2 * Copyright (c) 2008, 2016 Christos Zoulas
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
15 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
16 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
18 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24 * POSSIBILITY OF SUCH DAMAGE.
29 FILE_RCSID("@(#)$File: readcdf.c,v 1.74 2019/09/11 15:46:30 christos Exp $")
42 #define NOTMIME(ms) (((ms)->flags & MAGIC_MIME) == 0)
44 static const struct nv {
48 { "Word", "msword", },
49 { "Excel", "vnd.ms-excel", },
50 { "Powerpoint", "vnd.ms-powerpoint", },
51 { "Crystal Reports", "x-rpt", },
52 { "Advanced Installer", "vnd.ms-msi", },
53 { "InstallShield", "vnd.ms-msi", },
54 { "Microsoft Patch Compiler", "vnd.ms-msi", },
55 { "NAnt", "vnd.ms-msi", },
56 { "Windows Installer", "vnd.ms-msi", },
59 { "Book", "vnd.ms-excel", },
60 { "Workbook", "vnd.ms-excel", },
61 { "WordDocument", "msword", },
62 { "PowerPoint", "vnd.ms-powerpoint", },
63 { "DigitalSignature", "vnd.ms-msi", },
66 { "Book", "Microsoft Excel", },
67 { "Workbook", "Microsoft Excel", },
68 { "WordDocument", "Microsoft Word", },
69 { "PowerPoint", "Microsoft PowerPoint", },
70 { "DigitalSignature", "Microsoft Installer", },
74 static const struct cv {
79 { 0x00000000000c1084ULL, 0x46000000000000c0ULL },
87 { 0x00000000000c1084ULL, 0x46000000000000c0ULL },
96 cdf_clsid_to_mime(const uint64_t clsid[2], const struct cv *cv)
99 for (i = 0; cv[i].mime != NULL; i++) {
100 if (clsid[0] == cv[i].clsid[0] && clsid[1] == cv[i].clsid[1])
104 fprintf(stderr, "unknown mime %" PRIx64 ", %" PRIx64 "\n", clsid[0],
111 cdf_app_to_mime(const char *vbuf, const struct nv *nv)
114 const char *rv = NULL;
116 locale_t old_lc_ctype, c_lc_ctype;
118 c_lc_ctype = newlocale(LC_CTYPE_MASK, "C", 0);
119 assert(c_lc_ctype != NULL);
120 old_lc_ctype = uselocale(c_lc_ctype);
121 assert(old_lc_ctype != NULL);
123 char *old_lc_ctype = setlocale(LC_CTYPE, NULL);
124 assert(old_lc_ctype != NULL);
125 old_lc_ctype = strdup(old_lc_ctype);
126 assert(old_lc_ctype != NULL);
127 (void)setlocale(LC_CTYPE, "C");
129 for (i = 0; nv[i].pattern != NULL; i++)
130 if (strcasestr(vbuf, nv[i].pattern) != NULL) {
135 fprintf(stderr, "unknown app %s\n", vbuf);
138 (void)uselocale(old_lc_ctype);
139 freelocale(c_lc_ctype);
141 (void)setlocale(LC_CTYPE, old_lc_ctype);
148 cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
149 size_t count, const cdf_directory_t *root_storage)
155 const char *str = NULL;
159 if (!NOTMIME(ms) && root_storage)
160 str = cdf_clsid_to_mime(root_storage->d_storage_uuid,
163 for (i = 0; i < count; i++) {
164 cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
165 switch (info[i].pi_type) {
169 if (NOTMIME(ms) && file_printf(ms, ", %s: %hd", buf,
170 info[i].pi_s16) == -1)
174 if (NOTMIME(ms) && file_printf(ms, ", %s: %d", buf,
