--- file-5.12/ChangeLog 2012-12-13 14:48:08.000000000 +0100 +++ upstream/ChangeLog 2013-01-21 16:12:12.877493299 +0100 @@ -1,3 +1,27 @@ +2013-01-11 14:50 Christos Zoulas + + * Warn about inconsistent continuation levels. + * Change fsmagic to add a space after it prints. + +2013-01-10 21:00 Christos Zoulas + + * Make getline public so that file can link against it. + Perhaps it is better to rename it, or hide it differently. + Fixes builds on platforms that do not provide it. + +2013-01-07 16:30 Christos Zoulas + + * Add SuS d{,1,2,4,8}, u{,1,2,4,8} and document + what long, int, short, etc is (Guy Harris) + +2013-01-06 11:20 Christos Zoulas + + * add magic_version function and constant + * Redo memory allocation and de-allocation. + (prevents double frees on non mmap platforms) + * Fix bug with name/use having to do with passing + found state from the parent to the child and back. + 2012-12-19 8:47 Christos Zoulas * Only print elf capabilities for archs we know (Jan Kaluza) --- file-5.12/README 2011-04-07 21:20:29.000000000 +0200 +++ upstream/README 2013-01-21 16:12:12.877493299 +0100 @@ -68,15 +68,19 @@ src/apprentice.c - parses /etc/magic to src/apptype.c - used for OS/2 specific application type magic src/asprintf.c - replacement for OS's that don't have it. src/ascmagic.c - third & last set of tests, based on hardwired assumptions. +src/asctime_r.c - for systems that don't have it. +src/asprintf.c - for systems that don't have it. src/cdf.c - parser for Microsoft Compound Document Files src/cdf_time.c - time converter for CDF. src/compress.c - handles decompressing files to look inside. +src/ctime_r.c - for systems that don't have it. src/encoding.c - handles unicode encodings src/file.c - the main program src/file.h - header file src/fsmagic.c - first set of tests the program runs, based on filesystem info src/funcs.c - utilility functions -src/getopt_long.c - used for OS/2 specific application type magic +src/getopt_long.c - for systems that don't have it. +src/getline.c - for systems that don't have it. src/is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore). src/names.h - header file for ascmagic.c src/magic.c - the libmagic api @@ -84,14 +88,13 @@ src/print.c - print results, errors, war src/readcdf.c - CDF wrapper. src/readelf.[ch] - Stand-alone elf parsing code. src/softmagic.c - 2nd set of tests, based on /etc/magic -src/strlcat.c - used for OS/2 specific application type magic -src/strlcpy.c - used for OS/2 specific application type magic -src/vasprintf.c - used for OS/2 specific application type magic -doc/file.1 - man page for the command -doc/magic.4 - man page for the magic file, courtesy Guy Harris. +src/strlcat.c - for systems that don't have it. +src/strlcpy.c - for systems that don't have it. +src/vasprintf.c - for systems that don't have it. +doc/file.man - man page for the command +doc/magic.man - man page for the magic file, courtesy Guy Harris. Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile. Magdir - directory of /etc/magic pieces - ------------------------------------------------------------------------------ If you submit a new magic entry please make sure you read the following --- file-5.12/doc/file.man 2012-11-13 17:32:01.000000000 +0100 +++ upstream/doc/file.man 2013-01-21 16:12:12.893533522 +0100 @@ -557,16 +557,20 @@ or the mailing list at .Sh TODO .Pp Fix output so that tests for MIME and APPLE flags are not needed all -over the place, and actual output is only done in one place. This -needs a design. Suggestion: push possible outputs on to a list, then -pick the last-pushed (most specific, one hopes) value at the end, or -use a default if the list is empty. This should not slow down evaluation. +over the place, and actual output is only done in one place. +This needs a design. +Suggestion: push possible outputs on to a list, then pick the +last-pushed (most specific, one hopes) value at the end, or +use a default if the list is empty. +This should not slow down evaluation. .Pp -Continue to squash all magic bugs. See Debian BTS for a good source. +Continue to squash all magic bugs. +See Debian BTS for a good source. .Pp Store arbitrarily long strings, for example for %s patterns, so that -they can be printed out. Fixes Debian bug #271672. Would require more -complex store/load code in apprentice. +they can be printed out. +Fixes Debian bug #271672. +Would require more complex store/load code in apprentice. .Pp Add syntax for relative offsets after current level (Debian bug #466037). .Pp @@ -579,8 +583,9 @@ Add an option to print URLs for the sour .Pp Combine script searches and add a way to map executable names to MIME types (e.g. have a magic value for !:mime which causes the resulting -string to be looked up in a table). This would avoid adding the same -magic repeatedly for each new hash-bang interpreter. +string to be looked up in a table). +This would avoid adding the same magic repeatedly for each new +hash-bang interpreter. .Pp Fix .Dq name --- file-5.12/doc/libmagic.man 2011-12-19 18:49:31.000000000 +0100 +++ upstream/doc/libmagic.man 2013-01-21 16:12:12.893533522 +0100 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd December 19, 2011 +.Dd January 6, 2012 .Dt LIBMAGIC 3 .Os .Sh NAME @@ -37,7 +37,9 @@ .Nm magic_setflags , .Nm magic_check , .Nm magic_compile , -.Nm magic_load +.Nm magic_list , +.Nm magic_load , +.Nm magic_version .Nd Magic number recognition library .Sh LIBRARY .Lb libmagic @@ -67,6 +69,8 @@ .Fn magic_list "magic_t cookie" "const char *filename" .Ft int .Fn magic_load "magic_t cookie" "const char *filename" +.Ft int +.Fn magic_version "void" .Sh DESCRIPTION These functions operate on the magic database file @@ -246,6 +250,16 @@ If that variable is not set, the default adds .Dq .mgc to the database filename as appropriate. +.Pp +The +.Fn magic_version +command returns the version number of this library which is compiled into +the shared library using the constant +.Dv MAGIC_VERSION +from +.In magic.h . +This can be used by client programs to verify that the version they compile +against is the same as the version that they run against. .Sh RETURN VALUES The function .Fn magic_open @@ -276,6 +290,9 @@ function returns a textual description o functions, or .Dv NULL if there was no error. +The +.Fn magic_version +always returns the version number of the library. Finally, .Fn magic_setflags returns \-1 on systems that don't support --- file-5.12/doc/magic.man 2012-11-13 17:32:01.000000000 +0100 +++ upstream/doc/magic.man 2013-01-21 16:12:12.893533522 +0100 @@ -1,5 +1,5 @@ -.\" $File: magic.man,v 1.76 2012/11/07 20:29:27 christos Exp $ -.Dd November 7, 2012 +.\" $File: magic.man,v 1.77 2013/01/08 01:37:01 christos Exp $ +.Dd January 7, 2013 .Dt MAGIC __FSECTION__ .Os .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. @@ -265,6 +265,67 @@ This is intended to be used with the tes no other matches. .El .Pp +For compatibility with the Single +.Ux +Standard, the type specifiers +.Dv dC +and +.Dv d1 +are equivalent to +.Dv byte , +the type specifiers +.Dv uC +and +.Dv u1 +are equivalent to +.Dv ubyte , +the type specifiers +.Dv dS +and +.Dv d2 +are equivalent to +.Dv short , +the type specifiers +.Dv uS +and +.Dv u2 +are equivalent to +.Dv ushort , +the type specifiers +.Dv dI , +.Dv dL , +and +.Dv d4 +are equivalent to +.Dv long , +the type specifiers +.Dv uI , +.Dv uL , +and +.Dv u4 +are equivalent to +.Dv ulong , +the type specifier +.Dv d8 +is equivalent to +.Dv quad , +the type specifier +.Dv u8 +is equivalent to +.Dv uquad , +and the type specifier +.Dv s +is equivalent to +.Dv string . +In addition, the type specifier +.Dv dQ +is equivalent to +.Dv quad +and the type specifier +.Dv uQ +is equivalent to +.Dv uquad . +.Pp Each top-level magic pattern (see below for an explanation of levels) is classified as text or binary according to the types used. Types @@ -570,19 +631,41 @@ The formats .Dv melong , .Dv short , .Dv beshort , -.Dv leshort , -.Dv date , -.Dv bedate , -.Dv medate , -.Dv ledate , -.Dv beldate , -.Dv leldate , -and -.Dv meldate -are system-dependent; perhaps they should be specified as a number -of bytes (2B, 4B, etc), -since the files being recognized typically come from -a system on which the lengths are invariant. +and +.Dv leshort +do not depend on the length of the C data types +.Dv short +and +.Dv long +on the platform, even though the Single +.Ux +Specification implies that they do. However, as OS X Mountain Lion has +passed the Single +.Ux +Specification validation suite, and supplies a version of +.Xr file __CSECTION__ +in which they do not depend on the sizes of the C data types and that is +built for a 64-bit environment in which +.Dv long +is 8 bytes rather than 4 bytes, presumably the validation suite does not +test whether, for example +.Dv long +refers to an item with the same size as the C data type +.Dv long . +There should probably be +.Dv type +names +.Dv int8 , +.Dv uint8 , +.Dv int16 , +.Dv uint16 , +.Dv int32 , +.Dv uint32 , +.Dv int64 , +and +.Dv uint64 , +and specified-byte-order variants of them, +to make it clearer that those types have specified widths. .\" .\" From: guy@sun.uucp (Guy Harris) .\" Newsgroups: net.bugs.usg --- file-5.12/magic/Magdir/alpha 1970-01-01 01:00:00.000000000 +0100 +++ upstream/magic/Magdir/alpha 2013-01-21 16:12:12.901972883 +0100 @@ -0,0 +1,32 @@ + +#------------------------------------------------------------------------------ +# $File$ +# alpha architecture description +# + +0 leshort 0603 COFF format alpha +>22 leshort&030000 !020000 executable +>24 leshort 0410 pure +>24 leshort 0413 paged +>22 leshort&020000 !0 dynamically linked +>16 lelong !0 not stripped +>16 lelong 0 stripped +>22 leshort&030000 020000 shared library +>24 leshort 0407 object +>27 byte x - version %d +>26 byte x .%d +>28 byte x -%d + +# Basic recognition of Digital UNIX core dumps - Mike Bremford +# +# The actual magic number is just "Core", followed by a 2-byte version +# number; however, treating any file that begins with "Core" as a Digital +# UNIX core dump file may produce too many false hits, so we include one +# byte of the version number as well; DU 5.0 appears only to be up to +# version 2. +# +0 string Core\001 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' +0 string Core\002 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' + --- file-5.12/magic/Magdir/aout 1970-01-01 01:00:00.000000000 +0100 +++ upstream/magic/Magdir/aout 2013-01-21 16:12:12.901972883 +0100 @@ -0,0 +1,46 @@ + +#------------------------------------------------------------------------------ +# $File$ +# aout: file(1) magic for a.out executable/object/etc entries that +# handle executables on multiple platforms. +# + +# +# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from +# BSDI), netbsd, and vax (for UNIX/32V and BSD) +# +# XXX - is there anything we can look at to distinguish BSD/OS 386 from +# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag +# works only for binaries using shared libraries. Grabbing the entry +# point from the a.out header, using it to find the first code executed +# in the program, and looking at that might help. +# +0 lelong 0407 a.out little-endian 32-bit executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses BSD/OS shared libs) + +0 lelong 0410 a.out little-endian 32-bit pure executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses BSD/OS shared libs) + +0 lelong 0413 a.out little-endian 32-bit demand paged pure executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses BSD/OS shared libs) + +# +# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), +# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). +# +# XXX - is there anything we can look at to distinguish old SunOS 68010 +# from old 68020 IRIX from old NetBSD? Again, I guess we could look at +# the first instruction or instructions in the program. +# +0 belong 0407 a.out big-endian 32-bit executable +>16 belong >0 not stripped + +0 belong 0410 a.out big-endian 32-bit pure executable +>16 belong >0 not stripped + +0 belong 0413 a.out big-endian 32-bit demand paged executable +>16 belong >0 not stripped + --- file-5.12/magic/Magdir/archive 2012-11-13 17:32:01.000000000 +0100 +++ upstream/magic/Magdir/archive 2013-01-21 16:12:12.901972883 +0100 @@ -36,7 +36,60 @@ 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) -# Debian package (needs to go before regular portable archives) +# +# Various archive formats used by various versions of the "ar" +# command. +# + +# +# Original UNIX archive formats. +# They were written with binary values in host byte order, and +# the magic number was a host "int", which might have been 16 bits +# or 32 bits. We don't say "PDP-11" or "VAX", as there might have +# been ports to little-endian 16-bit-int or 32-bit-int platforms +# (x86?) using some of those formats; if none existed, feel free +# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian +# 32-bit. There might have been big-endian ports of that sort as +# well. +# +0 leshort 0177555 very old 16-bit-int little-endian archive +0 beshort 0177555 very old 16-bit-int big-endian archive +0 lelong 0177555 very old 32-bit-int little-endian archive +0 belong 0177555 very old 32-bit-int big-endian archive + +0 leshort 0177545 old 16-bit-int little-endian archive +>2 string __.SYMDEF random library +0 beshort 0177545 old 16-bit-int big-endian archive +>2 string __.SYMDEF random library +0 lelong 0177545 old 32-bit-int little-endian archive +>4 string __.SYMDEF random library +0 belong 0177545 old 32-bit-int big-endian archive +>4 string __.SYMDEF random library + +# +# From "pdp" (but why a 4-byte quantity?) +# +0 lelong 0x39bed PDP-11 old archive +0 lelong 0x39bee PDP-11 4.0 archive + +# +# XXX - what flavor of APL used this, and was it a variant of +# some ar archive format? It's similar to, but not the same +# as, the APL workspace magic numbers in pdp. +# +0 long 0100554 apl workspace + +# +# System V Release 1 portable(?) archive format. +# +0 string = System V Release 1 ar archive +!:mime application/x-archive + +# +# Debian package; it's in the portable archive format, and needs to go +# before the entry for regular portable archives, as it's recognized as +# a portable archive whose first member has a name beginning with +# "debian". # 0 string =!\ndebian !:mime application/x-debian-package @@ -53,23 +106,14 @@ #>84 string gz \b, uses gzip compression #>136 ledate x created: %s -0 string =!