mdl_verify.c File Reference

Portable bounded structural validators for media artifacts. More...

#include "mdl_verify.h"
#include <ctype.h>
#include <limits.h>
#include <string.h>
#include "jof.h"
#include "mdl_verify_internal.h"
#include "mdl_verify_rabook_internal.h"
#include "miniz.h"
#include "ra8_attributes.h"

Include dependency graph for mdl_verify.c:

Go to the source code of this file.

Data Structures
struct	mdl_alloc_header_t
	Header stored before each monotonic miniz allocation. More...
struct	mdl_zip_scan_t
	Semantic markers accumulated while scanning ZIP members. More...

Functions
void *	priv_mdl_verify_workspace_take (mdl_export_workspace_t *workspace, size_t bytes, size_t alignment)
	Reserve one aligned span from the verifier's caller-owned arena.
static bool	internal_ends_ci (const char *text, const char *suffix)
	Test a suffix without case sensitivity.
bool	priv_mdl_verify_is_image (const char *name)
	Recognize supported image suffixes.
bool	priv_mdl_verify_safe_member_name (const char *name)
	Reject unsafe archive member paths.
ra8_err_t	mdl_format_from_path (const char *path, mdl_format_t *out_format)
	Infer an artifact format from its complete path suffix.
bool	mdl_format_is_verifiable (mdl_format_t format)
	Report whether a format has an in-process structural validator.
void *	priv_mdl_verify_arena_alloc (void *opaque, size_t items, size_t size)
	Allocate one aligned miniz span from a monotonic arena.
void	priv_mdl_verify_arena_free (void *opaque, void *address)
	Accept a miniz free for a monotonic arena.
static void *	internal_arena_realloc (void *opaque, void *address, size_t items, size_t size)
	Grow a miniz span by copying it to the next arena allocation.
static ra8_err_t	internal_io_open (mdl_storage_t *storage, const char *path, mdl_verify_io_t *io)
	Open a portable read-only input.
static ra8_err_t	internal_io_close (mdl_verify_io_t *io, ra8_err_t prior)
	Close an input without masking prior failure.
ra8_err_t	priv_mdl_verify_io_read_up_to (mdl_verify_io_t *io, uint8_t *destination, size_t length, size_t *out_read)
	Read up to a requested portable span.
static size_t	internal_zip_read (void *opaque, mz_uint64 offset, void *destination, size_t length)
	Adapt portable reads to miniz.
static size_t	internal_discard_zip (void *opaque, mz_uint64 offset, const void *data, size_t bytes)
	Discard verified ZIP output.
static ra8_err_t	internal_zip_member (mz_zip_archive *zip, mz_uint index, mdl_zip_scan_t *scan)
	Validate one ZIP member.
static ra8_err_t	internal_zip_semantics (mdl_format_t format, const mdl_zip_scan_t *scan, mdl_verify_report_t *report)
	Enforce ZIP format semantics.
static ra8_err_t	internal_verify_zip (mdl_verify_io_t *io, mdl_format_t format, mdl_export_workspace_t *workspace, mdl_verify_report_t *report)
	Validate a ZIP-backed artifact.
static ra8_err_t	internal_jof_pread (void *opaque, uint64_t offset, uint8_t *destination, size_t length, size_t *got)
	Adapt JOF positioned reads.
static ra8_err_t	internal_verify_jof (mdl_verify_io_t *io, mdl_verify_report_t *report)
	Validate a JOF artifact.
static ra8_err_t	internal_verify_borrowed (mdl_verify_io_t *io, mdl_format_t format, mdl_export_workspace_t *workspace, mdl_verify_report_t *report)
	Dispatch validation over one borrowed input.
ra8_err_t	mdl_verify_open_file (mdl_storage_t *storage, mdl_format_t format, fw_fs_file_t *file, uint64_t size_bytes, mdl_export_workspace_t *workspace, mdl_verify_report_t *report)
	Validate an artifact through a borrowed open filesystem handle.
ra8_err_t	mdl_verify_file (mdl_storage_t *storage, mdl_format_t format, const char *path, mdl_export_workspace_t *workspace, mdl_verify_report_t *report)
	Validate a completed artifact using caller-owned scratch only.

