softmagic.c 44 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009
  1. /*
  2. * Copyright (c) Ian F. Darwin 1986-1995.
  3. * Software written by Ian F. Darwin and others;
  4. * maintained 1995-present by Christos Zoulas and others.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions
  8. * are met:
  9. * 1. Redistributions of source code must retain the above copyright
  10. * notice immediately at the beginning of the file, without modification,
  11. * this list of conditions, and the following disclaimer.
  12. * 2. Redistributions in binary form must reproduce the above copyright
  13. * notice, this list of conditions and the following disclaimer in the
  14. * documentation and/or other materials provided with the distribution.
  15. *
  16. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
  20. * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26. * SUCH DAMAGE.
  27. */
  28. /*
  29. * softmagic - interpret variable magic from MAGIC
  30. */
  31. #include "file.h"
  32. #ifndef lint
  33. FILE_RCSID("@(#)$File: softmagic.c,v 1.135 2009/03/27 22:42:49 christos Exp $")
  34. #endif /* lint */
  35. #include "magic.h"
  36. #include <string.h>
  37. #include <ctype.h>
  38. #include <stdlib.h>
  39. #include <time.h>
  40. private int match(struct magic_set *, struct magic *, uint32_t,
  41. const unsigned char *, size_t, int);
  42. private int mget(struct magic_set *, const unsigned char *,
  43. struct magic *, size_t, unsigned int);
  44. private int magiccheck(struct magic_set *, struct magic *);
  45. private int32_t mprint(struct magic_set *, struct magic *);
  46. private int32_t moffset(struct magic_set *, struct magic *);
  47. private void mdebug(uint32_t, const char *, size_t);
  48. private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
  49. const unsigned char *, uint32_t, size_t, size_t);
  50. private int mconvert(struct magic_set *, struct magic *);
  51. private int print_sep(struct magic_set *, int);
  52. private int handle_annotation(struct magic_set *, struct magic *);
  53. private void cvt_8(union VALUETYPE *, const struct magic *);
  54. private void cvt_16(union VALUETYPE *, const struct magic *);
  55. private void cvt_32(union VALUETYPE *, const struct magic *);
  56. private void cvt_64(union VALUETYPE *, const struct magic *);
  57. /*
  58. * softmagic - lookup one file in parsed, in-memory copy of database
  59. * Passed the name and FILE * of one file to be typed.
  60. */
  61. /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */
  62. protected int
  63. file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes, int mode)
  64. {
  65. struct mlist *ml;
  66. int rv;
  67. for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next)
  68. if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, mode)) != 0)
  69. return rv;
  70. return 0;
  71. }
  72. /*
  73. * Go through the whole list, stopping if you find a match. Process all
  74. * the continuations of that match before returning.
  75. *
  76. * We support multi-level continuations:
  77. *
  78. * At any time when processing a successful top-level match, there is a
  79. * current continuation level; it represents the level of the last
  80. * successfully matched continuation.
  81. *
  82. * Continuations above that level are skipped as, if we see one, it
  83. * means that the continuation that controls them - i.e, the
  84. * lower-level continuation preceding them - failed to match.
  85. *
  86. * Continuations below that level are processed as, if we see one,
  87. * it means we've finished processing or skipping higher-level
  88. * continuations under the control of a successful or unsuccessful
  89. * lower-level continuation, and are now seeing the next lower-level
  90. * continuation and should process it. The current continuation
  91. * level reverts to the level of the one we're seeing.
  92. *
  93. * Continuations at the current level are processed as, if we see
  94. * one, there's no lower-level continuation that may have failed.
  95. *
  96. * If a continuation matches, we bump the current continuation level
  97. * so that higher-level continuations are processed.
  98. */
  99. private int
  100. match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
  101. const unsigned char *s, size_t nbytes, int mode)
  102. {
  103. uint32_t magindex = 0;
  104. unsigned int cont_level = 0;
  105. int need_separator = 0;
  106. int returnval = 0, e; /* if a match is found it is set to 1*/
  107. int firstline = 1; /* a flag to print X\n X\n- X */
  108. int printed_something = 0;
  109. int print = (ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0;
  110. if (file_check_mem(ms, cont_level) == -1)
  111. return -1;
  112. for (magindex = 0; magindex < nmagic; magindex++) {
  113. int flush = 0;
  114. struct magic *m = &magic[magindex];
  115. if ((m->flag & BINTEST) != mode) {
  116. /* Skip sub-tests */
  117. while (magic[magindex + 1].cont_level != 0 &&
  118. ++magindex < nmagic)
  119. continue;
  120. continue; /* Skip to next top-level test*/
  121. }
  122. ms->offset = m->offset;
  123. ms->line = m->lineno;
  124. /* if main entry matches, print it... */
  125. switch (mget(ms, s, m, nbytes, cont_level)) {
  126. case -1:
  127. return -1;
  128. case 0:
  129. flush = m->reln != '!';
  130. break;
  131. default:
  132. if (m->type == FILE_INDIRECT)
  133. returnval = 1;
  134. switch (magiccheck(ms, m)) {
  135. case -1:
  136. return -1;
  137. case 0:
  138. flush++;
  139. break;
  140. default:
  141. flush = 0;
  142. break;
  143. }
  144. break;
  145. }
  146. if (flush) {
  147. /*
  148. * main entry didn't match,
  149. * flush its continuations
  150. */
  151. while (magindex < nmagic - 1 &&
  152. magic[magindex + 1].cont_level != 0)
  153. magindex++;
  154. continue;
  155. }
  156. /*
  157. * If we are going to print something, we'll need to print
  158. * a blank before we print something else.
  159. */
  160. if (*m->desc) {
  161. need_separator = 1;
  162. printed_something = 1;
  163. if ((e = handle_annotation(ms, m)) != 0)
  164. return e;
  165. if (print_sep(ms, firstline) == -1)
  166. return -1;
  167. }
  168. if (print && mprint(ms, m) == -1)
  169. return -1;
  170. ms->c.li[cont_level].off = moffset(ms, m);
  171. /* and any continuations that match */
  172. if (file_check_mem(ms, ++cont_level) == -1)
  173. return -1;
  174. while (magic[magindex+1].cont_level != 0 &&
  175. ++magindex < nmagic) {
  176. m = &magic[magindex];
  177. ms->line = m->lineno; /* for messages */
  178. if (cont_level < m->cont_level)
  179. continue;
  180. if (cont_level > m->cont_level) {
  181. /*
  182. * We're at the end of the level
  183. * "cont_level" continuations.
  184. */
  185. cont_level = m->cont_level;
  186. }
  187. ms->offset = m->offset;
  188. if (m->flag & OFFADD) {
  189. ms->offset +=
  190. ms->c.li[cont_level - 1].off;
  191. }
  192. #ifdef ENABLE_CONDITIONALS
  193. if (m->cond == COND_ELSE ||
  194. m->cond == COND_ELIF) {
  195. if (ms->c.li[cont_level].last_match == 1)
  196. continue;
  197. }
  198. #endif
  199. switch (mget(ms, s, m, nbytes, cont_level)) {
  200. case -1:
  201. return -1;
  202. case 0:
  203. if (m->reln != '!')
  204. continue;
  205. flush = 1;
  206. break;
  207. default:
  208. if (m->type == FILE_INDIRECT)
  209. returnval = 1;
  210. flush = 0;
  211. break;
  212. }
  213. switch (flush ? 1 : magiccheck(ms, m)) {
  214. case -1:
  215. return -1;
  216. case 0:
  217. #ifdef ENABLE_CONDITIONALS
  218. ms->c.li[cont_level].last_match = 0;
  219. #endif
  220. break;
  221. default:
  222. #ifdef ENABLE_CONDITIONALS
  223. ms->c.li[cont_level].last_match = 1;
  224. #endif
  225. if (m->type != FILE_DEFAULT)
  226. ms->c.li[cont_level].got_match = 1;
  227. else if (ms->c.li[cont_level].got_match) {
  228. ms->c.li[cont_level].got_match = 0;
  229. break;
  230. }
  231. /*
  232. * If we are going to print something,
  233. * make sure that we have a separator first.
  234. */
  235. if (*m->desc) {
  236. if ((e = handle_annotation(ms, m)) != 0)
  237. return e;
  238. if (!printed_something) {
  239. printed_something = 1;
  240. if (print_sep(ms, firstline)
  241. == -1)
  242. return -1;
  243. }
  244. }
  245. /*
  246. * This continuation matched. Print
  247. * its message, with a blank before it
  248. * if the previous item printed and
  249. * this item isn't empty.
