cppcheck/test/bug-hunting/cve/CVE-2019-7156/ole.c

/**
 * @file   ole.c
 * @author Alex Ott, Victor B Wagner
 * @date   Wed Jun 11 12:33:01 2003
 * Version: $Id: ole.c,v 1.2 2006/02/25 15:28:14 vitus Exp $
 * Copyright: Victor B Wagner, 1996-2003 Alex Ott, 2003
 *
 * @brief  Parsing structure of MS Office compound document
 *
 * This file is part of catdoc project
 * and distributed under GNU Public License
 *
 */
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#include "catdoc.h"

#define min(a,b) ((a) < (b) ? (a) : (b))

const static unsigned char ole_sign[]={0xD0,0xCF,0x11,0xE0,0xA1,0xB1,0x1A,0xE1,0};


/**
 * Initializes ole structure
 *
 * @param f (FILE *) compound document file, positioned at bufSize
 *           byte. Might be pipe or socket
 * @param buffer (void *) bytes already read from f
 * @param bufSize number of bytes already read from f should be less
 *                than 512
 *
 * @return
 */
FILE* ole_init(FILE *f, void *buffer, size_t bufSize, struct ole_params_t *ole_params)  {
    unsigned char oleBuf[BBD_BLOCK_SIZE];
    unsigned char *tmpBuf;
    FILE *newfile;
    int ret=0, i;
    long int sbdMaxLen, sbdCurrent, propMaxLen, propCurrent, mblock, msat_size;
    oleEntry *tEntry;
    long int sectorSize;
    long int shortSectorSize;
    long int bbdNumBlocks;

    /* deleting old data (if it was allocated) */
    ole_finish(ole_params);

    if (fseek(f,0,SEEK_SET) == -1) {
        if (errno == ESPIPE) {
            /* We got non-seekable file, create temp file */
            if ((newfile=tmpfile()) == NULL) {
                return NULL;
            }
            if (bufSize > 0) {
                ret=fwrite(buffer, 1, bufSize, newfile);
                if (ret != bufSize) {
                    return NULL;
                }
            }

            while (!feof(f)) {
                ret=fread(oleBuf,1,BBD_BLOCK_SIZE,f);
                fwrite(oleBuf, 1, ret, newfile);
            }
            fseek(newfile,0,SEEK_SET);
        } else {
            return NULL;
        }
    } else {
        newfile=f;
    }
    fseek(newfile,0,SEEK_END);
    ole_params->fileLength=ftell(newfile);

    fseek(newfile,0,SEEK_SET);
    ret=fread(oleBuf,1,BBD_BLOCK_SIZE,newfile);
    if (ret != BBD_BLOCK_SIZE) {
        return NULL;
    }
    if (strncmp(oleBuf,ole_sign,8) != 0) {
        return NULL;
    }
    ole_params->sectorSize = 1<<getshort(oleBuf,0x1e);
    if (ole_params->sectorSize == 0) {
        return NULL;
    }
    sectorSize = ole_params->sectorSize;
    ole_params->shortSectorSize = 1<<getshort(oleBuf,0x20);
    shortSectorSize= ole_params->shortSectorSize;
    if (shortSectorSize > sectorSize) {
        return NULL;
    }
/* Read BBD into memory */
    ole_params->bbdNumBlocks = getulong(oleBuf,0x2c);
    bbdNumBlocks = ole_params->bbdNumBlocks;
    if ((ole_params->BBD=malloc(bbdNumBlocks*sectorSize)) == NULL) {
        return NULL;
    }

    if ((tmpBuf=malloc(MSAT_ORIG_SIZE)) == NULL) {
        return NULL;
    }
    memcpy(tmpBuf,oleBuf+0x4c,MSAT_ORIG_SIZE);
    mblock=getlong(oleBuf,0x44);
    msat_size=getlong(oleBuf,0x48);