Detailed Description

Portable bounded structural validators for media artifacts.

Reads only through an injected mdl_storage_t. ZIP uses miniz's positioned callback and JOF uses its production pread seam; the incremental TAR and gzip validators live beside this file in mdl_verify_tarball.c.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file mdl_verify.c.

Function Documentation

internal_arena_realloc()

void * internal_arena_realloc ( void * opaque, void * address, size_t items, size_t size )

static

Grow a miniz span by copying it to the next arena allocation.

Definition at line 170 of file mdl_verify.c.

References mdl_alloc_header_t::bytes, memcpy(), and priv_mdl_verify_arena_alloc().

Referenced by internal_verify_zip().

internal_discard_zip()

size_t internal_discard_zip ( void * opaque, mz_uint64 offset, const void * data, size_t bytes )

static

Discard verified ZIP output.

Supplies a bounded sink so miniz computes and checks member CRCs.

Parameters

[in,out]	opaque	Unused callback context.
[in]	offset	Output offset.
[in]	data	Decoded bytes.
[in]	bytes	Byte count.

Returns

Accepted bytes.

Return values

bytes

Always.

Precondition

data spans bytes bytes.

offset is supplied by miniz.

Postcondition

data is unchanged.

No bytes are retained.

Note

This validates rather than extracts.

Since

v0.1.0

Definition at line 295 of file mdl_verify.c.

Referenced by internal_zip_member().

internal_ends_ci()

bool internal_ends_ci ( const char * text, const char * suffix )

static

Test a suffix without case sensitivity.

Compares only the tail of a valid string.

Parameters

[in]	text	Candidate string.
[in]	suffix	Required suffix.

Returns

Whether the suffix matches.

Return values

true	On a match.

Precondition

Both pointers address terminated strings.

Their lengths fit in size_t.

Postcondition

Neither string is modified.

The result depends only on input bytes.

Note

ASCII suffixes are expected.

Since

v0.1.0

Definition at line 62 of file mdl_verify.c.

References RA8_INTERNAL, and strlen().

Referenced by internal_zip_member(), mdl_format_from_path(), and priv_mdl_verify_is_image().

internal_io_close()

ra8_err_t internal_io_close ( mdl_verify_io_t * io, ra8_err_t prior )

static

Close an input without masking prior failure.

A close error is returned only when prior succeeded.

Parameters

[in,out]	io	Open input state.
[in]	prior	Earlier operation status.

Returns

Final status.

Return values

k_ra8_ok

When both stages succeed.

Precondition

io was initialized by internal_io_open.

prior is a valid error code.

Postcondition

io is marked closed.

The first failure remains observable.

Note

Close is attempted exactly once.

Since

v0.1.0

Definition at line 223 of file mdl_verify.c.

References fw_fs_close(), k_ra8_ok, and RA8_INTERNAL.

Referenced by mdl_verify_file().

internal_io_open()

ra8_err_t internal_io_open ( mdl_storage_t * storage, const char * path, mdl_verify_io_t * io )

static

Open a portable read-only input.

Opens through storage and snapshots the immutable validation size.

Parameters

[in]	storage	Bound storage facade.
[in]	path	Canonical bound-root path.
[in,out]	io	Output state.

Returns

Status.

Return values

k_ra8_ok

On success.

Precondition

All pointers are valid.

storage workspaces satisfy its contract.

Postcondition

Success leaves io open.

Failure leaves no owned file.

Note

The caller must close successful opens.

Since

v0.1.0

Definition at line 195 of file mdl_verify.c.

References mdl_storage_t::file_workspace, mdl_storage_t::file_workspace_bytes, mdl_storage_t::fs, fw_fs_close(), fw_fs_file_size(), fw_fs_open(), k_fw_fs_open_read, k_ra8_ok, and fw_fs_t::streams.

