/src/libfwevt/libfwevt/libfwevt_channel.c

Source (jump to first uncovered line)
/*
 * Channel functions
 *
 * Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <narrow_string.h>
#include <system_string.h>
#include <types.h>
#include <wide_string.h>

#include "libfwevt_debug.h"
#include "libfwevt_channel.h"
#include "libfwevt_libcerror.h"
#include "libfwevt_libcnotify.h"
#include "libfwevt_libuna.h"
#include "libfwevt_types.h"

#include "fwevt_template.h"

/* Creates a channel
 * Make sure the value channel is referencing, is set to NULL
 * Returns 1 if successful or -1 on error
 */
int libfwevt_channel_initialize(
     libfwevt_channel_t **channel,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  static char *function                         = "libfwevt_channel_initialize";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  if( *channel != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid channel value already set.",
     function );

    return( -1 );
  }
  internal_channel = memory_allocate_structure(
                      libfwevt_internal_channel_t );

  if( internal_channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
     "%s: unable to create channel.",
     function );

    goto on_error;
  }
  if( memory_set(
       internal_channel,
       0,
       sizeof( libfwevt_internal_channel_t ) ) == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
     "%s: unable to clear channel.",
     function );

    goto on_error;
  }
  *channel = (libfwevt_channel_t *) internal_channel;

  return( 1 );

on_error:
  if( internal_channel != NULL )
  {
    memory_free(
     internal_channel );
  }
  return( -1 );
}

/* Frees a channel
 * Returns 1 if successful or -1 on error
 */
int libfwevt_channel_free(
     libfwevt_channel_t **channel,
     libcerror_error_t **error )
{
  static char *function = "libfwevt_channel_free";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid WEVT channel descriptor.",
     function );

    return( -1 );
  }
  if( *channel != NULL )
  {
    *channel = NULL;
  }
  return( 1 );
}

/* Frees a channel
 * Returns 1 if successful or -1 on error
 */
int libfwevt_internal_channel_free(
     libfwevt_internal_channel_t **internal_channel,
     libcerror_error_t **error )
{
  static char *function = "libfwevt_internal_channel_free";

  if( internal_channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid WEVT channel descriptor.",
     function );

    return( -1 );
  }
  if( *internal_channel != NULL )
  {
    if( ( *internal_channel )->name != NULL )
    {
      memory_free(
       ( *internal_channel )->name );
    }
    memory_free(
     *internal_channel );

    *internal_channel = NULL;
  }
  return( 1 );
}

/* Reads the channel
 * Returns 1 if successful or -1 on error
 */
int libfwevt_channel_read_data(
     libfwevt_channel_t *channel,
     const uint8_t *data,
     size_t data_size,
     size_t data_offset,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  fwevt_template_channel_t *wevt_channel        = NULL;
  static char *function                         = "libfwevt_channel_read_data";
  uint32_t name_offset                          = 0;
  uint32_t name_size                            = 0;

#if defined( HAVE_DEBUG_OUTPUT )
  uint32_t value_32bit                          = 0;
#endif

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  internal_channel = (libfwevt_internal_channel_t *) channel;

  if( internal_channel->name != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid channel - name value already set.",
     function );

    return( -1 );
  }
  if( data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid data.",
     function );

    return( -1 );
  }
  if( data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( data_offset >= data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid data offset value out of bounds.",
     function );

    return( -1 );
  }
  if( ( data_size < sizeof( fwevt_template_channel_t ) )
   || ( data_offset > ( data_size - sizeof( fwevt_template_channel_t ) ) ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
     "%s: invalid data value too small.",
     function );

    return( -1 );
  }
  wevt_channel = (fwevt_template_channel_t *) &( data[ data_offset ] );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: channel data:\n",
     function );
    libcnotify_print_data(
     (uint8_t *) wevt_channel,
     sizeof( fwevt_template_channel_t ),
     0 );
  }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  byte_stream_copy_to_uint32_little_endian(
   wevt_channel->identifier,
   internal_channel->identifier );