/*  fprintf(stderr, "msat_size=%ld\n", msat_size); */

    i=0;
    while ((mblock >= 0) && (i < msat_size)) {
        unsigned char *newbuf;
/*      fprintf(stderr, "i=%d mblock=%ld\n", i, mblock); */
        if ((newbuf=realloc(tmpBuf, sectorSize*(i+1)+MSAT_ORIG_SIZE)) != NULL) {
            tmpBuf=newbuf;
        } else {
            free(tmpBuf);
            ole_finish(ole_params);
            return NULL;
        }

        fseek(newfile, 512+mblock*sectorSize, SEEK_SET);
        if (fread(tmpBuf+MSAT_ORIG_SIZE+(sectorSize-4)*i,
                  1, sectorSize, newfile) != sectorSize) {
            ole_finish(ole_params);
            return NULL;
        }

        i++;
        mblock=getlong(tmpBuf, MSAT_ORIG_SIZE+(sectorSize-4)*i);
    }

/*  fprintf(stderr, "bbdNumBlocks=%ld\n", bbdNumBlocks); */
    for (i=0; i< bbdNumBlocks; i++) {
        long int bbdSector=getlong(tmpBuf,4*i);

        if (bbdSector >= ole_params->fileLength/sectorSize || bbdSector < 0) {
            errno = EINVAL;
            ole_finish(ole_params);
            return NULL;
        }
        fseek(newfile, 512+bbdSector*sectorSize, SEEK_SET);
        if (fread(ole_params->BBD+i*sectorSize, 1, sectorSize, newfile) != sectorSize) {
            free(tmpBuf);
            ole_finish(ole_params);
            return NULL;
        }
    }
    free(tmpBuf);

/* Read SBD into memory */
    ole_params->sbdLen=0;
    sbdMaxLen=10;
    sbdCurrent = ole_params->sbdStart = getlong(oleBuf,0x3c);
    if (ole_params->sbdStart > 0) {
        if ((ole_params->SBD=malloc(sectorSize*sbdMaxLen)) == NULL) {
            ole_finish(ole_params);
            return NULL;
        }
        while (1) {
            fseek(newfile, 512+sbdCurrent*sectorSize, SEEK_SET);
            fread(ole_params->SBD+ole_params->sbdLen*sectorSize, 1, sectorSize, newfile);
            ole_params->sbdLen++;
            if (ole_params->sbdLen >= sbdMaxLen) {
                unsigned char *newSBD;

                sbdMaxLen+=5;
                if ((newSBD=realloc(ole_params->SBD, sectorSize*sbdMaxLen)) != NULL) {
                    ole_params->SBD=newSBD;
                } else {
                    ole_finish(ole_params);
                    return NULL;
                }
            }
            if (sbdCurrent < 0 || sbdCurrent * 4 >= bbdNumBlocks * sectorSize)
            {
                break;
            }
            sbdCurrent = getlong(ole_params->BBD, sbdCurrent*4);
            if (sbdCurrent < 0 ||
                sbdCurrent >= ole_params->fileLength/sectorSize)
                break;
        }
        ole_params->sbdNumber = (ole_params->sbdLen*sectorSize)/shortSectorSize;
    } else {
        ole_params->SBD=NULL;
    }
/* Read property catalog into memory */
    ole_params->propLen = 0;
    propMaxLen = 5;
    propCurrent = ole_params->propStart = getlong(oleBuf,0x30);
    if (ole_params->propStart >= 0) {
        if ((ole_params->properties=malloc(propMaxLen*sectorSize)) == NULL) {
            ole_finish(ole_params);
            return NULL;
        }
        while (1) {
/*              fprintf(stderr, "propCurrent=%ld\n",propCurrent); */
            fseek(newfile, 512+propCurrent*sectorSize, SEEK_SET);
            fread(ole_params->properties+ole_params->propLen*sectorSize,
                  1, sectorSize, newfile);
            (ole_params->propLen)++;
            if (ole_params->propLen >= propMaxLen) {
                unsigned char *newProp;

                propMaxLen+=5;
                if ((newProp=realloc(ole_params->properties, propMaxLen*sectorSize)) != NULL)
                    ole_params->properties=newProp;
                else {
                    ole_finish(ole_params);
                    return NULL;
                }
            }

            propCurrent = getlong(ole_params->BBD, propCurrent*4);
            if (propCurrent < 0 ||
                propCurrent >= ole_params->fileLength/sectorSize) {
                break;
            }
        }

        ole_params->propNumber = (ole_params->propLen*sectorSize)/PROP_BLOCK_SIZE;
        ole_params->propCurNumber = 0;
    } else {
        ole_finish(ole_params);
        ole_params->properties = NULL;
        return NULL;
    }