Referenced by mdl_verify_file().

internal_jof_pread()

ra8_err_t internal_jof_pread ( void * opaque, uint64_t offset, uint8_t * destination, size_t length, size_t * got )

static

Adapt JOF positioned reads.

Uses portable seek and bounded reads against the size snapshot.

Parameters

[in,out]	opaque	Verifier input.
[in]	offset	File offset.
[out]	destination	Output buffer.
[in]	length	Requested bytes.
[out]	got	Produced bytes.

Returns

Status.

Return values

k_ra8_ok

On data or EOF.

Precondition

All pointers are valid.

destination spans length bytes.

Postcondition

got never exceeds length.

Reads stay within the snapshot.

Note

Parser-visible EOF is a zero-byte success.

Since

v0.1.0

Definition at line 421 of file mdl_verify.c.

References fw_fs_seek(), k_ra8_ok, priv_mdl_verify_io_read_up_to(), and mdl_verify_io_t::size_bytes.

Referenced by internal_verify_jof().

internal_verify_borrowed()

ra8_err_t internal_verify_borrowed ( mdl_verify_io_t * io, mdl_format_t format, mdl_export_workspace_t * workspace, mdl_verify_report_t * report )

static

Dispatch validation over one borrowed input.

Keeps format selection separate from ownership.

Parameters

[in,out]	io	Borrowed verifier input.
[in]	format	Expected format.
[in,out]	workspace	Scratch arena.
[in,out]	report	Candidate report.

Returns

Status.

Return values

k_ra8_ok

For a valid artifact.

Precondition

All pointers are valid.

io starts at offset zero.

Postcondition

io remains open.

Success fills report.

Note

Unsupported formats stay explicit.

Since

v0.1.0

Definition at line 464 of file mdl_verify.c.

References internal_verify_jof(), internal_verify_zip(), k_mdl_format_cbr, k_mdl_format_cbt, k_mdl_format_cbt_gz, k_mdl_format_cbt_xz, k_mdl_format_cbz, k_mdl_format_epub, k_mdl_format_invalid, k_mdl_format_jof, k_mdl_format_loose, k_mdl_format_rabook, k_ra8_err_invalid_arg, k_ra8_err_not_supported, priv_mdl_verify_gzip_tar(), priv_mdl_verify_rabook(), priv_mdl_verify_tar(), and RA8_INTERNAL.

Referenced by mdl_verify_open_file().

internal_verify_jof()

ra8_err_t internal_verify_jof ( mdl_verify_io_t * io, mdl_verify_report_t * report )

static

Validate a JOF artifact.

Invokes the production parser through the injected positioned-read adapter.

Parameters

[in,out]	io	Borrowed input.
[in,out]	report	Candidate report.

Returns

Status.

Return values

k_ra8_ok

For valid JOF.

Precondition

Both pointers are valid.

io stream capabilities include seek.

Postcondition

The input remains open.

Success publishes JOF counts.

Note

Parser faults are preserved.

Since

v0.1.0

Definition at line 442 of file mdl_verify.c.

References internal_jof_pread(), jof_parse(), k_ra8_err_validation_failed, k_ra8_ok, RA8_INTERNAL, and jof_info_t::tile_count.

Referenced by internal_verify_borrowed().

internal_verify_zip()

ra8_err_t internal_verify_zip ( mdl_verify_io_t * io, mdl_format_t format, mdl_export_workspace_t * workspace, mdl_verify_report_t * report )

static

Validate a ZIP-backed artifact.

Runs miniz over borrowed reads and a caller-owned arena.

Parameters

[in,out]	io	Borrowed input.
[in]	format	CBZ or EPUB.
[in,out]	workspace	Scratch arena.
[in,out]	report	Candidate report.

Returns

Status.

Return values

k_ra8_ok

For a valid archive.

Precondition

All pointers are valid.

workspace is reset and bounded.

Postcondition

The input remains open.

Success fills report.

Note

Every file member is CRC checked.

Since

v0.1.0

Definition at line 376 of file mdl_verify.c.