\n thin archive with ->68 belong 0 no symbol entries ->68 belong 1 %d symbol entry ->68 belong >1 %d symbol entries - -# other archives -0 long 0177555 very old archive -0 short 0177555 very old PDP-11 archive -0 long 0177545 old archive -0 short 0177545 old PDP-11 archive -0 long 0100554 apl workspace -0 string = archive -!:mime application/x-archive - -# MIPS archive (needs to go before regular portable archives) +# +# MIPS archive; they're in the portable archive format, and need to go +# before the entry for regular portable archives, as it's recognized as +# a portable archive whose first member has a name beginning with +# "__________E". # 0 string =!\n__________E MIPS archive +!:mime application/x-archive >20 string U with MIPS Ucode members >21 string L with MIPSEL members >21 string B with MIPSEB members @@ -80,56 +124,26 @@ 0 search/1 -h- Software Tools format archive text # -# XXX - why are there multiple thingies? Note that 0x213c6172 is -# "! current ar archive -# 0 long 0x213c6172 archive file -# -# and for SVR1 archives, we have: -# -# 0 string \ System V Release 1 ar archive -# 0 string = archive -# -# XXX - did Aegis really store shared libraries, breakpointed modules, -# and absolute code program modules in the same format as new-style -# "ar" archives? +# BSD/SVR2-and-later portable archive formats. # 0 string =! current ar archive !:mime application/x-archive >8 string __.SYMDEF random library +>68 string __.SYMDEF\ SORTED random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive >0 beshort 3 - shared library module >0 beshort 4 - debug break-pointed module >0 beshort 5 - absolute code program module -0 string \ System V Release 1 ar archive -0 string = archive -# -# XXX - from "vax", which appears to collect a bunch of byte-swapped -# thingies, to help you recognize VAX files on big-endian machines; -# with "leshort", "lelong", and "string", that's no longer necessary.... -# -0 belong 0x65ff0000 VAX 3.0 archive -0 belong 0x3c61723e VAX 5.0 archive -# -0 long 0x213c6172 archive file -0 lelong 0177555 very old VAX archive -0 leshort 0177555 very old PDP-11 archive -# -# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus -# be a random library (it said 0xff65 rather than 0177545). -# -0 lelong 0177545 old VAX archive ->8 string __.SYMDEF random library -0 leshort 0177545 old PDP-11 archive ->8 string __.SYMDEF random library + # -# From "pdp" (but why a 4-byte quantity?) +# "Thin" archive, as can be produced by GNU ar. # -0 lelong 0x39bed PDP-11 old archive -0 lelong 0x39bee PDP-11 4.0 archive +0 string =!\n thin archive with +>68 belong 0 no symbol entries +>68 belong 1 %d symbol entry +>68 belong >1 %d symbol entries # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) # @@ -666,11 +680,10 @@ !:mime application/vnd.oasis.opendocument.image-template # EPUB (OEBPS) books using OCF (OEBPS Container Format) -# From: Adam Buchbinder # http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. -# (mimetype contains "application/epub+zip") ->>50 string epub+zip EPUB ebook data -!:mime application/epub+zip +# From: Ralf Brown +>0x1E string mimetypeapplication/epub+zip EPUB document +!:mime application/epub+zip # Catch other ZIP-with-mimetype formats # In a ZIP file, the bytes immediately after a member's contents are @@ -895,12 +908,6 @@ # archive must be an uncompressed file called 'mimetype' with contents # 'application/epub+zip' -# start by checking that this is a ZIP archive, then check for the -# proper mimetype file -# From: Ralf Brown -0 string PK\003\004 ->0x1E string mimetypeapplication/epub+zip EPUB document -!:mime application/epub+zip # From: "Michał Górny" # ZPAQ: http://mattmahoney.net/dc/zpaq.html --- file-5.12/magic/Magdir/assembler 2012-11-06 21:37:19.000000000 +0100 +++ upstream/magic/Magdir/assembler 2013-01-21 16:12:12.901972883 +0100 @@ -1,18 +1,18 @@ #------------------------------------------------------------------------------ -# $File: assembler,v 1.2 2012/10/31 18:41:42 christos Exp $ +# $File: assembler,v 1.3 2013/01/04 17:23:28 christos Exp $ # make: file(1) magic for assembler source # -0 regex \^[\020\t]*\.asciiz\? assembler source text +0 regex \^[\020\t]*\\.asciiz assembler source text !:mime text/x-asm -0 regex \^[\020\t]*\.byte assembler source text +0 regex \^[\020\t]*\\.byte assembler source text !:mime text/x-asm -0 regex \^[\020\t]*\.even assembler source text +0 regex \^[\020\t]*\\.even assembler source text !:mime text/x-asm -0 regex \^[\020\t]*\.globl assembler source text +0 regex \^[\020\t]*\\.globl assembler source text !:mime text/x-asm -0 regex \^[\020\t]*\.text assembler source text +0 regex \^[\020\t]*\\.text assembler source text !:mime text/x-asm -0 regex \^[\020\t]*\.file assembler source text +0 regex \^[\020\t]*\\.file assembler source text !:mime text/x-asm -0 regex \^[\020\t]*\.type assembler source text +0 regex \^[\020\t]*\\.type assembler source text !:mime text/x-asm --- file-5.12/magic/Magdir/bsdi 2009-09-19 18:28:08.000000000 +0200 +++ upstream/magic/Magdir/bsdi 2013-01-21 16:12:12.921512911 +0100 @@ -2,24 +2,14 @@ #------------------------------------------------------------------------------ # $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $ # bsdi: file(1) magic for BSD/OS (from BSDI) objects +# Some object/executable formats use the same magic numbers as are used +# in other OSes; those are handled by entries in aout. # 0 lelong 0314 386 compact demand paged pure executable >16 lelong >0 not stripped >32 byte 0x6a (uses shared libs) -0 lelong 0407 386 executable ->16 lelong >0 not stripped ->32 byte 0x6a (uses shared libs) - -0 lelong 0410 386 pure executable ->16 lelong >0 not stripped ->32 byte 0x6a (uses shared libs) - -0 lelong 0413 386 demand paged pure executable ->16 lelong >0 not stripped ->32 byte 0x6a (uses shared libs) - # same as in SunOS 4.x, except for static shared libraries 0 belong&077777777 0600413 sparc demand paged >0 byte &0x80 --- file-5.12/magic/Magdir/cafebabe 2012-10-31 19:31:28.000000000 +0100 +++ upstream/magic/Magdir/cafebabe 2013-01-21 16:12:12.929502699 +0100 @@ -1,13 +1,13 @@ #------------------------------------------------------------------------------ -# $File: cafebabe,v 1.10 2012/10/31 16:32:01 christos Exp $ +# $File: cafebabe,v 1.11 2013/01/04 23:27:55 christos Exp $ # Cafe Babes unite! # -# Since Java bytecode and Mach-O fat-files have the same magic number, the test -# must be performed in the same "magic" sequence to get both right. The long -# at offset 4 in a mach-O fat file tells the number of architectures; the short at -# offset 4 in a Java bytecode file is the JVM minor version and the -# short at offset 6 is the JVM major version. Since there are only +# Since Java bytecode and Mach-O universal binaries have the same magic number, +# the test must be performed in the same "magic" sequence to get both right. +# The long at offset 4 in a Mach-O universal binary tells the number of +# architectures; the short at offset 4 in a Java bytecode file is the JVM minor +# version and the short at offset 6 is the JVM major version. Since there are only # only 18 labeled Mach-O architectures at current, and the first released # Java class format was version 43.0, we can safely choose any number # between 18 and 39 to test the number of architectures against @@ -30,14 +30,14 @@ >>4 belong 0x0032 (Java 1.6) 0 belong 0xcafed00d JAR compressed with pack200, ->>5 byte x version %d. ->>4 byte x \b%d +>5 byte x version %d. +>4 byte x \b%d !:mime application/x-java-pack200 0 belong 0xcafed00d JAR compressed with pack200, ->>5 byte x version %d. ->>4 byte x \b%d +>5 byte x version %d. +>4 byte x \b%d !:mime application/x-java-pack200 ### JAVA END ### @@ -64,10 +64,10 @@ >0 belong x \b] 0 belong 0xcafebabe ->4 belong 1 Mach-O fat file with 1 architecture: +>4 belong 1 Mach-O universal binary with 1 architecture: >>8 use mach-o >4 belong >1 ->>4 belong <20 Mach-O fat file with %ld architectures: +>>4 belong <20 Mach-O universal binary with %ld architectures: >>>8 use mach-o >>>28 use mach-o >>>4 belong >2 --- file-5.12/magic/Magdir/database 2012-09-06 16:16:05.000000000 +0200 +++ upstream/magic/Magdir/database 2013-01-21 16:12:12.953452459 +0100 @@ -271,14 +271,6 @@ >48 lequad x \b, rnum=%lld >56 lequad x \b, fsiz=%lld -# G-IR database made by gobject-introspect toolset, -# http://live.gnome.org/GObjectIntrospection -0 string GOBJ\nMETADATA\r\n\032 G-IR binary database ->16 byte x \b, v%d ->17 byte x \b.%d ->20 leshort x \b, %d entries ->22 leshort x \b/%d local - # Type: QDBM Quick Database Manager # From: Benoit Sibaud 0 string \\[depot\\]\n\f Quick Database Manager, little endian --- file-5.12/magic/Magdir/digital 2011-05-11 03:32:28.000000000 +0200 +++ upstream/magic/Magdir/digital 2013-01-21 16:12:12.953452459 +0100 @@ -8,20 +8,20 @@ # 0 leshort 0603 ->>24 leshort 0410 COFF format alpha pure ->>24 leshort 0413 COFF format alpha demand paged ->>>22 leshort&030000 !020000 executable ->>>22 leshort&020000 !0 dynamically linked ->>>16 lelong !0 not stripped ->>>16 lelong 0 stripped ->>>27 byte x - version %d ->>>26 byte x \b.%d ->>>28 byte x \b-%d ->>24 leshort 0407 COFF format alpha object ->>>22 leshort&030000 020000 shared library ->>>27 byte x - version %d ->>>26 byte x \b.%d ->>>28 byte x \b-%d +>24 leshort 0410 COFF format alpha pure +>24 leshort 0413 COFF format alpha demand paged +>>22 leshort&030000 !020000 executable +>>22 leshort&020000 !0 dynamically linked +>>16 lelong !0 not stripped +>>16 lelong 0 stripped +>>27 byte x - version %d +>>26 byte x \b.%d +>>28 byte x \b-%d +>24 leshort 0407 COFF format alpha object +>>22 leshort&030000 020000 shared library +>>27 byte x - version %d +>>26 byte x \b.%d +>>28 byte x \b-%d # Basic recognition of Digital UNIX core dumps - Mike Bremford # --- file-5.12/magic/Magdir/gnome 1970-01-01 01:00:00.000000000 +0100 +++ upstream/magic/Magdir/gnome 2013-01-21 16:12:12.997452122 +0100 @@ -0,0 +1,59 @@ + +#------------------------------------------------------------------------------ +# $File: gnome,v 1.3 2012/06/21 01:19:51 christos Exp $ +# GNOME related files + +# Contributed by Josh Triplett +# FIXME: Could be simplified if pstring supported two-byte counts +0 string GnomeKeyring\n\r\0\n GNOME keyring +>&0 ubyte 0 \b, major version 0 +>>&0 ubyte 0 \b, minor version 0 +>>>&0 ubyte 0 \b, crypto type 0 (AES) +>>>&0 ubyte >0 \b, crypto type %hhu (unknown) +>>>&1 ubyte 0 \b, hash type 0 (MD5) +>>>&1 ubyte >0 \b, hash type %hhu (unknown) +>>>&2 ubelong 0xFFFFFFFF \b, name NULL +>>>&2 ubelong !0xFFFFFFFF +>>>>&-4 ubelong >255 \b, name too long for file's pstring type +>>>>&-4 ubelong <256 +>>>>>&-1 pstring x \b, name "%s" +>>>>>>&0 ubeqdate x \b, last modified %s +>>>>>>&8 ubeqdate x \b, created %s +>>>>>>&16 ubelong &1 +>>>>>>>&0 ubelong x \b, locked if idle for %u seconds +>>>>>>&16 ubelong ^1 \b, not locked if idle +>>>>>>&24 ubelong x \b, hash iterations %u +>>>>>>&28 ubequad x \b, salt %llu +>>>>>>&52 ubelong x \b, %u item(s) + +# From: Alex Beregszaszi +4 string gtktalog GNOME Catalogue (gtktalog) +>13 string >\0 version %s + +# Summary: GStreamer binary registry +# Extension: .bin +# Submitted by: Josh Triplett +0 belong 0xc0def00d GStreamer binary registry +>4 string x \b, version %s + +# GVariant Database file +# By Elan Ruusam=E4e +# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h +# It's always "GVariant", it's byte swapped on incompatible archs +# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c +# file_builder_serialise() +# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant +0 string GVariant GVariant Database file, +# version is never filled. probably future extension +>8 lelong x version %d +# not sure are these usable, so commented out +#>>16 lelong x start %d, +#>>>20 lelong x end %d + +# G-IR database made by gobject-introspect toolset, +# http://live.gnome.org/GObjectIntrospection +0 string GOBJ\nMETADATA\r\n\032 G-IR binary database +>16 byte x \b, v%d +>17 byte x \b.%d +>20 leshort x \b, %d entries +>22 leshort x \b/%d local --- file-5.12/magic/Magdir/gnome-keyring 2012-06-21 03:19:51.000000000 +0200 +++ upstream/magic/Magdir/gnome-keyring 1970-01-01 01:00:00.000000000 +0100 @@ -1,26 +0,0 @@ - -#------------------------------------------------------------------------------ -# $File: gnome-keyring,v 1.3 2012/06/21 01:19:51 christos Exp $ -# GNOME keyring -# Contributed by Josh Triplett -# FIXME: Could be simplified if pstring supported two-byte counts -0 string GnomeKeyring\n\r\0\n GNOME keyring ->&0 ubyte 0 \b, major version 0 ->>&0 ubyte 0 \b, minor version 0 ->>>&0 ubyte 0 \b, crypto type 0 (AES) ->>>&0 ubyte >0 \b, crypto type %hhu (unknown) ->>>&1 ubyte 0 \b, hash type 0 (MD5) ->>>&1 ubyte >0 \b, hash type %hhu (unknown) ->>>&2 ubelong 0xFFFFFFFF \b, name NULL ->>>&2 ubelong !0xFFFFFFFF ->>>>&-4 ubelong >255 \b, name too long for file's pstring type ->>>>&-4 ubelong <256 ->>>>>&-1 pstring x \b, name "%s" ->>>>>>&0 ubeqdate x \b, last modified %s ->>>>>>&8 ubeqdate x \b, created %s ->>>>>>&16 ubelong &1 ->>>>>>>&0 ubelong x \b, locked if idle for %u seconds ->>>>>>&16 ubelong ^1 \b, not locked if idle ->>>>>>&24 ubelong x \b, hash iterations %u ->>>>>>&28 ubequad x \b, salt %llu ->>>>>>&52 ubelong x \b, %u item(s) --- file-5.12/magic/Magdir/ibm6000 2012-08-10 17:06:07.000000000 +0200 +++ upstream/magic/Magdir/ibm6000 2013-01-21 16:12:12.997452122 +0100 @@ -21,6 +21,7 @@ 0 beshort 0x01f7 64-bit XCOFF executable or object module >20 belong 0 not stripped 4 belong &0x0feeddb0 AIX core file +>1 byte &0x01 fulldump >7 byte &0x01 32-bit >>0x6e0 string >\0 \b, %s >7 byte &0x02 64-bit --- file-5.12/magic/Magdir/icc 1970-01-01 01:00:00.000000000 +0100 +++ upstream/magic/Magdir/icc 2013-01-21 16:12:13.021452655 +0100 @@ -0,0 +1,51 @@ + +#------------------------------------------------------------------------------ +# $File$ +# icc: file(1) magic for International Color Consortium file formats + +# +# Color profiles as per the ICC's "Image technology colour management - +# Architecture, profile format, and data structure" specification. +# See +# +# http://www.color.org/specification/ICC1v43_2010-12.pdf +# +# for Specification ICC.1:2010 (Profile version 4.3.0.0). +# +# Bytes 36 to 39 contain a generic profile file signature of "acsp"; +# bytes 40 to 43 "may be used to identify the primary platform/operating +# system framework for