  byte_stream_copy_to_uint32_little_endian(
   wevt_channel->name_offset,
   name_offset );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: identifier\t\t\t\t\t: %" PRIu32 "\n",
     function,
     internal_channel->identifier );

    libcnotify_printf(
     "%s: name offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     name_offset );

    byte_stream_copy_to_uint32_little_endian(
     wevt_channel->unknown1,
     value_32bit );
    libcnotify_printf(
     "%s: unknown1\t\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     value_32bit );

    byte_stream_copy_to_uint32_little_endian(
     wevt_channel->message_identifier,
     value_32bit );
    libcnotify_printf(
     "%s: message identifier\t\t\t\t: 0x%08" PRIx32 "\n",
     function,
     value_32bit );
  }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  if( name_offset > 0 )
  {
    if( name_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid name offset value out of bounds.",
       function );

      goto on_error;
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ name_offset ] ),
     name_size );

    if( ( data_size < name_size )
     || ( name_offset > ( data_size - name_size ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid name size value out of bounds.",
       function );

      goto on_error;
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: data:\n",
       function );
      libcnotify_print_data(
       &( data[ name_offset ] ),
       name_size,
       0 );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: name size\t\t\t\t\t: %" PRIu32 "\n",
       function,
       name_size );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    if( name_size >= 4 )
    {
      name_offset += 4;
      name_size   -= 4;

      if( ( name_size == 0 )
       || ( name_size > ( MEMORY_MAXIMUM_ALLOCATION_SIZE / sizeof( uint8_t ) ) ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
         "%s: invalid name size value out of bounds.",
         function );

        goto on_error;
      }
      internal_channel->name = (uint8_t *) memory_allocate(
                                            sizeof( uint8_t ) * name_size );

      if( internal_channel->name == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
         "%s: unable to create name.",
         function );

        goto on_error;
      }
      internal_channel->name_size = (size_t) name_size;

      if( memory_copy(
           internal_channel->name,
           &( data[ name_offset ] ),
           (size_t) name_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy name.",
         function );

        goto on_error;
      }
#if defined( HAVE_DEBUG_OUTPUT )
      if( libcnotify_verbose != 0 )
      {
        if( libfwevt_debug_print_utf16_string_value(
             function,
             "name\t\t\t\t\t",
             internal_channel->name,
             internal_channel->name_size,
             LIBUNA_ENDIAN_LITTLE,
             error ) != 1 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
           "%s: unable to print UTF-16 string value.",
           function );

          goto on_error;
        }
      }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */
    }
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "\n" );
  }
#endif
  return( 1 );

on_error:
  if( internal_channel->name != NULL )
  {
    memory_free(
     internal_channel->name );

    internal_channel->name = NULL;
  }
  internal_channel->name_size = 0;

  return( -1 );
}

/* Retrieves the identifier
 * Returns 1 if successful or -1 on error
 */
int libfwevt_channel_get_identifier(
     libfwevt_channel_t *channel,
     uint32_t *identifier,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  static char *function                         = "libfwevt_channel_get_identifier";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  internal_channel = (libfwevt_internal_channel_t *) channel;

  if( identifier == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid identifier.",
     function );

    return( -1 );
  }
  *identifier = internal_channel->identifier;

  return( 1 );
}

/* Retrieves the size of the UTF-8 formatted name
 * Returns 1 if successful, 0 if not available or -1 on error
 */
int libfwevt_channel_get_utf8_name_size(
     libfwevt_channel_t *channel,
     size_t *utf8_string_size,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  static char *function                         = "libfwevt_channel_get_utf8_name_size";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  internal_channel = (libfwevt_internal_channel_t *) channel;

  if( ( internal_channel->name == NULL )
   || ( internal_channel->name_size == 0 ) )
  {
    return( 0 );
  }
  if( libuna_utf8_string_size_from_utf16_stream(
       internal_channel->name,
       internal_channel->name_size,
       LIBUNA_ENDIAN_LITTLE,
       utf8_string_size,
       error ) != 1 )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
     "%s: unable to retrieve UTF-8 string size.",
     function );

