 goto out;
3203 }
3204 memset(&hdr, 0, sizeof(hdr));
3205 hdr.h[0] = MAGICNO;
3206 hdr.h[1] = VERSIONNO;
3207 memcpy(hdr.h + 2, map->nmagic, nm);
3208
3209 if (php_stream_write(stream,(const char *)&hdr, sizeof(hdr)) != (ssize_t)sizeof(hdr)) {
3210 file_error(ms, errno, "error writing `%s'", dbname);
3211 goto out;
3212 }
3213
3214 for (i = 0; i < MAGIC_SETS; i++) {
3215 len = m * map->nmagic[i];
3216 if (php_stream_write(stream, (const char *)map->magic[i], len) != (ssize_t)len) {
3217 file_error(ms, errno, "error writing `%s'", dbname);
3218 goto out;
3219 }
3220 }
3221
3222 if (stream) {
3223 php_stream_close(stream);
3224 }
3225 rv = 0;
3226 out:
3227 efree(dbname);
3228 return rv;
3229 }
3230
3231 private const char ext[] = ".mgc";
3232 /*
3233 * make a dbname
3234 */
3235 private char *
mkdbname(struct magic_set * ms,const char * fn,int strip)3236 mkdbname(struct magic_set *ms, const char *fn, int strip)
3237 {
3238 const char *p, *q;
3239 char *buf;
3240
3241 if (strip) {
3242 if ((p = strrchr(fn, '/')) != NULL)
3243 fn = ++p;
3244 }
3245
3246 for (q = fn; *q; q++)
3247 continue;
3248 /* Look for .mgc */
3249 for (p = ext + sizeof(ext) - 1; p >= ext && q >= fn; p--, q--)
3250 if (*p != *q)
3251 break;
3252
3253 /* Did not find .mgc, restore q */
3254 if (p >= ext)
3255 while (*q)
3256 q++;
3257
3258 q++;
3259 /* Compatibility with old code that looked in .mime */
3260 if (ms->flags & MAGIC_MIME) {
3261 spprintf(&buf, MAXPATHLEN, "%.*s.mime%s", CAST(int, q - fn), fn, ext);
3262 #ifdef PHP_WIN32
3263 if (VCWD_ACCESS(buf, R_OK) == 0) {
3264 #else
3265 if (VCWD_ACCESS(buf, R_OK) != -1) {
3266 #endif
3267 ms->flags &= MAGIC_MIME_TYPE;
3268 return buf;
3269 }
3270 efree(buf);
3271 }
3272 spprintf(&buf, MAXPATHLEN, "%.*s%s", CAST(int, q - fn), fn, ext);
3273
3274 /* Compatibility with old code that looked in .mime */
3275 if (strstr(fn, ".mime") != NULL)
3276 ms->flags &= MAGIC_MIME_TYPE;
3277 return buf;
3278 }
3279
3280 /*
3281 * Byteswap an mmap'ed file if needed
3282 */
3283 private void
3284 byteswap(struct magic *magic, uint32_t nmagic)
3285 {
3286 uint32_t i;
3287 for (i = 0; i < nmagic; i++)
3288 bs1(&magic[i]);
3289 }
3290
3291 /*
3292 * swap a short
3293 */
3294 private uint16_t
3295 swap2(uint16_t sv)
3296 {
3297 uint16_t rv;
3298 uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
3299 uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
3300 d[0] = s[1];
3301 d[1] = s[0];
3302 return rv;
3303 }
3304
3305 /*
3306 * swap an int
3307 */
3308 private uint32_t
3309 swap4(uint32_t sv)
3310 {
3311 uint32_t rv;
3312 uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
3313 uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
3314 d[0] = s[3];
3315 d[1] = s[2];
3316 d[2] = s[1];
3317 d[3] = s[0];
3318 return rv;
3319 }
3320
3321 /*
3322 * swap a quad
3323 */
3324 private uint64_t
3325 swap8(uint64_t sv)
3326 {
3327 uint64_t rv;
3328 uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
3329 uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
3330 #if 0
3331 d[0] = s[3];
3332 d[1] = s[2];
3333 d[2] = s[1];
3334 d[3] = s[0];
3335 d[4] = s[7];
