/*
* Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2011-2013 Sourcefire, Inc.
*
* Authors: Tomasz Kojm <tkojm@clamav.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/stat.h>
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#include <time.h>
#include "jpeg.h"
#include "clamav.h"
#define EC16(x) le16_to_host(x)
#define GETBYTE(v) \
if(fmap_readn(map, &v, offset, sizeof(v)) == sizeof(v)) { \
offset += sizeof(v); \
} else { \
cli_errmsg("cli_parse(jpeg|gif): Can't read file (corrupted?)\n"); \
return CL_EPARSE; \
}
int cli_parsejpeg(cli_ctx *ctx)
{
fmap_t *map = *ctx->fmap;
unsigned char marker, prev_marker, prev_segment = 0, v1, v2, buff[8];
unsigned int offset = 0, i, len, comment = 0, segment = 0, app = 0;
cli_dbgmsg("in cli_parsejpeg()\n");
if(fmap_readn(map, buff, offset, 4) != 4)
return CL_SUCCESS; /* Ignore */
if(!memcmp(buff, "\xff\xd8\xff", 3))
offset = 2;
else if(!memcmp(buff, "\xff\xd9\xff\xd8", 4))
offset = 4;
else
return CL_SUCCESS; /* Not a JPEG file */
while(1) {
segment++;
prev_marker = 0;
for(i = 0; offset < map->len && i < 16; i++) {
GETBYTE(marker);
if(prev_marker == 0xff && marker != 0xff)
break;
prev_marker = marker;
}
if(i == 16) {
cli_warnmsg("cli_parsejpeg: Spurious bytes before segment %u\n", segment);
return CL_EPARSE;
}
if(offset == map->len) {
cli_warnmsg("cli_parsejpeg: Error looking for marker\n");
return CL_EPARSE;
}
GETBYTE(v1);
GETBYTE(v2);
len = (unsigned int) (v1 << 8) | v2;
cli_dbgmsg("JPEG: Marker %02x, length %u\n", marker, len);
if(len < 2) {
cli_warnmsg("cli_parsejpeg: Invalid segment size\n");
return CL_EPARSE;
}
if(len >= map->len - offset + 2) {
cli_warnmsg("cli_parsejpeg: Segment data out of file\n");
return CL_EPARSE;
}
offset += len - 2;
switch(marker) {
case 0xe0: /* JFIF */
if(app) {
cli_warnmsg("cli_parsejpeg: Duplicate Application Marker\n");
return CL_EPARSE;
}
if(segment != 1 && (segment != 2 || !comment)) {
cli_warnmsg("cli_parsejpeg: JFIF marker at wrong position\n");
return CL_EPARSE;
}
if(fmap_readn(map, buff, offset - len + 2, 5) != 5 || memcmp(buff, "JFIF\0",5)) {
cli_warnmsg("cli_parsejpeg: No JFIF marker\n");
return CL_EPARSE;
}
if(len < 16) {
cli_warnmsg("cli_parsejpeg: JFIF header too short\n");
return CL_EPARSE;
}
app = 0xe0;
break;
case 0xe1: /* EXIF */
if(fmap_readn(map, buff, offset - len + 2, 7) != 7) {
cli_warnmsg("cli_parsejpeg: Can't read Exif header\n");
return CL_EPARSE;
}
if(!memcmp(buff, "Exif\0\0", 6)) {
if(app && app != 0xe0) {
cli_warnmsg("cli_parsejpeg: Duplicate Application Marker\n");
return CL_EPARSE;
}
if(segment > 3 && !comment && app != 0xe0) {
cli_warnmsg("cli_parsejpeg: Exif marker at wrong position\n");
return CL_EPARSE;
}
} else if(!memcmp(buff, "http://", 7)) {
cli_dbgmsg("JPEG: XMP data in segment %u\n", segment);
} else {
cli_warnmsg("cli_parsejpeg: Invalid Exif header\n");
return CL_EPARSE;
}
if(len < 16) {
cli_warnmsg("cli_parsejpeg: Exif header too short\n");
return CL_EPARSE;
}
app = 0xe1;
break;
case 0xe8: /* SPIFF */
if(app) {
cli_warnmsg("cli_parsejpeg: Duplicate Application Marker\n");
return CL_EPARSE;
}
if(segment != 1 && (segment != 2 || !comment)) {
cli_warnmsg("cli_parsejpeg: SPIFF marker at wrong position\n");
return CL_EPARSE;
}
