mdl_verify_tarball.c

Go to the documentation of this file.

 
#include <stddef.h>
#include <string.h>
 
#include "mdl_verify_internal.h"
#include "miniz.h"
#include "ra8_attributes.h"

typedef enum : uint16_t {
  k_tar_name_bytes      = 100U, 
  k_tar_size_offset     = 124U, 
  k_tar_size_bytes      = 12U,  
  k_tar_checksum_offset = 148U, 
  k_tar_checksum_end    = 156U, 
  k_tar_type_offset     = 156U, 
  k_tar_block_bytes     = 512U, 
  k_tar_padding_mask    = 511U, 
} mdl_verify_tar_layout_t;

typedef enum : uint32_t {
  k_gzip_id_one         = 0x1FU, 
  k_gzip_id_two         = 0x8BU, 
  k_gzip_method_deflate = 8U,    
  k_gzip_header_bytes   = 10U,   
  k_gzip_trailer_bytes  = 8U,    
  k_gzip_isize_offset   = 4U,    
  k_gzip_min_bytes      = 18U,   
} mdl_verify_gzip_frame_t;

typedef enum : uint8_t {
  k_u32_byte_one_shift   = 8U,  
  k_u32_byte_two_shift   = 16U, 
  k_u32_byte_three_shift = 24U, 
} mdl_verify_u32_shift_t;

typedef struct {
  uint8_t  block[k_tar_block_bytes]; 
  uint64_t skip_bytes;               
  uint64_t total_bytes;              
  size_t   block_used;               
  size_t   pages;                    
  size_t   members;                  
  uint8_t  zero_blocks;              
  bool     metadata;                 
  bool     ended;                    
} mdl_tar_stream_t;

typedef struct {
  mz_stream        stream;     
  mdl_tar_stream_t tar;        
  uint8_t*         output;     
  uint32_t         output_cap; 
  uint32_t         crc;        
  uint64_t         raw_bytes;  
  bool             ended;      
} mdl_gzip_stream_t;

RA8_INTERNAL static ra8_err_t
internal_io_read_exact(mdl_verify_io_t* io, uint8_t* destination, size_t length)
{
  size_t          got = 0U;
  const ra8_err_t err = priv_mdl_verify_io_read_up_to(io, destination, length, &got);
  if (err != k_ra8_ok) {
    return err;
  }
  return (got == length) ? k_ra8_ok : k_ra8_err_validation_failed;
}

RA8_INTERNAL static bool internal_parse_octal(const uint8_t* field, size_t length, uint64_t* out)
{
  size_t index = 0U;
  while ((index < length) && ((field[index] == (uint8_t)' ') || (field[index] == (uint8_t)'\0'))) {
    ++index;
  }
  uint64_t value = 0U;
  bool     any   = false;
  for (; (index < length) && (field[index] != (uint8_t)'\0') && (field[index] != (uint8_t)' ');
       ++index) {
    if ((field[index] < (uint8_t)'0') || (field[index] > (uint8_t)'7') ||
        (value > (UINT64_MAX >> 3U))) {
      return false;
    }
    const uint64_t digit = (uint64_t)field[index] - (uint64_t)(uint8_t)'0';
    value                = (value << 3U) + digit;
    any                  = true;
  }
  *out = value;
  return any;
}

RA8_INTERNAL static ra8_err_t internal_tar_member(mdl_tar_stream_t* state)
{
  unsigned checksum = 0U;
  for (size_t i = 0U; i < k_tar_block_bytes; ++i) {
    checksum +=
      ((i >= k_tar_checksum_offset) && (i < k_tar_checksum_end)) ? (unsigned)' ' : state->block[i];
  }
  uint64_t expected = 0U;
  uint64_t size     = 0U;
  if (!internal_parse_octal(&state->block[k_tar_checksum_offset],
                            k_tar_checksum_end - k_tar_checksum_offset,
                            &expected) ||
      ((uint64_t)checksum != expected) ||
      !internal_parse_octal(&state->block[k_tar_size_offset], k_tar_size_bytes, &size) ||
      (state->block[k_tar_type_offset] != (uint8_t)'0') ||
      (size > UINT64_MAX - k_tar_padding_mask)) {
    return k_ra8_err_validation_failed;
  }
  char name[k_tar_name_bytes + 1U];
  (void)memcpy(name, state->block, k_tar_name_bytes);
  name[k_tar_name_bytes] = '\0';
  if (!priv_mdl_verify_safe_member_name(name)) {
    return k_ra8_err_validation_failed;
  }
  if (state->members >= k_verify_member_max) {
    return k_ra8_err_invalid_size;
  }
  ++state->members;
  state->pages += priv_mdl_verify_is_image(name) ? 1U : 0U;
  state->metadata   = state->metadata || (strcmp(name, "ComicInfo.xml") == 0);
  state->skip_bytes = ((size + k_tar_padding_mask) / k_tar_block_bytes) * k_tar_block_bytes;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_tar_process_block(mdl_tar_stream_t* state)
{
  bool zero = true;
  for (size_t i = 0U; i < k_tar_block_bytes; ++i) {
    zero = zero && (state->block[i] == 0U);
  }
  state->block_used = 0U;
  if (zero) {
    state->zero_blocks += 1U;
    state->ended = state->zero_blocks >= 2U;
    return k_ra8_ok;
  }
  state->zero_blocks = 0U;
  return internal_tar_member(state);
}