References mdl_verify_arena_t::exhausted, internal_arena_realloc(), internal_zip_member(), internal_zip_read(), internal_zip_semantics(), k_ra8_err_invalid_size, k_ra8_err_validation_failed, k_ra8_ok, k_verify_member_max, priv_mdl_verify_arena_alloc(), priv_mdl_verify_arena_free(), and RA8_INTERNAL.

Referenced by internal_verify_borrowed().

internal_zip_member()

ra8_err_t internal_zip_member ( mz_zip_archive * zip, mz_uint index, mdl_zip_scan_t * scan )

static

Validate one ZIP member.

Checks bounded safe names and forces CRC-checked extraction.

Parameters

[in,out]	zip	Open miniz archive.
[in]	index	Member index.
[in,out]	scan	Semantic accumulator.

Returns

Status.

Return values

k_ra8_ok

For a safe valid member.

Precondition

zip and scan are valid.

index is in the archive range.

Postcondition

Success updates scan once.

Failure retains no output.

Note

Directories are structural only.

Since

v0.1.0

Definition at line 321 of file mdl_verify.c.

References internal_discard_zip(), internal_ends_ci(), k_ra8_err_validation_failed, k_ra8_ok, priv_mdl_verify_is_image(), priv_mdl_verify_safe_member_name(), and strcmp().

Referenced by internal_verify_zip().

internal_zip_read()

size_t internal_zip_read ( void * opaque, mz_uint64 offset, void * destination, size_t length )

static

Adapt portable reads to miniz.

Seeks and fills the bounded random-read request.

Parameters

[in,out]	opaque	Verifier input.
[in]	offset	File offset.
[out]	destination	Output bytes.
[in]	length	Requested bytes.

Returns

Bytes read.

Return values

0	On failure.

Precondition

opaque and destination are valid.

length fits the destination.

Postcondition

Reads stay within the size snapshot.

The first fault is retained.

Note

Miniz observes faults as short reads.

Since

v0.1.0

Definition at line 264 of file mdl_verify.c.

References fw_fs_seek(), k_ra8_err_validation_failed, k_ra8_ok, priv_mdl_verify_io_read_up_to(), and mdl_verify_io_t::size_bytes.

Referenced by internal_verify_zip().

internal_zip_semantics()

ra8_err_t internal_zip_semantics ( mdl_format_t format, const mdl_zip_scan_t * scan, mdl_verify_report_t * report )

static

Enforce ZIP format semantics.

Distinguishes CBZ image policy from EPUB mimetype requirements.

Parameters

[in]	format	Requested format.
[in,out]	scan	Completed scan.
[in,out]	report	Candidate report.

Returns

Status.

Return values

k_ra8_ok

When required members exist.

Precondition

scan and report are valid.

format is CBZ or EPUB.

Postcondition

Success publishes semantic counts.

Failure does not touch caller output.

Note

ZIP structure is already verified.

Since

v0.1.0

Definition at line 352 of file mdl_verify.c.

References k_mdl_format_cbz, k_mdl_format_epub, k_ra8_err_validation_failed, and k_ra8_ok.

Referenced by internal_verify_zip().

mdl_format_from_path()

ra8_err_t mdl_format_from_path	(	const char *	path,
		mdl_format_t *	out_format )

Infer an artifact format from its complete path suffix.

Matches the complete, case-insensitive suffix so multi-dot formats such as .cbt.gz are not misclassified by their last extension.

Parameters

[in]	path	NUL-terminated artifact path to classify.
[out]	out_format	Receives the recognized format or invalid sentinel.

Returns

Classification status.

Return values

k_ra8_ok	A supported artifact suffix was recognized.
k_ra8_err_invalid_arg	Either pointer is NULL.
k_ra8_err_not_supported	The suffix is not supported.

Precondition

path, when non-NULL, is NUL-terminated.

out_format, when non-NULL, addresses writable storage.

Postcondition

Success stores a verifiable format in out_format.

Failure for an unknown suffix stores k_mdl_format_invalid.

Note

Thread-safe: reads arguments and writes caller-owned storage only.

Since

0.1.0

< Complete artifact suffix.

< Corresponding format.