which the profile was created". +# +# There are other fields that might be worth dumping as well. +# + +# This appears to be what's used for Apple ColorSync profiles. +# Instead of adding that, Apple just changed the generic "acsp" entry +# to be for "ColorSync ICC Color Profile" rather than "Kodak Color +# Management System, ICC Profile". +# Yes, it's "APPL", not "AAPL"; see the spec. +36 string acspAPPL ColorSync ICC Profile +!:mime application/vnd.iccprofile + +# Microsoft ICM color profile +36 string acspMSFT Microsoft ICM Color Profile +!:mime application/vnd.iccprofile + +# Yes, that's a blank after "SGI". +36 string acspSGI\ SGI ICC Profile +!:mime application/vnd.iccprofile + +# XXX - is this what's used for the Sun KCMS or not? The standard file +# uses just "acsp" for that, but Apple's file uses it for "ColorSync", +# and there *is* an identified "primary platform" value of SUNW. +36 string acspSUNW Sun KCMS ICC Profile +!:mime application/vnd.iccprofile + +# Any other profile. +# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, +# and use "acsp" for everything else and dump the "primary platform" +# string in those cases? +36 string acsp ICC Profile +!:mime application/vnd.iccprofile + + --- file-5.12/magic/Magdir/linux 2012-10-29 18:36:49.000000000 +0100 +++ upstream/magic/Magdir/linux 2013-01-21 16:12:13.057952501 +0100 @@ -98,6 +98,7 @@ # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel +!:strength + 5 >510 leshort 0xAA55 x86 boot executable >>518 leshort >0x1ff >>>529 byte 0 zImage, --- file-5.12/magic/Magdir/llvm 2010-10-07 03:13:42.000000000 +0200 +++ upstream/magic/Magdir/llvm 2013-01-21 16:12:13.057952501 +0100 @@ -9,5 +9,13 @@ 0 string llvc0 LLVM byte-codes, null compression 0 string llvc1 LLVM byte-codes, gzip compression 0 string llvc2 LLVM byte-codes, bzip2 compression -0 string \xde\xc0\x17\x0b LLVM bitcode, wrapper -0 string BC\xc0\xde LLVM bitcode + +0 lelong 0x0b17c0de LLVM bitcode, wrapper +# Are these Mach-O ABI values? They appear to be. +>16 lelong 0x01000007 x86_64 +>16 lelong 0x00000007 i386 +>16 lelong 0x00000012 ppc +>16 lelong 0x01000012 ppc64 +>16 lelong 0x0000000c arm + +0 string BC\xc0\xde LLVM IR bitcode --- file-5.12/magic/Magdir/lua 2009-09-19 18:28:10.000000000 +0200 +++ upstream/magic/Magdir/lua 2013-01-21 16:12:13.057952501 +0100 @@ -19,3 +19,4 @@ 0 string \033Lua Lua bytecode, >4 byte 0x50 version 5.0 >4 byte 0x51 version 5.1 +>4 byte 0x52 version 5.2 --- file-5.12/magic/Magdir/mach 2012-11-06 21:37:19.000000000 +0100 +++ upstream/magic/Magdir/mach 2013-01-21 16:12:13.085452498 +0100 @@ -1,118 +1,191 @@ #------------------------------------------------------------ -# $File: mach,v 1.12 2012/11/01 04:26:40 christos Exp $ +# $File: mach,v 1.13 2013/01/04 21:46:59 christos Exp $ # Mach has two magic numbers, 0xcafebabe and 0xfeedface. # Unfortunately the first, cafebabe, is shared with # Java ByteCode, so they are both handled in the file "cafebabe". # The "feedface" ones are handled herein. #------------------------------------------------------------ -0 name mach-o-bed +0 name mach-o-be >0 byte 0xcf 64-bit ->4 belong <0 ->>4 belong x architecture=%ld ->4 belong 1 ->>8 belong 0 vax ->>8 belong 1 vax11/780 ->>8 belong 2 vax11/785 ->>8 belong 3 vax11/750 ->>8 belong 4 vax11/730 ->>8 belong 5 uvaxI ->>8 belong 6 uvaxII ->>8 belong 7 vax8200 ->>8 belong 8 vax8500 ->>8 belong 9 vax8600 ->>8 belong 10 vax8650 ->>8 belong 11 vax8800 ->>8 belong 12 uvaxIII ->4 belong 2 romp ->4 belong 3 architecture=3 ->4 belong 4 ns32032 ->4 belong 5 ns32332 ->4 belong 6 m68k ->4 belong 7 ->>8 belong 3 i386 ->>8 belong 4 i486 ->>8 belong 132 i486sx ->>8 belong 5 i586 ->>8 belong 8 pentium_3 ->>8 belong 9 pentiumM ->>8 belong 10 pentiumIV ->>8 belong 11 itanium ->>8 belong 12 xeon ->>8 belong 14 pentiumIV_M ->>8 belong 15 itanium2 ->>8 belong 21 pentiumpro ->>8 belong 23 pentiumIII ->>8 belong 24 pentium_3_M ->>8 belong 25 pentiumV ->>8 belong 26 xeon_mp ->>8 belong 40 pentium_3_xeon ->>8 belong 113 celeron ->>8 belong 119 celeron_mobile ->4 belong 8 mips ->>8 belong 1 R2300 ->>8 belong 2 R2600 ->>8 belong 3 R2800 ->>8 belong 4 R2000a ->>8 belong 5 R2000 ->>8 belong 6 R3000a ->>8 belong 7 R3000 ->4 belong 9 ns32532 ->4 belong 10 mc98000 ->4 belong 11 hppa ->>8 belong 0 7100 ->>8 belong 1 7100LC ->4 belong 12 ->>8 belong 0 arm ->>8 belong 1 arm_v4t ->>8 belong 2 arm_v6 ->>8 belong 3 arm_v5tej ->>8 belong 4 arm_xscale ->>8 belong 5 arm_v7 ->>8 belong 6 arm_v7f ->>8 belong 7 arm_v7k ->4 belong 13 ->>8 belong 0 mc88000 ->>8 belong 1 mc88100 ->>8 belong 2 mc88110 ->4 belong 14 sparc ->4 belong 15 i860g ->4 belong 16 alpha ->4 belong 17 rs6000 ->4 belong 18 ->>8 belong 0 ppc ->>8 belong 1 ppc_601 ->>8 belong 2 ppc_602 ->>8 belong 3 ppc_603 ->>8 belong 4 ppc_603e ->>8 belong 5 ppc_603ev ->>8 belong 6 ppc_604 ->>8 belong 7 ppc_604e ->>8 belong 8 ppc_620 ->>8 belong 9 ppc_650 ->>8 belong 10 ppc_7400 ->>8 belong 11 ppc_7450 ->>8 belong 100 ppc_970 ->4 belong 16777223 ->>8 belong 3 x86_64 ->>8 belong 4 x86_64_arch1 ->4 belong 16777234 ->>8 belong 0 ppc64 ->>8 belong 1 ppc64_601 ->>8 belong 2 ppc64_602 ->>8 belong 3 ppc64_603 ->>8 belong 4 ppc64_603e ->>8 belong 5 ppc64_603ev ->>8 belong 6 ppc64_604 ->>8 belong 7 ppc64_604e ->>8 belong 8 ppc64_620 ->>8 belong 9 ppc64_650 ->>8 belong 10 ppc64_7400 ->>8 belong 11 ppc64_7450 ->>8 belong 100 ppc64_970 ->4 belong >16777234 ->>4 belong x architecture=%ld +# if set, it's for the 64-bit version of the architecture +# yes, this is separate from the low-order magic number bit +# it's also separate from the "64-bit libraries" bit in the +# upper 8 bits of the CPU subtype +>4 belong&0x01000000 0 +# +# 32-bit ABIs. +# +# 1 vax +>>4 belong&0x00ffffff 1 +>>>8 belong&0x00ffffff 0 vax +>>>8 belong&0x00ffffff 1 vax11/780 +>>>8 belong&0x00ffffff 2 vax11/785 +>>>8 belong&0x00ffffff 3 vax11/750 +>>>8 belong&0x00ffffff 4 vax11/730 +>>>8 belong&0x00ffffff 5 uvaxI +>>>8 belong&0x00ffffff 6 uvaxII +>>>8 belong&0x00ffffff 7 vax8200 +>>>8 belong&0x00ffffff 8 vax8500 +>>>8 belong&0x00ffffff 9 vax8600 +>>>8 belong&0x00ffffff 10 vax8650 +>>>8 belong&0x00ffffff 11 vax8800 +>>>8 belong&0x00ffffff 12 uvaxIII +>>>8 belong&0x00ffffff >12 vax subarchitecture=%ld +>>4 belong&0x00ffffff 2 romp +>>4 belong&0x00ffffff 3 architecture=3 +>>4 belong&0x00ffffff 4 ns32032 +>>4 belong&0x00ffffff 5 ns32332 +>>4 belong&0x00ffffff 6 m68k +# 7 x86 +>>4 belong&0x00ffffff 7 +>>>8 belong&0x0000000f 3 i386 +>>>8 belong&0x0000000f 4 i486 +>>>>8 belong&0x00fffff0 0 +>>>>8 belong&0x00fffff0 0x80 \bsx +>>>8 belong&0x0000000f 5 i586 +>>>8 belong&0x0000000f 6 +>>>>8 belong&0x00fffff0 0 p6 +>>>>8 belong&0x00fffff0 0x10 pentium_pro +>>>>8 belong&0x00fffff0 0x20 pentium_2_m0x20 +>>>>8 belong&0x00fffff0 0x30 pentium_2_m3 +>>>>8 belong&0x00fffff0 0x40 pentium_2_m0x40 +>>>>8 belong&0x00fffff0 0x50 pentium_2_m5 +>>>>8 belong&0x00fffff0 >0x50 pentium_2_m0x%lx +>>>8 belong&0x0000000f 7 celeron +>>>>8 belong&0x00fffff0 0x00 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x10 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x20 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x30 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x40 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x50 \b_m0x%lx +>>>>8 belong&0x00fffff0 0x60 +>>>>8 belong&0x00fffff0 0x70 \b_mobile +>>>>8 belong&0x00fffff0 >0x70 \b_m0x%lx +>>>8 belong&0x0000000f 8 pentium_3 +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_m +>>>>8 belong&0x00fffff0 0x20 \b_xeon +>>>>8 belong&0x00fffff0 >0x20 \b_m0x%lx +>>>8 belong&0x0000000f 9 pentiumM +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 >0x00 \b_m0x%lx +>>>8 belong&0x0000000f 10 pentium_4 +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_m +>>>>8 belong&0x00fffff0 >0x10 \b_m0x%lx +>>>8 belong&0x0000000f 11 itanium +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_2 +>>>>8 belong&0x00fffff0 >0x10 \b_m0x%lx +>>>8 belong&0x0000000f 12 xeon +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 0x10 \b_mp +>>>>8 belong&0x00fffff0 >0x10 \b_m0x%lx +>>>8 belong&0x0000000f >12 ia32 family=%ld +>>>>8 belong&0x00fffff0 0x00 +>>>>8 belong&0x00fffff0 >0x00 model=%lx +>>4 belong&0x00ffffff 8 mips +>>>8 belong&0x00ffffff 1 R2300 +>>>8 belong&0x00ffffff 2 R2600 +>>>8 belong&0x00ffffff 3 R2800 +>>>8 belong&0x00ffffff 4 R2000a +>>>8 belong&0x00ffffff 5 R2000 +>>>8 belong&0x00ffffff 6 R3000a +>>>8 belong&0x00ffffff 7 R3000 +>>>8 belong&0x00ffffff >7 subarchitecture=%ld +>>4 belong&0x00ffffff 9 ns32532 +>>4 belong&0x00ffffff 10 mc98000 +>>4 belong&0x00ffffff 11 hppa +>>>8 belong&0x00ffffff 0 7100 +>>>8 belong&0x00ffffff 1 7100LC +>>>8 belong&0x00ffffff >1 subarchitecture=%ld +>>4 belong&0x00ffffff 12 arm +>>>8 belong&0x00ffffff 0 +>>>8 belong&0x00ffffff 1 subarchitecture=%ld +>>>8 belong&0x00ffffff 2 subarchitecture=%ld +>>>8 belong&0x00ffffff 3 subarchitecture=%ld +>>>8 belong&0x00ffffff 4 subarchitecture=%ld +>>>8 belong&0x00ffffff 5 \b_v4t +>>>8 belong&0x00ffffff 6 \b_v6 +>>>8 belong&0x00ffffff 7 \b_v5tej +>>>8 belong&0x00ffffff 8 \b_xscale +>>>8 belong&0x00ffffff 9 \b_v7 +>>>8 belong&0x00ffffff 10 \b_v7f +>>>8 belong&0x00ffffff 11 subarchitecture=%ld +>>>8 belong&0x00ffffff 12 \b_v7k +>>>8 belong&0x00ffffff >12 subarchitecture=%ld +# 13 m88k +>>4 belong&0x00ffffff 13 +>>>8 belong&0x00ffffff 0 mc88000 +>>>8 belong&0x00ffffff 1 mc88100 +>>>8 belong&0x00ffffff 2 mc88110 +>>>8 belong&0x00ffffff >2 mc88000 subarchitecture=%ld +>>4 belong&0x00ffffff 14 sparc +>>4 belong&0x00ffffff 15 i860g +>>4 belong&0x00ffffff 16 alpha +>>4 belong&0x00ffffff 17 rs6000 +>>4 belong&0x00ffffff 18 ppc +>>>8 belong&0x00ffffff 0 +>>>8 belong&0x00ffffff 1 \b_601 +>>>8 belong&0x00ffffff 2 \b_602 +>>>8 belong&0x00ffffff 3 \b_603 +>>>8 belong&0x00ffffff 4 \b_603e +>>>8 belong&0x00ffffff 5 \b_603ev +>>>8 belong&0x00ffffff 6 \b_604 +>>>8 belong&0x00ffffff 7 \b_604e +>>>8 belong&0x00ffffff 8 \b_620 +>>>8 belong&0x00ffffff 9 \b_650 +>>>8 belong&0x00ffffff 10 \b_7400 +>>>8 belong&0x00ffffff 11 \b_7450 +>>>8 belong&0x00ffffff 100 \b_970 +>>>8 belong&0x00ffffff >100 subarchitecture=%ld +>>4 belong&0x00ffffff >18 architecture=%ld +>4 belong&0x01000000 0x01000000 +# +# 64-bit ABIs. +# +>>4 belong&0x00ffffff 0 64-bit architecture=%ld +>>4 belong&0x00ffffff 1 64-bit architecture=%ld +>>4 belong&0x00ffffff 2 64-bit architecture=%ld +>>4 belong&0x00ffffff 3 64-bit architecture=%ld +>>4 belong&0x00ffffff 4 64-bit architecture=%ld +>>4 belong&0x00ffffff 5 64-bit architecture=%ld +>>4 belong&0x00ffffff 6 64-bit architecture=%ld +>>4 belong&0x00ffffff 7 x86_64 +>>>8 belong&0x00ffffff 0 subarchitecture=%ld +>>>8 belong&0x00ffffff 1 subarchitecture=%ld +>>>8 belong&0x00ffffff 2 subarchitecture=%ld +>>>8 belong&0x00ffffff 3 +>>>8 belong&0x00ffffff 4 \b_arch1 +>>>8 belong&0x00ffffff >4 subarchitecture=%ld +>>4 belong&0x00ffffff 8 64-bit architecture=%ld +>>4 belong&0x00ffffff 9 64-bit architecture=%ld +>>4 belong&0x00ffffff 10 64-bit architecture=%ld +>>4 belong&0x00ffffff 11 64-bit architecture=%ld +>>4 belong&0x00ffffff 12 64-bit architecture=%ld +>>4 belong&0x00ffffff 13 64-bit architecture=%ld +>>4 belong&0x00ffffff 14 64-bit architecture=%ld +>>4 belong&0x00ffffff 15 64-bit architecture=%ld +>>4 belong&0x00ffffff 16 64-bit architecture=%ld +>>4 belong&0x00ffffff 17 64-bit architecture=%ld +>>4 belong&0x00ffffff 18 ppc64 +>>>8 belong&0x00ffffff 0 +>>>8 belong&0x00ffffff 1 \b_601 +>>>8 belong&0x00ffffff 2 \b_602 +>>>8 belong&0x00ffffff 3 \b_603 +>>>8 belong&0x00ffffff 4 \b_603e +>>>8 belong&0x00ffffff 5 \b_603ev +>>>8 belong&0x00ffffff 6 \b_604 +>>>8 belong&0x00ffffff 7 \b_604e +>>>8 belong&0x00ffffff 8 \b_620 +>>>8 belong&0x00ffffff 9 \b_650 +>>>8 belong&0x00ffffff 10 \b_7400 +>>>8 belong&0x00ffffff 11 \b_7450 +>>>8 belong&0x00ffffff 100 \b_970 +>>>8 belong&0x00ffffff >100 subarchitecture=%ld +>>4 belong&0x00ffffff >18 64-bit architecture=%ld >12 belong 1 object >12 belong 2 executable >12 belong 3 fixed virtual memory shared library @@ -122,7 +195,9 @@ >12 belong 7 dynamic linker >12 belong 8 bundle >12 belong 9 dynamically linked shared library stub ->12 belong >9 +>12 belong 10 dSYM companion file +>12 belong 11 kext bundle +>12 belong >11 >>12 belong x filetype=%ld # --- file-5.12/magic/Magdir/mail.news 2012-06-21 03:44:52.000000000 +0200 +++ upstream/magic/Magdir/mail.news 2013-01-21 16:12:13.085452498 +0100 @@ -14,9 +14,9 @@ !:mime message/rfc822 0 string/t Pipe\ to mail piping text !:mime message/rfc822 -0 string/t Delivered-To: SMTP mail text +0 string/tc delivered-to: SMTP mail text !:mime message/rfc822 -0 string/t Return-Path: SMTP mail text +0 string/tc return-path: SMTP mail text !:mime message/rfc822 0 string/t Path: news text !:mime message/news --- file-5.12/magic/Magdir/maple 2009-09-19 18:28:10.000000000 +0200 +++ upstream/magic/Magdir/maple 2013-01-21 16:12:13.093452481 +0100 @@ -33,7 +33,7 @@ # that is {VERSION major_version miunor_version computer_type version_string} 0 string {VERSION\ Maple worksheet >9 string >\0 version %.1s. ->>>11 string >\0 %.1s +>>11 string >\0 %.1s # .mps 0 string \0\0\001$ Maple something --- file-5.12/magic/Magdir/mips 2011-05-11 03:32:28.000000000 +0200 +++ upstream/magic/Magdir/mips 2013-01-21 16:12:13.113952530 +0100 @@ -1,32 +1,8 @@ #------------------------------------------------------------------------------ -# $File: mips,v 1.7 2011/05/03 01:44:17 christos Exp $ -# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) -# Dec Ultrix (MIPS) -# all of SGI's *current* machines and OSes run in big-endian mode on the -# MIPS machines, as far as I know. -# -# XXX - what is the blank "-" line? -# -# kbd file definitions -0 string kbd!map kbd map file ->8 byte >0 Ver %d: ->10 short >0 with %d table(s) -0 belong 0407 old SGI 68020 executable -0 belong 0410 old SGI 68020 pure executable -0 beshort 0x8765 disk quotas file -0 beshort 0x0506 IRIS Showcase file ->2 byte 0x49 - ->3 byte x - version %ld -0 beshort 0x0226 IRIS Showcase template ->2 byte 0x63 - ->3 byte x - version %ld -0 belong 0x5343464d IRIS Showcase file ->4 byte x - version %ld -0 belong 0x5443464d IRIS Showcase template ->4 byte x - version %ld -0 belong 0xdeadbabe IRIX Parallel Arena ->8 belong >0 - version %ld +# $File: mips,v 1.8 2013/01/09 22:37:24 christos Exp $ +# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX +# and DEC Ultrix # 0 beshort 0x0160 MIPSEB ECOFF executable >20 beshort 0407 (impure) @@ -142,41 +118,3 @@ # 0 beshort 0x180 MIPSEB Ucode 0 beshort 0x182 MIPSEL-BE Ucode -# 32bit core file -0 belong 0xdeadadb0 IRIX core dump ->4 belong 1 of ->16 string >\0 '%s' -# 64bit core file -0 belong 0xdeadad40 IRIX 64-bit core dump ->4 belong 1 of ->16 string >\0 '%s' -# N32bit core file -0 belong 0xbabec0bb IRIX N32 core dump ->4 belong 1 of ->16 string >\0 '%s' -# New style crash dump file -0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of ->36 string >\0 '%s' -# Trusted IRIX info -0 string SGIAUDIT SGI Audit file ->8 byte x - version %d ->9 byte x \b.