    return( -1 );
  }
  return( 1 );
}

/* Retrieves the UTF-8 formatted name
 * Returns 1 if successful, 0 if not available or -1 on error
 */
int libfwevt_channel_get_utf8_name(
     libfwevt_channel_t *channel,
     uint8_t *utf8_string,
     size_t utf8_string_size,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  static char *function                         = "libfwevt_channel_get_utf8_name";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  internal_channel = (libfwevt_internal_channel_t *) channel;

  if( ( internal_channel->name == NULL )
   || ( internal_channel->name_size == 0 ) )
  {
    return( 0 );
  }
  if( libuna_utf8_string_copy_from_utf16_stream(
       utf8_string,
       utf8_string_size,
       internal_channel->name,
       internal_channel->name_size,
       LIBUNA_ENDIAN_LITTLE,
       error ) != 1 )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
     "%s: unable to retrieve UTF-8 string.",
     function );

    return( -1 );
  }
  return( 1 );
}

/* Retrieves the size of the UTF-16 formatted name
 * Returns 1 if successful, 0 if not available or -1 on error
 */
int libfwevt_channel_get_utf16_name_size(
     libfwevt_channel_t *channel,
     size_t *utf16_string_size,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  static char *function                         = "libfwevt_channel_get_utf16_name_size";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  internal_channel = (libfwevt_internal_channel_t *) channel;

  if( ( internal_channel->name == NULL )
   || ( internal_channel->name_size == 0 ) )
  {
    return( 0 );
  }
  if( libuna_utf16_string_size_from_utf16_stream(
       internal_channel->name,
       internal_channel->name_size,
       LIBUNA_ENDIAN_LITTLE,
       utf16_string_size,
       error ) != 1 )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
     "%s: unable to retrieve UTF-16 string size.",
     function );

    return( -1 );
  }
  return( 1 );
}

/* Retrieves the UTF-16 formatted name
 * Returns 1 if successful, 0 if not available or -1 on error
 */
int libfwevt_channel_get_utf16_name(
     libfwevt_channel_t *channel,
     uint16_t *utf16_string,
     size_t utf16_string_size,
     libcerror_error_t **error )
{
  libfwevt_internal_channel_t *internal_channel = NULL;
  static char *function                         = "libfwevt_channel_get_utf16_name";

  if( channel == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid channel.",
     function );

    return( -1 );
  }
  internal_channel = (libfwevt_internal_channel_t *) channel;

  if( ( internal_channel->name == NULL )
   || ( internal_channel->name_size == 0 ) )
  {
    return( 0 );
  }
  if( libuna_utf16_string_copy_from_utf16_stream(
       utf16_string,
       utf16_string_size,
       internal_channel->name,
       internal_channel->name_size,
       LIBUNA_ENDIAN_LITTLE,
       error ) != 1 )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
     "%s: unable to retrieve UTF-8 string.",
     function );

