0646ab95 |
/*
* Copyright (C) 2005 Nigel Horne <njh@bandsman.co.uk>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
ef0f4fdf |
*
* The algorithm is based on kdepim/ktnef/lib/ktnefparser.cpp from
* KDE, rewritten in C by NJH. That algorithm is released under the GPL and is
* Copyright (C) 2002 Michael Goffioul <kdeprint@swing.be> |
0646ab95 |
*/ |
af5f3346 |
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
|
e82a5185 |
static char const rcsid[] = "$Id: tnef.c,v 1.31 2006/03/14 11:39:43 nigelhorne Exp $"; |
0646ab95 |
|
5f591f08 |
#include <stdio.h> |
e483f51a |
#include <fcntl.h> |
5f591f08 |
#include "cltypes.h" |
af5f3346 |
#include "clamav.h" |
5f591f08 |
#include "others.h"
#include "tnef.h" |
ef0f4fdf |
#if CL_DEBUG
#include "mbox.h"
#endif |
2b227b61 |
#include "blob.h" |
5f591f08 |
|
e82a5185 |
static int tnef_message(FILE *fp, uint16_t type, uint16_t tag, int32_t length, off_t fsize);
static int tnef_attachment(FILE *fp, uint16_t type, uint16_t tag, int32_t length, const char *dir, fileblob **fbref, off_t fsize); |
c840fa41 |
static int tnef_header(FILE *fp, uint8_t *part, uint16_t *type, uint16_t *tag, int32_t *length); |
5f591f08 |
#define TNEF_SIGNATURE 0x223E9f78
#define LVL_MESSAGE 0x01
#define LVL_ATTACHMENT 0x02
#define attMSGCLASS 0x8008 |
2b227b61 |
#define attBODY 0x800c
#define attATTACHDATA 0x800f /* Attachment Data */
#define attATTACHTITLE 0x8010 /* Attachment File Name */ |
5f591f08 |
#define attDATEMODIFIED 0x8020 |
ac8dfb6a |
#define attTNEFVERSION 0x9006 |
5f591f08 |
#define attOEMCODEPAGE 0x9007 |
0646ab95 |
|
6d584c4d |
#if WORDS_BIGENDIAN == 0
#define host16(v) (v)
#define host32(v) (v)
#else
#define host16(v) ((v >> 8) | (v << 8))
#define host32(v) ((v >> 24) | ((v & 0x00FF0000) >> 8) | \
((v & 0x0000FF00) << 8) | (v << 24))
#endif |
d90e454a |
|
e483f51a |
extern short cli_debug_flag;
|
0646ab95 |
int
cli_tnef(const char *dir, int desc)
{ |
5f591f08 |
uint32_t i32;
uint16_t i16; |
2b227b61 |
fileblob *fb; |
ef0f4fdf |
int i, ret, alldone;
FILE *fp; |
e82a5185 |
off_t fsize;
struct stat statb; |
c0dda7a6 |
|
5f591f08 |
lseek(desc, 0L, SEEK_SET);
|
e82a5185 |
if(fstat(desc, &statb) < 0) {
cli_errmsg("Can't fstat descriptor %d\n", desc);
return CL_EIO;
}
fsize = statb.st_size;
|
ef0f4fdf |
i = dup(desc);
if((fp = fdopen(i, "rb")) == NULL) {
cli_errmsg("Can't open descriptor %d\n", desc);
close(i);
return CL_EOPEN;
} |
5f591f08 |
|
ef0f4fdf |
if(fread(&i32, sizeof(uint32_t), 1, fp) != 1) {
fclose(fp);
return CL_EIO;
} |
f3395337 |
if(host32(i32) != TNEF_SIGNATURE) { |
ef0f4fdf |
fclose(fp); |
5f591f08 |
return CL_EFORMAT; |
ef0f4fdf |
} |
5f591f08 |
|
ef0f4fdf |
if(fread(&i16, sizeof(uint16_t), 1, fp) != 1) {
fclose(fp); |
5f591f08 |
return CL_EIO; |
ef0f4fdf |
} |
5f591f08 |
|
2b227b61 |
fb = NULL; |
e483f51a |
ret = CL_CLEAN; /* we don't know if it's clean or not :-) */ |
2b227b61 |
alldone = 0; |
5f591f08 |
|
2b227b61 |
do { |
e82a5185 |
uint8_t part = 0;
uint16_t type = 0, tag = 0;