  250. */
  251. /* space if previous printed */
  252. if (need_separator
  253. && ((m->flag & NOSPACE) == 0)
  254. && *m->desc) {
  255. if (print &&
  256. file_printf(ms, " ") == -1)
  257. return -1;
  258. need_separator = 0;
  259. }
  260. if (print && mprint(ms, m) == -1)
  261. return -1;
  262. ms->c.li[cont_level].off = moffset(ms, m);
  263. if (*m->desc)
  264. need_separator = 1;
  265. /*
  266. * If we see any continuations
  267. * at a higher level,
  268. * process them.
  269. */
  270. if (file_check_mem(ms, ++cont_level) == -1)
  271. return -1;
  272. break;
  273. }
  274. }
  275. if (printed_something) {
  276. firstline = 0;
  277. if (print)
  278. returnval = 1;
  279. }
  280. if ((ms->flags & MAGIC_CONTINUE) == 0 && printed_something) {
  281. return returnval; /* don't keep searching */
  282. }
  283. }
  284. return returnval; /* This is hit if -k is set or there is no match */
  285. }
  286. private int
  287. check_fmt(struct magic_set *ms, struct magic *m)
  288. {
  289. regex_t rx;
  290. int rc;
  291. if (strchr(m->desc, '%') == NULL)
  292. return 0;
  293. rc = regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB);
  294. if (rc) {
  295. char errmsg[512];
  296. (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
  297. file_magerror(ms, "regex error %d, (%s)", rc, errmsg);
  298. return -1;
  299. } else {
  300. rc = regexec(&rx, m->desc, 0, 0, 0);
  301. regfree(&rx);
  302. return !rc;
  303. }
  304. }
  305. #ifndef HAVE_STRNDUP
  306. char * strndup(const char *, size_t);
  307. char *
  308. strndup(const char *str, size_t n)
  309. {
  310. size_t len;
  311. char *copy;
  312. for (len = 0; len < n && str[len]; len++)
  313. continue;
  314. if ((copy = malloc(len + 1)) == NULL)
  315. return NULL;
  316. (void)memcpy(copy, str, len);
  317. copy[len] = '\0';
  318. return copy;
  319. }
  320. #endif /* HAVE_STRNDUP */
  321. private int32_t
  322. mprint(struct magic_set *ms, struct magic *m)
  323. {
  324. uint64_t v;
  325. float vf;
  326. double vd;
  327. int64_t t = 0;
  328. char buf[128];
  329. union VALUETYPE *p = &ms->ms_value;
  330. switch (m->type) {
  331. case FILE_BYTE:
  332. v = file_signextend(ms, m, (uint64_t)p->b);
  333. switch (check_fmt(ms, m)) {
  334. case -1:
  335. return -1;
  336. case 1:
  337. (void)snprintf(buf, sizeof(buf), "%c",
  338. (unsigned char)v);
  339. if (file_printf(ms, m->desc, buf) == -1)
  340. return -1;
  341. break;
  342. default:
  343. if (file_printf(ms, m->desc, (unsigned char) v) == -1)
  344. return -1;
  345. break;
  346. }
  347. t = ms->offset + sizeof(char);
  348. break;
  349. case FILE_SHORT:
  350. case FILE_BESHORT:
  351. case FILE_LESHORT:
  352. v = file_signextend(ms, m, (uint64_t)p->h);
  353. switch (check_fmt(ms, m)) {
  354. case -1:
  355. return -1;
  356. case 1:
  357. (void)snprintf(buf, sizeof(buf), "%hu",
  358. (unsigned short)v);
  359. if (file_printf(ms, m->desc, buf) == -1)
  360. return -1;
  361. break;
  362. default:
  363. if (
  364. file_printf(ms, m->desc, (unsigned short) v) == -1)
  365. return -1;
  366. break;
  367. }
  368. t = ms->offset + sizeof(short);
  369. break;
  370. case FILE_LONG:
  371. case FILE_BELONG:
  372. case FILE_LELONG:
  373. case FILE_MELONG:
  374. v = file_signextend(ms, m, (uint64_t)p->l);
  375. switch (check_fmt(ms, m)) {
  376. case -1:
  377. return -1;
  378. case 1:
  379. (void)snprintf(buf, sizeof(buf), "%u", (uint32_t)v);
  380. if (file_printf(ms, m->desc, buf) == -1)
  381. return -1;
  382. break;
  383. default:
  384. if (file_printf(ms, m->desc, (uint32_t) v) == -1)
  385. return -1;
  386. break;
  387. }
  388. t = ms->offset + sizeof(int32_t);
  389. break;
  390. case FILE_QUAD:
  391. case FILE_BEQUAD:
  392. case FILE_LEQUAD:
  393. v = file_signextend(ms, m, p->q);
  394. if (file_printf(ms, m->desc, (uint64_t) v) == -1)
  395. return -1;
  396. t = ms->offset + sizeof(int64_t);
  397. break;
  398. case FILE_STRING:
  399. case FILE_PSTRING:
  400. case FILE_BESTRING16:
  401. case FILE_LESTRING16:
  402. if (m->reln == '=' || m->reln == '!') {
  403. if (file_printf(ms, m->desc, m->value.s) == -1)
  404. return -1;
  405. t = ms->offset + m->vallen;
  406. }
  407. else {
  408. if (*m->value.s == '\0')
  409. p->s[strcspn(p->s, "\n")] = '\0';
  410. if (file_printf(ms, m->desc, p->s) == -1)
  411. return -1;
  412. t = ms->offset + strlen(p->s);
  413. if (m->type == FILE_PSTRING)
  414. t++;
  415. }
  416. break;
  417. case FILE_DATE:
  418. case FILE_BEDATE:
  419. case FILE_LEDATE:
  420. case FILE_MEDATE:
  421. if (file_printf(ms, m->desc, file_fmttime(p->l, 1)) == -1)
  422. return -1;
  423. t = ms->offset + sizeof(time_t);
  424. break;
  425. case FILE_LDATE:
  426. case FILE_BELDATE:
  427. case FILE_LELDATE:
  428. case FILE_MELDATE:
  429. if (file_printf(ms, m->desc, file_fmttime(p->l, 0)) == -1)
  430. return -1;
  431. t = ms->offset + sizeof(time_t);
  432. break;
  433. case FILE_QDATE:
  434. case FILE_BEQDATE:
  435. case FILE_LEQDATE:
  436. if (file_printf(ms, m->desc, file_fmttime((uint32_t)p->q,
  437. 1)) == -1)
  438. return -1;
  439. t = ms->offset + sizeof(uint64_t);
  440. break;
  441. case FILE_QLDATE:
  442. case FILE_BEQLDATE:
  443. case FILE_LEQLDATE:
  444. if (file_printf(ms, m->desc, file_fmttime((uint32_t)p->q,
  445. 0)) == -1)
  446. return -1;
  447. t = ms->offset + sizeof(uint64_t);
  448. break;
  449. case FILE_FLOAT:
  450. case FILE_BEFLOAT:
  451. case FILE_LEFLOAT:
  452. vf = p->f;
  453. switch (check_fmt(ms, m)) {
  454. case -1:
  455. return -1;
  456. case 1:
  457. (void)snprintf(buf, sizeof(buf), "%g", vf);
  458. if (file_printf(ms, m->desc, buf) == -1)
  459. return -1;
  460. break;
  461. default:
  462. if (file_printf(ms, m->desc, vf) == -1)
  463. return -1;
  464. break;
  465. }
  466. t = ms->offset + sizeof(float);
  467. break;
  468. case FILE_DOUBLE:
  469. case FILE_BEDOUBLE:
  470. case FILE_LEDOUBLE:
  471. vd = p->d;
  472. switch (check_fmt(ms, m)) {
  473. case -1:
  474. return -1;
  475. case 1:
  476. (void)snprintf(buf, sizeof(buf), "%g", vd);
  477. if (file_printf(ms, m->desc, buf) == -1)
  478. return -1;
  479. break;
  480. default:
  481. if (file_printf(ms, m->desc, vd) == -1)
  482. return -1;
  483. break;
  484. }
  485. t = ms->offset + sizeof(double);
  486. break;
  487. case FILE_REGEX: {
  488. char *cp;
  489. int rval;
  490. cp = strndup((const char *)ms->search.s, ms->search.rm_len);
  491. if (cp == NULL) {
  492. file_oomem(ms, ms->search.rm_len);
  493. return -1;
  494. }
  495. rval = file_printf(ms, m->desc, cp);
  496. free(cp);
  497. if (rval == -1)
  498. return -1;
  499. if ((m->str_flags & REGEX_OFFSET_START))
  500. t = ms->search.offset;
  501. else
  502. t = ms->search.offset + ms->search.rm_len;
  503. break;
  504. }
  505. case FILE_SEARCH:
  506. if (file_printf(ms, m->desc, m->value.s) == -1)
  507. return -1;
  508. if ((m->str_flags & REGEX_OFFSET_START))
  509. t = ms->search.offset;
  510. else
  511. t = ms->search.offset + m->vallen;
  512. break;
  513. case FILE_DEFAULT:
  514. if (file_printf(ms, m->desc, m->value.s) == -1)
  515. return -1;
  516. t = ms->offset;
  517. break;
  518. case FILE_INDIRECT:
  519. t = ms->offset;
  520. break;
  521. default:
  522. file_magerror(ms, "invalid m->type (%d) in mprint()", m->type);
  523. return -1;
  524. }
  525. return (int32_t)t;
  526. }
  527. private int32_t
  528. moffset(struct magic_set *ms, struct magic *m)
  529. {
  530. switch (m->type) {
  531. case FILE_BYTE:
  532. return ms->offset + sizeof(char);
  533. case FILE_SHORT:
  534. case FILE_BESHORT:
  535. case FILE_LESHORT:
  536. return ms->offset + sizeof(short);
  537. case FILE_LONG:
  538. case FILE_BELONG:
  539. case FILE_LELONG:
  540. case FILE_MELONG:
  541. return ms->offset + sizeof(int32_t);
  542. case FILE_QUAD:
  543. case FILE_BEQUAD:
  544. case FILE_LEQUAD:
  545. return ms->offset + sizeof(int64_t);
  546. case FILE_STRING:
  547. case FILE_PSTRING:
  548. case FILE_BESTRING16:
  549. case FILE_LESTRING16:
  550. if (m->reln == '=' || m->reln == '!')