    return( -1 );
  }
  return( 1 );
}


Coverage Report

Created: 2025-06-13 07:21

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Channel functions
3		*
4		* Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <narrow_string.h>
26		#include <system_string.h>
27		#include <types.h>
28		#include <wide_string.h>
29
30		#include "libfwevt_debug.h"
31		#include "libfwevt_channel.h"
32		#include "libfwevt_libcerror.h"
33		#include "libfwevt_libcnotify.h"
34		#include "libfwevt_libuna.h"
35		#include "libfwevt_types.h"
36
37		#include "fwevt_template.h"
38
39		/* Creates a channel
40		* Make sure the value channel is referencing, is set to NULL
41		* Returns 1 if successful or -1 on error
42		*/
43		int libfwevt_channel_initialize(
44		libfwevt_channel_t **channel,
45		libcerror_error_t **error )
46	6.16k	{
47	6.16k	libfwevt_internal_channel_t *internal_channel = NULL;
48	6.16k	static char *function = "libfwevt_channel_initialize";
49
50	6.16k	if( channel == NULL )
51	0	{
52	0	libcerror_error_set(
53	0	error,
54	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
55	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
56	0	"%s: invalid channel.",
57	0	function );
58
59	0	return( -1 );
60	0	}
61	6.16k	if( *channel != NULL )
62	0	{
63	0	libcerror_error_set(
64	0	error,
65	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
66	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
67	0	"%s: invalid channel value already set.",
68	0	function );
69
70	0	return( -1 );
71	0	}
72	6.16k	internal_channel = memory_allocate_structure(
73	6.16k	libfwevt_internal_channel_t );
74
75	6.16k	if( internal_channel == NULL )
76	0	{
77	0	libcerror_error_set(
78	0	error,
79	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
80	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
81	0	"%s: unable to create channel.",
82	0	function );
83
84	0	goto on_error;
85	0	}
86	6.16k	if( memory_set(
87	6.16k	internal_channel,
88	6.16k	0,
89	6.16k	sizeof( libfwevt_internal_channel_t ) ) == NULL )
90	0	{
91	0	libcerror_error_set(
92	0	error,
93	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
94	0	LIBCERROR_MEMORY_ERROR_SET_FAILED,
95	0	"%s: unable to clear channel.",
96	0	function );
97
98	0	goto on_error;
99	0	}
100	6.16k	channel = (libfwevt_channel_t ) internal_channel;
101
102	6.16k	return( 1 );
103
104	0	on_error:
105	0	if( internal_channel != NULL )
106	0	{
107	0	memory_free(
108	0	internal_channel );
109	0	}
110	0	return( -1 );
111	6.16k	}
112
113		/* Frees a channel
114		* Returns 1 if successful or -1 on error
115		*/
116		int libfwevt_channel_free(
117		libfwevt_channel_t **channel,
118		libcerror_error_t **error )
119	0	{
120	0	static char *function = "libfwevt_channel_free";
121
122	0	if( channel == NULL )
123	0	{
124	0	libcerror_error_set(
125	0	error,
126	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
127	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
128	0	"%s: invalid WEVT channel descriptor.",
129	0	function );
130
131	0	return( -1 );
132	0	}
133	0	if( *channel != NULL )
134	0	{
135	0	*channel = NULL;
136	0	}
137	0	return( 1 );
138	0	}
139
140		/* Frees a channel
141		* Returns 1 if successful or -1 on error
142		*/
143		int libfwevt_internal_channel_free(
144		libfwevt_internal_channel_t **internal_channel,
145		libcerror_error_t **error )
146	6.16k	{
147	6.16k	static char *function = "libfwevt_internal_channel_free";
148
149	6.16k	if( internal_channel == NULL )
150	0	{
151	0	libcerror_error_set(
152	0	error,
153	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
154	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
155	0	"%s: invalid WEVT channel descriptor.",
156	0	function );
157
158	0	return( -1 );
159	0	}
160	6.16k	if( *internal_channel != NULL )
161	6.16k	{
162	6.16k	if( ( *internal_channel )->name != NULL )
163	457	{
164	457	memory_free(
165	457	( *internal_channel )->name );
166	457	}
167	6.16k	memory_free(
168	6.16k	*internal_channel );
169
170	6.16k	*internal_channel = NULL;
171	6.16k	}
172	6.16k	return( 1 );
173	6.16k	}
174
175		/* Reads the channel