int32_t length = 0; |
e483f51a |
switch(tnef_header(fp, &part, &type, &tag, &length)) { |
5f591f08 |
case 0: |
ef0f4fdf |
if(ferror(fp)) {
perror("read");
ret = CL_EIO;
} |
5f591f08 |
alldone = 1;
break; |
ef0f4fdf |
case 1: |
5f591f08 |
break;
default: |
2b227b61 |
ret = CL_EIO;
alldone = 1;
break; |
5f591f08 |
} |
e82a5185 |
if(length == 0)
continue;
if(length < 0) {
cli_warnmsg("Corrupt TNEF header detected - length %d\n", length);
ret = CL_EFORMAT;
break;
} |
5f591f08 |
if(alldone)
break; |
e483f51a |
switch(part) { |
5f591f08 |
case LVL_MESSAGE: |
e483f51a |
cli_dbgmsg("TNEF - found message\n"); |
9c8806fb |
if(fb != NULL) {
fileblobDestroy(fb);
fb = NULL;
}
fb = fileblobCreate(); |
e82a5185 |
if(tnef_message(fp, type, tag, length, fsize) != 0) { |
5f591f08 |
cli_errmsg("Error reading TNEF message\n"); |
2b227b61 |
ret = CL_EFORMAT;
alldone = 1; |
5f591f08 |
}
break;
case LVL_ATTACHMENT: |
e483f51a |
cli_dbgmsg("TNEF - found attachment\n"); |
e82a5185 |
if(tnef_attachment(fp, type, tag, length, dir, &fb, fsize) != 0) { |
5f591f08 |
cli_errmsg("Error reading TNEF message\n"); |
2b227b61 |
ret = CL_EFORMAT;
alldone = 1; |
5f591f08 |
}
break; |
2b227b61 |
case 0:
break; |
5f591f08 |
default: |
e483f51a |
cli_warnmsg("TNEF - unknown level %d tag 0x%x\n", (int)part, (int)tag); |
e82a5185 |
|
e483f51a |
/*
* Dump the file incase it was part of an
* email that's about to be deleted
*/
if(cli_debug_flag) {
int fout;
char *filename = cli_gentemp(NULL);
char buffer[BUFSIZ];
#ifdef O_BINARY
fout = open(filename, O_WRONLY|O_CREAT|O_EXCL|O_TRUNC|O_BINARY, 0600);
#else
fout = open(filename, O_WRONLY|O_CREAT|O_EXCL|O_TRUNC, 0600);
#endif
if(fout >= 0) {
int count;
cli_warnmsg("Saving dump to %s - send to bugs@clamav.net\n", filename);
lseek(desc, 0L, SEEK_SET);
while((count = cli_readn(desc, buffer, sizeof(buffer))) > 0)
cli_writen(fout, buffer, count);
close(fout);
}
free(filename);
} |
2b227b61 |
ret = CL_EFORMAT;
alldone = 1;
break; |
5f591f08 |
} |
2b227b61 |
} while(!alldone); |
5f591f08 |
|
c840fa41 |
fclose(fp);
|
2b227b61 |
if(fb) { |
1ae303c2 |
cli_dbgmsg("cli_tnef: flushing final data\n");
if(fileblobGetFilename(fb) == NULL) { |
e82a5185 |
cli_dbgmsg("Saving TNEF portion with an unknown name\n"); |
1ae303c2 |
fileblobSetFilename(fb, dir, "tnef");
} |
2b227b61 |
fileblobDestroy(fb);
fb = NULL;
} |
f3395337 |
|
e483f51a |
cli_dbgmsg("cli_tnef: returning %d\n", ret);
return ret; |
0646ab95 |
} |
5f591f08 |
static int |
e82a5185 |
tnef_message(FILE *fp, uint16_t type, uint16_t tag, int32_t length, off_t fsize) |
5f591f08 |
{ |
e483f51a |
uint16_t i16; |
e82a5185 |
off_t offset; |
2b227b61 |
#if CL_DEBUG |
ac8dfb6a |
uint32_t i32; |
5f591f08 |
char *string; |
2b227b61 |
#endif |
5f591f08 |
|
c840fa41 |
cli_dbgmsg("message tag 0x%x, type 0x%x, length %d\n", tag, type, length); |
5f591f08 |
|
e82a5185 |
offset = ftell(fp); |
5f591f08 |
/*
* a lot of this stuff should be only discovered in debug mode...
