1 | /* Copyright © 2013 Canonical Limited |
2 | * |
3 | * This library is free software; you can redistribute it and/or |
4 | * modify it under the terms of the GNU Lesser General Public |
5 | * License as published by the Free Software Foundation; either |
6 | * version 2.1 of the License, or (at your option) any later version. |
7 | * |
8 | * This library is distributed in the hope that it will be useful, |
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
11 | * Lesser General Public License for more details. |
12 | * |
13 | * You should have received a copy of the GNU Lesser General |
14 | * Public License along with this library; if not, see <http://www.gnu.org/licenses/>. |
15 | * |
16 | * Author: Ryan Lortie <desrt@desrt.ca> |
17 | */ |
18 | |
19 | #include "config.h" |
20 | |
21 | #include "thumbnail-verify.h" |
22 | |
23 | #include <string.h> |
24 | |
25 | /* Begin code to check the validity of thumbnail files. In order to do |
26 | * that we need to parse enough PNG in order to get the Thumb::URI, |
27 | * Thumb::MTime and Thumb::Size tags out of the file. Fortunately this |
28 | * is relatively easy. |
29 | */ |
30 | typedef struct |
31 | { |
32 | const gchar *uri; |
33 | guint64 mtime; |
34 | guint64 size; |
35 | } ExpectedInfo; |
36 | |
37 | /* We *require* matches on URI and MTime, but the Size field is optional |
38 | * (as per the spec). |
39 | * |
40 | * http://specifications.freedesktop.org/thumbnail-spec/thumbnail-spec-latest.html |
41 | */ |
42 | #define MATCHED_URI (1u << 0) |
43 | #define MATCHED_MTIME (1u << 1) |
44 | #define MATCHED_ALL (MATCHED_URI | MATCHED_MTIME) |
45 | |
46 | static gboolean |
47 | check_integer_match (guint64 expected, |
48 | const gchar *value, |
49 | guint32 value_size) |
50 | { |
51 | /* Would be nice to g_ascii_strtoll here, but we don't have a variant |
52 | * that works on strings that are not nul-terminated. |
53 | * |
54 | * It's easy enough to do it ourselves... |
55 | */ |
56 | if (expected == 0) /* special case: "0" */ |
57 | return value_size == 1 && value[0] == '0'; |
58 | |
59 | /* Check each digit, as long as we have data from both */ |
60 | while (expected && value_size) |
61 | { |
62 | /* Check the low-order digit */ |
63 | if (value[value_size - 1] != (gchar) ((expected % 10) + '0')) |
64 | return FALSE; |
65 | |
66 | /* Move on... */ |
67 | expected /= 10; |
68 | value_size--; |
69 | } |
70 | |
71 | /* Make sure nothing is left over, on either side */ |
72 | return !expected && !value_size; |
73 | } |
74 | |
75 | static gboolean |
76 | check_png_info_chunk (ExpectedInfo *expected_info, |
77 | const gchar *key, |
78 | guint32 key_size, |
79 | const gchar *value, |
80 | guint32 value_size, |
81 | guint *required_matches) |
82 | { |
83 | if (key_size == 10 && memcmp (s1: key, s2: "Thumb::URI" , n: 10) == 0) |
84 | { |
85 | gsize expected_size; |
86 | |
87 | expected_size = strlen (s: expected_info->uri); |
88 | |
89 | if (expected_size != value_size) |
90 | return FALSE; |
91 | |
92 | if (memcmp (s1: expected_info->uri, s2: value, n: value_size) != 0) |
93 | return FALSE; |
94 | |
95 | *required_matches |= MATCHED_URI; |
96 | } |
97 | |
98 | else if (key_size == 12 && memcmp (s1: key, s2: "Thumb::MTime" , n: 12) == 0) |
99 | { |
100 | if (!check_integer_match (expected: expected_info->mtime, value, value_size)) |
101 | return FALSE; |
102 | |
103 | *required_matches |= MATCHED_MTIME; |
104 | } |
105 | |
106 | else if (key_size == 11 && memcmp (s1: key, s2: "Thumb::Size" , n: 11) == 0) |
107 | { |
108 | /* A match on Thumb::Size is not required for success, but if we |
109 | * find this optional field and it's wrong, we should reject the |
110 | * thumbnail. |
111 | */ |
112 | if (!check_integer_match (expected: expected_info->size, value, value_size)) |
113 | return FALSE; |
114 | } |
115 | |
116 | return TRUE; |
117 | } |
118 | |
119 | static gboolean |
120 | check_thumbnail_validity (ExpectedInfo *expected_info, |
121 | const gchar *contents, |
122 | gsize size) |
123 | { |
124 | guint required_matches = 0; |
125 | |
126 | /* Reference: http://www.w3.org/TR/PNG/ */ |
127 | if (size < 8) |