RA8_INTERNAL static ra8_err_t
internal_tar_feed(mdl_tar_stream_t* state, const uint8_t* bytes, size_t length)
{
  if (state->total_bytes > (UINT64_MAX - length)) {
    return k_ra8_err_invalid_size;
  }
  state->total_bytes += length;
  size_t offset = 0U;
  while (offset < length) {
    if (state->ended) {
      if (bytes[offset++] != 0U) {
        return k_ra8_err_validation_failed;
      }
      continue;
    }
    if (state->skip_bytes != 0U) {
      const uint64_t available = (uint64_t)length - (uint64_t)offset;
      const size_t   consumed =
        (state->skip_bytes < available) ? (size_t)state->skip_bytes : (length - offset);
      state->skip_bytes -= consumed;
      offset += consumed;
      continue;
    }
    const size_t missing = k_tar_block_bytes - state->block_used;
    const size_t copied  = ((length - offset) < missing) ? (length - offset) : missing;
    (void)memcpy(&state->block[state->block_used], &bytes[offset], copied);
    state->block_used += copied;
    offset += copied;
    if (state->block_used == k_tar_block_bytes) {
      const ra8_err_t error = internal_tar_process_block(state);
      if (error != k_ra8_ok) {
        return error;
      }
    }
  }
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_tar_finish(const mdl_tar_stream_t* state,
                                                  mdl_verify_report_t*    report)
{
  if (!state->ended || (state->block_used != 0U) || (state->skip_bytes != 0U) ||
      ((state->total_bytes % k_tar_block_bytes) != 0U) || (state->pages == 0U) ||
      !state->metadata) {
    return k_ra8_err_validation_failed;
  }
  report->page_count       = state->pages;
  report->member_count     = state->members;
  report->metadata_present = state->metadata;
  return k_ra8_ok;
}
 
RA8_PRIV ra8_err_t priv_mdl_verify_tar(mdl_verify_io_t* io, mdl_verify_report_t* report)
{
  mdl_storage_t*   storage = io->storage;
  ra8_err_t        error   = k_ra8_ok;
  mdl_tar_stream_t tar     = {};
  bool             done    = false;
  while (!done) {
    size_t got = 0U;
    error = priv_mdl_verify_io_read_up_to(io, storage->io_buffer, storage->io_buffer_bytes, &got);
    if (error != k_ra8_ok) {
      done = true;
    } else if (got == 0U) {
      error = internal_tar_finish(&tar, report);
      done  = true;
    } else {
      error = internal_tar_feed(&tar, storage->io_buffer, got);
      done  = (error != k_ra8_ok);
    }
  }
  return error;
}

RA8_INTERNAL static uint32_t internal_get_u32le(const uint8_t* bytes)
{
  return (uint32_t)bytes[0] | ((uint32_t)bytes[1] << k_u32_byte_one_shift) |
         ((uint32_t)bytes[2] << k_u32_byte_two_shift) |
         ((uint32_t)bytes[3] << k_u32_byte_three_shift);
}

RA8_INTERNAL static ra8_err_t
internal_gzip_feed(mdl_gzip_stream_t* gzip, const uint8_t* bytes, uint32_t length)
{
  gzip->stream.next_in  = bytes;
  gzip->stream.avail_in = length;
  do {
    const mz_uint before_in = gzip->stream.avail_in;
    gzip->stream.next_out   = gzip->output;
    gzip->stream.avail_out  = gzip->output_cap;
    const int      status   = mz_inflate(&gzip->stream, MZ_NO_FLUSH);
    const uint32_t produced = gzip->output_cap - gzip->stream.avail_out;
    if (gzip->raw_bytes > (uint64_t)UINT32_MAX - produced) {
      return k_ra8_err_invalid_size;
    }
    if (produced != 0U) {
      const ra8_err_t error = internal_tar_feed(&gzip->tar, gzip->output, produced);
      if (error != k_ra8_ok) {
        return error;
      }
      gzip->crc = (uint32_t)mz_crc32(gzip->crc, gzip->output, produced);
      gzip->raw_bytes += produced;
    }
    if (status == MZ_STREAM_END) {
      gzip->ended = true;
      return (gzip->stream.avail_in == 0U) ? k_ra8_ok : k_ra8_err_validation_failed;
    }
    if ((status != MZ_OK) || ((before_in == gzip->stream.avail_in) && (produced == 0U))) {
      return k_ra8_err_validation_failed;
    }
  } while ((gzip->stream.avail_in != 0U) || (gzip->stream.avail_out == 0U));
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_gzip_finish_deflate(mdl_gzip_stream_t* gzip)
{
  const uint8_t empty_input = 0U;
  while (!gzip->ended) {
    /* miniz performs pointer arithmetic even for zero-byte input. */
    const ra8_err_t error = internal_gzip_feed(gzip, &empty_input, 0U);
    if (error != k_ra8_ok) {
      return error;
    }
    if (!gzip->ended && (gzip->stream.avail_out != 0U)) {
      return k_ra8_err_validation_failed;
    }
  }
  return k_ra8_ok;
}