%ld -# -0 string WNGZWZSC Wingz compiled script -0 string WNGZWZSS Wingz spreadsheet -0 string WNGZWZHP Wingz help file -# -0 string #Inventor V IRIS Inventor 1.0 file -0 string #Inventor V2 Open Inventor 2.0 file -# GLF is OpenGL stream encoding -0 string glfHeadMagic(); GLF_TEXT -4 belong 0x7d000000 GLF_BINARY_LSB_FIRST -!:strength -30 -4 belong 0x0000007d GLF_BINARY_MSB_FIRST -!:strength -30 -# GLS is OpenGL stream encoding; GLS is the successor of GLF -0 string glsBeginGLS( GLS_TEXT -4 belong 0x10000000 GLS_BINARY_LSB_FIRST -!:strength -30 -4 belong 0x00000010 GLS_BINARY_MSB_FIRST -!:strength -30 --- file-5.12/magic/Magdir/misctools 2010-10-07 03:13:42.000000000 +0200 +++ upstream/magic/Magdir/misctools 2013-01-21 16:12:13.113952530 +0100 @@ -9,16 +9,6 @@ 0 string/c BEGIN:VCARD vCard visiting card !:mime text/x-vcard -# From: Alex Beregszaszi -4 string gtktalog GNOME Catalogue (gtktalog) ->13 string >\0 version %s - -# Summary: GStreamer binary registry -# Extension: .bin -# Submitted by: Josh Triplett -0 belong 0xc0def00d GStreamer binary registry ->4 string x \b, version %s - # Summary: Libtool library file # Extension: .la # Submitted by: Tomasz Trojanowski --- file-5.12/magic/Magdir/neko 1970-01-01 01:00:00.000000000 +0100 +++ upstream/magic/Magdir/neko 2013-01-21 16:12:13.153952609 +0100 @@ -0,0 +1,12 @@ + +#------------------------------------------------------------ +# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $ + +# From: Mikhail Gusarov +# NekoVM (http://nekovm.org/) bytecode +0 string NEKO NekoVM bytecode +>4 lelong x (%d global symbols, +>8 lelong x %d global fields, +>12 lelong x %d bytecode ops) +!:mime application/x-nekovm-bytecode + --- file-5.12/magic/Magdir/netbsd 2011-12-13 14:52:48.000000000 +0100 +++ upstream/magic/Magdir/netbsd 2013-01-21 16:12:13.153952609 +0100 @@ -4,13 +4,11 @@ # netbsd: file(1) magic for NetBSD objects # # All new-style magic numbers are in network byte order. +# The old-style magic numbers are indistinguishable from the same magic +# numbers used in other systems, and are handled, for all those systems, +# in aout. # -0 lelong 000000407 a.out NetBSD little-endian object file ->16 lelong >0 not stripped -0 belong 000000407 a.out NetBSD big-endian object file ->16 belong >0 not stripped - 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged >0 byte &0x80 >>20 lelong <4096 shared library --- file-5.12/magic/Magdir/rpm 2011-06-14 14:47:41.000000000 +0200 +++ upstream/magic/Magdir/rpm 2013-01-21 16:12:13.257451964 +0100 @@ -31,22 +31,15 @@ >>8 beshort 255 noarch #delta RPM Daniel Novotny (dnovotny@redhat.com) -0 string drpm Delta RPM +0 string drpm Delta RPM !:mime application/x-rpm >12 string x %s - ->>>8 beshort 11 MIPSel ->>>8 beshort 12 ARM ->>>8 beshort 13 MiNT ->>>8 beshort 14 S/390 ->>>8 beshort 15 S/390x ->>>8 beshort 16 PowerPC64 ->>>8 beshort 17 SuperH ->>>8 beshort 18 Xtensa +>>8 beshort 11 MIPSel +>>8 beshort 12 ARM +>>8 beshort 13 MiNT +>>8 beshort 14 S/390 +>>8 beshort 15 S/390x +>>8 beshort 16 PowerPC64 +>>8 beshort 17 SuperH +>>8 beshort 18 Xtensa >>10 string x %s - -# Type: Delta RPM -# From: Daniel Novotny (dnovotny@redhat.com) -0 string drpm Delta RPM -!:mime application/x-rpm ->12 string x %s --- file-5.12/magic/Magdir/sgi 2010-11-25 16:00:12.000000000 +0100 +++ upstream/magic/Magdir/sgi 2013-01-21 16:12:13.257451964 +0100 @@ -1,7 +1,74 @@ #------------------------------------------------------------------------------ # $File: sgi,v 1.18 2010/11/25 15:00:12 christos Exp $ -# sgi: file(1) magic for Silicon Graphics applications +# sgi: file(1) magic for Silicon Graphics operating systems and applications +# +# Executable images are handled either in aout (for old-style a.out +# files for 68K; they are indistinguishable from other big-endian 32-bit +# a.out files) or in mips (for MIPS ECOFF and Ucode files) +# + +# kbd file definitions +0 string kbd!map kbd map file +>8 byte >0 Ver %d: +>10 short >0 with %d table(s) + +0 beshort 0x8765 disk quotas file + +0 beshort 0x0506 IRIS Showcase file +>2 byte 0x49 - +>3 byte x - version %ld +0 beshort 0x0226 IRIS Showcase template +>2 byte 0x63 - +>3 byte x - version %ld +0 belong 0x5343464d IRIS Showcase file +>4 byte x - version %ld +0 belong 0x5443464d IRIS Showcase template +>4 byte x - version %ld +0 belong 0xdeadbabe IRIX Parallel Arena +>8 belong >0 - version %ld + +# core files +# +# 32bit core file +0 belong 0xdeadadb0 IRIX core dump +>4 belong 1 of +>16 string >\0 '%s' +# 64bit core file +0 belong 0xdeadad40 IRIX 64-bit core dump +>4 belong 1 of +>16 string >\0 '%s' +# N32bit core file +0 belong 0xbabec0bb IRIX N32 core dump +>4 belong 1 of +>16 string >\0 '%s' +# New style crash dump file +0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of +>36 string >\0 '%s' + +# Trusted IRIX info +0 string SGIAUDIT SGI Audit file +>8 byte x - version %d +>9 byte x \b.%ld +# +0 string WNGZWZSC Wingz compiled script +0 string WNGZWZSS Wingz spreadsheet +0 string WNGZWZHP Wingz help file +# +0 string #Inventor V IRIS Inventor 1.0 file +0 string #Inventor V2 Open Inventor 2.0 file +# GLF is OpenGL stream encoding +0 string glfHeadMagic(); GLF_TEXT +4 belong 0x7d000000 GLF_BINARY_LSB_FIRST +!:strength -30 +4 belong 0x0000007d GLF_BINARY_MSB_FIRST +!:strength -30 +# GLS is OpenGL stream encoding; GLS is the successor of GLF +0 string glsBeginGLS( GLS_TEXT +4 belong 0x10000000 GLS_BINARY_LSB_FIRST +!:strength -30 +4 belong 0x00000010 GLS_BINARY_MSB_FIRST +!:strength -30 # # --- file-5.12/magic/Magdir/sniffer 2011-08-08 10:49:27.000000000 +0200 +++ upstream/magic/Magdir/sniffer 2013-01-21 16:12:13.273452401 +0100 @@ -17,6 +17,7 @@ >6 leshort 2 (Token Ring) >6 leshort 3 (FDDI) >6 leshort 4 (ATM) +>6 leshort >4 (type %d) # # Microsoft Network Monitor 2.x capture files. @@ -29,6 +30,12 @@ >6 leshort 2 (Token Ring) >6 leshort 3 (FDDI) >6 leshort 4 (ATM) +>6 leshort 5 (IP-over-IEEE 1394) +>6 leshort 6 (802.11) +>6 leshort 7 (Raw IP) +>6 leshort 8 (Raw IP) +>6 leshort 9 (Raw IP) +>6 leshort >9 (type %d) # # Network General Sniffer capture files. @@ -57,6 +64,7 @@ # Sorry, make that "Network Associates Sniffer Basic, and Windows # Sniffer Pro", capture files." # Sorry, make that "Network General Sniffer capture files." +# Sorry, make that "NetScout Sniffer capture files." # 0 string XCP\0 NetXRay capture file >4 string >\0 - version %s @@ -73,8 +81,7 @@ # the main program that uses that format, but there are other programs # that use "libpcap", or that use the same capture file format.) # -0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) -!:mime application/vnd.tcpdump.pcap +0 name pcap-be >4 beshort x - version %d >6 beshort x \b.%d >20 belong 0 (No link-layer encapsulation @@ -116,8 +123,10 @@ >20 belong 127 (802.11 with radiotap header >20 belong 129 (Linux ARCNET >20 belong 138 (Apple IP over IEEE 1394 +>20 belong 139 (MTP2 with pseudo-header >20 belong 140 (MTP2 >20 belong 141 (MTP3 +>20 belong 142 (SCCP >20 belong 143 (DOCSIS >20 belong 144 (IrDA >20 belong 147 (Private use 0 @@ -137,72 +146,53 @@ >20 belong 161 (Private use 14 >20 belong 162 (Private use 15 >20 belong 163 (802.11 with AVS header +>20 belong 165 (BACnet MS/TP +>20 belong 166 (PPPD +>20 belong 169 (GPRS LLC +>20 belong 177 (Linux LAPD +>20 belong 187 (Bluetooth HCI H4 +>20 belong 189 (Linux USB +>20 belong 192 (PPI +>20 belong 195 (802.15.4 +>20 belong 196 (SITA +>20 belong 197 (Endace ERF +>20 belong 201 (Bluetooth HCI H4 with pseudo-header +>20 belong 202 (AX.25 with KISS header +>20 belong 203 (LAPD +>20 belong 204 (PPP with direction pseudo-header +>20 belong 205 (Cisco HDLC with direction pseudo-header +>20 belong 206 (Frame Relay with direction pseudo-header +>20 belong 209 (Linux IPMB +>20 belong 215 (802.15.4 with non-ASK PHY header +>20 belong 220 (Memory-mapped Linux USB +>20 belong 224 (Fibre Channel FC-2 +>20 belong 225 (Fibre Channel FC-2 with frame delimiters +>20 belong 226 (Solaris IPNET +>20 belong 227 (SocketCAN +>20 belong 228 (Raw IPv4 +>20 belong 229 (Raw IPv6 +>20 belong 230 (802.15.4 without FCS +>20 belong 231 (D-Bus messages +>20 belong 235 (DVB-CI +>20 belong 236 (MUX27010 +>20 belong 237 (STANAG 5066 D_PDUs +>20 belong 239 (Linux netlink NFLOG messages +>20 belong 240 (Hilscher netAnalyzer +>20 belong 241 (Hilscher netAnalyzer with delimiters +>20 belong 242 (IP-over-Infiniband +>20 belong 243 (MPEG-2 Transport Stream packets +>20 belong 244 (ng4t ng40 +>20 belong 245 (NFC LLCP +>20 belong 247 (Infiniband +>20 belong 248 (SCTP >16 belong x \b, capture length %d) + +0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) +!:mime application/vnd.tcpdump.pcap +>0 use pcap-be 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) !:mime application/vnd.tcpdump.pcap ->4 leshort x - version %d ->6 leshort x \b.%d ->20 lelong 0 (No link-layer encapsulation ->20 lelong 1 (Ethernet ->20 lelong 2 (3Mb Ethernet ->20 lelong 3 (AX.25 ->20 lelong 4 (ProNET ->20 lelong 5 (CHAOS ->20 lelong 6 (Token Ring ->20 lelong 7 (ARCNET ->20 lelong 8 (SLIP ->20 lelong 9 (PPP ->20 lelong 10 (FDDI ->20 lelong 11 (RFC 1483 ATM ->20 lelong 12 (raw IP ->20 lelong 13 (BSD/OS SLIP ->20 lelong 14 (BSD/OS PPP ->20 lelong 19 (Linux ATM Classical IP ->20 lelong 50 (PPP or Cisco HDLC ->20 lelong 51 (PPP-over-Ethernet ->20 lelong 99 (Symantec Enterprise Firewall ->20 lelong 100 (RFC 1483 ATM ->20 lelong 101 (raw IP ->20 lelong 102 (BSD/OS SLIP ->20 lelong 103 (BSD/OS PPP ->20 lelong 104 (BSD/OS Cisco HDLC ->20 lelong 105 (802.11 ->20 lelong 106 (Linux Classical IP over ATM ->20 lelong 107 (Frame Relay ->20 lelong 108 (OpenBSD loopback ->20 lelong 109 (OpenBSD IPsec encrypted ->20 lelong 112 (Cisco HDLC ->20 lelong 113 (Linux "cooked" ->20 lelong 114 (LocalTalk ->20 lelong 117 (OpenBSD PFLOG ->20 lelong 119 (802.11 with Prism header ->20 lelong 122 (RFC 2625 IP over Fibre Channel ->20 lelong 123 (SunATM ->20 lelong 127 (802.11 with radiotap header ->20 lelong 129 (Linux ARCNET ->20 lelong 138 (Apple IP over IEEE 1394 ->20 lelong 140 (MTP2 ->20 lelong 141 (MTP3 ->20 lelong 143 (DOCSIS ->20 lelong 144 (IrDA ->20 lelong 147 (Private use 0 ->20 lelong 148 (Private use 1 ->20 lelong 149 (Private use 2 ->20 lelong 150 (Private use 3 ->20 lelong 151 (Private use 4 ->20 lelong 152 (Private use 5 ->20 lelong 153 (Private use 6 ->20 lelong 154 (Private use 7 ->20 lelong 155 (Private use 8 ->20 lelong 156 (Private use 9 ->20 lelong 157 (Private use 10 ->20 lelong 158 (Private use 11 ->20 lelong 159 (Private use 12 ->20 lelong 160 (Private use 13 ->20 lelong 161 (Private use 14 ->20 lelong 162 (Private use 15 ->20 lelong 163 (802.11 with AVS header ->16 lelong x \b, capture length %d) +>0 use \^pcap-be # # "libpcap"-with-Alexey-Kuznetsov's-patches capture files. @@ -211,43 +201,9 @@ # that use "libpcap", or that use the same capture file format.) # 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) ->4 beshort x - version %d ->6 beshort x \b.%d ->20 belong 0 (No link-layer encapsulation ->20 belong 1 (Ethernet ->20 belong 2 (3Mb Ethernet ->20 belong 3 (AX.25 ->20 belong 4 (ProNET ->20 belong 5 (CHAOS ->20 belong 6 (Token Ring ->20 belong 7 (ARCNET ->20 belong 8 (SLIP ->20 belong 9 (PPP ->20 belong 10 (FDDI ->20 belong 11 (RFC 1483 ATM ->20 belong 12 (raw IP ->20 belong 13 (BSD/OS SLIP ->20 belong 14 (BSD/OS PPP ->16 belong x \b, capture length %d) +>0 use pcap-be 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) ->4 leshort x - version %d ->6 leshort x \b.%d ->20 lelong 0 (No link-layer encapsulation ->20 lelong 1 (Ethernet ->20 lelong 2 (3Mb Ethernet ->20 lelong 3 (AX.25 ->20 lelong 4 (ProNET ->20 lelong 5 (CHAOS ->20 lelong 6 (Token Ring ->20 lelong 7 (ARCNET ->20 lelong 8 (SLIP ->20 lelong 9 (PPP ->20 lelong 10 (FDDI ->20 lelong 11 (RFC 1483 ATM ->20 lelong 12 (raw IP ->20 lelong 13 (BSD/OS SLIP ->20 lelong 14 (BSD/OS PPP ->16 lelong x \b, capture length %d) +>0 use \^pcap-be # # "pcap-ng" capture files. @@ -295,9 +251,9 @@ >8 lelong x \b, %d stations found # -# EtherPeek/AiroPeek "version 9" capture files. +# *Peek tagged capture files. # -0 string \177ver EtherPeek/AiroPeek capture file +0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file # # Visual Networks traffic capture files. --- file-5.12/magic/Magdir/sun 2011-04-07 21:20:30.000000000 +0200 +++ upstream/magic/Magdir/sun 2013-01-21 16:12:13.293952641 +0100 @@ -1,12 +1,15 @@ #------------------------------------------------------------------------------ -# $File: sun,v 1.22 2011/02/10 01:52:51 christos Exp $ +# $File: sun,v 1.24 2013/01/08 01:43:18 christos Exp $ # sun: file(1) magic for Sun machines # # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x -# releases. (5.x uses ELF.) +# releases. (5.x uses ELF.) Entries for executables without an +# architecture type, used before the 68020-based Sun-3's came out, +# are in aout, as they're indistinguishable from other big-endian +# 32-bit a.out files. # -0 belong&077777777 0600413 sparc demand paged +0 belong&077777777 0600413 a.out SunOS sparc demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable @@ -14,17 +17,17 @@ >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0600410 sparc pure +0 belong&077777777 0600410 a.out SunOS sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0600407 sparc +0 belong&077777777 0600407 a.out SunOS sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0400413 mc68020 demand paged +0 belong&077777777 0400413 a.out SunOS mc68020 demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable @@ -32,17 +35,17 @@ >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0400410 mc68020 pure +0 belong&077777777 0400410 a.out SunOS mc68020 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0400407 mc68020 +0 belong&077777777 0400407 a.out SunOS mc68020 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0200413 mc68010 demand paged +0 belong&077777777 0200413 a.out SunOS mc68010 demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable @@ -50,24 +53,16 @@ >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0200410 mc68010 pure +0 belong&077777777 0200410 a.out SunOS mc68010 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped -0 belong&077777777 0200407 mc68010 +0 belong&077777777 0200407 a.out SunOS mc68010 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped -# reworked these to avoid anything beginning with zero becoming "old sun-2" -0 belong 0407 old sun-2 executable ->16 belong >0 not stripped -0 belong 0410 old sun-2 pure executable ->16 belong >0 not stripped -0 belong 0413 old sun-2 demand paged executable ->16 belong >0 not stripped - # # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC # binary executed in compatibility mode under SunOS 5.x". @@ -96,7 +91,10 @@ # Sun SunPC 0 long 0xfa33c08e SunPC 4.0 Hard Disk 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values -# Sun snoop (see RFC 1761, which describes the capture file format). +# Sun snoop (see RFC 1761, which describes the capture file format, +# RFC 3827, which describes some additional datalink types, and +# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, +# which is the IANA registry of Snoop datalink types) # 0 string snoop Snoop capture file >8 belong >0 - version %ld @@ -109,14 +107,25 @@ >12 belong 6 (Character synchronous) >12 belong 7 (IBM channel-to-channel adapter) >12 belong 8 (FDDI) ->12 belong 9 (Unknown) - -# Microsoft ICM color profile -36 string acspMSFT Microsoft ICM Color Profile -!:mime application/vnd.iccprofile -# Sun KCMS -36 string acsp Kodak Color Management System, ICC Profile -!:mime application/vnd.iccprofile +>12 belong 9 (Other) +>12 belong 10 (type %ld) +>12 belong 11 (type %ld) +>12 belong 12 (type %ld) +>12 belong 13 (type %ld) +>12 belong 14 (type %ld) +>12 belong 15 (type %ld) +>12 belong 16 (Fibre Channel) +>12 belong 17 (ATM) +>12 belong 18 (ATM Classical IP) +>12 belong 19 (type %ld) +>12 belong 20 (type %ld) +>12 belong 21 (type %ld) +>12 belong 22 (type %ld) +>12 belong 23 (type %ld) +>12 belong 24 (type %ld) +>12 belong 25 (type %ld) +>12 belong 26 (IP over Infiniband) +>12 belong >26 (type %ld) #--------------------------------------------------------------------------- # The following entries have been tested by Duncan Laurie (a @@ -130,5 +139,3 @@ # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code # at the very end where file(1) can't get it. 0 string CRfs COBALT boot rom data (Flat boot rom or file system) - - --- file-5.12/magic/Magdir/unknown 2009-09-19 18:28:13.000000000 +0200 +++ upstream/magic/Magdir/unknown 2013-01-21 16:12:13.309952677 +0100 @@ -3,33 +3,32 @@ # $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $ # unknown: file(1) magic for unknown machines # -# XXX - this probably should be pruned, as it'll match PDP-11 and -# VAX image formats. -# -# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, -# respectively). -# -# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't -# have the "version %ld", which may be a bogus COFFism (I don't think -# there ever was COFF for the PDP-11). +# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 +# (executable, pure, and split I&D, respectively), but the PDP-11 version +# doesn't have the "version %ld", which may be a bogus COFFism (I don't +# think there was ever COFF for the PDP-11). # # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a -# long, as it would be on a VAX. -# -# 0x10C is 0414 and 0x10E is 416; those *are* unknown. -# -0 short 0x107 unknown machine executable ->8 short >0 not stripped ->15 byte >0 - version %ld -0 short 0x108 unknown pure executable ->8 short >0 not stripped ->15 byte >0 - version %ld -0 short 0x109 PDP-11 separate I&D ->8 short >0 not stripped ->15 byte >0 - version %ld -0 short 0x10b unknown pure executable ->8 short >0 not stripped ->15 byte >0 - version %ld +# long, as it would be on a VAX. In any case, that could collide with +# VAX demand-paged files, as the magic number is little-endian on those +# binaries, so the first 16 bits of the file would contain 0x10B. +# +# Therefore, those entries are commented out. +# +# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. +# +#0 short 0x107 unknown machine executable +#>8 short >0 not stripped +#>15 byte >0 - version %ld +#0 short 0x108 unknown pure executable +#>8 short >0 not stripped +#>15 byte >0 - version %ld +#0 short 0x109 PDP-11 separate I&D +#>8 short >0 not stripped +#>15 byte >0 - version %ld +#0 short 0x10b unknown pure executable +#>8 short >0 not stripped +#>15 byte >0 - version %ld 0 long 0x10c unknown demand paged pure executable >16 long >0 not stripped 0 long 0x10e unknown readable demand paged pure executable --- file-5.12/magic/Magdir/vax 2009-09-19 18:28:13.000000000 +0200 +++ upstream/magic/Magdir/vax 2013-01-21 16:12:13.321452648 +0100 @@ -7,24 +7,16 @@ 0 lelong 0101556 VAX double precision APL workspace # -# VAX a.out (32V, BSD) +# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian +# executables, and are handled in aout) # -0 lelong 0407 VAX executable ->16 lelong >0 not stripped - -0 lelong 0410 VAX pure executable ->16 lelong >0 not stripped - -0 lelong 0413 VAX demand paged pure executable ->16 lelong >0 not stripped - -0 lelong 0420 VAX demand paged (first page unmapped) pure executable +0 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable >16 lelong >0 not stripped # # VAX COFF # -# The `versions' should be un-commented if they work for you. +# The `versions' were commented out, but have been un-commented out. # (Was the problem just one of endianness?) # 0 leshort 0570 VAX COFF executable --- file-5.12/magic/Magdir/xilinx 2009-09-19 18:28:13.000000000 +0200 +++ upstream/magic/Magdir/xilinx 2013-01-21 16:12:13.353452562 +0100 @@ -33,3 +33,6 @@ >>>>>>>>&1 byte 0x00 >>>>>>>>&2 string e >>>>>>>>&4 belong x - data length 0x%lx +# Raw bitstream files +0 long 0xffffffff +>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) --- file-5.12/magic/Makefile.am 2013-01-03 17:00:42.000000000 +0100 +++ upstream/magic/Makefile.am 2013-01-21 16:12:13.373487615 +0100 @@ -1,5 +1,5 @@ # -# $File: Makefile.am,v 1.85 2013/01/03 16:00:42 christos Exp $ +# $File: Makefile.am,v 1.87 2013/01/09 22:37:38 christos Exp $ # MAGIC_FRAGMENT_BASE = Magdir MAGIC_DIR = $(top_srcdir)/magic @@ -18,6 +18,7 @@ $(MAGIC_FRAGMENT_DIR)/alliant \ $(MAGIC_FRAGMENT_DIR)/amanda \ $(MAGIC_FRAGMENT_DIR)/amigaos \ $(MAGIC_FRAGMENT_DIR)/animation \ +$(MAGIC_FRAGMENT_DIR)/aout \ $(MAGIC_FRAGMENT_DIR)/apl \ $(MAGIC_FRAGMENT_DIR)/apple \ $(MAGIC_FRAGMENT_DIR)/applix \ @@ -85,7 +86,7 @@ $(MAGIC_FRAGMENT_DIR)/gcc \ $(MAGIC_FRAGMENT_DIR)/geo \ $(MAGIC_FRAGMENT_DIR)/geos \ $(MAGIC_FRAGMENT_DIR)/gimp \ -$(MAGIC_FRAGMENT_DIR)/gnome-keyring \ +$(MAGIC_FRAGMENT_DIR)/gnome \ $(MAGIC_FRAGMENT_DIR)/gnu \ $(MAGIC_FRAGMENT_DIR)/gnumeric \ $(MAGIC_FRAGMENT_DIR)/grace \ @@ -97,6 +98,7 @@ $(MAGIC_FRAGMENT_DIR)/hp \ $(MAGIC_FRAGMENT_DIR)/human68k \ $(MAGIC_FRAGMENT_DIR)/ibm370 \ $(MAGIC_FRAGMENT_DIR)/ibm6000 \ +$(MAGIC_FRAGMENT_DIR)/icc \ $(MAGIC_FRAGMENT_DIR)/iff \ $(MAGIC_FRAGMENT_DIR)/images \ $(MAGIC_FRAGMENT_DIR)/inform \ --- file-5.12/src/BNF 1970-01-01 01:00:00.000000000 +0100 +++ upstream/src/BNF 2013-01-21 16:12:13.433451925 +0100 @@ -0,0 +1,151 @@ +This is a first attempt to document the grammar used by magic(5), with +hopes of eventually incorporating something like this into the manpage. + +Note: Currently, the parser varies slightly from this, but only in +very minor ways, e.g., the strflags maybe separated by '/' characters +and at most one strcount is allowed; likewise for regflags. + +------------------------------------------------------------------------ +magic = 1*query + +query = line *( 1*level line ) + +level = ">" ;; Increment the level by 1. + ;; The first line of a query is at level 0. + +line = offset HWS type HWS test HWS message EOL + +------------------------------------------------------------------------ +offset = absoffset | reloffset | indoffset + ;; The offset in the file at which to apply + ;; the . + +absoffset = NUMBER ;; An absolute offset from the start of the file. + +reloffset = "&" NUMBER ;; The offset relative to the last match offset + ;; at one level up. + ;; Not allowed at level == 0. + +indoffset = indoff | relindoff + +indoff = "(" offset1 [ "." size ] [ op disp ] ")" + ;; Read the file at of width . + ;; If size is not specified, assume a long. + ;; If is given, then preform that + ;; operation on the result and the . + +offset1 = absoffset | reloffset + +size = byte | leshort | beshort | lelong | belong | melong + +byte = "B" | "b" | "C" | "c" ;; A one-byte value. +leshort = "s" | "h" ;; A two-byte little-endian value. +beshort = "S" | "H" ;; A two-byte big-endian value. +lelong = "l" ;; A four-byte little-endian value. +belong = "L" ;; A four-byte big-endian value. +melong = "m" ;; A four-byte middle-endian value. + +op = [ invert ] ( "+" | "-" | "*" | "/" | "%" | "&" | "|" | "^" ) + +invert = "~" ;; Flip the bits on result of the . + +disp = NUMBER | memvalue + +memvalue = "(" NUMBER ")" + ;; NUMBER is interpreted as an absolute or + ;; relative offset matching that of . + ;; Read the file at the resulting offset with + ;; the same size as + +relindoff = "&" indoff ;; add to the last match offset at + ;; one level up. + +------------------------------------------------------------------------ +type = [ unsigned ] ( numeric | strtype | default ) + +unsigned = "u" ;; The value is unsigned. + ;; This affects the sign extension of numeric + ;; types and the '<' and '>' compares. It is + ;; intended for numeric types, but allowed on + ;; all types. + +numeric = ( numtype | datatype ) [ nummask ] + +numtype = byte | short | long | quad + +byte = "byte" +short = "short" | "beshort" | "leshort" +long = "long" | "lelong" | "belong" | "melong" +quad = "quad" | "lequad" | "bequad" + +datetype = udate32 | ldate32 | udate64 | ldate64 + +udate32 = "date" | "bedate" | "ledate" | "medate" ;; UTC dates +ldate32 = "ldate" | "beldate" | "leldate" | "meldate" ;; local dates +udate64 = "qdate" | "leqdate" | "beqdate" ;; UTC dates +ldate64 = "qldate" | "leqldate" | "beqldate" ;; local dates + +nummask = op NUMBER + +strtype = regex | search | string8 | string16 + +regex = "regex" [ "/" 1*regflag ] + +regflag = "c" | "s" | linecnt + +linecnt = NUMBER ;; The number of lines to search. If this + ;; is missing or zero, the rest of the + ;; file is searched. + +search = "string" [ "/" 1*srchflag ] + +srchflag = strflag | srchcnt + +srchcnt = NUMBER ;; The number of search tries. If this + ;; is missing or zero, the rest of the + ;; file is searched. + +string8 = ( "string" | "pstring" ) [ "/" 1*strflag ] + +strflag = "b" | "B" | "c" | "C" + +string16 = "bestring16" | "lestring16" + +default = "default" ;; This is intended to be used with the + ;; ("x" below). It is matched if + ;; there has been no previous match at its + ;; level or none since the last default at + ;; that level. It is useful for implementing + ;; switch-like and if/else constructions. + +------------------------------------------------------------------------ +test = numtest | strtest | truetest + ;; Test to preform on read from file. + +numtest = [ compare ] NUMBER ;; If compare is missing, "=" is assumed. + +strtest = [ compare ] STRING ;; If compare is missing, "=" is assumed. + ;; Note: If the STRING begins with a + ;; character, the field cannot be + ;; omitted. + +compare = "=" | "!" | "<" | ">" | "&" | "^" + +truetest = "x" ;; This always returns true. + ;; To test for the string "x" use "=x". + +------------------------------------------------------------------------ +message = [ nospflag ] ( STRING | FMT_STRING ) + ;; Message to print if test result is true. + +nospflag = %x08 | "\\b" ;; Do not insert a space before the message. + ;; By default, messages are separated by a " ". + +------------------------------------------------------------------------ +HWS = +EOL = +NUMBER = +STRING = +FMTSTR = + +------------------------------------------------------------------------ --- file-5.12/src/Makefile.am 2012-06-21 00:16:32.000000000 +0200 +++ upstream/src/Makefile.am 2013-01-21 16:12:13.433451925 +0100 @@ -21,3 +21,9 @@ libmagic_la_LIBADD = $(LTLIBOBJS) $(MING file_SOURCES = file.c file_LDADD = libmagic.la +CLEANFILES = magic.h +HDR= $(top_srcdir)/src/magic.h.in +BUILT_SOURCES = magic.h + +magic.h: ${HDR} + sed -e "s/X.YY/$$(echo @VERSION@ | tr -d .)