175 info[i].pi_s32) == -1)
179 if (NOTMIME(ms) && file_printf(ms, ", %s: %u", buf,
180 info[i].pi_u32) == -1)
184 if (NOTMIME(ms) && file_printf(ms, ", %s: %g", buf,
189 if (NOTMIME(ms) && file_printf(ms, ", %s: %g", buf,
193 case CDF_LENGTH32_STRING:
194 case CDF_LENGTH32_WSTRING:
195 len = info[i].pi_str.s_len;
200 if (info[i].pi_type == CDF_LENGTH32_WSTRING)
202 s = info[i].pi_str.s_buf;
203 e = info[i].pi_str.s_buf + len;
204 for (j = 0; s < e && j < sizeof(vbuf)
208 if (isprint(CAST(unsigned char, *s)))
211 if (j == sizeof(vbuf))
216 if (file_printf(ms, ", %s: %s",
220 } else if (str == NULL && info[i].pi_id ==
221 CDF_PROPERTY_NAME_OF_APPLICATION) {
222 str = cdf_app_to_mime(vbuf, app2mime);
230 if (tp < 1000000000000000LL) {
231 cdf_print_elapsed_time(tbuf,
233 if (NOTMIME(ms) && file_printf(ms,
234 ", %s: %s", buf, tbuf) == -1)
238 cdf_timestamp_to_timespec(&ts, tp);
239 c = cdf_ctime(&ts.tv_sec, tbuf);
241 (ec = strchr(c, '\n')) != NULL)
244 if (NOTMIME(ms) && file_printf(ms,
245 ", %s: %s", buf, c) == -1)
256 if (ms->flags & MAGIC_MIME_TYPE) {
259 if (file_printf(ms, "application/%s", str) == -1)
266 cdf_file_catalog(struct magic_set *ms, const cdf_header_t *h,
267 const cdf_stream_t *sst)
272 cdf_catalog_entry_t *ce;
275 if (file_printf(ms, "Microsoft Thumbs.db [") == -1)
277 if (cdf_unpack_catalog(h, sst, &cat) == -1)
280 /* skip first entry since it has a , or paren */
281 for (i = 1; i < cat->cat_num; i++)
282 if (file_printf(ms, "%s%s",
283 cdf_u16tos8(buf, ce[i].ce_namlen, ce[i].ce_name),
284 i == cat->cat_num - 1 ? "]" : ", ") == -1) {
289 } else if (ms->flags & MAGIC_MIME_TYPE) {
290 if (file_printf(ms, "application/CDFV2") == -1)
297 cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
298 const cdf_stream_t *sst, const cdf_directory_t *root_storage)
300 cdf_summary_info_header_t si;
301 cdf_property_info_t *info;
305 if (cdf_unpack_summary_info(sst, h, &si, &info, &count) == -1)
311 if (file_printf(ms, "Composite Document File V2 Document")
315 if (file_printf(ms, ", %s Endian",
316 si.si_byte_order == 0xfffe ? "Little" : "Big") == -1)
320 if (file_printf(ms, ", Os: Windows, Version %d.%d",
321 si.si_os_version & 0xff,
322 CAST(uint32_t, si.si_os_version) >> 8) == -1)
326 if (file_printf(ms, ", Os: MacOS, Version %d.%d",
327 CAST(uint32_t, si.si_os_version) >> 8,
328 si.si_os_version & 0xff) == -1)
332 if (file_printf(ms, ", Os %d, Version: %d.%d", si.si_os,
333 si.si_os_version & 0xff,
334 CAST(uint32_t, si.si_os_version) >> 8) == -1)
339 str = cdf_clsid_to_mime(root_storage->d_storage_uuid,
342 if (file_printf(ms, ", %s", str) == -1)
348 m = cdf_file_property_info(ms, info, count, root_storage);
351 return m == -1 ? -2 : m;
356 format_clsid(char *buf, size_t len, const uint64_t uuid[2]) {
357 snprintf(buf, len, "%.8" PRIx64 "-%.4" PRIx64 "-%.4" PRIx64 "-%.4"