/* Find Root Entry */
    while ((tEntry=(oleEntry*)ole_readdir(newfile, ole_params)) != NULL) {
        if (tEntry->type == oleRootDir) {
            ole_params->rootEntry=tEntry;
            break;
        }
        ole_close((FILE*)tEntry);
    }
    ole_params->propCurNumber = 0;
    fseek(newfile, 0, SEEK_SET);
    if (!ole_params->rootEntry) {
        errno = EINVAL;
        ole_finish(ole_params);
        return NULL;
    }
    return newfile;
}

/**
 *
 *
 * @param oleBuf
 *
 * @return
 */
int rightOleType(unsigned char *oleBuf) {
    return (oleBuf[0x42] == 1 || oleBuf[0x42] == 2 ||
            oleBuf[0x42] == 3 || oleBuf[0x42] == 5);
}

/**
 *
 *
 * @param oleBuf
 *
 * @return
 */
oleType getOleType(unsigned char *oleBuf) {
    return (oleType)((unsigned char)oleBuf[0x42]);
}

/**
 * Reads next directory entry from file
 *
 * @param name buffer for name converted to us-ascii should be at least 33 chars long
 * @param size size of file
 *
 * @return 0 if everything is ok -1 on error
 */
FILE *ole_readdir(FILE *f, struct ole_params_t *ole_params) {
    int i, nLen;
    unsigned char *oleBuf;
    oleEntry *e=NULL;
    long int chainMaxLen, chainCurrent;

    if (ole_params->properties == NULL || ole_params->propCurNumber >= ole_params->propNumber || f == NULL)
        return NULL;
    oleBuf=ole_params->properties + ole_params->propCurNumber*PROP_BLOCK_SIZE;
    if (!rightOleType(oleBuf))
        return NULL;
    if ((e = (oleEntry*)malloc(sizeof(oleEntry))) == NULL) {
        return NULL;
    }
    e->dirPos=oleBuf;
    e->type=getOleType(oleBuf);
    e->file=f;
    e->startBlock=getlong(oleBuf,0x74);
    e->blocks=NULL;

    nLen=getshort(oleBuf,0x40);
    for (i=0; i < nLen/2 && i < OLENAMELENGHT; i++)
        e->name[i]=(char)oleBuf[i*2];
    e->name[i]='\0';
    (ole_params->propCurNumber)++;
    e->length=getulong(oleBuf,0x78);
/* Read sector chain for object */
    chainMaxLen = 25;
    e->numOfBlocks = 0;
    chainCurrent = e->startBlock;
    e->isBigBlock = (e->length >= 0x1000) || !strcmp(e->name, "Root Entry");
/*  fprintf(stderr, "e->name=%s e->length=%ld\n", e->name, e->length); */
/*  fprintf(stderr, "e->startBlock=%ld BBD=%p\n", e->startBlock, BBD); */
    if (e->startBlock >= 0 &&
        e->length >= 0 &&
        (e->startBlock <=
         ole_params->fileLength/(e->isBigBlock ? ole_params->sectorSize : ole_params->shortSectorSize))) {
        if ((e->blocks=malloc(chainMaxLen*sizeof(long int))) == NULL) {
            return NULL;
        }
        while (1) {
/*          fprintf(stderr, "chainCurrent=%ld\n", chainCurrent); */
            e->blocks[e->numOfBlocks++] = chainCurrent;
            if (e->numOfBlocks >= chainMaxLen) {
                long int *newChain;
                chainMaxLen+=25;
                if ((newChain=realloc(e->blocks,
                                      chainMaxLen*sizeof(long int))) != NULL)
                    e->blocks=newChain;
                else {
                    free(e->blocks);
                    e->blocks=NULL;
                    return NULL;
                }
            }
            if (e->isBigBlock) {
                chainCurrent = getlong(ole_params->BBD, chainCurrent*4);
            } else if (ole_params->SBD != NULL) {
                chainCurrent = getlong(ole_params->SBD, chainCurrent*4);
            } else {
                chainCurrent=-1;
            }
            if (chainCurrent <= 0 ||
                chainCurrent >= (e->isBigBlock ?
                                 ((ole_params->bbdNumBlocks*ole_params->sectorSize)/4)
                                 : ((ole_params->sbdNumber*ole_params->shortSectorSize)/4)) ||
                (e->numOfBlocks >
                 e->length/(e->isBigBlock ? ole_params->sectorSize : ole_params->shortSectorSize))) {
/*                  fprintf(stderr, "chain End=%ld\n", chainCurrent);   */
                break;
            }
        }
    }