  551. return ms->offset + m->vallen;
  552. else {
  553. union VALUETYPE *p = &ms->ms_value;
  554. uint32_t t;
  555. if (*m->value.s == '\0')
  556. p->s[strcspn(p->s, "\n")] = '\0';
  557. t = ms->offset + strlen(p->s);
  558. if (m->type == FILE_PSTRING)
  559. t++;
  560. return t;
  561. }
  562. case FILE_DATE:
  563. case FILE_BEDATE:
  564. case FILE_LEDATE:
  565. case FILE_MEDATE:
  566. return ms->offset + sizeof(time_t);
  567. case FILE_LDATE:
  568. case FILE_BELDATE:
  569. case FILE_LELDATE:
  570. case FILE_MELDATE:
  571. return ms->offset + sizeof(time_t);
  572. case FILE_QDATE:
  573. case FILE_BEQDATE:
  574. case FILE_LEQDATE:
  575. return ms->offset + sizeof(uint64_t);
  576. case FILE_QLDATE:
  577. case FILE_BEQLDATE:
  578. case FILE_LEQLDATE:
  579. return ms->offset + sizeof(uint64_t);
  580. case FILE_FLOAT:
  581. case FILE_BEFLOAT:
  582. case FILE_LEFLOAT:
  583. return ms->offset + sizeof(float);
  584. case FILE_DOUBLE:
  585. case FILE_BEDOUBLE:
  586. case FILE_LEDOUBLE:
  587. return ms->offset + sizeof(double);
  588. break;
  589. case FILE_REGEX:
  590. if ((m->str_flags & REGEX_OFFSET_START) != 0)
  591. return ms->search.offset;
  592. else
  593. return ms->search.offset + ms->search.rm_len;
  594. case FILE_SEARCH:
  595. if ((m->str_flags & REGEX_OFFSET_START) != 0)
  596. return ms->search.offset;
  597. else
  598. return ms->search.offset + m->vallen;
  599. case FILE_DEFAULT:
  600. return ms->offset;
  601. case FILE_INDIRECT:
  602. return ms->offset;
  603. default:
  604. return 0;
  605. }
  606. }
  607. #define DO_CVT(fld, cast) \
  608. if (m->num_mask) \
  609. switch (m->mask_op & FILE_OPS_MASK) { \
  610. case FILE_OPAND: \
  611. p->fld &= cast m->num_mask; \
  612. break; \
  613. case FILE_OPOR: \
  614. p->fld |= cast m->num_mask; \
  615. break; \
  616. case FILE_OPXOR: \
  617. p->fld ^= cast m->num_mask; \
  618. break; \
  619. case FILE_OPADD: \
  620. p->fld += cast m->num_mask; \
  621. break; \
  622. case FILE_OPMINUS: \
  623. p->fld -= cast m->num_mask; \
  624. break; \
  625. case FILE_OPMULTIPLY: \
  626. p->fld *= cast m->num_mask; \
  627. break; \
  628. case FILE_OPDIVIDE: \
  629. p->fld /= cast m->num_mask; \
  630. break; \
  631. case FILE_OPMODULO: \
  632. p->fld %= cast m->num_mask; \
  633. break; \
  634. } \
  635. if (m->mask_op & FILE_OPINVERSE) \
  636. p->fld = ~p->fld \
  637. private void
  638. cvt_8(union VALUETYPE *p, const struct magic *m)
  639. {
  640. DO_CVT(b, (uint8_t));
  641. }
  642. private void
  643. cvt_16(union VALUETYPE *p, const struct magic *m)
  644. {
  645. DO_CVT(h, (uint16_t));
  646. }
  647. private void
  648. cvt_32(union VALUETYPE *p, const struct magic *m)
  649. {
  650. DO_CVT(l, (uint32_t));
  651. }
  652. private void
  653. cvt_64(union VALUETYPE *p, const struct magic *m)
  654. {
  655. DO_CVT(q, (uint64_t));
  656. }
  657. #define DO_CVT2(fld, cast) \
  658. if (m->num_mask) \
  659. switch (m->mask_op & FILE_OPS_MASK) { \
  660. case FILE_OPADD: \
  661. p->fld += cast m->num_mask; \
  662. break; \
  663. case FILE_OPMINUS: \
  664. p->fld -= cast m->num_mask; \
  665. break; \
  666. case FILE_OPMULTIPLY: \
  667. p->fld *= cast m->num_mask; \
  668. break; \
  669. case FILE_OPDIVIDE: \
  670. p->fld /= cast m->num_mask; \
  671. break; \
  672. } \
  673. private void
  674. cvt_float(union VALUETYPE *p, const struct magic *m)
  675. {
  676. DO_CVT2(f, (float));
  677. }
  678. private void
  679. cvt_double(union VALUETYPE *p, const struct magic *m)
  680. {
  681. DO_CVT2(d, (double));
  682. }
  683. /*
  684. * Convert the byte order of the data we are looking at
  685. * While we're here, let's apply the mask operation
  686. * (unless you have a better idea)
  687. */
  688. private int
  689. mconvert(struct magic_set *ms, struct magic *m)
  690. {
  691. union VALUETYPE *p = &ms->ms_value;
  692. switch (m->type) {
  693. case FILE_BYTE:
  694. cvt_8(p, m);
  695. return 1;
  696. case FILE_SHORT:
  697. cvt_16(p, m);
  698. return 1;
  699. case FILE_LONG:
  700. case FILE_DATE:
  701. case FILE_LDATE:
  702. cvt_32(p, m);
  703. return 1;
  704. case FILE_QUAD:
  705. case FILE_QDATE:
  706. case FILE_QLDATE:
  707. cvt_64(p, m);
  708. return 1;
  709. case FILE_STRING:
  710. case FILE_BESTRING16:
  711. case FILE_LESTRING16: {
  712. /* Null terminate and eat *trailing* return */
  713. p->s[sizeof(p->s) - 1] = '\0';
  714. #if 0
  715. /* Why? breaks magic numbers that end with \xa */
  716. len = strlen(p->s);
  717. if (len-- && p->s[len] == '\n')
  718. p->s[len] = '\0';
  719. #endif
  720. return 1;
  721. }
  722. case FILE_PSTRING: {
  723. char *ptr1 = p->s, *ptr2 = ptr1 + 1;
  724. size_t len = *p->s;
  725. if (len >= sizeof(p->s))
  726. len = sizeof(p->s) - 1;
  727. while (len--)
  728. *ptr1++ = *ptr2++;
  729. *ptr1 = '\0';
  730. #if 0
  731. /* Why? breaks magic numbers that end with \xa */
  732. len = strlen(p->s);
  733. if (len-- && p->s[len] == '\n')
  734. p->s[len] = '\0';
  735. #endif
  736. return 1;
  737. }
  738. case FILE_BESHORT:
  739. p->h = (short)((p->hs[0]<<8)|(p->hs[1]));
  740. cvt_16(p, m);
  741. return 1;
  742. case FILE_BELONG:
  743. case FILE_BEDATE:
  744. case FILE_BELDATE:
  745. p->l = (int32_t)
  746. ((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3]));
  747. cvt_32(p, m);
  748. return 1;
  749. case FILE_BEQUAD:
  750. case FILE_BEQDATE:
  751. case FILE_BEQLDATE:
  752. p->q = (uint64_t)
  753. (((uint64_t)p->hq[0]<<56)|((uint64_t)p->hq[1]<<48)|
  754. ((uint64_t)p->hq[2]<<40)|((uint64_t)p->hq[3]<<32)|
  755. ((uint64_t)p->hq[4]<<24)|((uint64_t)p->hq[5]<<16)|
  756. ((uint64_t)p->hq[6]<<8)|((uint64_t)p->hq[7]));
  757. cvt_64(p, m);
  758. return 1;
  759. case FILE_LESHORT:
  760. p->h = (short)((p->hs[1]<<8)|(p->hs[0]));
  761. cvt_16(p, m);
  762. return 1;
  763. case FILE_LELONG:
  764. case FILE_LEDATE:
  765. case FILE_LELDATE:
  766. p->l = (int32_t)
  767. ((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0]));
  768. cvt_32(p, m);
  769. return 1;
  770. case FILE_LEQUAD:
  771. case FILE_LEQDATE:
  772. case FILE_LEQLDATE:
  773. p->q = (uint64_t)
  774. (((uint64_t)p->hq[7]<<56)|((uint64_t)p->hq[6]<<48)|
  775. ((uint64_t)p->hq[5]<<40)|((uint64_t)p->hq[4]<<32)|
  776. ((uint64_t)p->hq[3]<<24)|((uint64_t)p->hq[2]<<16)|
  777. ((uint64_t)p->hq[1]<<8)|((uint64_t)p->hq[0]));
  778. cvt_64(p, m);
  779. return 1;
  780. case FILE_MELONG:
  781. case FILE_MEDATE:
  782. case FILE_MELDATE:
  783. p->l = (int32_t)
  784. ((p->hl[1]<<24)|(p->hl[0]<<16)|(p->hl[3]<<8)|(p->hl[2]));
  785. cvt_32(p, m);
  786. return 1;
  787. case FILE_FLOAT:
  788. cvt_float(p, m);
  789. return 1;
  790. case FILE_BEFLOAT:
  791. p->l = ((uint32_t)p->hl[0]<<24)|((uint32_t)p->hl[1]<<16)|
  792. ((uint32_t)p->hl[2]<<8) |((uint32_t)p->hl[3]);
  793. cvt_float(p, m);
  794. return 1;
  795. case FILE_LEFLOAT:
  796. p->l = ((uint32_t)p->hl[3]<<24)|((uint32_t)p->hl[2]<<16)|
  797. ((uint32_t)p->hl[1]<<8) |((uint32_t)p->hl[0]);
  798. cvt_float(p, m);
  799. return 1;
  800. case FILE_DOUBLE:
  801. cvt_double(p, m);
  802. return 1;
  803. case FILE_BEDOUBLE:
  804. p->q = ((uint64_t)p->hq[0]<<56)|((uint64_t)p->hq[1]<<48)|
  805. ((uint64_t)p->hq[2]<<40)|((uint64_t)p->hq[3]<<32)|
  806. ((uint64_t)p->hq[4]<<24)|((uint64_t)p->hq[5]<<16)|
  807. ((uint64_t)p->hq[6]<<8) |((uint64_t)p->hq[7]);
  808. cvt_double(p, m);
  809. return 1;
  810. case FILE_LEDOUBLE:
  811. p->q = ((uint64_t)p->hq[7]<<56)|((uint64_t)p->hq[6]<<48)|
  812. ((uint64_t)p->hq[5]<<40)|((uint64_t)p->hq[4]<<32)|
  813. ((uint64_t)p->hq[3]<<24)|((uint64_t)p->hq[2]<<16)|
  814. ((uint64_t)p->hq[1]<<8) |((uint64_t)p->hq[0]);
  815. cvt_double(p, m);
  816. return 1;
  817. case FILE_REGEX:
  818. case FILE_SEARCH:
  819. case FILE_DEFAULT:
  820. return 1;
  821. default:
  822. file_magerror(ms, "invalid type %d in mconvert()", m->type);
  823. return 0;
  824. }
  825. }
  826. private void
  827. mdebug(uint32_t offset, const char *str, size_t len)
  828. {
  829. (void) fprintf(stderr, "mget @%d: ", offset);
  830. file_showstr(stderr, str, len);
  831. (void) fputc('\n', stderr);
  832. (void) fputc('\n', stderr);
  833. }
  834. private int
  835. mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
  836. const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
  837. {
  838. /*
  839. * Note: FILE_SEARCH and FILE_REGEX do not actually copy
  840. * anything, but setup pointers into the source
  841. */
  842. if (indir == 0) {
  843. switch (type) {
  844. case FILE_SEARCH:
  845. ms->search.s = (const char *)s + offset;
  846. ms->search.s_len = nbytes - offset;
  847. ms->search.offset = offset;
  848. return 0;
  849. case FILE_REGEX: {
  850. const char *b;
  851. const char *c;
  852. const char *last; /* end of search region */
  853. const char *buf; /* start of search region */
  854. const char *end;
  855. size_t lines;
  856. if (s == NULL) {
  857. ms->search.s_len = 0;
  858. ms->search.s = NULL;
  859. return 0;
  860. }
  861. buf = (const char *)s + offset;
  862. end = last = (const char *)s + nbytes;
  863. /* mget() guarantees buf <= last */
  864. for (lines = linecnt, b = buf;
  865. lines && ((b = memchr(c = b, '\n', end - b)) || (b = memchr(c, '\r', end - c)));
  866. lines--, b++) {
  867. last = b;
  868. if (b[0] == '\r' && b[1] == '\n')
  869. b++;
  870. }
  871. if (lines)
  872. last = (const char *)s + nbytes;
  873. ms->search.s = buf;
  874. ms->search.s_len = last - buf;
  875. ms->search.offset = offset;
  876. ms->search.rm_len = 0;
  877. return 0;
  878. }
  879. case FILE_BESTRING16:
  880. case FILE_LESTRING16: {
  881. const unsigned char *src = s + offset;
  882. const unsigned char *esrc = s + nbytes;
  883. char *dst = p->s;
  884. char *edst = &p->s[sizeof(p->s) - 1];
  885. if (type == FILE_BESTRING16)
  886. src++;
  887. /* check for pointer overflow */
  888. if (src < s) {
  889. file_magerror(ms, "invalid offset %u in mcopy()",
  890. offset);
  891. return -1;
  892. }
  893. for (/*EMPTY*/; src < esrc; src += 2, dst++) {
  894. if (dst < edst)
  895. *dst = *src;
  896. else
  897. break;
  898. if (*dst == '\0') {
  899. if (type == FILE_BESTRING16 ?
