parse_~1.cpp

一百个病毒的源代码 包括熊猫烧香等 极其具有研究价值

   hold_size=strlen(boundary)+sizeof("\x0d\x0a--");
   buff_compare=(char*) malloc(hold_size);

   if(buff_compare == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"Out of memory (%s)",strerror(errno));
      return(-1);
   }

   strcpy(buff_compare,"\x0d\x0a--");
   strcat(buff_compare,boundary);

   hold=0;

   do
   {
      char_read=getchar();

      if(char_read != EOF)
      {
         if(hold < (hold_size-1) )
         {
            if(char_read == buff_compare[hold])
               hold++;
            else
            {
               if(hold > 0)
               {
                  for(x=0;x<hold;x++)
                     if( fputc(buff_compare[x],tmp_file) == EOF)
                     {
                        syslog(LOG_MAIL | LOG_ERR,"fputc tmp_file failed (%s)"
				,strerror(errno));
                        free(buff_compare);
                        buff_compare=NULL;
                        return(-1);
                     }

                  hold=0;

                  if(char_read == buff_compare[hold])
                     hold++;
                  else
                     if( fputc(char_read,tmp_file) == EOF)
                     {
                        syslog(LOG_MAIL | LOG_ERR,"fputc tmp_file failed (%s)"
				,strerror(errno));
                        free(buff_compare);
                        buff_compare=NULL;
                        return(-1);
                     }
               }
               else
                  putc(char_read,tmp_file);
            }
         }
         else
            char_read=EOF;
      }
   }
   while(char_read != EOF);

   if(hold < hold_size-1)
   {
      syslog(LOG_MAIL | LOG_ERR,"No end boundary during send_message.");
      return(-1);
   }

   char_read=getchar();

   if(char_read == '-')
   {
      char_read=getchar();

      if(char_read != '-');
         ungetc(char_read,stdin);
   }
   else 
      ungetc(char_read,stdin);
      

   free(buff_compare);

   return(0);
}

////////////////////////////////////////////////////////////////////////////

char* create_tmp_filename(void)
{
   char* filename=NULL;
   size_t filename_size=0;
   DIR* tmp_dir=NULL;
   struct dirent* tmp_dir_file=NULL;
   int tmp_num=0;
   int new_num=1;
   char* tmp_ptr=NULL;

   if(user_ses.sessionid == NULL)
      find_action_and_session();

   if(user_ses.sessionid == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"Invalid sessionid");
      syslog(LOG_MAIL | LOG_ERR,"Browser did not send form data in proper "
			"sequence. Expected sessionid before file.");
      return(NULL);
   }

   setuid(euid);
   tmp_dir=opendir(TMPDIR);
   setuid(ruid);

   if(tmp_dir == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"could not open tempdir for reading (%s)",
				strerror(errno));
      return(NULL);
   }

   filename_size=sizeof(TMPDIR "/" TMPPREFIX ".0000" )
		 +strlen(user_ses.sessionid);
   filename=(char*) malloc(filename_size);

   if(filename == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"Out of memory (%s)",strerror(errno));
      return(NULL);
   }

   strcpy(filename,TMPPREFIX);
   strcat(filename,user_ses.sessionid);

   do
   {
      tmp_dir_file=readdir(tmp_dir);

      if(tmp_dir_file != NULL && tmp_dir_file->d_name != NULL)
      {
         if( strncmp(filename,tmp_dir_file->d_name,strlen(filename)) == 0)
         {
            tmp_ptr=strchr(tmp_dir_file->d_name,'.');

            if(tmp_ptr != NULL)
            {
               tmp_ptr++;
               tmp_num=strtol(tmp_ptr,NULL,10);

               if(tmp_num >= new_num)
                  new_num=tmp_num+1;
            }
         }
      }
   }
   while(tmp_dir_file != NULL);

   closedir(tmp_dir);

   snprintf(filename,filename_size,
		TMPDIR "/" TMPPREFIX "%s.%d",
		user_ses.sessionid,new_num);

   return(filename);
}

////////////////////////////////////////////////////////////////////////////
//This will find the parameter parm_name in buff and malloc a copy of
//   it and save it in *save_buff
//   returns 0 on success
//   returns -1 on failure

int get_parameter(char* buff, char* parm_name, char** save_buff)
{
   char* tmp_ptr=NULL;
   char* start_ptr=NULL;
   char* end_ptr=NULL;
   size_t size=0;

   if(buff == NULL || parm_name == NULL || save_buff == NULL)
      return(-1);