    if (e->length > (e->isBigBlock ? ole_params->sectorSize : ole_params->shortSectorSize)*e->numOfBlocks)
        e->length = (e->isBigBlock ? ole_params->sectorSize : ole_params->shortSectorSize)*e->numOfBlocks;
/*  fprintf(stderr, "READDIR: e->name=%s e->numOfBlocks=%ld length=%ld\n", */
/*                  e->name, e->numOfBlocks, e->length); */

    return (FILE*)e;
}

/**
 * Open stream, which correspond to directory entry last read by
 * ole_readdir
 *
 *
 * @return opaque pointer to pass to ole_read, casted to (FILE *)
 */
int ole_open(FILE *stream) {
    oleEntry *e=(oleEntry *)stream;
    if (e->type != oleStream)
        return -2;

    e->ole_offset=0;
    e->file_offset= ftell(e->file);
    return 0;
}

/**
 *
 *
 * @param e
 * @param blk
 *
 * @return
 */
long int calcFileBlockOffset(oleEntry *e, long int blk, struct ole_params_t *ole_params) {
    long int res;
    if (e->isBigBlock) {
        res=512+e->blocks[blk]*ole_params->sectorSize;
    } else {
        long int sbdPerSector=(ole_params->sectorSize)/(ole_params->shortSectorSize);
        long int sbdSecNum=e->blocks[blk]/sbdPerSector;
        long int sbdSecMod=e->blocks[blk]%sbdPerSector;

        res=512 + ole_params->rootEntry->blocks[sbdSecNum]*ole_params->sectorSize + sbdSecMod*ole_params->shortSectorSize;
    }
    return res;
}


/**
 * Reads block from open ole stream interface-compatible with fread
 *
 * @param ptr pointer to buffer for read to
 * @param size size of block
 * @param nmemb size in blocks
 * @param stream pointer to FILE* structure
 *
 * @return number of readed blocks
 */
size_t ole_read(void *ptr, size_t size, size_t nmemb, FILE *stream, struct ole_params_t *ole_params) {
    oleEntry *e = (oleEntry*)stream;
    long int llen = size*nmemb, rread=0, i;
    long int blockNumber, modBlock, toReadBlocks, toReadBytes, bytesInBlock;
    long int ssize;             /**< Size of block */
    long int newoffset;
    unsigned char *cptr = ptr;
    if (e->ole_offset+llen > e->length)
        llen= e->length - e->ole_offset;

    ssize = (e->isBigBlock ? ole_params->sectorSize : ole_params->shortSectorSize);
    blockNumber=e->ole_offset/ssize;
/*  fprintf(stderr, "blockNumber=%ld e->numOfBlocks=%ld llen=%ld\n", */
/*          blockNumber, e->numOfBlocks, llen); */
    if (blockNumber >= e->numOfBlocks || llen <=0)
        return 0;

    modBlock=e->ole_offset%ssize;
    bytesInBlock = ssize - modBlock;
    if (bytesInBlock < llen) {
        toReadBlocks = (llen-bytesInBlock)/ssize;
        toReadBytes = (llen-bytesInBlock)%ssize;
    } else {
        toReadBlocks = toReadBytes = 0;
    }
/*  fprintf(stderr, "llen=%ld toReadBlocks=%ld toReadBytes=%ld bytesInBlock=%ld blockNumber=%ld modBlock=%ld\n", */
/*          llen, toReadBlocks, toReadBytes, bytesInBlock, blockNumber, modBlock); */
    newoffset = calcFileBlockOffset(e,blockNumber, ole_params)+modBlock;
    if (e->file_offset != newoffset) {
        fseek(e->file, e->file_offset=newoffset, SEEK_SET);
    }
    rread=fread(ptr, 1, min(llen,bytesInBlock), e->file);
    e->file_offset += rread;
    for (i=0; i<toReadBlocks; i++) {
        int readbytes;
        blockNumber++;
        newoffset = calcFileBlockOffset(e,blockNumber, ole_params);
        if (newoffset != e->file_offset);
        fseek(e->file, e->file_offset=newoffset, SEEK_SET);
        readbytes=fread(cptr+rread, 1, min(llen-rread, ssize), e->file);
        rread +=readbytes;
        e->file_offset +=readbytes;
    }
    if (toReadBytes > 0) {
        int readbytes;
        blockNumber++;
        newoffset = calcFileBlockOffset(e,blockNumber, ole_params);
        fseek(e->file, e->file_offset=newoffset, SEEK_SET);
        readbytes=fread(cptr+rread, 1, toReadBytes,e->file);
        rread +=readbytes;
        e->file_offset +=readbytes;
    }
/*  fprintf(stderr, "ole_offset=%ld rread=%ld llen=%ld\n",
    e->ole_offset, rread, llen);*/
    e->ole_offset+=rread;
    return rread;
}