358 PRIx64 "-%.12" PRIx64,
359 (uuid[0] >> 32) & (uint64_t)0x000000000ffffffffULL,
360 (uuid[0] >> 16) & (uint64_t)0x0000000000000ffffULL,
361 (uuid[0] >> 0) & (uint64_t)0x0000000000000ffffULL,
362 (uuid[1] >> 48) & (uint64_t)0x0000000000000ffffULL,
363 (uuid[1] >> 0) & (uint64_t)0x0000fffffffffffffULL);
369 cdf_file_catalog_info(struct magic_set *ms, const cdf_info_t *info,
370 const cdf_header_t *h, const cdf_sat_t *sat, const cdf_sat_t *ssat,
371 const cdf_stream_t *sst, const cdf_dir_t *dir, cdf_stream_t *scn)
375 if ((i = cdf_read_user_stream(info, h, sat, ssat, sst,
376 dir, "Catalog", scn)) == -1)
379 cdf_dump_catalog(h, scn);
381 if ((i = cdf_file_catalog(ms, h, scn)) == -1)
387 cdf_check_summary_info(struct magic_set *ms, const cdf_info_t *info,
388 const cdf_header_t *h, const cdf_sat_t *sat, const cdf_sat_t *ssat,
389 const cdf_stream_t *sst, const cdf_dir_t *dir, cdf_stream_t *scn,
390 const cdf_directory_t *root_storage, const char **expn)
393 const char *str = NULL;
395 char name[__arraycount(d->d_name)];
399 cdf_dump_summary_info(h, scn);
401 if ((i = cdf_file_summary_info(ms, h, scn, root_storage)) < 0) {
402 *expn = "Can't expand summary_info";
407 for (j = 0; str == NULL && j < dir->dir_len; j++) {
408 d = &dir->dir_tab[j];
409 for (k = 0; k < sizeof(name); k++)
410 name[k] = CAST(char, cdf_tole2(d->d_name[k]));
411 str = cdf_app_to_mime(name,
412 NOTMIME(ms) ? name2desc : name2mime);
416 if (file_printf(ms, "%s", str) == -1)
420 } else if (ms->flags & MAGIC_MIME_TYPE) {
422 str = "vnd.ms-office";
423 if (file_printf(ms, "application/%s", str) == -1)
428 i = cdf_file_catalog_info(ms, info, h, sat, ssat, sst,
434 private struct sinfo {
437 const char *sections[5];
440 { "Encrypted", "encrypted",
442 "EncryptedPackage", "EncryptedSummary",
446 CDF_DIR_TYPE_USER_STREAM,
447 CDF_DIR_TYPE_USER_STREAM,
452 { "QuickBooks", "quickbooks",
455 "TaxForms", "PDFTaxForms", "modulesInBackup",
457 "mfbu_header", NULL, NULL, NULL, NULL,
461 CDF_DIR_TYPE_USER_STORAGE,
462 CDF_DIR_TYPE_USER_STORAGE,
463 CDF_DIR_TYPE_USER_STREAM,
465 CDF_DIR_TYPE_USER_STREAM,
469 { "Microsoft Excel", "vnd.ms-excel",
471 "Book", "Workbook", NULL, NULL, NULL,
474 CDF_DIR_TYPE_USER_STREAM,
475 CDF_DIR_TYPE_USER_STREAM,
479 { "Microsoft Word", "msword",
481 "WordDocument", NULL, NULL, NULL, NULL,
484 CDF_DIR_TYPE_USER_STREAM,
488 { "Microsoft PowerPoint", "vnd.ms-powerpoint",
490 "PowerPoint", NULL, NULL, NULL, NULL,
493 CDF_DIR_TYPE_USER_STREAM,
497 { "Microsoft Outlook Message", "vnd.ms-outlook",
499 "__properties_version1.0",
500 "__recip_version1.0_#00000000",
504 CDF_DIR_TYPE_USER_STREAM,
505 CDF_DIR_TYPE_USER_STORAGE,
512 cdf_file_dir_info(struct magic_set *ms, const cdf_dir_t *dir)
516 for (sd = 0; sd < __arraycount(sectioninfo); sd++) {