  900. *(src - 1) != '\0' :
  901. *(src + 1) != '\0')
  902. *dst = ' ';
  903. }
  904. }
  905. *edst = '\0';
  906. return 0;
  907. }
  908. case FILE_STRING: /* XXX - these two should not need */
  909. case FILE_PSTRING: /* to copy anything, but do anyway. */
  910. default:
  911. break;
  912. }
  913. }
  914. if (offset >= nbytes) {
  915. (void)memset(p, '\0', sizeof(*p));
  916. return 0;
  917. }
  918. if (nbytes - offset < sizeof(*p))
  919. nbytes = nbytes - offset;
  920. else
  921. nbytes = sizeof(*p);
  922. (void)memcpy(p, s + offset, nbytes);
  923. /*
  924. * the usefulness of padding with zeroes eludes me, it
  925. * might even cause problems
  926. */
  927. if (nbytes < sizeof(*p))
  928. (void)memset(((char *)(void *)p) + nbytes, '\0',
  929. sizeof(*p) - nbytes);
  930. return 0;
  931. }
  932. private int
  933. mget(struct magic_set *ms, const unsigned char *s,
  934. struct magic *m, size_t nbytes, unsigned int cont_level)
  935. {
  936. uint32_t offset = ms->offset;
  937. uint32_t count = m->str_range;
  938. union VALUETYPE *p = &ms->ms_value;
  939. if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1)
  940. return -1;
  941. if ((ms->flags & MAGIC_DEBUG) != 0) {
  942. mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
  943. #ifndef COMPILE_ONLY
  944. file_mdump(m);
  945. #endif
  946. }
  947. if (m->flag & INDIR) {
  948. int off = m->in_offset;
  949. if (m->in_op & FILE_OPINDIRECT) {
  950. const union VALUETYPE *q = CAST(const union VALUETYPE *,
  951. ((const void *)(s + offset + off)));
  952. switch (m->in_type) {
  953. case FILE_BYTE:
  954. off = q->b;
  955. break;
  956. case FILE_SHORT:
  957. off = q->h;
  958. break;
  959. case FILE_BESHORT:
  960. off = (short)((q->hs[0]<<8)|(q->hs[1]));
  961. break;
  962. case FILE_LESHORT:
  963. off = (short)((q->hs[1]<<8)|(q->hs[0]));
  964. break;
  965. case FILE_LONG:
  966. off = q->l;
  967. break;
  968. case FILE_BELONG:
  969. case FILE_BEID3:
  970. off = (int32_t)((q->hl[0]<<24)|(q->hl[1]<<16)|
  971. (q->hl[2]<<8)|(q->hl[3]));
  972. break;
  973. case FILE_LEID3:
  974. case FILE_LELONG:
  975. off = (int32_t)((q->hl[3]<<24)|(q->hl[2]<<16)|
  976. (q->hl[1]<<8)|(q->hl[0]));
  977. break;
  978. case FILE_MELONG:
  979. off = (int32_t)((q->hl[1]<<24)|(q->hl[0]<<16)|
  980. (q->hl[3]<<8)|(q->hl[2]));
  981. break;
  982. }
  983. }
  984. switch (m->in_type) {
  985. case FILE_BYTE:
  986. if (nbytes < (offset + 1))
  987. return 0;
  988. if (off) {
  989. switch (m->in_op & FILE_OPS_MASK) {
  990. case FILE_OPAND:
  991. offset = p->b & off;
  992. break;
  993. case FILE_OPOR:
  994. offset = p->b | off;
  995. break;
  996. case FILE_OPXOR:
  997. offset = p->b ^ off;
  998. break;
  999. case FILE_OPADD:
  1000. offset = p->b + off;
  1001. break;
  1002. case FILE_OPMINUS:
  1003. offset = p->b - off;
  1004. break;
  1005. case FILE_OPMULTIPLY:
  1006. offset = p->b * off;
  1007. break;
  1008. case FILE_OPDIVIDE:
  1009. offset = p->b / off;
  1010. break;
  1011. case FILE_OPMODULO:
  1012. offset = p->b % off;
  1013. break;
  1014. }
  1015. } else
  1016. offset = p->b;
  1017. if (m->in_op & FILE_OPINVERSE)
  1018. offset = ~offset;
  1019. break;
  1020. case FILE_BESHORT:
  1021. if (nbytes < (offset + 2))
  1022. return 0;
  1023. if (off) {
  1024. switch (m->in_op & FILE_OPS_MASK) {
  1025. case FILE_OPAND:
  1026. offset = (short)((p->hs[0]<<8)|
  1027. (p->hs[1])) &
  1028. off;
  1029. break;
  1030. case FILE_OPOR:
  1031. offset = (short)((p->hs[0]<<8)|
  1032. (p->hs[1])) |
  1033. off;
  1034. break;
  1035. case FILE_OPXOR:
  1036. offset = (short)((p->hs[0]<<8)|
  1037. (p->hs[1])) ^
  1038. off;
  1039. break;
  1040. case FILE_OPADD:
  1041. offset = (short)((p->hs[0]<<8)|
  1042. (p->hs[1])) +
  1043. off;
  1044. break;
  1045. case FILE_OPMINUS:
  1046. offset = (short)((p->hs[0]<<8)|
  1047. (p->hs[1])) -
  1048. off;
  1049. break;
  1050. case FILE_OPMULTIPLY:
  1051. offset = (short)((p->hs[0]<<8)|
  1052. (p->hs[1])) *
  1053. off;
  1054. break;
  1055. case FILE_OPDIVIDE:
  1056. offset = (short)((p->hs[0]<<8)|
  1057. (p->hs[1])) /
  1058. off;
  1059. break;
  1060. case FILE_OPMODULO:
  1061. offset = (short)((p->hs[0]<<8)|
  1062. (p->hs[1])) %
  1063. off;
  1064. break;
  1065. }
  1066. } else
  1067. offset = (short)((p->hs[0]<<8)|
  1068. (p->hs[1]));
  1069. if (m->in_op & FILE_OPINVERSE)
  1070. offset = ~offset;
  1071. break;
  1072. case FILE_LESHORT:
  1073. if (nbytes < (offset + 2))
  1074. return 0;
  1075. if (off) {
  1076. switch (m->in_op & FILE_OPS_MASK) {
  1077. case FILE_OPAND:
  1078. offset = (short)((p->hs[1]<<8)|
  1079. (p->hs[0])) &
  1080. off;
  1081. break;
  1082. case FILE_OPOR:
  1083. offset = (short)((p->hs[1]<<8)|
  1084. (p->hs[0])) |
  1085. off;
  1086. break;
  1087. case FILE_OPXOR:
  1088. offset = (short)((p->hs[1]<<8)|
  1089. (p->hs[0])) ^
  1090. off;
  1091. break;
  1092. case FILE_OPADD:
  1093. offset = (short)((p->hs[1]<<8)|
  1094. (p->hs[0])) +
  1095. off;
  1096. break;
  1097. case FILE_OPMINUS:
  1098. offset = (short)((p->hs[1]<<8)|
  1099. (p->hs[0])) -
  1100. off;
  1101. break;
  1102. case FILE_OPMULTIPLY:
  1103. offset = (short)((p->hs[1]<<8)|
  1104. (p->hs[0])) *
  1105. off;
  1106. break;
  1107. case FILE_OPDIVIDE:
  1108. offset = (short)((p->hs[1]<<8)|
  1109. (p->hs[0])) /
  1110. off;
  1111. break;
  1112. case FILE_OPMODULO:
  1113. offset = (short)((p->hs[1]<<8)|
  1114. (p->hs[0])) %
  1115. off;
  1116. break;
  1117. }
  1118. } else
  1119. offset = (short)((p->hs[1]<<8)|
  1120. (p->hs[0]));
  1121. if (m->in_op & FILE_OPINVERSE)
  1122. offset = ~offset;
  1123. break;
  1124. case FILE_SHORT:
  1125. if (nbytes < (offset + 2))
  1126. return 0;
  1127. if (off) {
  1128. switch (m->in_op & FILE_OPS_MASK) {
  1129. case FILE_OPAND:
  1130. offset = p->h & off;
  1131. break;
  1132. case FILE_OPOR:
  1133. offset = p->h | off;
  1134. break;
  1135. case FILE_OPXOR:
  1136. offset = p->h ^ off;
  1137. break;
  1138. case FILE_OPADD:
  1139. offset = p->h + off;
  1140. break;
  1141. case FILE_OPMINUS:
  1142. offset = p->h - off;
  1143. break;
  1144. case FILE_OPMULTIPLY:
  1145. offset = p->h * off;
  1146. break;
  1147. case FILE_OPDIVIDE:
  1148. offset = p->h / off;
  1149. break;
  1150. case FILE_OPMODULO:
  1151. offset = p->h % off;
  1152. break;
  1153. }
  1154. }
  1155. else
  1156. offset = p->h;
  1157. if (m->in_op & FILE_OPINVERSE)
  1158. offset = ~offset;
  1159. break;
  1160. case FILE_BELONG:
  1161. case FILE_BEID3:
  1162. if (nbytes < (offset + 4))
  1163. return 0;
  1164. if (off) {
  1165. switch (m->in_op & FILE_OPS_MASK) {
  1166. case FILE_OPAND:
  1167. offset = (int32_t)((p->hl[0]<<24)|
  1168. (p->hl[1]<<16)|
  1169. (p->hl[2]<<8)|
  1170. (p->hl[3])) &
  1171. off;
  1172. break;
  1173. case FILE_OPOR:
  1174. offset = (int32_t)((p->hl[0]<<24)|
  1175. (p->hl[1]<<16)|
  1176. (p->hl[2]<<8)|
  1177. (p->hl[3])) |
  1178. off;
  1179. break;
  1180. case FILE_OPXOR:
  1181. offset = (int32_t)((p->hl[0]<<24)|
  1182. (p->hl[1]<<16)|
  1183. (p->hl[2]<<8)|
  1184. (p->hl[3])) ^
  1185. off;
  1186. break;
  1187. case FILE_OPADD:
  1188. offset = (int32_t)((p->hl[0]<<24)|
  1189. (p->hl[1]<<16)|
  1190. (p->hl[2]<<8)|
  1191. (p->hl[3])) +
  1192. off;
  1193. break;
  1194. case FILE_OPMINUS:
  1195. offset = (int32_t)((p->hl[0]<<24)|
  1196. (p->hl[1]<<16)|
  1197. (p->hl[2]<<8)|
  1198. (p->hl[3])) -
  1199. off;
  1200. break;
  1201. case FILE_OPMULTIPLY:
  1202. offset = (int32_t)((p->hl[0]<<24)|
  1203. (p->hl[1]<<16)|
  1204. (p->hl[2]<<8)|
  1205. (p->hl[3])) *
  1206. off;
  1207. break;
  1208. case FILE_OPDIVIDE:
  1209. offset = (int32_t)((p->hl[0]<<24)|
  1210. (p->hl[1]<<16)|
  1211. (p->hl[2]<<8)|
  1212. (p->hl[3])) /
  1213. off;
  1214. break;
  1215. case FILE_OPMODULO:
  1216. offset = (int32_t)((p->hl[0]<<24)|
  1217. (p->hl[1]<<16)|
  1218. (p->hl[2]<<8)|
  1219. (p->hl[3])) %
  1220. off;
  1221. break;
  1222. }
  1223. } else
  1224. offset = (int32_t)((p->hl[0]<<24)|
  1225. (p->hl[1]<<16)|
  1226. (p->hl[2]<<8)|
  1227. (p->hl[3]));
  1228. if (m->in_op & FILE_OPINVERSE)
  1229. offset = ~offset;
  1230. break;
  1231. case FILE_LELONG:
  1232. case FILE_LEID3:
  1233. if (nbytes < (offset + 4))
  1234. return 0;
  1235. if (off) {
  1236. switch (m->in_op & FILE_OPS_MASK) {
  1237. case FILE_OPAND:
  1238. offset = (int32_t)((p->hl[3]<<24)|
  1239. (p->hl[2]<<16)|
  1240. (p->hl[1]<<8)|
  1241. (p->hl[0])) &
  1242. off;
  1243. break;
  1244. case FILE_OPOR:
  1245. offset = (int32_t)((p->hl[3]<<24)|
  1246. (p->hl[2]<<16)|
  1247. (p->hl[1]<<8)|
  1248. (p->hl[0])) |
  1249. off;
  1250. break;
  1251. case FILE_OPXOR:
  1252. offset = (int32_t)((p->hl[3]<<24)|
  1253. (p->hl[2]<<16)|
  1254. (p->hl[1]<<8)|
  1255. (p->hl[0])) ^
  1256. off;
  1257. break;
  1258. case FILE_OPADD:
  1259. offset = (int32_t)((p->hl[3]<<24)|
  1260. (p->hl[2]<<16)|
  1261. (p->hl[1]<<8)|
  1262. (p->hl[0])) +
  1263. off;
  1264. break;
  1265. case FILE_OPMINUS:
  1266. offset = (int32_t)((p->hl[3]<<24)|
  1267. (p->hl[2]<<16)|
  1268. (p->hl[1]<<8)|
  1269. (p->hl[0])) -
  1270. off;
  1271. break;
  1272. case FILE_OPMULTIPLY:
  1273. offset = (int32_t)((p->hl[3]<<24)|
  1274. (p->hl[2]<<16)|
  1275. (p->hl[1]<<8)|
  1276. (p->hl[0])) *
  1277. off;
  1278. break;
  1279. case FILE_OPDIVIDE:
  1280. offset = (int32_t)((p->hl[3]<<24)|
  1281. (p->hl[2]<<16)|
  1282. (p->hl[1]<<8)|
  1283. (p->hl[0])) /
  1284. off;
  1285. break;
  1286. case FILE_OPMODULO:
  1287. offset = (int32_t)((p->hl[3]<<24)|
  1288. (p->hl[2]<<16)|
  1289. (p->hl[1]<<8)|
  1290. (p->hl[0])) %
  1291. off;
  1292. break;
  1293. }
  1294. } else
  1295. offset = (int32_t)((p->hl[3]<<24)|
  1296. (p->hl[2]<<16)|
  1297. (p->hl[1]<<8)|
  1298. (p->hl[0]));
  1299. if (m->in_op & FILE_OPINVERSE)
  1300. offset = ~offset;
  1301. break;
  1302. case FILE_MELONG:
  1303. if (nbytes < (offset + 4))
  1304. return 0;
  1305. if (off) {
  1306. switch (m->in_op & FILE_OPS_MASK) {
  1307. case FILE_OPAND:
  1308. offset = (int32_t)((p->hl[1]<<24)|
  1309. (p->hl[0]<<16)|
  1310. (p->hl[3]<<8)|
  1311. (p->hl[2])) &
  1312. off;
  1313. break;
  1314. case FILE_OPOR:
  1315. offset = (int32_t)((p->hl[1]<<24)|
  1316. (p->hl[0]<<16)|
  1317. (p->hl[3]<<8)|
  1318. (p->hl[2])) |
  1319. off;
  1320. break;
  1321. case FILE_OPXOR:
  1322. offset = (int32_t)((p->hl[1]<<24)|
  1323. (p->hl[0]<<16)|
  1324. (p->hl[3]<<8)|
  1325. (p->hl[2])) ^
  1326. off;
  1327. break;
  1328. case FILE_OPADD:
  1329. offset = (int32_t)((p->hl[1]<<24)|
  1330. (p->hl[0]<<16)|
  1331. (p->hl[3]<<8)|
  1332. (p->hl[2])) +
  1333. off;
  1334. break;
  1335. case FILE_OPMINUS:
  1336. offset = (int32_t)((p->hl[1]<<24)|
  1337. (p->hl[0]<<16)|
  1338. (p->hl[3]<<8)|
  1339. (p->hl[2])) -
  1340. off;
  1341. break;
  1342. case FILE_OPMULTIPLY:
  1343. offset = (int32_t)((p->hl[1]<<24)|
  1344. (p->hl[0]<<16)|
  1345. (p->hl[3]<<8)|
  1346. (p->hl[2])) *
  1347. off;
  1348. break;
  1349. case FILE_OPDIVIDE:
  1350. offset = (int32_t)((p->hl[1]<<24)|
  1351. (p->hl[0]<<16)|
  1352. (p->hl[3]<<8)|
  1353. (p->hl[2])) /
  1354. off;
  1355. break;
  1356. case FILE_OPMODULO:
  1357. offset = (int32_t)((p->hl[1]<<24)|
  1358. (p->hl[0]<<16)|
  1359. (p->hl[3]<<8)|
  1360. (p->hl[2])) %
  1361. off;
  1362. break;
  1363. }
  1364. } else
  1365. offset = (int32_t)((p->hl[1]<<24)|
  1366. (p->hl[0]<<16)|
  1367. (p->hl[3]<<8)|
  1368. (p->hl[2]));
  1369. if (m->in_op & FILE_OPINVERSE)
  1370. offset = ~offset;
  1371. break;
  1372. case FILE_LONG:
  1373. if (nbytes < (offset + 4))
  1374. return 0;
  1375. if (off) {
  1376. switch (m->in_op & FILE_OPS_MASK) {
  1377. case FILE_OPAND:
  1378. offset = p->l & off;
  1379. break;
  1380. case FILE_OPOR:
  1381. offset = p->l | off;
  1382. break;
  1383. case FILE_OPXOR:
  1384. offset = p->l ^ off;
  1385. break;
  1386. case FILE_OPADD:
  1387. offset = p->l + off;
  1388. break;
  1389. case FILE_OPMINUS:
  1390. offset = p->l - off;
  1391. break;
  1392. case FILE_OPMULTIPLY:
  1393. offset = p->l * off;
  1394. break;
  1395. case FILE_OPDIVIDE:
  1396. offset = p->l / off;
  1397. break;
  1398. case FILE_OPMODULO:
  1399. offset = p->l % off;
  1400. break;
  1401. }
  1402. } else
  1403. offset = p->l;
  1404. if (m->in_op & FILE_OPINVERSE)
  1405. offset = ~offset;
  1406. break;
  1407. }
  1408. switch (m->in_type) {
  1409. case FILE_LEID3:
  1410. case FILE_BEID3:
  1411. offset = ((((offset >> 0) & 0x7f) << 0) |
  1412. (((offset >> 8) & 0x7f) << 7) |
  1413. (((offset >> 16) & 0x7f) << 14) |
  1414. (((offset >> 24) & 0x7f) << 21)) + 10;
  1415. break;
  1416. default:
  1417. break;
  1418. }
  1419. if (m->flag & INDIROFFADD) {
  1420. offset += ms->c.li[cont_level-1].off;
  1421. }
  1422. if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
  1423. return -1;
  1424. ms->offset = offset;
  1425. if ((ms->flags & MAGIC_DEBUG) != 0) {
  1426. mdebug(offset, (char *)(void *)p,
  1427. sizeof(union VALUETYPE));
  1428. #ifndef COMPILE_ONLY
  1429. file_mdump(m);
  1430. #endif
  1431. }
  1432. }
  1433. /* Verify we have enough data to match magic type */
  1434. switch (m->type) {
  1435. case FILE_BYTE:
  1436. if (nbytes < (offset + 1)) /* should alway be true */
  1437. return 0;
  1438. break;
  1439. case FILE_SHORT:
  1440. case FILE_BESHORT:
  1441. case FILE_LESHORT:
  1442. if (nbytes < (offset + 2))
  1443. return 0;
  1444. break;
  1445. case FILE_LONG:
  1446. case FILE_BELONG:
  1447. case FILE_LELONG:
  1448. case FILE_MELONG:
  1449. case FILE_DATE:
  1450. case FILE_BEDATE:
  1451. case FILE_LEDATE:
  1452. case FILE_MEDATE:
  1453. case FILE_LDATE:
  1454. case FILE_BELDATE:
  1455. case FILE_LELDATE:
  1456. case FILE_MELDATE:
  1457. case FILE_FLOAT:
  1458. case FILE_BEFLOAT:
  1459. case FILE_LEFLOAT:
  1460. if (nbytes < (offset + 4))
  1461. return 0;
  1462. break;
  1463. case FILE_DOUBLE:
  1464. case FILE_BEDOUBLE:
  1465. case FILE_LEDOUBLE:
  1466. if (nbytes < (offset + 8))
  1467. return 0;
  1468. break;
  1469. case FILE_STRING:
  1470. case FILE_PSTRING:
  1471. case FILE_SEARCH:
  1472. if (nbytes < (offset + m->vallen))
  1473. return 0;
  1474. break;
  1475. case FILE_REGEX:
  1476. if (nbytes < offset)
  1477. return 0;
  1478. break;
  1479. case FILE_INDIRECT:
  1480. if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
  1481. file_printf(ms, m->desc) == -1)
  1482. return -1;
  1483. if (nbytes < offset)
  1484. return 0;
  1485. return file_softmagic(ms, s + offset, nbytes - offset,
  1486. BINTEST);
  1487. case FILE_DEFAULT: /* nothing to check */
  1488. default:
  1489. break;
  1490. }
  1491. if (!mconvert(ms, m))
  1492. return 0;
  1493. return 1;
  1494. }
  1495. private uint64_t
  1496. file_strncmp(const char *s1, const char *s2, size_t len, uint32_t flags)
  1497. {
  1498. /*
  1499. * Convert the source args to unsigned here so that (1) the
  1500. * compare will be unsigned as it is in strncmp() and (2) so
  1501. * the ctype functions will work correctly without extra
  1502. * casting.
  1503. */
  1504. const unsigned char *a = (const unsigned char *)s1;
  1505. const unsigned char *b = (const unsigned char *)s2;
  1506. uint64_t v;
  1507. /*
  1508. * What we want here is v = strncmp(s1, s2, len),
  1509. * but ignoring any nulls.
  1510. */
  1511. v = 0;
  1512. if (0L == flags) { /* normal string: do it fast */
  1513. while (len-- > 0)
  1514. if ((v = *b++ - *a++) != '\0')
  1515. break;
  1516. }
  1517. else { /* combine the others */
  1518. while (len-- > 0) {
  1519. if ((flags & STRING_IGNORE_LOWERCASE) &&
  1520. islower(*a)) {
  1521. if ((v = tolower(*b++) - *a++) != '\0')
  1522. break;
  1523. }
  1524. else if ((flags & STRING_IGNORE_UPPERCASE) &&
  1525. isupper(*a)) {
  1526. if ((v = toupper(*b++) - *a++) != '\0')
  1527. break;
  1528. }
  1529. else if ((flags & STRING_COMPACT_BLANK) &&
  1530. isspace(*a)) {
  1531. a++;
  1532. if (isspace(*b++)) {
  1533. while (isspace(*b))
  1534. b++;
  1535. }
  1536. else {
  1537. v = 1;
  1538. break;
  1539. }
  1540. }
  1541. else if ((flags & STRING_COMPACT_OPTIONAL_BLANK) &&
  1542. isspace(*a)) {
  1543. a++;
  1544. while (isspace(*b))
  1545. b++;
  1546. }
  1547. else {
  1548. if ((v = *b++ - *a++) != '\0')
  1549. break;
  1550. }
  1551. }
  1552. }
  1553. return v;
  1554. }
  1555. private uint64_t
  1556. file_strncmp16(const char *a, const char *b, size_t len, uint32_t flags)
  1557. {
  1558. /*
  1559. * XXX - The 16-bit string compare probably needs to be done
  1560. * differently, especially if the flags are to be supported.
  1561. * At the moment, I am unsure.
  1562. */
  1563. flags = 0;
  1564. return file_strncmp(a, b, len, flags);
  1565. }
  1566. private int
  1567. magiccheck(struct magic_set *ms, struct magic *m)
  1568. {
  1569. uint64_t l = m->value.q;
  1570. uint64_t v;
  1571. float fl, fv;
  1572. double dl, dv;
  1573. int matched;
  1574. union VALUETYPE *p = &ms->ms_value;
  1575. switch (m->type) {
  1576. case FILE_BYTE:
  1577. v = p->b;
  1578. break;
  1579. case FILE_SHORT:
  1580. case FILE_BESHORT:
  1581. case FILE_LESHORT:
  1582. v = p->h;
  1583. break;
  1584. case FILE_LONG:
  1585. case FILE_BELONG:
  1586. case FILE_LELONG:
  1587. case FILE_MELONG:
  1588. case FILE_DATE:
  1589. case FILE_BEDATE:
  1590. case FILE_LEDATE:
  1591. case FILE_MEDATE:
  1592. case FILE_LDATE:
  1593. case FILE_BELDATE:
  1594. case FILE_LELDATE:
  1595. case FILE_MELDATE:
  1596. v = p->l;
  1597. break;
  1598. case FILE_QUAD:
  1599. case FILE_LEQUAD:
  1600. case FILE_BEQUAD:
  1601. case FILE_QDATE:
  1602. case FILE_BEQDATE:
  1603. case FILE_LEQDATE:
  1604. case FILE_QLDATE:
  1605. case FILE_BEQLDATE:
  1606. case FILE_LEQLDATE:
  1607. v = p->q;
  1608. break;
  1609. case FILE_FLOAT:
  1610. case FILE_BEFLOAT:
  1611. case FILE_LEFLOAT:
  1612. fl = m->value.f;
  1613. fv = p->f;
  1614. switch (m->reln) {
  1615. case 'x':
  1616. matched = 1;
  1617. break;
  1618. case '!':
  1619. matched = fv != fl;
  1620. break;
  1621. case '=':
  1622. matched = fv == fl;
  1623. break;
  1624. case '>':
  1625. matched = fv > fl;
  1626. break;
  1627. case '<':
  1628. matched = fv < fl;
  1629. break;
  1630. default:
  1631. matched = 0;
  1632. file_magerror(ms, "cannot happen with float: invalid relation `%c'",
  1633. m->reln);
  1634. return -1;
  1635. }
  1636. return matched;
  1637. case FILE_DOUBLE:
  1638. case FILE_BEDOUBLE:
  1639. case FILE_LEDOUBLE:
  1640. dl = m->value.d;
  1641. dv = p->d;
  1642. switch (m->reln) {
  1643. case 'x':
  1644. matched = 1;
  1645. break;
  1646. case '!':
  1647. matched = dv != dl;
  1648. break;