   *save_buff=NULL;

   tmp_ptr=buff;

   do
   {
      tmp_ptr=strchr(tmp_ptr,';');

      if(tmp_ptr == NULL)
         return(-1);

      tmp_ptr++;
      tmp_ptr=strpcbrk(tmp_ptr," \t");

      if(tmp_ptr == NULL)
         return(-1);

   }
   while(strncasecmp(tmp_ptr,parm_name,strlen(parm_name)) != 0);

   tmp_ptr+=strlen(parm_name);

   tmp_ptr=strpcbrk(tmp_ptr," \t");

   if(tmp_ptr == NULL)
      return(-1);

   if(*tmp_ptr != '=')
      return(-1);

   tmp_ptr++;

   start_ptr=strpcbrk(tmp_ptr," \t");

   if(start_ptr == NULL)
      return(-1);

   if(*start_ptr == '"')
   {
      start_ptr++;

      end_ptr=strchr(start_ptr,'"');

      if(end_ptr != NULL)
         size=end_ptr-start_ptr;
      else
         size=strlen(start_ptr);
   }
   else
   {
      end_ptr=strchr(start_ptr,';');

      if(end_ptr != NULL)
         size=end_ptr-start_ptr;
      else
         size=strlen(start_ptr);
   }

   *save_buff=(char*)malloc(size+1);

   if(*save_buff == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"Out of memory (%s)",strerror(errno));
      return(-1);
   }

   strncpy(*save_buff,start_ptr,size);
   *((*save_buff)+size)='\0';
  
   return(0); 
}

////////////////////////////////////////////////////////////////////////////
//This will determine if the string pointed to by buff is boundary
//   returns 0 if boundary
//   returns -1 if not boundary

int is_cgi_boundary(char* buff)
{
   if(buff == NULL)
      return(-1);
   if(strlen(buff) < (strlen(user_env.boundary)+sizeof("--")-1) )
      return(-1);

   if(buff[0] != '-' || buff[1] != '-')
      return(-1);

   if(strncmp(buff+2,user_env.boundary,strlen(user_env.boundary)) != 0)
      return(-1);

   return(0);
}

////////////////////////////////////////////////////////////////////////////
//This function will determine if the next read from stdin is a boundary
//	returns 0 if it is
//		will read terminating '\n'
//	returns 1 is ending boundary
//	returns 2 if not
//		sets buff to bytes read from stdin
//		sets buff_size to num bytes read from stdin
//	returns -1 on error

int next_is_cgi_boundary(char** buff, size_t* size_read)
{
   *buff=NULL;
   *size_read=0;
   size_t buff_size=0;
   int char_read=0;

   if(user_env.boundary == NULL)
      return(-1);

   buff_size=strlen(user_env.boundary)+sizeof("----")-1;
   *buff=(char*)malloc(buff_size);
 
   if(*buff == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"%s",strerror(errno));
      return(-1);
   }

   if((char_read=getchar()) == EOF)
   {
      free(*buff);
      *buff=NULL;
      *size_read=0;
      return(-1);
   } 

   (*buff)[(*size_read)++]=char_read;

   if(char_read != '-')
      return(2);

   if((char_read=getchar()) == EOF)
   {
      free(*buff);
      *buff=NULL;
      *size_read=0;
      return(-1);
   } 

   (*buff)[(*size_read)++]=char_read;

   if(char_read != '-')
      return(2);


   do
   {
      if((char_read=getchar()) == EOF)
      {
         free(*buff);
         *buff=NULL;
         *size_read=0;
         return(-1);
      }

      (*buff)[(*size_read)++]=char_read;
      if(char_read != user_env.boundary[(*size_read)-3])
         return(2);
   }
   while( (*size_read) < (buff_size - (sizeof("--")-1) ) );

   if((char_read=getchar()) == EOF)
   {
      free(*buff);
      *buff=NULL;
      *size_read=0;
      return(-1);
   }
   
   (*buff)[(*size_read)++]=char_read;

   if(char_read != '\n' && char_read != '-')
      return(2);


//we found our boundary

   if(char_read == '\n')
   {
      free(buff);
      buff=NULL;
      *size_read=0;
      return(0);
   }
      
//ending boundary ???