/" < ${HDR} > $@ --- file-5.12/src/apprentice.c 2013-01-04 01:47:35.000000000 +0100 +++ upstream/src/apprentice.c 2013-01-21 16:12:13.433451925 +0100 @@ -32,7 +32,7 @@ #include "file.h" #ifndef lint -FILE_RCSID("@(#)$File: apprentice.c,v 1.181 2013/01/03 23:11:38 christos Exp $") +FILE_RCSID("@(#)$File: apprentice.c,v 1.188 2013/01/09 15:36:55 christos Exp $") #endif /* lint */ #include "magic.h" @@ -80,6 +80,13 @@ struct magic_entry { uint32_t max_count; }; +struct magic_map { + void *p; + size_t len; + struct magic *magic[MAGIC_SETS]; + uint32_t nmagic[MAGIC_SETS]; +}; + int file_formats[FILE_NAMES_SIZE]; const size_t file_nformats = FILE_NAMES_SIZE; const char *file_names[FILE_NAMES_SIZE]; @@ -96,7 +103,7 @@ private int apprentice_1(struct magic_se private size_t apprentice_magic_strength(const struct magic *); private int apprentice_sort(const void *, const void *); private void apprentice_list(struct mlist *, int ); -private int apprentice_load(struct magic_set *, struct magic **, uint32_t *, +private struct magic_map *apprentice_load(struct magic_set *, const char *, int); private struct mlist *mlist_alloc(void); private void mlist_free(struct mlist *); @@ -106,9 +113,9 @@ private uint16_t swap2(uint16_t); private uint32_t swap4(uint32_t); private uint64_t swap8(uint64_t); private char *mkdbname(struct magic_set *, const char *, int); -private int apprentice_map(struct magic_set *, struct magic **, uint32_t *, - const char *); -private int apprentice_compile(struct magic_set *, struct magic **, uint32_t *, +private struct magic_map *apprentice_map(struct magic_set *, const char *); +private void apprentice_unmap(struct magic_map *); +private int apprentice_compile(struct magic_set *, struct magic_map *, const char *); private int check_format_type(const char *, int); private int check_format(struct magic_set *, struct magic *); @@ -169,12 +176,21 @@ main(int argc, char *argv[]) } #endif /* COMPILE_ONLY */ -static const struct type_tbl_s { +struct type_tbl_s { const char name[16]; const size_t len; const int type; const int format; -} type_tbl[] = { +}; + +/* + * XXX - the actual Single UNIX Specification says that "long" means "long", + * as in the C data type, but we treat it as meaning "4-byte integer". + * Given that the OS X version of file 5.04 did the same, I guess that passes + * the actual test; having "long" be dependent on how big a "long" is on + * the machine running "file" is silly. + */ +static const struct type_tbl_s type_tbl[] = { # define XX(s) s, (sizeof(s) - 1) # define XX_NULL "", 0 { XX("byte"), FILE_BYTE, FILE_FMT_NUM }, @@ -221,19 +237,27 @@ static const struct type_tbl_s { { XX("qwdate"), FILE_QWDATE, FILE_FMT_STR }, { XX("leqwdate"), FILE_LEQWDATE, FILE_FMT_STR }, { XX("beqwdate"), FILE_BEQWDATE, FILE_FMT_STR }, + { XX_NULL, FILE_INVALID, FILE_FMT_NONE }, +}; + +/* + * These are not types, and cannot be preceded by "u" to make them + * unsigned. + */ +static const struct type_tbl_s special_tbl[] = { { XX("name"), FILE_NAME, FILE_FMT_STR }, { XX("use"), FILE_USE, FILE_FMT_STR }, { XX_NULL, FILE_INVALID, FILE_FMT_NONE }, +}; # undef XX # undef XX_NULL -}; private int -get_type(const char *l, const char **t) +get_type(const struct type_tbl_s *tbl, const char *l, const char **t) { const struct type_tbl_s *p; - for (p = type_tbl; p->len; p++) { + for (p = tbl; p->len; p++) { if (strncmp(l, p->name, p->len) == 0) { if (t) *t = l + p->len; @@ -243,6 +267,91 @@ get_type(const char *l, const char **t) return p->type; } +private int +get_standard_integer_type(const char *l, const char **t) +{ + int type; + + if (isalpha((unsigned char)l[1])) { + switch (l[1]) { + case 'C': + /* "dC" and "uC" */ + type = FILE_BYTE; + break; + case 'S': + /* "dS" and "uS" */ + type = FILE_SHORT; + break; + case 'I': + case 'L': + /* + * "dI", "dL", "uI", and "uL". + * + * XXX - the actual Single UNIX Specification says + * that "L" means "long", as in the C data type, + * but we treat it as meaning "4-byte integer". + * Given that the OS X version of file 5.04 did + * the same, I guess that passes the actual SUS + * validation suite; having "dL" be dependent on + * how big a "long" is on the machine running + * "file" is silly. + */ + type = FILE_LONG; + break; + case 'Q': + /* "dQ" and "uQ" */ + type = FILE_QUAD; + break; + default: + /* "d{anything else}", "u{anything else}" */ + return FILE_INVALID; + } + l += 2; + } else if (isdigit((unsigned char)l[1])) { + /* + * "d{num}" and "u{num}"; we only support {num} values + * of 1, 2, 4, and 8 - the Single UNIX Specification + * doesn't say anything about whether arbitrary + * values should be supported, but both the Solaris 10 + * and OS X Mountain Lion versions of file passed the + * Single UNIX Specification validation suite, and + * neither of them support values bigger than 8 or + * non-power-of-2 values. + */ + if (isdigit((unsigned char)l[2])) { + /* Multi-digit, so > 9 */ + return FILE_INVALID; + } + switch (l[1]) { + case '1': + type = FILE_BYTE; + break; + case '2': + type = FILE_SHORT; + break; + case '4': + type = FILE_LONG; + break; + case '8': + type = FILE_QUAD; + break; + default: + /* XXX - what about 3, 5, 6, or 7? */ + return FILE_INVALID; + } + l += 2; + } else { + /* + * "d" or "u" by itself. + */ + type = FILE_LONG; + ++l; + } + if (t) + *t = l; + return type; +} + private void init_file_tables(void) { @@ -261,16 +370,16 @@ init_file_tables(void) } private int -add_mlist(struct mlist *mlp, struct magic *magic, uint32_t nmagic, int mapped) +add_mlist(struct mlist *mlp, struct magic_map *map, size_t idx) { struct mlist *ml; if ((ml = CAST(struct mlist *, malloc(sizeof(*ml)))) == NULL) return -1; - ml->magic = magic; - ml->nmagic = nmagic; - ml->mapped = mapped; + ml->map = idx == 0 ? map : NULL; + ml->magic = map->magic[idx]; + ml->nmagic = map->nmagic[idx]; mlp->prev->next = ml; ml->prev = mlp->prev; @@ -285,49 +394,38 @@ add_mlist(struct mlist *mlp, struct magi private int apprentice_1(struct magic_set *ms, const char *fn, int action) { - struct magic *magic[MAGIC_SETS] = { NULL }; - uint32_t nmagic[MAGIC_SETS] = { 0 }; struct mlist *ml; - int rv = -1; - int mapped; + struct magic_map *map; size_t i; if (magicsize != FILE_MAGICSIZE) { file_error(ms, 0, "magic element size %lu != %lu", - (unsigned long)sizeof(*magic[0]), + (unsigned long)sizeof(*map->magic[0]), (unsigned long)FILE_MAGICSIZE); return -1; } if (action == FILE_COMPILE) { - rv = apprentice_load(ms, magic, nmagic, fn, action); - if (rv != 0) + map = apprentice_load(ms, fn, action); + if (map == NULL) return -1; - rv = apprentice_compile(ms, magic, nmagic, fn); - return rv; + return apprentice_compile(ms, map, fn); } #ifndef COMPILE_ONLY - if ((rv = apprentice_map(ms, magic, nmagic, fn)) < 0) { - if (rv == -2) - return -1; + map = apprentice_map(ms, fn); + if (map == NULL) { if (ms->flags & MAGIC_CHECK) file_magwarn(ms, "using regular magic file `%s'", fn); - rv = apprentice_load(ms, magic, nmagic, fn, action); - if (rv != 0) + map = apprentice_load(ms, fn, action); + if (map == NULL) return -1; } - mapped = rv; - for (i = 0; i < MAGIC_SETS; i++) { - if (magic[i] == NULL) - continue; - if (add_mlist(ms->mlist[i], magic[i], nmagic[i], mapped) == -1) - { - i = i == 1 ? 0 : 1; - file_delmagic(magic[i], mapped, nmagic[i]); + if (add_mlist(ms->mlist[i], map, i) == -1) { file_oomem(ms, sizeof(*ml)); + apprentice_unmap(map); return -1; } } @@ -392,38 +490,27 @@ free: return NULL; } -protected void -file_delmagic(struct magic *p, int type, size_t entries) +private void +apprentice_unmap(struct magic_map *map) { - if (p == NULL) + if (map == NULL) + return; + if (map->p == NULL) return; - switch (type) { - case 2: #ifdef QUICK - p--; - (void)munmap((void *)p, sizeof(*p) * (entries + 1)); - break; -#else - (void)&entries; - abort(); - /*NOTREACHED*/ + if (map->len) + (void)munmap(map->p, map->len); + else #endif - case 1: - p--; - /*FALLTHROUGH*/ - case 0: - free(p); - break; - default: - abort(); - } + free(map->p); + free(map); } private struct mlist * mlist_alloc(void) { struct mlist *mlist; - if ((mlist = CAST(struct mlist *, malloc(sizeof(*mlist)))) == NULL) { + if ((mlist = CAST(struct mlist *, calloc(1, sizeof(*mlist)))) == NULL) { return NULL; } mlist->next = mlist->prev = mlist; @@ -440,8 +527,8 @@ mlist_free(struct mlist *mlist) for (ml = mlist->next; ml != mlist;) { struct mlist *next = ml->next; - struct magic *mg = ml->magic; - file_delmagic(mg, ml->mapped, ml->nmagic); + if (ml->map) + apprentice_unmap(ml->map); free(ml); ml = next; } @@ -500,7 +587,7 @@ file_apprentice(struct magic_set *ms, co mlist_free(ms->mlist[i]); ms->mlist[i] = NULL; } - file_error(ms, 0, "could not find any magic files!"); + file_error(ms, 0, "could not find any valid magic files!"); return -1; } @@ -1015,9 +1102,8 @@ magic_entry_free(struct magic_entry *me, free(me); } -private int -apprentice_load(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, - const char *fn, int action) +private struct magic_map * +apprentice_load(struct magic_set *ms, const char *fn, int action) { int errs = 0; struct magic_entry *mentry[MAGIC_SETS] = { NULL }; @@ -1026,11 +1112,17 @@ apprentice_load(struct magic_set *ms, st size_t files = 0, maxfiles = 0; char **filearr = NULL, *mfn; struct stat st; + struct magic_map *map; DIR *dir; struct dirent *d; ms->flags |= MAGIC_CHECK; /* Enable checks for parsed files */ + if ((map = CAST(struct magic_map *, calloc(1, sizeof(*map)))) == NULL) { + file_oomem(ms, sizeof(*map)); + return NULL; + } + /* print silly verbose header for USG compat. */ if (action == FILE_CHECK) (void)fprintf(stderr, "%s\n", usg_hdr); @@ -1102,7 +1194,7 @@ apprentice_load(struct magic_set *ms, st /* coalesce per file arrays into a single one */ if (coalesce_entries(ms, mentry[j], mentrycount[j], - &magicp[j], &nmagicp[j]) == -1) { + &map->magic[j], &map->nmagic[j]) == -1) { errs++; goto out; } @@ -1114,15 +1206,13 @@ out: if (errs) { for (j = 0; j < MAGIC_SETS; j++) { - if (magicp[j]) { - free(magicp[j]); - magicp[j] = NULL; - } - nmagicp[j] = 0; + if (map->magic[j]) + free(map->magic[j]); } - return errs; + free(map); + return NULL; } - return 0; + return map; } /* @@ -1371,9 +1461,13 @@ parse(struct magic_set *ms, struct magic char *t; int op; uint32_t cont_level; + int32_t diff; cont_level = 0; + /* + * Parse the offset. + */ while (*l == '>') { ++l; /* step over */ cont_level++; @@ -1386,9 +1480,19 @@ parse(struct magic_set *ms, struct magic #endif if (cont_level != 0) { if (me->mp == NULL) { - file_error(ms, 0, "No current entry for continuation"); + file_magerror(ms, "No current entry for continuation"); return -1; } + if (me->cont_count == 0) { + file_magerror(ms, "Continuations present with 0 count"); + return -1; + } + m = &me->mp[me->cont_count - 1]; + diff = (int32_t)cont_level - (int32_t)m->cont_level; + if (diff > 1) + file_magwarn(ms, "New continuation level %u is more " + "than one larger than current level %u", cont_level, + m->cont_level); if (me->cont_count == me->max_count) { struct magic *nm; size_t cnt = me->max_count + ALLOC_CHUNK; @@ -1542,12 +1646,52 @@ parse(struct magic_set *ms, struct magic EATAB; #endif - if (*l == 'u' && (l[1] != 's' || l[2] != 'e')) { - ++l; + /* + * Parse the type. + */ + if (*l == 'u') { + /* + * Try it as a keyword type prefixed by "u"; match what + * follows the "u". If that fails, try it as an SUS + * integer type. In either case, it's unsigned. + */ m->flag |= UNSIGNED; + m->type = get_type(type_tbl, l + 1, &l); + if (m->type == FILE_INVALID) { + /* + * Not a keyword type; parse it as an SUS type, + * 'u' possibly followed by a number or C/S/L. + */ + m->type = get_standard_integer_type(l, &l); + } + } else { + /* + * Try it as a keyword type. If that fails, try it as + * an SUS integer type if it begins with "d" or as an + * SUS string type if it begins with "s". In any case, + * it's not unsigned. + */ + m->type = get_type(type_tbl, l, &l); + if (m->type == FILE_INVALID) { + /* + * Not a keyword type; parse it as an SUS type, + * either 'd' possibly followed by a number or + * C/S/L, or just 's'. + */ + if (*l == 'd') + m->type = get_standard_integer_type(l, &l); + else if (*l == 's' && !isalpha((unsigned char)l[1])) { + m->type = FILE_STRING; + ++l; + } + } } - m->type = get_type(l, &l); + if (m->type == FILE_INVALID) { + /* Not found - try it as a special keyword. */ + m->type = get_type(special_tbl, l, &l); + } + if (m->type == FILE_INVALID) { if (ms->flags & MAGIC_CHECK) file_magwarn(ms, "type `%s' invalid", l); @@ -2397,61 +2541,67 @@ eatsize(const char **p) /* * handle a compiled file. */ -private int -apprentice_map(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, - const char *fn) + +private struct magic_map * +apprentice_map(struct magic_set *ms, const char *fn) { - int fd, ret; + int fd; struct stat st; uint32_t *ptr; uint32_t version, entries, nentries; int needsbyteswap; char *dbname = NULL; - void *mm = NULL; + struct magic_map *map; size_t i; - ret = -1; + fd = -1; + if ((map = CAST(struct magic_map *, calloc(1, sizeof(*map)))) == NULL) { + file_oomem(ms, sizeof(*map)); + goto error; + } + dbname = mkdbname(ms, fn, 0); if (dbname == NULL) - goto error2; + goto error; if ((fd = open(dbname, O_RDONLY|O_BINARY)) == -1) - goto error2; + goto error; if (fstat(fd, &st) == -1) { file_error(ms, errno, "cannot stat `%s'", dbname); - goto error1; + goto error; } if (st.st_size < 8) { file_error(ms, 0, "file `%s' is too small", dbname); - goto error1; + goto error; } + map->len = (size_t)st.st_size; #ifdef QUICK - if ((mm = mmap(0, (size_t)st.st_size, PROT_READ|PROT_WRITE, + if ((map->p = mmap(0, (size_t)st.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FILE, fd, (off_t)0)) == MAP_FAILED) { file_error(ms, errno, "cannot map `%s'", dbname); - goto error1; + goto error; } -#define RET 2 #else - if ((mm = CAST(void *, malloc((size_t)st.st_size))) == NULL) { - file_oomem(ms, (size_t)st.st_size); - goto error1; + if ((map->p = CAST(void *, malloc(map->len))) == NULL) { + file_oomem(ms, map->len); + goto error; } - if (read(fd, mm, (size_t)st.st_size) != (ssize_t)st.st_size) { + if (read(fd, map->p, map->len) != (ssize_t)map->len) { file_badread(ms); - goto error1; + goto error; } + map->len = 0; #define RET 1 #endif (void)close(fd); fd = -1; - ptr = CAST(uint32_t *, mm); + ptr = CAST(uint32_t *, map->p); if (*ptr != MAGICNO) { if (swap4(*ptr) != MAGICNO) { file_error(ms, 0, "bad magic in `%s'", dbname); - goto error1; + goto error; } needsbyteswap = 1; } else @@ -2460,74 +2610,63 @@ apprentice_map(struct magic_set *ms, str version = swap4(ptr[1]); else version = ptr[1]; - ret = -2; if (version != VERSIONNO) { file_error(ms, 0, "File %s supports only version %d magic " "files. `%s' is version %d", VERSION, VERSIONNO, dbname, version); - goto error1; + goto error; } entries = (uint32_t)(st.st_size / sizeof(struct magic)); if ((off_t)(entries * sizeof(struct magic)) != st.st_size) { file_error(ms, 0, "Size of `%s' %llu is not a multiple of %zu", dbname, (unsigned long long)st.st_size, sizeof(struct magic)); - goto error1; + goto error; } - magicp[0] = CAST(struct magic *, mm) + 1; + map->magic[0] = CAST(struct magic *, map->p) + 1; nentries = 0; for (i = 0; i < MAGIC_SETS; i++) { if (needsbyteswap) - nmagicp[i] = swap4(ptr[i + 2]); + map->nmagic[i] = swap4(ptr[i + 2]); else - nmagicp[i] = ptr[i + 2]; + map->nmagic[i] = ptr[i + 2]; if (i != MAGIC_SETS - 1) - magicp[i + 1] = magicp[i] + nmagicp[i]; - nentries += nmagicp[i]; + map->magic[i + 1] = map->magic[i] + map->nmagic[i]; + nentries += map->nmagic[i]; } if (entries != nentries + 1) { file_error(ms, 0, "Inconsistent entries in `%s' %u != %u", dbname, entries, nentries + 1); - goto error1; + goto error; } if (needsbyteswap) for (i = 0; i < MAGIC_SETS; i++) - byteswap(magicp[i], nmagicp[i]); + byteswap(map->magic[i], map->nmagic[i]); free(dbname); - return RET; + return map; -error1: +error: if (fd != -1) (void)close(fd); - if (mm) { -#ifdef QUICK - (void)munmap((void *)mm, (size_t)st.st_size); -#else - free(mm); -#endif - } else { - for (i = 0; i < MAGIC_SETS; i++) { - magicp[i] = NULL; - nmagicp[i] = 0; - } - } -error2: + apprentice_unmap(map); free(dbname); - return ret; + return NULL; } private const uint32_t ar[] = { MAGICNO, VERSIONNO }; + /* * handle an mmaped file. */ private int -apprentice_compile(struct magic_set *ms, struct magic **magicp, - uint32_t *nmagicp, const char *fn) +apprentice_compile(struct magic_set *ms, struct magic_map *map, const char *fn) { - static size_t nm = sizeof(*nmagicp) * MAGIC_SETS; + static const size_t nm = sizeof(*map->nmagic) * MAGIC_SETS; + static const size_t m = sizeof(**map->magic); int fd = -1; + size_t len; char *dbname; int rv = -1; uint32_t i; @@ -2548,24 +2687,23 @@ apprentice_compile(struct magic_set *ms, goto out; } - if (write(fd, nmagicp, nm) != (ssize_t)nm) { + if (write(fd, map->nmagic, nm) != (ssize_t)nm) { file_error(ms, errno, "error writing `%s'", dbname); goto out; } - assert(nm + sizeof(ar) < sizeof(struct magic)); + assert(nm + sizeof(ar) < m); - if (lseek(fd, (off_t)sizeof(struct magic), SEEK_SET) - != sizeof(struct magic)) { + if (lseek(fd, (off_t)m, SEEK_SET) != (off_t)m) { file_error(ms, errno, "error seeking `%s'", dbname); goto out; } for (i = 0; i < MAGIC_SETS; i++) { - if (write(fd, magicp[i], (sizeof(struct magic) * nmagicp[i])) - != (ssize_t)(sizeof(struct magic) * nmagicp[i])) { - file_error(ms, errno, "error writing `%s'", dbname); - goto out; + len = m * map->nmagic[i]; + if (write(fd, map->magic[i], len) != (ssize_t)len) { + file_error(ms, errno, "error writing `%s'", dbname); + goto out; } } @@ -2607,14 +2745,16 @@ mkdbname(struct magic_set *ms, const cha q++; /* Compatibility with old code that looked in .mime */ if (ms->flags & MAGIC_MIME) { - asprintf(&buf, "%.