if(fmap_readn(map, buff, offset - len + 2, 6) != 6 || memcmp(buff, "SPIFF\0", 6)) {
cli_warnmsg("cli_parsejpeg: No SPIFF marker\n");
return CL_EPARSE;
}
if(len < 16) {
cli_warnmsg("cli_parsejpeg: SPIFF header too short\n");
return CL_EPARSE;
}
app = 0xe8;
break;
case 0xf7: /* JPG7 */
if(app) {
cli_warnmsg("cli_parsejpeg: Application Marker before JPG7\n");
return CL_EPARSE;
}
return CL_SUCCESS;
case 0xda: /* SOS */
if(!app) {
cli_warnmsg("cli_parsejpeg: Invalid file structure\n");
return CL_EPARSE;
}
return CL_SUCCESS;
case 0xd9: /* EOI */
cli_warnmsg("cli_parsejpeg: No image in jpeg\n");
return CL_EPARSE;
case 0xfe: /* COM */
comment = 1;
break;
case 0xed: /* IPTC */
comment = 1;
break;
case 0xf2: /* DTT */
if(prev_segment != 0xf1) {
cli_warnmsg("cli_parsejpeg: No DTI segment before DTT\n");
return CL_EPARSE;
}
break;
default:
break;
}
prev_segment = marker;
}
return CL_SUCCESS;
}
/* GIF */
struct gif_screen_desc {
uint16_t width;
uint16_t height;
uint8_t flags;
uint8_t bgcolor;
uint8_t aspect;
};
struct gif_graphic_control_ext {
uint8_t blksize;
uint8_t flags;
uint16_t delaytime;
uint8_t tcoloridx;
uint8_t blkterm;
};
struct gif_image_desc {
uint16_t leftpos;
uint16_t toppos;
uint16_t width;
uint16_t height;
uint8_t flags;
};
int cli_parsegif(cli_ctx *ctx)
{
fmap_t *map = *ctx->fmap;
unsigned char magic[6], v;
unsigned int offset = 0, have_gce = 0;
struct gif_screen_desc screen_desc;
struct gif_graphic_control_ext graphic_control_ext;
struct gif_image_desc image_desc;
cli_dbgmsg("in cli_parsegif()\n");
if(fmap_readn(map, magic, offset, 6) != 6)
return CL_SUCCESS; /* Ignore */
if(!memcmp(magic, "GIF87a", 6) || !memcmp(magic, "GIF89a", 6))
offset = 6;
else
return CL_SUCCESS; /* Not a GIF file */
if(fmap_readn(map, &screen_desc, offset, sizeof(screen_desc)) != sizeof(screen_desc)) {
cli_warnmsg("cli_parsegif: Can't read Logical Screen Descriptor block\n");
return CL_EPARSE;
}
offset += 7;
cli_dbgmsg("GIF: Screen size %ux%u, gctsize: %u\n", EC16(screen_desc.width), EC16(screen_desc.height), screen_desc.flags & 0x7);
if(screen_desc.flags & 0x80)
offset += 3 * (1 << ((screen_desc.flags & 0x7) + 1));
while(1) {
GETBYTE(v);
if(v == 0x21) {
GETBYTE(v);
if(v == 0xf9) {
if(fmap_readn(map, &graphic_control_ext, offset, sizeof(graphic_control_ext)) != sizeof(graphic_control_ext)) {
cli_warnmsg("cli_parsegif: Can't read Graphic Control Extension block\n");
return CL_EPARSE;
}
if(have_gce) {
cli_warnmsg("cli_parsegif: Multiple Graphic Control Extension blocks not allowed\n");
return CL_EPARSE;
}
have_gce = 1;
offset += sizeof(graphic_control_ext);
if(graphic_control_ext.blksize != 4 || graphic_control_ext.blkterm) {
cli_warnmsg("cli_parsegif: Invalid Graphic Control Extension block\n");
return CL_EPARSE;
}
} else {
while(1) {
GETBYTE(v);
if(!v)
break;
offset += v;
}
}
} else if(v == 0x2c) {
if(fmap_readn(map, &image_desc, offset, sizeof(image_desc)) != sizeof(image_desc)) {
cli_warnmsg("cli_parsegif: Can't read Image Descriptor block\n");
return CL_EPARSE;
}
offset += 9;
cli_dbgmsg("GIF: Image size %ux%u, left pos: %u, top pos: %u\n", EC16(image_desc.width), EC16(image_desc.height), EC16(image_desc.leftpos), EC16(image_desc.toppos));
break;
}
}
return CL_SUCCESS;
}