176		* Returns 1 if successful or -1 on error
177		*/
178		int libfwevt_channel_read_data(
179		libfwevt_channel_t *channel,
180		const uint8_t *data,
181		size_t data_size,
182		size_t data_offset,
183		libcerror_error_t **error )
184	6.16k	{
185	6.16k	libfwevt_internal_channel_t *internal_channel = NULL;
186	6.16k	fwevt_template_channel_t *wevt_channel = NULL;
187	6.16k	static char *function = "libfwevt_channel_read_data";
188	6.16k	uint32_t name_offset = 0;
189	6.16k	uint32_t name_size = 0;
190
191		#if defined( HAVE_DEBUG_OUTPUT )
192		uint32_t value_32bit = 0;
193		#endif
194
195	6.16k	if( channel == NULL )
196	0	{
197	0	libcerror_error_set(
198	0	error,
199	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
200	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
201	0	"%s: invalid channel.",
202	0	function );
203
204	0	return( -1 );
205	0	}
206	6.16k	internal_channel = (libfwevt_internal_channel_t *) channel;
207
208	6.16k	if( internal_channel->name != NULL )
209	0	{
210	0	libcerror_error_set(
211	0	error,
212	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
213	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
214	0	"%s: invalid channel - name value already set.",
215	0	function );
216
217	0	return( -1 );
218	0	}
219	6.16k	if( data == NULL )
220	0	{
221	0	libcerror_error_set(
222	0	error,
223	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
224	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
225	0	"%s: invalid data.",
226	0	function );
227
228	0	return( -1 );
229	0	}
230	6.16k	if( data_size > (size_t) SSIZE_MAX )
231	0	{
232	0	libcerror_error_set(
233	0	error,
234	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
235	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
236	0	"%s: invalid data size value exceeds maximum.",
237	0	function );
238
239	0	return( -1 );
240	0	}
241	6.16k	if( data_offset >= data_size )
242	0	{
243	0	libcerror_error_set(
244	0	error,
245	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
246	0	LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
247	0	"%s: invalid data offset value out of bounds.",
248	0	function );
249
250	0	return( -1 );
251	0	}
252	6.16k	if( ( data_size < sizeof( fwevt_template_channel_t ) )
253	6.16k	\|\| ( data_offset > ( data_size - sizeof( fwevt_template_channel_t ) ) ) )
254	0	{
255	0	libcerror_error_set(
256	0	error,
257	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
258	0	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
259	0	"%s: invalid data value too small.",
260	0	function );
261
262	0	return( -1 );
263	0	}
264	6.16k	wevt_channel = (fwevt_template_channel_t *) &( data[ data_offset ] );
265
266		#if defined( HAVE_DEBUG_OUTPUT )
267		if( libcnotify_verbose != 0 )
268		{
269		libcnotify_printf(
270		"%s: channel data:\n",
271		function );
272		libcnotify_print_data(
273		(uint8_t *) wevt_channel,
274		sizeof( fwevt_template_channel_t ),
275		0 );
276		}
277		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
278
279	6.16k	byte_stream_copy_to_uint32_little_endian(
280	6.16k	wevt_channel->identifier,
281	6.16k	internal_channel->identifier );
282
283	6.16k	byte_stream_copy_to_uint32_little_endian(
284	6.16k	wevt_channel->name_offset,
285	6.16k	name_offset );
286
287		#if defined( HAVE_DEBUG_OUTPUT )
288		if( libcnotify_verbose != 0 )
289		{
290		libcnotify_printf(
291		"%s: identifier\t\t\t\t\t: %" PRIu32 "\n",
292		function,
293		internal_channel->identifier );
294
295		libcnotify_printf(
296		"%s: name offset\t\t\t\t\t: 0x%08" PRIx32 "\n",
297		function,
298		name_offset );
299
300		byte_stream_copy_to_uint32_little_endian(
301		wevt_channel->unknown1,
302		value_32bit );
303		libcnotify_printf(
304		"%s: unknown1\t\t\t\t\t: 0x%08" PRIx32 "\n",
305		function,
306		value_32bit );
307
308		byte_stream_copy_to_uint32_little_endian(
309		wevt_channel->message_identifier,
310		value_32bit );
311		libcnotify_printf(
312		"%s: message identifier\t\t\t\t: 0x%08" PRIx32 "\n",
313		function,
314		value_32bit );
315		}
316		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
317