Definition at line 107 of file mdl_verify.c.

References internal_ends_ci(), k_mdl_format_cbt, k_mdl_format_cbt_gz, k_mdl_format_cbz, k_mdl_format_epub, k_mdl_format_invalid, k_mdl_format_jof, k_mdl_format_rabook, k_ra8_err_invalid_arg, k_ra8_err_not_supported, and k_ra8_ok.

Referenced by internal_verify_artifact_entry(), and mdl_app_run_artifact().

mdl_format_is_verifiable()

bool mdl_format_is_verifiable

(

mdl_format_t

format

)

Report whether a format has an in-process structural validator.

Distinguishes advertised native formats from reserved enum values whose readers or writers are not yet exposed by this host tool.

Parameters

[in]

format

Format enum value to query.

Returns

Whether mdl_verify_file implements the format.

Return values

true	The format can be structurally validated in process.
false	The format is invalid, loose, or currently unsupported.

Precondition

format is represented by mdl_format_t.

The caller does not infer writer availability from this predicate.

Postcondition

No caller or global state is modified.

Repeated calls with the same value return the same result.

Note

Thread-safe: this is a pure classifier.

Since

0.1.0

Definition at line 131 of file mdl_verify.c.

References k_mdl_format_cbt, k_mdl_format_cbt_gz, k_mdl_format_cbz, k_mdl_format_epub, k_mdl_format_jof, and k_mdl_format_rabook.

Referenced by internal_verify_artifact_entry(), mdl_app_run_artifact(), priv_mdl_export_output_begin(), and priv_mdl_export_output_begin_new().

mdl_verify_file()

ra8_err_t mdl_verify_file	(	mdl_storage_t *	storage,
		mdl_format_t	format,
		const char *	path,
		mdl_export_workspace_t *	workspace,
		mdl_verify_report_t *	report )

Validate a completed artifact using caller-owned scratch only.

Dispatches to the format-specific ZIP, tar, gzip, JOF, or strict RBKC reader, rejects unsafe member paths and missing required metadata, and resets the workspace so high_water describes this call alone. ZIP and JOF use positioned reads; TAR and gzip are streamed through bounded chunks, so no complete compressed or decoded archive is retained. Every opened stream is closed before return.

Parameters

[in,out]	storage	Injected filesystem and exclusive file workspace.
[in]	format	Expected artifact format.
[in]	path	NUL-terminated path to the completed artifact.
[in,out]	workspace	Caller-owned bounded validation workspace.
[out]	report	Structural counts populated only on success.

Returns

Validation or argument status.

Return values

k_ra8_ok	The artifact is structurally valid for format.
k_ra8_err_invalid_arg	A pointer, workspace, or format is invalid.
k_ra8_err_invalid_size	The caller workspace is too small.
k_ra8_err_validation_failed	Container structure or metadata is bad.
k_ra8_err_not_supported	The reserved format has no validator.
other	A filesystem open/read/seek/size/close failure was propagated.

Precondition

path is canonical, NUL-terminated, and names a stable completed file.

storage, workspace, and report are exclusive to this call.

Postcondition

workspace->used and workspace->high_water describe this validation attempt.

On success report contains format, member, page, and metadata data.

On failure report retains its entry value.

Note

Thread-safe across calls that use distinct workspaces and reports.

Since

0.1.0

Definition at line 520 of file mdl_verify.c.

References mdl_export_workspace::data, mdl_storage_t::file_workspace, mdl_storage_t::file_workspace_bytes, mdl_storage_t::fs, mdl_export_workspace::high_water, internal_io_close(), internal_io_open(), mdl_storage_t::io_buffer, mdl_storage_t::io_buffer_bytes, k_ra8_err_invalid_arg, k_ra8_ok, mdl_verify_open_file(), and mdl_export_workspace::used.

Referenced by internal_verify_artifact_entry(), and mdl_app_run_artifact().

mdl_verify_open_file()

ra8_err_t mdl_verify_open_file	(	mdl_storage_t *	storage,
		mdl_format_t	format,
		fw_fs_file_t *	file,
		uint64_t	size_bytes,
		mdl_export_workspace_t *	workspace,
		mdl_verify_report_t *	report )

Validate an artifact through a borrowed open filesystem handle.