RA8_INTERNAL static bool internal_gzip_header_valid(const uint8_t* header)
{
  return (header[0] == k_gzip_id_one) && (header[1] == k_gzip_id_two) &&
         (header[2] == k_gzip_method_deflate) && (header[3] == 0U);
}

RA8_INTERNAL static bool internal_gzip_trailer_valid(const uint8_t*           trailer,
                                                     const mdl_gzip_stream_t* gzip)
{
  return (internal_get_u32le(trailer) == gzip->crc) &&
         (internal_get_u32le(&trailer[k_gzip_isize_offset]) == (uint32_t)gzip->raw_bytes);
}

RA8_INTERNAL static ra8_err_t internal_gzip_init_inflate(mdl_export_workspace_t* workspace,
                                                         mdl_verify_arena_t*     arena,
                                                         mdl_gzip_stream_t*      gzip)
{
  gzip->output =
    (uint8_t*)priv_mdl_verify_workspace_take(workspace, gzip->output_cap, alignof(max_align_t));
  arena->exhausted    = gzip->output == nullptr;
  gzip->stream.zalloc = priv_mdl_verify_arena_alloc;
  gzip->stream.zfree  = priv_mdl_verify_arena_free;
  gzip->stream.opaque = arena;
  if ((gzip->output == nullptr) ||
      (mz_inflateInit2(&gzip->stream, -MZ_DEFAULT_WINDOW_BITS) != MZ_OK)) {
    return arena->exhausted ? k_ra8_err_invalid_size : k_ra8_err_validation_failed;
  }
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_gzip_consume(mdl_verify_io_t*    io,
                                                    mdl_verify_arena_t* arena,
                                                    mdl_gzip_stream_t*  gzip,
                                                    uint64_t            remaining)
{
  mdl_storage_t* storage = io->storage;
  ra8_err_t      error   = k_ra8_ok;
  uint64_t       left    = remaining;
  while ((error == k_ra8_ok) && (left != 0U) && !gzip->ended) {
    const uint32_t chunk =
      (left < storage->io_buffer_bytes) ? (uint32_t)left : storage->io_buffer_bytes;
    error = internal_io_read_exact(io, storage->io_buffer, chunk);
    if (error == k_ra8_ok) {
      left -= chunk;
      error = internal_gzip_feed(gzip, storage->io_buffer, chunk);
    }
  }
  if ((error == k_ra8_ok) && gzip->ended && (left != 0U)) {
    error = k_ra8_err_validation_failed;
  }
  if ((error == k_ra8_ok) && !gzip->ended) {
    error = internal_gzip_finish_deflate(gzip);
  }
  uint8_t trailer[k_gzip_trailer_bytes];
  if (error == k_ra8_ok) {
    error = internal_io_read_exact(io, trailer, sizeof(trailer));
  }
  if ((error == k_ra8_ok) && !internal_gzip_trailer_valid(trailer, gzip)) {
    error = k_ra8_err_validation_failed;
  }
  if ((error == k_ra8_ok) && arena->exhausted) {
    error = k_ra8_err_invalid_size;
  }
  return error;
}
 
RA8_PRIV ra8_err_t priv_mdl_verify_gzip_tar(mdl_verify_io_t*        io,
                                            mdl_export_workspace_t* workspace,
                                            mdl_verify_report_t*    report)
{
  ra8_err_t error;
  uint8_t   header[k_gzip_header_bytes];
  error = (io->size_bytes < k_gzip_min_bytes) ? k_ra8_err_validation_failed
                                              : internal_io_read_exact(io, header, sizeof(header));
  if ((error == k_ra8_ok) && !internal_gzip_header_valid(header)) {
    error = k_ra8_err_validation_failed;
  }
  mdl_verify_arena_t arena = {.workspace = workspace};
  mdl_gzip_stream_t  gzip  = {.output_cap = k_mdl_storage_io_bytes, .crc = MZ_CRC32_INIT};
  if (error == k_ra8_ok) {
    error = internal_gzip_init_inflate(workspace, &arena, &gzip);
  }
  if (error == k_ra8_ok) {
    const uint64_t remaining =
      (io->size_bytes >= k_gzip_min_bytes) ? io->size_bytes - k_gzip_min_bytes : 0U;
    error = internal_gzip_consume(io, &arena, &gzip, remaining);
  }
  if (gzip.stream.state != nullptr) {
    (void)mz_inflateEnd(&gzip.stream);
  }
  if (error == k_ra8_ok) {
    error = internal_tar_finish(&gzip.tar, report);
  }
  return error;
}