/**
 *
 *
 * @param stream
 *
 * @return
 */
int ole_eof(FILE *stream) {
    oleEntry *e=(oleEntry*)stream;
/*  fprintf(stderr, "EOF: e->ole_offset=%ld  e->length=%ld\n",
    e->ole_offset,  e->length);*/
    return (e->ole_offset >=  e->length);
}

/**
 *
 *
 */
void ole_finish(struct ole_params_t *ole_params) {
    if (ole_params->BBD != NULL) free(ole_params->BBD);
    if (ole_params->SBD != NULL) free(ole_params->SBD);
    if (ole_params->properties != NULL) free(ole_params->properties);
    if (ole_params->rootEntry != NULL) ole_close((FILE*)(ole_params->rootEntry));
    ole_params->properties = ole_params->SBD = ole_params->BBD = NULL;
    ole_params->rootEntry = NULL;
}

/**
 *
 *
 * @param stream
 *
 * @return
 */
int ole_close(FILE *stream) {
    oleEntry *e=(oleEntry*)stream;
    if (e == NULL)
        return -1;
    if (e->blocks != NULL)
        free(e->blocks);
    free(e);
    return 0;
}

/**
 *
 *
 * @param stream pointer to OLE stream structure
 * @param offset
 * @param whence
 *
 * @return
 */
int ole_seek(FILE *stream, long offset, int whence, struct ole_params_t *ole_params) {
    oleEntry *e=(oleEntry*)stream;
    long int new_ole_offset=0, new_file_offset;
    int ssize, modBlock, blockNumber;

    switch (whence) {
    case SEEK_SET:
        new_ole_offset=offset;
        break;

    case SEEK_CUR:
        new_ole_offset=e->ole_offset+offset;
        break;

    case SEEK_END:
        new_ole_offset=e->length+offset;
        break;

    default:
        errno=EINVAL;
        return -1;
    }
    if (new_ole_offset<0)
        new_ole_offset=0;
    if (new_ole_offset >= e->length)
        new_ole_offset=e->length;

    ssize = (e->isBigBlock ? ole_params->sectorSize : ole_params->shortSectorSize);
    blockNumber=new_ole_offset/ssize;
    if (blockNumber >= e->numOfBlocks)
        return -1;

    modBlock=new_ole_offset%ssize;
    new_file_offset = calcFileBlockOffset(e,blockNumber, ole_params)+modBlock;
    fseek(e->file, e->file_offset=new_file_offset, SEEK_SET);
    e->ole_offset=new_ole_offset;

    return 0;
}

/**
 * Tell position inside OLE stream
 *
 * @param stream pointer to OLE stream
 *
 * @return current position inside OLE stream
 */
long ole_tell(FILE *stream) {
    oleEntry *e=(oleEntry*)stream;
    return e->ole_offset;
}


void set_ole_func(struct io_funcs_t *io_funcs) {
    io_funcs->catdoc_read=ole_read;
    io_funcs->catdoc_eof=ole_eof;
    io_funcs->catdoc_seek=ole_seek;
    io_funcs->catdoc_tell=ole_tell;
}


size_t my_fread(void *ptr, size_t size, size_t nmemb, FILE *stream, struct ole_params_t *ole_params)
{
    return fread(ptr, size, nmemb, stream);
}

int my_fseek(FILE *stream, long offset, int whence, struct ole_params_t *ole_params)
{
    return fseek(stream, offset, whence);
}

void set_std_func(struct io_funcs_t *io_funcs) {
    io_funcs->catdoc_read=my_fread;
    io_funcs->catdoc_eof=feof;
    io_funcs->catdoc_seek=my_fseek;
    io_funcs->catdoc_tell=ftell;
}