Dispatches to the same ZIP, tar, gzip, JOF, or strict RBKC validator used by mdl_verify_file after seeking file to offset zero. This entry point lets an exporter validate a staged transaction before commit without publishing or reopening the stage by name. The handle is borrowed: this function never closes it, and its final offset is unspecified. The size is an immutable caller-supplied snapshot.

Parameters

[in,out]	storage	Injected storage buffers used by streaming readers.
[in]	format	Expected artifact format.
[in,out]	file	Borrowed readable and seekable open handle.
[in]	size_bytes	Stable artifact extent in bytes.
[in,out]	workspace	Caller-owned bounded validation workspace.
[out]	report	Structural counts populated only on success.

Returns

Validation, argument, or stream status.

Return values

k_ra8_ok	The staged artifact is structurally valid for format.
k_ra8_err_invalid_arg	A pointer, workspace, or format is invalid.
k_ra8_err_invalid_size	The caller workspace is too small.
k_ra8_err_validation_failed	Container structure or metadata is bad.
k_ra8_err_not_supported	The reserved format has no validator.
other	A seek or read failure was propagated.

Precondition

file remains exclusively borrowed for the complete call.

size_bytes is the stable size of the staged artifact.

Postcondition

file remains open and owned by the caller.

On failure report retains its entry value.

workspace->high_water describes this validation attempt.

Note

Thread-safe across distinct handles, workspaces, buffers, and reports.

Since

0.1.0

Definition at line 491 of file mdl_verify.c.

References mdl_export_workspace::data, fw_fs_seek(), mdl_export_workspace::high_water, internal_verify_borrowed(), mdl_storage_t::io_buffer, mdl_storage_t::io_buffer_bytes, k_ra8_err_invalid_arg, k_ra8_ok, and mdl_export_workspace::used.

Referenced by internal_validate_stage(), and mdl_verify_file().

priv_mdl_verify_arena_alloc()

void * priv_mdl_verify_arena_alloc	(	void *	opaque,
		size_t	items,
		size_t	size )

Allocate one aligned miniz span from a monotonic arena.

Prefixes each payload with a bounded header recording its extent so a later reallocation can copy exactly the preserved bytes.

Parameters

[in,out]	opaque	Bound mdl_verify_arena_t callback context.
[in]	items	Element count requested by miniz.
[in]	size	Element size requested by miniz.

Returns

Payload pointer, or NULL when the arena cannot serve the request.

Return values

NULL	The product overflowed or the arena is exhausted.
other	One writable payload of items times size bytes.

Precondition

opaque addresses one arena bound to a reset workspace.

The caller treats NULL as an allocation failure.

Postcondition

Failure latches the arena exhaustion flag.

Success reserves exactly one header plus payload block.

Note

Not thread-safe for a shared arena.

Since

0.1.0

Definition at line 138 of file mdl_verify.c.

References mdl_alloc_header_t::bytes, mdl_verify_arena_t::exhausted, priv_mdl_verify_workspace_take(), RA8_PRIV, and mdl_verify_arena_t::workspace.

Referenced by internal_arena_realloc(), internal_gzip_init_inflate(), and internal_verify_zip().

priv_mdl_verify_arena_free()

void priv_mdl_verify_arena_free	(	void *	opaque,
		void *	address )

Accept a miniz free for a monotonic arena.

Individual allocations remain reserved until the owning verifier resets the workspace, so this release has nothing to reclaim.

Parameters

[in,out]	opaque	Borrowed arena context.
[in]	address	Allocation being released.

Precondition

opaque is the callback context handed to miniz.

address is NULL or was produced by priv_mdl_verify_arena_alloc.

Postcondition

Arena offsets are unchanged.

address is not accessed.

Note

Miniz requires a free callback even for arena allocation.

Since

0.1.0

Definition at line 162 of file mdl_verify.c.

References RA8_PRIV.