*s.mime%s", (int)(q - fn), fn, ext); + if (asprintf(&buf, "%.*s.mime%s", (int)(q - fn), fn, ext) < 0) + return NULL; if (access(buf, R_OK) != -1) { ms->flags &= MAGIC_MIME_TYPE; return buf; } free(buf); } - asprintf(&buf, "%.*s%s", (int)(q - fn), fn, ext); + if (asprintf(&buf, "%.*s%s", (int)(q - fn), fn, ext) < 0) + return NULL; /* Compatibility with old code that looked in .mime */ if (strstr(p, ".mime") != NULL) --- file-5.12/src/cdf.mk 1970-01-01 01:00:00.000000000 +0100 +++ upstream/src/cdf.mk 2013-01-21 16:12:13.449452152 +0100 @@ -0,0 +1,3 @@ +CFLAGS+=-DTEST -DCDF_DEBUG -g -DHAVE_CONFIG_H -I.. +cdf: cdf.o cdf_time.o + ${CC} ${CFLAGS} -o $@ $> --- file-5.12/src/file.c 2012-11-21 17:27:39.000000000 +0100 +++ upstream/src/file.c 2013-01-21 16:12:13.453452572 +0100 @@ -276,6 +276,11 @@ main(int argc, char *argv[]) if (e) return e; + if (MAGIC_VERSION != magic_version()) + (void)fprintf(stderr, "%s: compiled magic version [%d] " + "does not match with shared library magic version [%d]\n", + progname, MAGIC_VERSION, magic_version()); + switch(action) { case FILE_CHECK: case FILE_COMPILE: --- file-5.12/src/file.h 2012-10-31 19:31:28.000000000 +0100 +++ upstream/src/file.h 2013-01-21 16:12:13.453452572 +0100 @@ -346,10 +346,8 @@ struct magic { /* list of magic entries */ struct mlist { struct magic *magic; /* array of magic entries */ - uint32_t nmagic; /* number of entries in array */ - int mapped; /* allocation type: 0 => apprentice_file - * 1 => apprentice_map + malloc - * 2 => apprentice_map + mmap */ + uint32_t nmagic; /* number of entries in array */ + void *map; /* internal resources used by entry */ struct mlist *next, *prev; }; @@ -444,7 +442,6 @@ protected int file_apprentice(struct mag protected int file_magicfind(struct magic_set *, const char *, struct mlist *); protected uint64_t file_signextend(struct magic_set *, struct magic *, uint64_t); -protected void file_delmagic(struct magic *, int type, size_t entries); protected void file_badread(struct magic_set *); protected void file_badseek(struct magic_set *); protected void file_oomem(struct magic_set *, size_t); --- file-5.12/src/fsmagic.c 2012-09-06 16:16:05.000000000 +0200 +++ upstream/src/fsmagic.c 2013-01-21 16:12:13.453452572 +0100 @@ -98,7 +98,7 @@ handle_mime(struct magic_set *ms, int mi protected int file_fsmagic(struct magic_set *ms, const char *fn, struct stat *sb) { - int ret = 0, did = 0; + int ret, did = 0; int mime = ms->flags & MAGIC_MIME; #ifdef S_IFLNK char buf[BUFSIZ+4]; @@ -135,6 +135,7 @@ file_fsmagic(struct magic_set *ms, const return -1; } + ret = 1; if (!mime) { #ifdef S_ISUID if (sb->st_mode & S_ISUID) @@ -160,7 +161,7 @@ file_fsmagic(struct magic_set *ms, const return -1; } else if (file_printf(ms, "%sdirectory", COMMA) == -1) return -1; - return 1; + break; #ifdef S_IFCHR case S_IFCHR: /* @@ -191,7 +192,7 @@ file_fsmagic(struct magic_set *ms, const return -1; #endif } - return 1; + break; #endif #ifdef S_IFBLK case S_IFBLK: @@ -223,7 +224,7 @@ file_fsmagic(struct magic_set *ms, const return -1; #endif } - return 1; + break; #endif /* TODO add code to handle V7 MUX and Blit MUX files */ #ifdef S_IFIFO @@ -235,7 +236,7 @@ file_fsmagic(struct magic_set *ms, const return -1; } else if (file_printf(ms, "%sfifo (named pipe)", COMMA) == -1) return -1; - return 1; + break; #endif #ifdef S_IFDOOR case S_IFDOOR: @@ -244,7 +245,7 @@ file_fsmagic(struct magic_set *ms, const return -1; } else if (file_printf(ms, "%sdoor", COMMA) == -1) return -1; - return 1; + break; #endif #ifdef S_IFLNK case S_IFLNK: @@ -261,7 +262,7 @@ file_fsmagic(struct magic_set *ms, const "%sunreadable symlink `%s' (%s)", COMMA, fn, strerror(errno)) == -1) return -1; - return 1; + break; } buf[nch] = '\0'; /* readlink(2) does not do this */ @@ -290,7 +291,7 @@ file_fsmagic(struct magic_set *ms, const "%spath too long: `%s'", COMMA, fn) == -1) return -1; - return 1; + break; } /* take dir part */ (void)strlcpy(buf2, fn, sizeof buf2); @@ -309,7 +310,8 @@ file_fsmagic(struct magic_set *ms, const ms->flags &= MAGIC_SYMLINK; p = magic_file(ms, buf); ms->flags |= MAGIC_SYMLINK; - return p != NULL ? 1 : -1; + if (p == NULL) + return -1; } else { /* just print what it points to */ if (mime) { if (handle_mime(ms, mime, "symlink") == -1) @@ -318,7 +320,7 @@ file_fsmagic(struct magic_set *ms, const COMMA, buf) == -1) return -1; } - return 1; + break; #endif #ifdef S_IFSOCK #ifndef __COHERENT__ @@ -328,36 +330,42 @@ file_fsmagic(struct magic_set *ms, const return -1; } else if (file_printf(ms, "%ssocket", COMMA) == -1) return -1; - return 1; + break; #endif #endif case S_IFREG: + /* + * regular file, check next possibility + * + * If stat() tells us the file has zero length, report here that + * the file is empty, so we can skip all the work of opening and + * reading the file. + * But if the -s option has been given, we skip this + * optimization, since on some systems, stat() reports zero + * size for raw disk partitions. (If the block special device + * really has zero length, the fact that it is empty will be + * detected and reported correctly when we read the file.) + */ + if ((ms->flags & MAGIC_DEVICES) == 0 && sb->st_size == 0) { + if (mime) { + if (handle_mime(ms, mime, "x-empty") == -1) + return -1; + } else if (file_printf(ms, "%sempty", COMMA) == -1) + return -1; + break; + } + ret = 0; break; + default: file_error(ms, 0, "invalid mode 0%o", sb->st_mode); return -1; /*NOTREACHED*/ } - /* - * regular file, check next possibility - * - * If stat() tells us the file has zero length, report here that - * the file is empty, so we can skip all the work of opening and - * reading the file. - * But if the -s option has been given, we skip this optimization, - * since on some systems, stat() reports zero size for raw disk - * partitions. (If the block special device really has zero length, - * the fact that it is empty will be detected and reported correctly - * when we read the file.) - */ - if ((ms->flags & MAGIC_DEVICES) == 0 && sb->st_size == 0) { - if (mime) { - if (handle_mime(ms, mime, "x-empty") == -1) - return -1; - } else if (file_printf(ms, "%sempty", COMMA) == -1) - return -1; - return 1; + if (!mime && did) { + if (file_printf(ms, " ") == -1) + return -1; } - return 0; + return ret; } --- file-5.12/src/getline.c 2012-06-21 00:18:33.000000000 +0200 +++ upstream/src/getline.c 2013-01-21 16:12:13.457452763 +0100 @@ -37,7 +37,7 @@ #include #include -ssize_t +public ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) { char *ptr, *eptr; --- file-5.12/src/magic.c 2012-10-31 19:31:28.000000000 +0100 +++ upstream/src/magic.c 2013-01-21 16:12:13.457452763 +0100 @@ -477,3 +477,9 @@ magic_setflags(struct magic_set *ms, int ms->flags = flags; return 0; } + +public int +magic_version(void) +{ + return MAGIC_VERSION; +} --- file-5.12/src/magic.h.in 1970-01-01 01:00:00.000000000 +0100 +++ upstream/src/magic.h.in 2013-01-21 16:12:13.457452763 +0100 @@ -0,0 +1,107 @@ +/* + * Copyright (c) Christos Zoulas 2003. + * All Rights Reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice immediately at the beginning of the file, without modification, + * this list of conditions, and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ +#ifndef _MAGIC_H +#define _MAGIC_H + +#include + +#define MAGIC_NONE 0x000000 /* No flags */ +#define MAGIC_DEBUG 0x000001 /* Turn on debugging */ +#define MAGIC_SYMLINK 0x000002 /* Follow symlinks */ +#define MAGIC_COMPRESS 0x000004 /* Check inside compressed files */ +#define MAGIC_DEVICES 0x000008 /* Look at the contents of devices */ +#define MAGIC_MIME_TYPE 0x000010 /* Return the MIME type */ +#define MAGIC_CONTINUE 0x000020 /* Return all matches */ +#define MAGIC_CHECK 0x000040 /* Print warnings to stderr */ +#define MAGIC_PRESERVE_ATIME 0x000080 /* Restore access time on exit */ +#define MAGIC_RAW 0x000100 /* Don't translate unprintable chars */ +#define MAGIC_ERROR 0x000200 /* Handle ENOENT etc as real errors */ +#define MAGIC_MIME_ENCODING 0x000400 /* Return the MIME encoding */ +#define MAGIC_MIME (MAGIC_MIME_TYPE|MAGIC_MIME_ENCODING) +#define MAGIC_APPLE 0x000800 /* Return the Apple creator and type */ + +#define MAGIC_NO_CHECK_COMPRESS 0x001000 /* Don't check for compressed files */ +#define MAGIC_NO_CHECK_TAR 0x002000 /* Don't check for tar files */ +#define MAGIC_NO_CHECK_SOFT 0x004000 /* Don't check magic entries */ +#define MAGIC_NO_CHECK_APPTYPE 0x008000 /* Don't check application type */ +#define MAGIC_NO_CHECK_ELF 0x010000 /* Don't check for elf details */ +#define MAGIC_NO_CHECK_TEXT 0x020000 /* Don't check for text files */ +#define MAGIC_NO_CHECK_CDF 0x040000 /* Don't check for cdf files */ +#define MAGIC_NO_CHECK_TOKENS 0x100000 /* Don't check tokens */ +#define MAGIC_NO_CHECK_ENCODING 0x200000 /* Don't check text encodings */ + +/* No built-in tests; only consult the magic file */ +#define MAGIC_NO_CHECK_BUILTIN ( \ + MAGIC_NO_CHECK_COMPRESS | \ + MAGIC_NO_CHECK_TAR | \ +/* MAGIC_NO_CHECK_SOFT | */ \ + MAGIC_NO_CHECK_APPTYPE | \ + MAGIC_NO_CHECK_ELF | \ + MAGIC_NO_CHECK_TEXT | \ + MAGIC_NO_CHECK_CDF | \ + MAGIC_NO_CHECK_TOKENS | \ + MAGIC_NO_CHECK_ENCODING | \ +) + +/* Defined for backwards compatibility (renamed) */ +#define MAGIC_NO_CHECK_ASCII MAGIC_NO_CHECK_TEXT + +/* Defined for backwards compatibility; do nothing */ +#define MAGIC_NO_CHECK_FORTRAN 0x000000 /* Don't check ascii/fortran */ +#define MAGIC_NO_CHECK_TROFF 0x000000 /* Don't check ascii/troff */ + +#define MAGIC_VERSION X.YY /* This implementation */ + + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct magic_set *magic_t; +magic_t magic_open(int); +void magic_close(magic_t); + +const char *magic_getpath(const char *, int); +const char *magic_file(magic_t, const char *); +const char *magic_descriptor(magic_t, int); +const char *magic_buffer(magic_t, const void *, size_t); + +const char *magic_error(magic_t); +int magic_setflags(magic_t, int); + +int magic_version(void); +int magic_load(magic_t, const char *); +int magic_compile(magic_t, const char *); +int magic_check(magic_t, const char *); +int magic_list(magic_t, const char *); +int magic_errno(magic_t); + +#ifdef __cplusplus +}; +#endif + +#endif /* _MAGIC_H */ --- file-5.12/src/patchlevel.h 1970-01-01 01:00:00.000000000 +0100 +++ upstream/src/patchlevel.h 2013-01-21 16:12:13.457452763 +0100 @@ -0,0 +1,361 @@ +#define FILE_VERSION_MAJOR 5 +#define patchlevel 6 + +/* + * Patchlevel file for Ian Darwin's MAGIC command. + * $File: patchlevel.h,v 1.76 2011/01/17 16:40:41 christos Exp $ + * + * $Log: patchlevel.h,v $ + * Revision 1.77 2011/04/15 22:07:27 christos + * fix the patchlevel. + * + * Revision 1.76 2011/01/17 16:40:41 christos + * welcome to 5_05 + * + * Revision 1.75 2010/01/22 21:08:13 christos + * welcome to 5.04 + * + * Revision 1.74 2009/05/06 20:32:48 christos + * welcome to 5.03 + * + * Revision 1.73 2009/05/04 15:15:13 christos + * 5.02... + * + * Revision 1.72 2009/04/30 21:20:15 christos + * 5.01 we are almost here. + * + * Revision 1.71 2009/01/21 19:09:42 christos + * file 5.0 + * + * Revision 1.70 2008/08/30 10:01:01 christos + * file 4.26 + * + * Revision 1.69 2008/07/02 15:27:05 christos + * welcome to 4.25 + * + * Revision 1.68 2008/03/22 21:39:43 christos + * file 4.24 + * + * Revision 1.67 2007/12/28 20:08:40 christos + * welcome to 4.23. + * + * Revision 1.66 2007/12/27 16:38:24 christos + * welcome to 4.22 + * + * Revision 1.65 2007/05/24 17:22:27 christos + * Welcome to 4.21 + * + * Revision 1.64 2007/03/01 22:14:55 christos + * welcome to 4.20 + * + * Revision 1.63 2007/01/12 17:38:28 christos + * Use File id. + * + * Revision 1.62 2006/12/11 21:49:58 christos + * time for 4.19 + * + * Revision 1.61 2006/10/31 21:18:09 christos + * bump + * + * Revision 1.60 2006/03/02 22:15:12 christos + * welcome to 4.17 + * + * Revision 1.59 2005/10/17 17:15:21 christos + * welcome to 4.16 + * + * Revision 1.58 2005/08/18 15:52:56 christos + * welcome to 4.15 + * + * Revision 1.57 2005/06/25 15:52:14 christos + * Welcome to 4.14 + * + * Revision 1.56 2005/02/09 19:25:13 christos + * Welcome to 4.13 + * + * Revision 1.55 2004/11/24 18:57:47 christos + * Re-do the autoconf stuff once more; passes make dist now. + * + * Revision 1.54 2004/11/21 05:52:05 christos + * ready for 4.11 + * + * Revision 1.53 2004/07/24 20:40:46 christos + * welcome to 4.10 + * + * Revision 1.52 2004/04/07 00:32:25 christos + * welcome to 4.09 + * + * Revision 1.51 2004/03/22 21:17:11 christos + * welcome to 4.08. + * + * Revision 1.50 2003/12/23 17:34:04 christos + * 4.07 + * + * Revision 1.49 2003/10/15 02:08:27 christos + * welcome to 4.06 + * + * Revision 1.48 2003/09/12 19:41:14 christos + * this is 4.04 + * + * Revision 1.47 2003/05/23 21:38:21 christos + * welcome to 4.03 + * + * Revision 1.46 2003/04/02 18:57:43 christos + * prepare for 4.02 + * + * Revision 1.45 2003/03/26 15:37:25 christos + * - Pass lint + * - make NULL in magic_file mean stdin + * - Fix "-" argument to file to pass NULL to magic_file + * - avoid pointer casts by using memcpy + * - rename magic_buf -> magic_buffer + * - keep only the first error + * - manual page: new