  1649. case '=':
  1650. matched = dv == dl;
  1651. break;
  1652. case '>':
  1653. matched = dv > dl;
  1654. break;
  1655. case '<':
  1656. matched = dv < dl;
  1657. break;
  1658. default:
  1659. matched = 0;
  1660. file_magerror(ms, "cannot happen with double: invalid relation `%c'", m->reln);
  1661. return -1;
  1662. }
  1663. return matched;
  1664. case FILE_DEFAULT:
  1665. l = 0;
  1666. v = 0;
  1667. break;
  1668. case FILE_STRING:
  1669. case FILE_PSTRING:
  1670. l = 0;
  1671. v = file_strncmp(m->value.s, p->s, (size_t)m->vallen, m->str_flags);
  1672. break;
  1673. case FILE_BESTRING16:
  1674. case FILE_LESTRING16:
  1675. l = 0;
  1676. v = file_strncmp16(m->value.s, p->s, (size_t)m->vallen, m->str_flags);
  1677. break;
  1678. case FILE_SEARCH: { /* search ms->search.s for the string m->value.s */
  1679. size_t slen;
  1680. size_t idx;
  1681. if (ms->search.s == NULL)
  1682. return 0;
  1683. slen = MIN(m->vallen, sizeof(m->value.s));
  1684. l = 0;
  1685. v = 0;
  1686. for (idx = 0; m->str_range == 0 || idx < m->str_range; idx++) {
  1687. if (slen + idx > ms->search.s_len)
  1688. break;
  1689. v = file_strncmp(m->value.s, ms->search.s + idx, slen, m->str_flags);
  1690. if (v == 0) { /* found match */
  1691. ms->search.offset += idx;
  1692. break;
  1693. }
  1694. }
  1695. break;
  1696. }
  1697. case FILE_REGEX: {
  1698. int rc;
  1699. regex_t rx;
  1700. char errmsg[512];
  1701. if (ms->search.s == NULL)
  1702. return 0;
  1703. l = 0;
  1704. rc = regcomp(&rx, m->value.s,
  1705. REG_EXTENDED|REG_NEWLINE|
  1706. ((m->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0));
  1707. if (rc) {
  1708. (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
  1709. file_magerror(ms, "regex error %d, (%s)",
  1710. rc, errmsg);
  1711. v = (uint64_t)-1;
  1712. }
  1713. else {
  1714. regmatch_t pmatch[1];
  1715. #ifndef REG_STARTEND
  1716. #define REG_STARTEND 0
  1717. size_t l = ms->search.s_len - 1;
  1718. char c = ms->search.s[l];
  1719. ((char *)(intptr_t)ms->search.s)[l] = '\0';
  1720. #else
  1721. pmatch[0].rm_so = 0;
  1722. pmatch[0].rm_eo = ms->search.s_len;
  1723. #endif
  1724. rc = regexec(&rx, (const char *)ms->search.s,
  1725. 1, pmatch, REG_STARTEND);
  1726. #if REG_STARTEND == 0
  1727. ((char *)(intptr_t)ms->search.s)[l] = c;
  1728. #endif
  1729. switch (rc) {
  1730. case 0:
  1731. ms->search.s += (int)pmatch[0].rm_so;
  1732. ms->search.offset += (size_t)pmatch[0].rm_so;
  1733. ms->search.rm_len =
  1734. (size_t)(pmatch[0].rm_eo - pmatch[0].rm_so);
  1735. v = 0;
  1736. break;
  1737. case REG_NOMATCH:
  1738. v = 1;
  1739. break;
  1740. default:
  1741. (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
  1742. file_magerror(ms, "regexec error %d, (%s)",
  1743. rc, errmsg);
  1744. v = (uint64_t)-1;
  1745. break;
  1746. }
  1747. regfree(&rx);
  1748. }
  1749. if (v == (uint64_t)-1)
  1750. return -1;
  1751. break;
  1752. }
  1753. case FILE_INDIRECT:
  1754. return 1;
  1755. default:
  1756. file_magerror(ms, "invalid type %d in magiccheck()", m->type);
  1757. return -1;
  1758. }
  1759. v = file_signextend(ms, m, v);
  1760. switch (m->reln) {
  1761. case 'x':
  1762. if ((ms->flags & MAGIC_DEBUG) != 0)
  1763. (void) fprintf(stderr, "%llu == *any* = 1\n",
  1764. (unsigned long long)v);
  1765. matched = 1;
  1766. break;
  1767. case '!':
  1768. matched = v != l;
  1769. if ((ms->flags & MAGIC_DEBUG) != 0)
  1770. (void) fprintf(stderr, "%llu != %llu = %d\n",
  1771. (unsigned long long)v, (unsigned long long)l,
  1772. matched);
  1773. break;
  1774. case '=':
  1775. matched = v == l;
  1776. if ((ms->flags & MAGIC_DEBUG) != 0)
  1777. (void) fprintf(stderr, "%llu == %llu = %d\n",
  1778. (unsigned long long)v, (unsigned long long)l,
  1779. matched);
  1780. break;
  1781. case '>':
  1782. if (m->flag & UNSIGNED) {
  1783. matched = v > l;
  1784. if ((ms->flags & MAGIC_DEBUG) != 0)
  1785. (void) fprintf(stderr, "%llu > %llu = %d\n",
  1786. (unsigned long long)v,
  1787. (unsigned long long)l, matched);
  1788. }
  1789. else {
  1790. matched = (int64_t) v > (int64_t) l;
  1791. if ((ms->flags & MAGIC_DEBUG) != 0)
  1792. (void) fprintf(stderr, "%lld > %lld = %d\n",
  1793. (long long)v, (long long)l, matched);
  1794. }
  1795. break;
  1796. case '<':
  1797. if (m->flag & UNSIGNED) {
  1798. matched = v < l;
  1799. if ((ms->flags & MAGIC_DEBUG) != 0)
  1800. (void) fprintf(stderr, "%llu < %llu = %d\n",
  1801. (unsigned long long)v,
  1802. (unsigned long long)l, matched);
  1803. }
  1804. else {
  1805. matched = (int64_t) v < (int64_t) l;
  1806. if ((ms->flags & MAGIC_DEBUG) != 0)
  1807. (void) fprintf(stderr, "%lld < %lld = %d\n",
  1808. (long long)v, (long long)l, matched);
  1809. }
  1810. break;
  1811. case '&':
  1812. matched = (v & l) == l;
  1813. if ((ms->flags & MAGIC_DEBUG) != 0)
  1814. (void) fprintf(stderr, "((%llx & %llx) == %llx) = %d\n",
  1815. (unsigned long long)v, (unsigned long long)l,
  1816. (unsigned long long)l, matched);
  1817. break;
  1818. case '^':
  1819. matched = (v & l) != l;
  1820. if ((ms->flags & MAGIC_DEBUG) != 0)
  1821. (void) fprintf(stderr, "((%llx & %llx) != %llx) = %d\n",
  1822. (unsigned long long)v, (unsigned long long)l,
  1823. (unsigned long long)l, matched);
  1824. break;
  1825. default:
  1826. matched = 0;
  1827. file_magerror(ms, "cannot happen: invalid relation `%c'",
  1828. m->reln);
  1829. return -1;
  1830. }
  1831. return matched;
  1832. }
  1833. private int
  1834. handle_annotation(struct magic_set *ms, struct magic *m)
  1835. {
  1836. if (ms->flags & MAGIC_APPLE) {
  1837. if (file_printf(ms, "%.8s", m->apple) == -1)
  1838. return -1;
  1839. return 1;
  1840. }
  1841. if ((ms->flags & MAGIC_MIME_TYPE) && m->mimetype[0]) {
  1842. if (file_printf(ms, "%s", m->mimetype) == -1)
  1843. return -1;
  1844. return 1;
  1845. }
  1846. return 0;
  1847. }
  1848. private int
  1849. print_sep(struct magic_set *ms, int firstline)
  1850. {
  1851. if (ms->flags & MAGIC_MIME)
  1852. return 0;
  1853. if (firstline)
  1854. return 0;
  1855. /*
  1856. * we found another match
  1857. * put a newline and '-' to do some simple formatting
  1858. */
  1859. return file_printf(ms, "\n- ");
  1860. }