libewf_header_values.c

sleuthit-2.09 一个磁盘的工具集

/*
 * libewf header values
 *
 * Copyright (c) 2006-2007, Joachim Metz <[e-mail]>,
 * Hoffmann Investigations. All rights reserved.
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * Redistribution and use in source and binary forms, with or without modification,
 * are permitted provided that the following conditions are met:
 *
 * - Redistributions of source code must retain the above copyright notice,
 *   this list of conditions and the following disclaimer.
 * - Redistributions in binary form must reproduce the above copyright notice,
 *   this list of conditions and the following disclaimer in the documentation
 *   and/or other materials provided with the distribution.
 * - Neither the name of the creator, related organisations, nor the names of
 *   its contributors may be used to endorse or promote products derived from
 *   this software without specific prior written permission.
 * - All advertising materials mentioning features or use of this software
 *   must acknowledge the contribution by people stated in the acknowledgements.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER, COMPANY AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include "libewf_includes.h"

#include <libewf/libewf_definitions.h>

#include "libewf_common.h"
#include "libewf_header_values.h"
#include "libewf_notify.h"
#include "libewf_string.h"

#include "ewf_compress.h"
#include "ewf_definitions.h"

/* Allocates memory for a new header values struct
 * Returns a pointer to the new instance, NULL on error
 */
LIBEWF_HEADER_VALUES *libewf_header_values_alloc( void )
{
	LIBEWF_HEADER_VALUES *header_values = NULL;
	size_t header_values_size           = 0;

	header_values = (LIBEWF_HEADER_VALUES *) libewf_common_alloc_cleared( LIBEWF_HEADER_VALUES_SIZE, 0 );

	if( header_values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_alloc: unable to allocate header values.\n" );

		return( NULL );
	}
	header_values->amount = LIBEWF_HEADER_VALUES_DEFAULT_AMOUNT;
	header_values_size    = header_values->amount * sizeof( LIBEWF_CHAR* );

	if( header_values_size > (size_t) SSIZE_MAX )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_alloc: invalid size value exceeds maximum.\n" );

		libewf_common_free( header_values );

		return( NULL );
	}
	header_values->identifiers = (LIBEWF_CHAR **) libewf_common_alloc_cleared( header_values_size, 0 );

	if( header_values->identifiers == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_alloc: unable to allocate identifiers.\n" );

		libewf_common_free( header_values );

		return( NULL );
	}
	header_values->values = (LIBEWF_CHAR **) libewf_common_alloc_cleared( header_values_size, 0 );

	if( header_values->values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_alloc: unable to allocate values.\n" );

		libewf_common_free( header_values->identifiers );
		libewf_common_free( header_values );

		return( NULL );
	}
	header_values->identifiers[ 0 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "case_number" ), 11 );
	header_values->identifiers[ 1 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "description" ), 11 );
	header_values->identifiers[ 2 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "examiner_name" ), 13 );
	header_values->identifiers[ 3 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "evidence_number" ), 15 );
	header_values->identifiers[ 4 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "notes" ), 5 );
	header_values->identifiers[ 5 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "acquiry_date" ), 12 );
	header_values->identifiers[ 6 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "system_date" ), 11 );
	header_values->identifiers[ 7 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "acquiry_operating_system" ), 24 );
	header_values->identifiers[ 8 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "acquiry_software_version" ), 24 );
	header_values->identifiers[ 9 ]  = libewf_string_duplicate( _S_LIBEWF_CHAR( "password" ), 8 );
	header_values->identifiers[ 10 ] = libewf_string_duplicate( _S_LIBEWF_CHAR( "compression_type" ), 16 );
	header_values->identifiers[ 11 ] = libewf_string_duplicate( _S_LIBEWF_CHAR( "model" ), 5 );
	header_values->identifiers[ 12 ] = libewf_string_duplicate( _S_LIBEWF_CHAR( "serial_number" ), 13 );
	header_values->identifiers[ 13 ] = libewf_string_duplicate( _S_LIBEWF_CHAR( "unknown_dc" ), 10 );

	return( header_values );
}

/* Reallocates memory for the header values
 * Returns a pointer to the instance, NULL on error
 */
LIBEWF_HEADER_VALUES *libewf_header_values_realloc( LIBEWF_HEADER_VALUES *header_values, uint32_t previous_amount, uint32_t new_amount )
{
	LIBEWF_CHAR **reallocation = NULL;
	size_t previous_size       = previous_amount * sizeof( LIBEWF_CHAR* );
	size_t new_size            = new_amount * sizeof( LIBEWF_CHAR* );

	if( header_values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_realloc: invalid header values.\n" );

		return( NULL );
	}
	if( ( previous_amount > (uint32_t) INT32_MAX ) || ( new_amount > (uint32_t) INT32_MAX ) )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_realloc: invalid amount only values below 2^32 are supported.\n" );

		return( NULL );
	}
	if( previous_amount >= new_amount )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_realloc: new amount smaller than previous amount.\n" );

		return( NULL );
	}
	if( ( previous_size > (size_t) SSIZE_MAX ) || ( new_size > (size_t) SSIZE_MAX ) )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_realloc: invalid size value exceeds maximum.\n" );

		return( NULL );
	}
	reallocation = (LIBEWF_CHAR **) libewf_common_realloc_new_cleared( header_values->identifiers, previous_size, new_size, 0 );