Referenced by internal_gzip_init_inflate(), and internal_verify_zip().

priv_mdl_verify_io_read_up_to()

ra8_err_t priv_mdl_verify_io_read_up_to	(	mdl_verify_io_t *	io,
		uint8_t *	destination,
		size_t	length,
		size_t *	out_read )

Read up to a requested portable span.

Repeats short reads and stops only at end of file or on failure.

Parameters

[in,out]	io	Open verifier input.
[out]	destination	Writable destination buffer.
[in]	length	Maximum byte count to transfer.
[out]	out_read	Byte count actually produced.

Returns

Portable read status.

Return values

k_ra8_ok	Data or a clean end of file was observed.
other	The portable read failed; out_read holds the prefix.

Precondition

io is open and destination spans length bytes.

out_read is non-NULL and does not alias destination.

Postcondition

out_read never exceeds length.

A zero count with k_ra8_ok denotes end of file.

Note

Not thread-safe for a shared input.

Since

0.1.0

Definition at line 233 of file mdl_verify.c.

References fw_fs_read(), k_ra8_ok, and RA8_PRIV.

Referenced by internal_io_read_exact(), internal_jof_pread(), internal_zip_read(), and priv_mdl_verify_tar().

priv_mdl_verify_is_image()

bool priv_mdl_verify_is_image

(

const char *

name

)

Recognize supported image suffixes.

Applies the archive image allowlist case-insensitively.

Parameters

[in]

name

Archive member name.

Returns

Whether the member carries a supported image suffix.

Return values

true	The suffix is one of the supported image extensions.
false	No supported suffix matched.

Precondition

name is a NUL-terminated string.

name remains valid for the call.

Postcondition

name is unchanged.

No storage is accessed.

Note

Content magic is validated during export, never here.

Since

0.1.0

Definition at line 79 of file mdl_verify.c.

References internal_ends_ci(), and RA8_PRIV.

Referenced by internal_tar_member(), and internal_zip_member().

priv_mdl_verify_safe_member_name()

bool priv_mdl_verify_safe_member_name

(

const char *

name

)

Reject unsafe archive member paths.

Rejects absolute, empty, dot, parent, and backslash segments.

Parameters

[in]

name

Archive member name, or NULL.

Returns

Whether the path is lexically contained.

Return values

true	The name is a safe relative path.
false	The name is NULL, absolute, or escapes its root.

Precondition

name is NULL or NUL-terminated.

A non-NULL name remains valid for the call.

Postcondition

name is unchanged.

No filesystem lookup occurs.

Note

This is a lexical containment check only.

Since

0.1.0

Definition at line 86 of file mdl_verify.c.

References RA8_PRIV.

Referenced by internal_tar_member(), and internal_zip_member().

priv_mdl_verify_workspace_take()

void * priv_mdl_verify_workspace_take	(	mdl_export_workspace_t *	workspace,
		size_t	bytes,
		size_t	alignment )

Reserve one aligned span from the verifier's caller-owned arena.

Rounds the bump cursor up to alignment, refuses a request that would leave the arena, and records the resulting high-water mark.

Parameters

[in,out]	workspace	Exclusive caller-owned bump arena.
[in]	bytes	Nonzero span extent to reserve.
[in]	alignment	Power-of-two alignment required by the caller.

Returns

Reserved span, or NULL when the request cannot be satisfied.

Return values

NULL	The request was malformed or the arena is exhausted.
other	One writable span of bytes bytes inside the arena.

Precondition

workspace is non-NULL and owns writable arena storage.

alignment is a nonzero power of two.

Postcondition

Success advances the arena cursor past the reserved span.

Failure leaves the arena cursor and high-water mark unchanged.

Note

Not thread-safe for a shared workspace.

Since

0.1.0

Definition at line 30 of file mdl_verify.c.

References mdl_export_workspace::cap, mdl_export_workspace::data, mdl_export_workspace::high_water, memcpy(), and mdl_export_workspace::used.

Referenced by internal_gzip_init_inflate(), and priv_mdl_verify_arena_alloc().