*/
switch(tag) { |
2b227b61 |
case attBODY: |
ac8dfb6a |
cli_warnmsg("TNEF body not being scanned - if you believe this file contains a virus, submit it to www.clamav.net\n"); |
2b227b61 |
break;
#if CL_DEBUG |
5f591f08 |
case attTNEFVERSION:
/*assert(length == sizeof(uint32_t))*/ |
ef0f4fdf |
if(fread(&i32, sizeof(uint32_t), 1, fp) != 1) |
5f591f08 |
return -1; |
f3395337 |
i32 = host32(i32); |
5f591f08 |
cli_dbgmsg("TNEF version %d\n", i32);
break;
case attOEMCODEPAGE: |
ef0f4fdf |
/* 8 bytes, but just print the first 4 */ |
5f591f08 |
/*assert(length == sizeof(uint32_t))*/ |
ef0f4fdf |
if(fread(&i32, sizeof(uint32_t), 1, fp) != 1) |
5f591f08 |
return -1; |
f3395337 |
i32 = host32(i32); |
5f591f08 |
cli_dbgmsg("TNEF codepage %d\n", i32);
break;
case attDATEMODIFIED:
/* 14 bytes, long */
break;
case attMSGCLASS: |
c840fa41 |
if(length <= 0)
return -1; |
5f591f08 |
string = cli_malloc(length + 1); |
c840fa41 |
if(string == NULL)
return -1;
if(fread(string, 1, (uint32_t)length, fp) != (uint32_t)length) { |
9c8806fb |
free(string); |
5f591f08 |
return -1; |
9c8806fb |
} |
5f591f08 |
string[length] = '\0';
cli_dbgmsg("TNEF class %s\n", string);
free(string);
break;
default: |
c840fa41 |
cli_dbgmsg("TNEF - unsupported message tag 0x%x type 0x%d length %d\n", tag, type, length); |
5f591f08 |
break; |
2b227b61 |
#endif |
5f591f08 |
}
|
e483f51a |
/*cli_dbgmsg("%lu %lu\n", (long)(offset + length), ftell(fp));*/ |
5f591f08 |
|
e82a5185 |
if(!CLI_ISCONTAINED2(0, fsize, (off_t)offset, (off_t)length)) {
cli_errmsg("TNEF: Incorrect length field\n");
return -1;
}
if(fseek(fp, offset + length, SEEK_SET) < 0)
return -1; |
5f591f08 |
/* Checksum - TODO, verify */ |
e82a5185 |
if(fread(&i16, sizeof(uint16_t), 1, fp) != 1) |
5f591f08 |
return -1;
return 0;
}
static int |
e82a5185 |
tnef_attachment(FILE *fp, uint16_t type, uint16_t tag, int32_t length, const char *dir, fileblob **fbref, off_t fsize) |
5f591f08 |
{ |
e483f51a |
uint32_t todo;
uint16_t i16; |
e82a5185 |
off_t offset; |
2b227b61 |
char *string;
|
c840fa41 |
cli_dbgmsg("attachment tag 0x%x, type 0x%x, length %d\n", tag, type, length); |
2b227b61 |
|
e82a5185 |
offset = ftell(fp); |
2b227b61 |
switch(tag) {
case attATTACHTITLE: |
c840fa41 |
if(length <= 0)
return -1; |