	if( reallocation == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_realloc: unable to reallocate identifiers.\n" );

		return( NULL );
	}
	header_values->identifiers = reallocation;
	reallocation               = (LIBEWF_CHAR **) libewf_common_realloc_new_cleared( header_values->values, previous_size, new_size, 0 );

	if( reallocation == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_realloc: unable to reallocate values.\n" );

		return( NULL );
	}
	header_values->values = reallocation;
	header_values->amount = new_amount;

	return( header_values );
}

/* Frees memory of a header values struct including elements
 */
void libewf_header_values_free( LIBEWF_HEADER_VALUES *header_values )
{
	uint32_t iterator = 0;

	if( header_values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_free: invalid header values.\n" );

		return;
	}
	if( header_values->values != NULL )
	{
		for( iterator = 0; iterator < header_values->amount; iterator++ )
		{
			libewf_common_free( header_values->identifiers[ iterator ] );
			libewf_common_free( header_values->values[ iterator ] );
		}
		libewf_common_free( header_values->values );
	}
	libewf_common_free( header_values );
}

/* Sets the year value in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_year( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements )
{
	size_t string_length = 0;

	if( date_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_year: invalid date string.\n" );

		return( -1 );
	}
	if( date_elements == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_year: invalid date elements.\n" );

		return( -1 );
	}
	string_length = libewf_string_length( date_elements[ 0 ] );

	if( string_length == 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_year: empty year string in date elements.\n" );

		return( -1 );
	}
	if( string_length < 4 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_year: invalid year string in date elements.\n" );

		return( -1 );
	}
	date_string[ 0 ] = date_elements[ 0 ][ 0 ];
	date_string[ 1 ] = date_elements[ 0 ][ 1 ];
	date_string[ 2 ] = date_elements[ 0 ][ 2 ];
	date_string[ 3 ] = date_elements[ 0 ][ 3 ];

	return( 1 );
}

/* Sets a 2 digit value for a certain index in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_2digit_value( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements, uint8_t index )
{
	size_t string_length = 0;

	if( date_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_2digit_value: invalid date string.\n" );

		return( -1 );
	}
	if( date_elements == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_2digit_value: invalid date elements.\n" );

		return( -1 );
	}
	string_length = libewf_string_length( date_elements[ index ] );

	if( string_length == 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_2digit_value: empty string at index: %" PRIu8 " in date elements.\n", index );

		return( -1 );
	}
	else if( string_length == 1 )
	{
		date_string[ 0 ] = (LIBEWF_CHAR) '0';
		date_string[ 1 ] = (LIBEWF_CHAR) date_elements[ index ][ 0 ];
	}
	else
	{
		date_string[ 0 ] = (LIBEWF_CHAR) date_elements[ index ][ 0 ];
		date_string[ 1 ] = (LIBEWF_CHAR) date_elements[ index ][ 1 ];
	}
	return( 1 );
}

/* Sets the month value in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_month( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements )
{
	if( libewf_date_string_set_2digit_value( date_string, date_elements, 1 ) == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_month: unable to set month.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Sets the day of the month value in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_day_of_month( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements )
{
	if( libewf_date_string_set_2digit_value( date_string, date_elements, 2 ) == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_month: unable to set day of the month.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Sets the hours value in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_hours( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements )
{
	if( libewf_date_string_set_2digit_value( date_string, date_elements, 3 ) == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_month: unable to set hours.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Sets the minutes value in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_minutes( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements )
{
	if( libewf_date_string_set_2digit_value( date_string, date_elements, 4 ) == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_month: unable to set minutes.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Sets the seconds value in the date element at the start of the date string
 * Returns 1 if successful, -1 otherwise
 */
int8_t libewf_date_string_set_seconds( LIBEWF_CHAR *date_string, LIBEWF_CHAR **date_elements )
{
	if( libewf_date_string_set_2digit_value( date_string, date_elements, 5 ) == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_date_string_set_month: unable to set seconds.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Convert date string within a header value
 * Returns a pointer to the new instance, NULL on error
 */
LIBEWF_CHAR *libewf_convert_date_header_value( LIBEWF_CHAR *header_value, uint8_t date_format )
{
	LIBEWF_CHAR **date_elements  = NULL;
	LIBEWF_CHAR *date_string     = NULL;
	uint32_t date_element_count  = 0;
	uint8_t date_string_iterator = 0;

	if( header_value == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_convert_date_header_value: invalid header value.\n" );

		return( NULL );
	}
	if( ( date_format != LIBEWF_DATE_FORMAT_DAYMONTH )
	 && ( date_format != LIBEWF_DATE_FORMAT_MONTHDAY )
	 && ( date_format != LIBEWF_DATE_FORMAT_ISO8601 ) )
	{
		LIBEWF_WARNING_PRINT( "libewf_convert_date_header_value: unsupported date format.\n" );

		return( NULL );
	}
	date_string = (LIBEWF_CHAR *) libewf_common_alloc( LIBEWF_CHAR_SIZE * 20 );

	if( date_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_convert_date_header_value: unable to create date string.\n" );

		return( NULL );
	}
	date_elements = libewf_string_split( header_value, libewf_string_length( header_value ), (LIBEWF_CHAR) ' ', &date_element_count );

	if( date_elements == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_convert_date_header_value: unable to split date elements in header value.\n" );

		libewf_common_free( date_string );

		return( NULL );