3336 d[5] = s[6];
3337 d[6] = s[5];
3338 d[7] = s[4];
3339 #else
3340 d[0] = s[7];
3341 d[1] = s[6];
3342 d[2] = s[5];
3343 d[3] = s[4];
3344 d[4] = s[3];
3345 d[5] = s[2];
3346 d[6] = s[1];
3347 d[7] = s[0];
3348 #endif
3349 return rv;
3350 }
3351
3352 /*
3353 * byteswap a single magic entry
3354 */
3355 private void
3356 bs1(struct magic *m)
3357 {
3358 m->cont_level = swap2(m->cont_level);
3359 m->offset = swap4(CAST(uint32_t, m->offset));
3360 m->in_offset = swap4(CAST(uint32_t, m->in_offset));
3361 m->lineno = swap4(CAST(uint32_t, m->lineno));
3362 if (IS_LIBMAGIC_STRING(m->type)) {
3363 m->str_range = swap4(m->str_range);
3364 m->str_flags = swap4(m->str_flags);
3365 }
3366 else {
3367 m->value.q = swap8(m->value.q);
3368 m->num_mask = swap8(m->num_mask);
3369 }
3370 }
3371
3372 protected size_t
3373 file_pstring_length_size(struct magic_set *ms, const struct magic *m)
3374 {
3375 switch (m->str_flags & PSTRING_LEN) {
3376 case PSTRING_1_LE:
3377 return 1;
3378 case PSTRING_2_LE:
3379 case PSTRING_2_BE:
3380 return 2;
3381 case PSTRING_4_LE:
3382 case PSTRING_4_BE:
3383 return 4;
3384 default:
3385 file_error(ms, 0, "corrupt magic file "
3386 "(bad pascal string length %d)",
3387 m->str_flags & PSTRING_LEN);
3388 return FILE_BADSIZE;
3389 }
3390 }
3391 protected size_t
3392 file_pstring_get_length(struct magic_set *ms, const struct magic *m,
3393 const char *ss)
3394 {
3395 size_t len = 0;
3396 const unsigned char *s = RCAST(const unsigned char *, ss);
3397 unsigned int s3, s2, s1, s0;
3398
3399 switch (m->str_flags & PSTRING_LEN) {
3400 case PSTRING_1_LE:
3401 len = *s;
3402 break;
3403 case PSTRING_2_LE:
3404 s0 = s[0];
3405 s1 = s[1];
3406 len = (s1 << 8) | s0;
3407 break;
3408 case PSTRING_2_BE:
3409 s0 = s[0];
3410 s1 = s[1];
3411 len = (s0 << 8) | s1;
3412 break;
3413 case PSTRING_4_LE:
3414 s0 = s[0];
3415 s1 = s[1];
3416 s2 = s[2];
3417 s3 = s[3];
3418 len = (s3 << 24) | (s2 << 16) | (s1 << 8) | s0;
3419 break;
3420 case PSTRING_4_BE:
3421 s0 = s[0];
3422 s1 = s[1];
3423 s2 = s[2];
3424 s3 = s[3];
3425 len = (s0 << 24) | (s1 << 16) | (s2 << 8) | s3;
3426 break;
3427 default:
3428 file_error(ms, 0, "corrupt magic file "
3429 "(bad pascal string length %d)",
3430 m->str_flags & PSTRING_LEN);
3431 return FILE_BADSIZE;
3432 }
3433
3434 if (m->str_flags & PSTRING_LENGTH_INCLUDES_ITSELF) {
3435 size_t l = file_pstring_length_size(ms, m);
3436 if (l == FILE_BADSIZE)
3437 return l;
3438 len -= l;
3439 }
3440
3441 return len;
3442 }
3443
3444 protected int
3445 file_magicfind(struct magic_set *ms, const char *name, struct mlist *v)
3446 {
3447 uint32_t i, j;
3448 struct mlist *mlist, *ml;
3449
3450 mlist = ms->mlist[1];
3451
3452 for (ml = mlist->next; ml != mlist; ml = ml->next) {
3453 struct magic *ma = ml->magic;
3454 uint32_t nma = ml->nmagic;
3455 for (i = 0; i < nma; i++) {
3456 if (ma[i].type != FILE_NAME)
3457 continue;
3458 if (strcmp(ma[i].value.s, name) == 0) {
3459 v->magic = &ma[i];
3460 for (j = i + 1; j < nma; j++)
3461 if (ma[j].cont_level == 0)
3462 break;
3463 v->nmagic = j - i;
3464 return 0;
3465 }
3466 }
3467 }
3468 return -1;
3469 }
3470