2b227b61 |
string = cli_malloc(length + 1); |
c840fa41 |
if(string == NULL)
return -1;
if(fread(string, 1, (uint32_t)length, fp) != (uint32_t)length) { |
9c8806fb |
free(string); |
2b227b61 |
return -1; |
9c8806fb |
} |
2b227b61 |
string[length] = '\0';
cli_dbgmsg("TNEF filename %s\n", string); |
9c8806fb |
if(*fbref == NULL) {
*fbref = fileblobCreate();
if(*fbref == NULL) {
free(string);
return -1;
}
} |
2b227b61 |
fileblobSetFilename(*fbref, dir, string);
free(string);
break;
case attATTACHDATA:
if(*fbref == NULL) {
*fbref = fileblobCreate();
if(*fbref == NULL)
return -1;
} |
ef0f4fdf |
for(todo = length; todo; todo--) { |
f3395337 |
#if WORDS_BIGENDIAN == 1
int c;
unsigned char c2;
if((c = fgetc(fp)) == EOF)
break;
c2 = (unsigned char)c;
fileblobAddData(*fbref, (const unsigned char *)&c2, 1);
#else |
ef0f4fdf |
int c; |
2b227b61 |
|
ef0f4fdf |
if((c = fgetc(fp)) == EOF) |
2b227b61 |
break;
fileblobAddData(*fbref, (const unsigned char *)&c, 1); |
f3395337 |
#endif |
2b227b61 |
}
break;
default: |
c840fa41 |
cli_dbgmsg("TNEF - unsupported attachment tag 0x%x type 0x%d length %d\n", tag, type, length); |
2b227b61 |
break;
}
|
e483f51a |
/*cli_dbgmsg("%lu %lu\n", (long)(offset + length), ftell(fp));*/ |
2b227b61 |
|
e82a5185 |
if(!CLI_ISCONTAINED2(0, fsize, (off_t)offset, (off_t)length)) {
cli_errmsg("TNEF: Incorrect length field\n");
return -1;
}
if(fseek(fp, (long)(offset + length), SEEK_SET) < 0) /* shouldn't be needed */
return -1; |
2b227b61 |
/* Checksum - TODO, verify */ |
e82a5185 |
if(fread(&i16, sizeof(uint16_t), 1, fp) != 1) |
2b227b61 |
return -1;
|
5f591f08 |
return 0;
} |
e483f51a |
static int |
c840fa41 |
tnef_header(FILE *fp, uint8_t *part, uint16_t *type, uint16_t *tag, int32_t *length) |
e483f51a |
{
uint32_t i32;
if(fread(part, sizeof(uint8_t), 1, fp) != 1)
return 0;
if(*part == (uint8_t)0)
return 0;
if(fread(&i32, sizeof(uint32_t), 1, fp) != 1)
return -1;
i32 = host32(i32); |
e82a5185 |
*tag = (uint16_t)(i32 & 0xFFFF);
*type = (uint16_t)((i32 & 0xFFFF0000) >> 16); |
e483f51a |
if(fread(&i32, sizeof(uint32_t), 1, fp) != 1)
return -1; |
c840fa41 |
*length = (int32_t)host32(i32); |
e483f51a |
|
c840fa41 |
cli_dbgmsg("message tag 0x%x, type 0x%x, length %d\n", *tag, *type, *length); |
e483f51a |
return 1;
} |