   if((char_read=getchar()) == EOF)
   {
      free(*buff);
      *buff=NULL;
      *size_read=0;
      return(-1);
   }
   
   (*buff)[(*size_read)++]=char_read;

   if(char_read != '-')
      return(2);

//we found ending boundary

   free(*buff);
   *buff=NULL;
   *size_read=0;
   return(1);

}

////////////////////////////////////////////////////////////////////////////
//This function will get the cgi data from environment variable QUERY_STRING
//   on success
//	returns 0
//	malloc data_cgi->name
//	malloc data_cgi->value
//		if value does not exist, will malloc(1) & set == '\0'
//	both data_cgi.name && data_cgi.value will be non-null on success
//  on error
//	returns -1

int acquire_get_data(cgi_t* cgi_data)
{

   static char* ptr_to_next=NULL;
   static char* ptr_to_start=NULL;
   char* ptr_to_equal=NULL;

   ssize_t temp_size=0;

   if(ptr_to_next == NULL && ptr_to_start != NULL)
      return(1);			//we have read everything

   if(ptr_to_next == NULL)
      ptr_to_next=user_env.query_string;

   if(ptr_to_next == NULL)
      return(1);

   ptr_to_start=ptr_to_next;

   ptr_to_equal=strchr(ptr_to_start,'=');

   if(ptr_to_equal == NULL)
      return(1);

   ptr_to_next=strchr(ptr_to_equal,'&');

   temp_size=ptr_to_equal-ptr_to_start;

   if(temp_size < 0)
      return(-1);

   cgi_data->name=(char*)malloc(temp_size+1);

   if(cgi_data->name == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"Out of memory (%s)",strerror(errno));
      return(-1);
   }

   strncpy(cgi_data->name,ptr_to_start,temp_size);
   cgi_data->name[temp_size]='\0';

   ptr_to_start=ptr_to_equal+1;

   temp_size=ptr_to_next == NULL ? 
		strlen(ptr_to_start) : 
		ptr_to_next-ptr_to_start;

   if(temp_size < 0)
   {
      return(-1);
   }

   cgi_data->value=(char*)malloc(temp_size+1);

   if(cgi_data->value == NULL)
   {
      syslog(LOG_MAIL | LOG_ERR,"Out of memory (%s)",strerror(errno));
      return(-1);
   }

   strncpy(cgi_data->value,ptr_to_start,temp_size);
   cgi_data->value[temp_size]='\0';

   if(ptr_to_next != NULL)
      ptr_to_next++;

   fix_cgi_string(cgi_data->name);
   fix_cgi_string(cgi_data->value);

   return(0);
}

////////////////////////////////////////////////////////////////////////////

int fix_cgi_string(char* buff)
{
   char* temp_ptr=NULL;
   char* move_ptr=NULL;
   char conv_char=0;

   if(buff == NULL)
      return(-1);

   temp_ptr=buff;

   do
   {
      temp_ptr=strchr(buff,'+');

      if(temp_ptr != NULL)
         *temp_ptr=' ';
   }
   while(temp_ptr != NULL);

   temp_ptr=buff;

   do
   {
      temp_ptr=strchr(temp_ptr,'%');

      if(temp_ptr != NULL && strlen(temp_ptr) >= 3)
      {
         conv_char=conv_hex(*(temp_ptr+1)) << 4;
         conv_char|=conv_hex(*(temp_ptr+2));

         *temp_ptr=conv_char;

         move_ptr=temp_ptr+1;

         while(*(move_ptr+2) != '\0')
         {
            *move_ptr=*(move_ptr+2);
            move_ptr++;
         }
         *move_ptr='\0';
      }
   }
   while(temp_ptr != NULL);

   return(0);
}

////////////////////////////////////////////////////////////////////////////

char conv_hex(char c)
{
   if(c >= '0' && c <= '9')
      return(c - '0');
   if(c >= 'A' && c <= 'F')
      return(c - 'A' + 10);
   if(c >= 'a' && c <= 'f')
      return(c - 'a' + 10);

   return(0);
}

////////////////////////////////////////////////////////////////////////////

int init_cgi_struct(cgi_t* cgi_data)
{
   cgi_data->name=NULL;
   cgi_data->value=NULL;
   cgi_data->cont_type=NULL;
   cgi_data->filename=NULL;
   cgi_data->tmp_file=NULL;
   cgi_data->tmp_filename=NULL;

   return(0);
}

////////////////////////////////////////////////////////////////////////////