sentence, new line + * - fix typo in api function (magic_buf -> magic_buffer) + * + * Revision 1.44 2003/03/23 22:23:31 christos + * finish librarification. + * + * Revision 1.43 2003/03/23 21:16:26 christos + * update copyrights. + * + * Revision 1.42 2003/03/23 04:06:05 christos + * Library re-organization + * + * Revision 1.41 2003/02/27 20:53:45 christos + * - fix memory allocation problem (Jeff Johnson) + * - fix stack overflow corruption (David Endler) + * - fixes from NetBSD source (Antti Kantee) + * - magic fixes + * + * Revision 1.40 2003/02/08 18:33:53 christos + * - detect inttypes.h too (Dave Love ) + * - eliminate unsigned char warnings (Petter Reinholdtsen ) + * - better elf PT_NOTE handling (Nalin Dahyabhai ) + * - add options to format the output differently + * - much more magic. + * + * Revision 1.39 2002/07/03 18:57:52 christos + * - ansify/c99ize + * - more magic + * - better COMPILE_ONLY support. + * - new magic files. + * - fix solaris compilation problems. + * + * Revision 1.38 2002/05/16 18:45:56 christos + * - pt_note elf additions from NetBSD + * - EMX os specific changes (Alexander Mai) + * - stdint.h detection, acconfig.h fixes (Maciej W. Rozycki, Franz Korntner) + * - regex file additions (Kim Cromie) + * - getopt_long support and misc cleanups (Michael Piefel) + * - many magic fixes and additions + * + * Revision 1.37 2001/09/03 14:44:22 christos + * daylight/tm_isdst detection + * magic fixes + * don't eat the whole file if it has only nulls + * + * Revision 1.36 2001/07/22 21:04:15 christos + * - magic fixes + * - add new operators, pascal strings, UTC date printing, $HOME/.magic + * [from "Tom N Harris" ] + * + * Revision 1.35 2001/04/24 14:40:25 christos + * - rename magic file sgi to mips and fix it + * - add support for building magic.mgc + * - portability fixes for mmap() + * - try gzip before uncompress, because uncompress sometimes hangs + * - be more conservative about pipe reads and writes + * - many magic fixes + * + * Revision 1.34 2001/03/12 05:05:57 christos + * - new compiled magic format + * - lots of magic additions + * + * Revision 1.33 2000/11/13 00:30:50 christos + * - wordperfect magic fix: freebsd pr 9388 + * - more msdos fixes from freebsd pr's 20131 and 20812 + * - sas and spss magic [Bruce Foster] + * - mkinstalldirs [John Fremlin] + * - sgi opengl fixes [Michael Pruett] + * - netbsd magic fixes [Ignatios Souvatzis] + * - audio additions [Michael Pruett] + * - fix problem with non ansi RCSID [Andreas Ley] + * - oggs magic [Felix von Leitner] + * - gmon magic [Eugen Dedu] + * - TNEF magic [Joomy] + * - netpbm magic and misc other image stuff [Bryan Henderson] + * + * Revision 1.32 2000/08/05 18:24:18 christos + * Correct indianness detection in elf (Charles Hannum) + * FreeBSD elf core support (Guy Harris) + * Use gzip in systems that don't have uncompress (Anthon van der Neut) + * Internationalization/EBCDIC support (Eric Fisher) + * Many many magic changes + * + * Revision 1.31 2000/05/14 17:58:36 christos + * - new magic for claris files + * - new magic for mathematica and maple files + * - new magic for msvc files + * - new -k flag to keep going matching all possible entries + * - add the word executable on #! magic files, and fix the usage of + * the word script + * - lots of other magic fixes + * - fix typo test -> text + * + * Revision 1.30 2000/04/11 02:41:17 christos + * - add support for mime output (-i) + * - make sure we free memory in case realloc fails + * - magic fixes + * + * Revision 1.29 1999/11/28 20:02:29 christos + * new string/[Bcb] magic from anthon, and adjustments to the magic files to + * use it. + * + * Revision 1.28 1999/10/31 22:11:48 christos + * - add "char" type for compatibility with HP/UX + * - recognize HP/UX syntax &=n etc. + * - include errno.h for CYGWIN + * - conditionalize the S_IS* macros + * - revert the SHT_DYNSYM test that broke the linux stripped binaries test + * - lots of Magdir changes + * + * Revision 1.27 1999/02/14 17:21:41 christos + * Automake support and misc cleanups from Rainer Orth + * Enable reading character and block special files from Dale R. Worley + * + * Revision 1.26 1998/09/12 13:19:39 christos + * - add support for bi-endian indirect offsets (Richard Verhoeven) + * - add recognition for bcpl (Joseph Myers) + * - remove non magic files from Magdir to avoid difficulties building + * on os2 where files are case independent + * - magic fixes. + * + * Revision 1.25 1998/06/27 14:04:04 christos + * OLF patch Guy Harris + * Recognize java/html (debian linux) + * Const poisoning (debian linux) + * More magic! + * + * Revision 1.24 1998/02/15 23:20:38 christos + * Autoconf patch: Felix von Leitner + * More magic fixes + * Elf64 fixes + * + * Revision 1.23 1997/11/05 16:03:37 christos + * - correct elf prps offset for SunOS-2.5.1 [guy@netapp.com] + * - handle 64 bit time_t's correctly [ewt@redhat.com] + * - new mime style magic [clarosse@netvista.net] + * - new TI calculator magic [rmcguire@freenet.columbus.oh.us] + * - new figlet fonts [obrien@freebsd.org] + * - new cisco magic, and elf fixes [jhawk@bbnplanet.com] + * - -b flag addition, and x86 filesystem magic [vax@linkhead.paranoia.com] + * - s/Mpeg/MPEG, header and elf typo fixes [guy@netapp.com] + * - Windows/NT registry files, audio code [guy@netapp.com] + * - libGrx graphics lib fonts [guy@netapp.com] + * - PNG fixes [guy@netapp.com] + * - more m$ document magic [guy@netapp.com] + * - PPD files [guy@netapp.com] + * - archive magic cleanup [guy@netapp.com] + * - linux kernel magic cleanup [guy@netapp.com] + * - lecter magic [guy@netapp.com] + * - vgetty magic [guy@netapp.com] + * - sniffer additions [guy@netapp.com] + * + * Revision 1.22 1997/01/15 17:23:24 christos + * - add support for elf core files: find the program name under SVR4 [Ken Pizzini] + * - print strings only up to the first carriage return [various] + * - freebsd international ascii support [J Wunsch] + * - magic fixes and additions [Guy Harris] + * - 64 bit fixes [Larry Schwimmer] + * - support for both utime and utimes, but don't restore file access times + * by default [various] + * - \xXX only takes 2 hex digits, not 3. + * - re-implement support for core files [Guy Harris] + * + * Revision 1.21 1996/10/05 18:15:29 christos + * Segregate elf stuff and conditionally enable it with -DBUILTIN_ELF + * More magic fixes + * + * Revision 1.20 1996/06/22 22:15:52 christos + * - support relative offsets of the form >& + * - fix bug with truncating magic strings that contain \n + * - file -f - did not read from stdin as documented + * - support elf file parsing using our own elf support. + * - as always magdir fixes and additions. + * + * Revision 1.19 1995/10/27 23:14:46 christos + * Ability to parse colon separated list of magic files + * New LEGAL.NOTICE + * Various magic file changes + * + * Revision 1.18 1995/05/20 22:09:21 christos + * Passed incorrect argument to eatsize(). + * Use %ld and %lx where appropriate. + * Remove unused variables + * ELF support for both big and little endian + * Fixes for small files again. + * + * Revision 1.17 1995/04/28 17:29:13 christos + * - Incorrect nroff detection fix from der Mouse + * - Lost and incorrect magic entries. + * - Added ELF stripped binary detection [in C; ugh] + * - Look for $MAGIC to find the magic file. + * - Eat trailing size specifications from numbers i.e. ignore 10L + * - More fixes for very short files + * + * Revision 1.16 1995/03/25 22:06:45 christos + * - use strtoul() where it exists. + * - fix sign-extend bug + * - try to detect tar archives before nroff files, otherwise + * tar files where the first file starts with a . will not work + * + * Revision 1.15 1995/01/21 21:03:35 christos + * Added CSECTION for the file man page + * Added version flag -v + * Fixed bug with -f input flag (from iorio@violet.berkeley.edu) + * Lots of magic fixes and reorganization... + * + * Revision 1.14 1994/05/03 17:58:23 christos + * changes from mycroft@gnu.ai.mit.edu (Charles Hannum) for unsigned + * + * Revision 1.13 1994/01/21 01:27:01 christos + * Fixed null termination bug from Don Seeley at BSDI in ascmagic.c + * + * Revision 1.12 1993/10/27 20:59:05 christos + * Changed -z flag to understand gzip format too. + * Moved builtin compression detection to a table, and move + * the compress magic entry out of the source. + * Made printing of numbers unsigned, and added the mask to it. + * Changed the buffer size to 8k, because gzip will refuse to + * unzip just a few bytes. + * + * Revision 1.11 1993/09/24 18:49:06 christos + * Fixed small bug in softmagic.c introduced by + * copying the data to be examined out of the input + * buffer. Changed the Makefile to use sed to create + * the correct man pages. + * + * Revision 1.10 1993/09/23 21:56:23 christos + * Passed purify. Fixed indirections. Fixed byte order printing. + * Fixed segmentation faults caused by referencing past the end + * of the magic buffer. Fixed bus errors caused by referencing + * unaligned shorts or longs. + * + * Revision 1.9 1993/03/24 14:23:40 ian + * Batch of minor changes from several contributors. + * + * Revision 1.8 93/02/19 15:01:26 ian + * Numerous changes from Guy Harris too numerous to mention but including + * byte-order independance, fixing "old-style masking", etc. etc. A bugfix + * for broken symlinks from martin@@d255s004.zfe.siemens.de. + * + * Revision 1.7 93/01/05 14:57:27 ian + * Couple of nits picked by Christos (again, thanks). + * + * Revision 1.6 93/01/05 13:51:09 ian + * Lotsa work on the Magic directory. + * + * Revision 1.5 92/09/14 14:54:51 ian + * Fix a tiny null-pointer bug in previous fix for tar archive + uncompress. + * + */ --- file-5.12/src/softmagic.c 2013-01-04 01:47:35.000000000 +0100 +++ upstream/src/softmagic.c 2013-01-21 16:12:13.461952805 +0100 @@ -43,9 +43,9 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.1 private int match(struct magic_set *, struct magic *, uint32_t, - const unsigned char *, size_t, size_t, int, int, int); + const unsigned char *, size_t, size_t, int, int, int, int *); private int mget(struct magic_set *, const unsigned char *, - struct magic *, size_t, size_t, unsigned int, int, int, int); + struct magic *, size_t, size_t, unsigned int, int, int, int, int *); private int magiccheck(struct magic_set *, struct magic *); private int32_t mprint(struct magic_set *, struct magic *); private int32_t moffset(struct magic_set *, struct magic *); @@ -73,7 +73,7 @@ file_softmagic(struct magic_set *ms, con int rv; for (ml = ms->mlist[0]->next; ml != ms->mlist[0]; ml = ml->next) if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, 0, mode, - text, 0)) != 0) + text, 0, NULL)) != 0) return rv; return 0; @@ -109,16 +109,19 @@ file_softmagic(struct magic_set *ms, con private int match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, const unsigned char *s, size_t nbytes, size_t offset, int mode, int text, - int flip) + int flip, int *returnval) { uint32_t magindex = 0; unsigned int cont_level = 0; int need_separator = 0; - int returnval = 0, e; /* if a match is found it is set to 1*/ + int returnvalv = 0, e; /* if a match is found it is set to 1*/ int firstline = 1; /* a flag to print X\n X\n- X */ int printed_something = 0; int print = (ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0; + if (returnval == NULL) + returnval = &returnvalv; + if (file_check_mem(ms, cont_level) == -1) return -1; @@ -144,7 +147,7 @@ match(struct magic_set *ms, struct magic /* if main entry matches, print it... */ switch (mget(ms, s, m, nbytes, offset, cont_level, mode, text, - flip)) { + flip, returnval)) { case -1: return -1; case 0: @@ -152,7 +155,7 @@ match(struct magic_set *ms, struct magic break; default: if (m->type == FILE_INDIRECT) - returnval = 1; + *returnval = 1; switch (magiccheck(ms, m)) { case -1: @@ -178,6 +181,7 @@ match(struct magic_set *ms, struct magic } if ((e = handle_annotation(ms, m)) != 0) { + *returnval = 1; return e; } /* @@ -229,7 +233,7 @@ match(struct magic_set *ms, struct magic } #endif switch (mget(ms, s, m, nbytes, offset, cont_level, mode, - text, flip)) { + text, flip, returnval)) { case -1: return -1; case 0: @@ -239,7 +243,7 @@ match(struct magic_set *ms, struct magic break; default: if (m->type == FILE_INDIRECT) - returnval = 1; + *returnval = 1; flush = 0; break; } @@ -262,8 +266,10 @@ match(struct magic_set *ms, struct magic ms->c.li[cont_level].got_match = 0; break; } - if ((e = handle_annotation(ms, m)) != 0) + if ((e = handle_annotation(ms, m)) != 0) { + *returnval = 1; return e; + } /* * If we are going to print something, * make sure that we have a separator first. @@ -312,13 +318,13 @@ match(struct magic_set *ms, struct magic if (printed_something) { firstline = 0; if (print) - returnval = 1; + *returnval = 1; } if ((ms->flags & MAGIC_CONTINUE) == 0 && printed_something) { - return returnval; /* don't keep searching */ + return *returnval; /* don't keep searching */ } } - return returnval; /* This is hit if -k is set or there is no match */ + return *returnval; /* This is hit if -k is set or there is no match */ } private int @@ -1058,8 +1064,8 @@ mcopy(struct magic_set *ms, union VALUET if (type == FILE_BESTRING16) src++; - /* check for pointer overflow */ - if (src < s) { + /* check that offset is within range */ + if (offset >= nbytes) { file_magerror(ms, "invalid offset %u in mcopy()", offset); return -1; @@ -1110,7 +1116,7 @@ mcopy(struct magic_set *ms, union VALUET private int mget(struct magic_set *ms, const unsigned char *s, struct magic *m, size_t nbytes, size_t o, unsigned int cont_level, int mode, int text, - int flip) + int flip, int *returnval) { uint32_t offset = ms->offset; uint32_t count = m->str_range; @@ -1713,7 +1719,7 @@ mget(struct magic_set *ms, const unsigne return -1; } return match(ms, ml.magic, ml.nmagic, s, nbytes, offset, - mode, text, flip); + mode, text, flip, returnval); case FILE_NAME: if (file_printf(ms, "%s", m->desc) == -1) --- file-5.12/src/teststrchr.c 1970-01-01 01:00:00.000000000 +0100 +++ upstream/src/teststrchr.c 2013-01-21 16:12:13.461952805 +0100 @@ -0,0 +1,20 @@ +#ifdef TEST +#include +#include +#include +int +main(void) +{ + char *strchr(); + + if (strchr(1, "abc", 'c') == NULL) + errx(1, "error 1"); + if (strchr("abc", 'd') != NULL) + errx(1, "error 2"); + if (strchr("abc", 'a') == NULL) + errx(1, "error 3"); + if (strchr("abc", 'c') == NULL) + errx(1, "error 4"); + return 0; +} +#endif