517 const struct sinfo *si = §ioninfo[sd];
518 for (j = 0; si->sections[j]; j++) {
519 if (cdf_find_stream(dir, si->sections[j], si->types[j])
523 fprintf(stderr, "Can't read %s\n", si->sections[j]);
526 if (si->sections[j] == NULL)
529 if (file_printf(ms, "CDFV2 %s", si->name) == -1)
531 } else if (ms->flags & MAGIC_MIME_TYPE) {
532 if (file_printf(ms, "application/%s", si->mime) == -1)
541 file_trycdf(struct magic_set *ms, const struct buffer *b)
544 const unsigned char *buf = CAST(const unsigned char *, b->fbuf);
545 size_t nbytes = b->flen;
549 cdf_stream_t sst, scn;
552 const char *expn = "";
553 const cdf_directory_t *root_storage;
559 if (ms->flags & (MAGIC_APPLE|MAGIC_EXTENSION))
561 if (cdf_read_header(&info, &h) == -1)
567 if ((i = cdf_read_sat(&info, &h, &sat)) == -1) {
568 expn = "Can't read SAT";
572 cdf_dump_sat("SAT", &sat, CDF_SEC_SIZE(&h));
575 if ((i = cdf_read_ssat(&info, &h, &sat, &ssat)) == -1) {
576 expn = "Can't read SSAT";
580 cdf_dump_sat("SSAT", &ssat, CDF_SHORT_SEC_SIZE(&h));
583 if ((i = cdf_read_dir(&info, &h, &sat, &dir)) == -1) {
584 expn = "Can't read directory";
588 if ((i = cdf_read_short_stream(&info, &h, &sat, &dir, &sst,
589 &root_storage)) == -1) {
590 expn = "Cannot read short stream";
594 cdf_dump_dir(&info, &h, &sat, &ssat, &sst, &dir);
600 if (file_printf(ms, "CLSID %s, ",
601 format_clsid(clsbuf, sizeof(clsbuf),
602 root_storage->d_storage_uuid)) == -1)
608 if ((i = cdf_read_user_stream(&info, &h, &sat, &ssat, &sst, &dir,
609 "FileHeader", &scn)) != -1) {
610 #define HWP5_SIGNATURE "HWP Document File"
611 if (scn.sst_len * scn.sst_ss >= sizeof(HWP5_SIGNATURE) - 1
612 && memcmp(scn.sst_tab, HWP5_SIGNATURE,
613 sizeof(HWP5_SIGNATURE) - 1) == 0) {
616 "Hangul (Korean) Word Processor File 5.x") == -1)
618 } else if (ms->flags & MAGIC_MIME_TYPE) {
619 if (file_printf(ms, "application/x-hwp") == -1)
625 cdf_zero_stream(&scn);
629 if ((i = cdf_read_summary_info(&info, &h, &sat, &ssat, &sst, &dir,
631 if (errno != ESRCH) {
632 expn = "Cannot read summary info";
635 i = cdf_check_summary_info(ms, &info, &h,
636 &sat, &ssat, &sst, &dir, &scn, root_storage, &expn);
637 cdf_zero_stream(&scn);
640 if ((i = cdf_read_doc_summary_info(&info, &h, &sat, &ssat,
641 &sst, &dir, &scn)) == -1) {
642 if (errno != ESRCH) {
643 expn = "Cannot read summary info";
646 i = cdf_check_summary_info(ms, &info, &h, &sat, &ssat,
647 &sst, &dir, &scn, root_storage, &expn);
651 i = cdf_file_dir_info(ms, &dir);
653 expn = "Cannot read section info";
656 cdf_zero_stream(&scn);
657 cdf_zero_stream(&sst);
665 /* If we handled it already, return */
668 /* Provide a default handler */
671 "Composite Document File V2 Document") == -1)
674 if (file_printf(ms, ", %s", expn) == -1)
676 } else if (ms->flags & MAGIC_MIME_TYPE) {
677 if (file_printf(ms, "application/CDFV2") == -1)