128 | return FALSE; |
129 | |
130 | if (memcmp (s1: contents, s2: "\x89PNG\r\n\x1a\n" , n: 8) != 0) |
131 | return FALSE; |
132 | |
133 | contents += 8, size -= 8; |
134 | |
135 | /* We need at least 12 bytes to have a chunk... */ |
136 | while (size >= 12) |
137 | { |
138 | guint32 chunk_size_be; |
139 | guint32 chunk_size; |
140 | |
141 | /* PNG is not an aligned file format so we have to be careful |
142 | * about reading integers... |
143 | */ |
144 | memcpy (dest: &chunk_size_be, src: contents, n: 4); |
145 | chunk_size = GUINT32_FROM_BE (chunk_size_be); |
146 | |
147 | contents += 4, size -= 4; |
148 | |
149 | /* After consuming the size field, we need to have enough bytes |
150 | * for 4 bytes type field, chunk_size bytes for data, then 4 byte |
151 | * for CRC (which we ignore) |
152 | * |
153 | * We just read chunk_size from the file, so it may be very large. |
154 | * Make sure it won't wrap when we add 8 to it. |
155 | */ |
156 | if (G_MAXUINT32 - chunk_size < 8 || size < chunk_size + 8) |
157 | goto out; |
158 | |
159 | /* We are only interested in tEXt fields */ |
160 | if (memcmp (s1: contents, s2: "tEXt" , n: 4) == 0) |
161 | { |
162 | const gchar *key = contents + 4; |
163 | guint32 key_size; |
164 | |
165 | /* We need to find the nul separator character that splits the |
166 | * key/value. The value is not terminated. |
167 | * |
168 | * If we find no nul then we just ignore the field. |
169 | * |
170 | * value may contain extra nuls, but check_png_info_chunk() |
171 | * can handle that. |
172 | */ |
173 | for (key_size = 0; key_size < chunk_size; key_size++) |
174 | { |
175 | if (key[key_size] == '\0') |
176 | { |
177 | const gchar *value; |
178 | guint32 value_size; |
179 | |
180 | /* Since key_size < chunk_size, value_size is |
181 | * definitely non-negative. |
182 | */ |
183 | value_size = chunk_size - key_size - 1; |
184 | value = key + key_size + 1; |
185 | |
186 | /* We found the separator character. */ |
187 | if (!check_png_info_chunk (expected_info, |
188 | key, key_size, |
189 | value, value_size, |
190 | required_matches: &required_matches)) |
191 | return FALSE; |
192 | } |
193 | } |
194 | } |
195 | else |
196 | { |
197 | /* A bit of a hack: assume that all tEXt chunks will appear |
198 | * together. Therefore, if we have already seen both required |
199 | * fields and then see a non-tEXt chunk then we can assume we |
200 | * are done. |
201 | * |
202 | * The common case is that the tEXt chunks come at the start |
203 | * of the file before any of the image data. This trick means |
204 | * that we will only fault in a single page (4k) whereas many |
205 | * thumbnails (particularly the large ones) can approach 100k |
206 | * in size. |
207 | */ |
208 | if (required_matches == MATCHED_ALL) |
209 | goto out; |
210 | } |
211 | |
212 | /* skip to the next chunk, ignoring CRC. */ |
213 | contents += 4, size -= 4; /* type field */ |
214 | contents += chunk_size, size -= chunk_size; /* data */ |
215 | contents += 4, size -= 4; /* CRC */ |
216 | } |
217 | |
218 | out: |
219 | return required_matches == MATCHED_ALL; |
220 | } |
221 | |
222 | gboolean |
223 | thumbnail_verify (const char *thumbnail_path, |
224 | const gchar *file_uri, |
225 | const GLocalFileStat *file_stat_buf) |
226 | { |
227 | gboolean thumbnail_is_valid = FALSE; |
228 | ExpectedInfo expected_info; |
229 | GMappedFile *file; |
230 | |
231 | if (file_stat_buf == NULL) |
232 | return FALSE; |
233 | |
234 | expected_info.uri = file_uri; |
235 | #ifdef G_OS_WIN32 |
236 | expected_info.mtime = (guint64) file_stat_buf->st_mtim.tv_sec; |
237 | #else |
238 | expected_info.mtime = _g_stat_mtime (buf: file_stat_buf); |
239 | #endif |
240 | expected_info.size = _g_stat_size (buf: file_stat_buf); |
241 | |
242 | file = g_mapped_file_new (filename: thumbnail_path, FALSE, NULL); |
243 | if (file) |
244 | { |
245 | thumbnail_is_valid = check_thumbnail_validity (expected_info: &expected_info, |
246 | contents: g_mapped_file_get_contents (file), |
247 | size: g_mapped_file_get_length (file)); |
248 | g_mapped_file_unref (file); |
249 | } |
250 | |
251 | return thumbnail_is_valid; |
252 | } |
253 | |