318	6.16k	if( name_offset > 0 )
319	996	{
320	996	if( name_offset >= ( data_size - 4 ) )
321	80	{
322	80	libcerror_error_set(
323	80	error,
324	80	LIBCERROR_ERROR_DOMAIN_RUNTIME,
325	80	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
326	80	"%s: invalid name offset value out of bounds.",
327	80	function );
328
329	80	goto on_error;
330	80	}
331	916	byte_stream_copy_to_uint32_little_endian(
332	916	&( data[ name_offset ] ),
333	916	name_size );
334
335	916	if( ( data_size < name_size )
336	916	\|\| ( name_offset > ( data_size - name_size ) ) )
337	95	{
338	95	libcerror_error_set(
339	95	error,
340	95	LIBCERROR_ERROR_DOMAIN_RUNTIME,
341	95	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
342	95	"%s: invalid name size value out of bounds.",
343	95	function );
344
345	95	goto on_error;
346	95	}
347		#if defined( HAVE_DEBUG_OUTPUT )
348		if( libcnotify_verbose != 0 )
349		{
350		libcnotify_printf(
351		"%s: data:\n",
352		function );
353		libcnotify_print_data(
354		&( data[ name_offset ] ),
355		name_size,
356		0 );
357		}
358		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
359
360		#if defined( HAVE_DEBUG_OUTPUT )
361		if( libcnotify_verbose != 0 )
362		{
363		libcnotify_printf(
364		"%s: name size\t\t\t\t\t: %" PRIu32 "\n",
365		function,
366		name_size );
367		}
368		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
369
370	821	if( name_size >= 4 )
371	459	{
372	459	name_offset += 4;
373	459	name_size -= 4;
374
375	459	if( ( name_size == 0 )
376	459	\|\| ( name_size > ( MEMORY_MAXIMUM_ALLOCATION_SIZE / sizeof( uint8_t ) ) ) )
377	2	{
378	2	libcerror_error_set(
379	2	error,
380	2	LIBCERROR_ERROR_DOMAIN_RUNTIME,
381	2	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
382	2	"%s: invalid name size value out of bounds.",
383	2	function );
384
385	2	goto on_error;
386	2	}
387	457	internal_channel->name = (uint8_t *) memory_allocate(
388	457	sizeof( uint8_t ) * name_size );
389
390	457	if( internal_channel->name == NULL )
391	0	{
392	0	libcerror_error_set(
393	0	error,
394	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
395	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
396	0	"%s: unable to create name.",
397	0	function );
398
399	0	goto on_error;
400	0	}
401	457	internal_channel->name_size = (size_t) name_size;
402
403	457	if( memory_copy(
404	457	internal_channel->name,
405	457	&( data[ name_offset ] ),
406	457	(size_t) name_size ) == NULL )
407	0	{
408	0	libcerror_error_set(
409	0	error,
410	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
411	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
412	0	"%s: unable to copy name.",
413	0	function );
414
415	0	goto on_error;
416	0	}
417		#if defined( HAVE_DEBUG_OUTPUT )
418		if( libcnotify_verbose != 0 )
419		{
420		if( libfwevt_debug_print_utf16_string_value(
421		function,
422		"name\t\t\t\t\t",
423		internal_channel->name,
424		internal_channel->name_size,
425		LIBUNA_ENDIAN_LITTLE,
426		error ) != 1 )
427		{
428		libcerror_error_set(
429		error,
430		LIBCERROR_ERROR_DOMAIN_RUNTIME,
431		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
432		"%s: unable to print UTF-16 string value.",
433		function );
434
435		goto on_error;
436		}
437		}
438		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
439	457	}
440	821	}
441		#if defined( HAVE_DEBUG_OUTPUT )
442		if( libcnotify_verbose != 0 )
443		{
444		libcnotify_printf(
445		"\n" );
446		}
447		#endif
448	5.98k	return( 1 );
449
450	177	on_error:
451	177	if( internal_channel->name != NULL )
452	0	{
453	0	memory_free(
454	0	internal_channel->name );
455
456	0	internal_channel->name = NULL;
457	0	}
458	177	internal_channel->name_size = 0;
459
460	177	return( -1 );
461	6.16k	}
462
463		/* Retrieves the identifier
464		* Returns 1 if successful or -1 on error
465		*/
466		int libfwevt_channel_get_identifier(
467		libfwevt_channel_t *channel,
468		uint32_t *identifier,
469		libcerror_error_t **error )
470	0	{
471	0	libfwevt_internal_channel_t *internal_channel = NULL;
472	0	static char *function = "libfwevt_channel_get_identifier";
473
474	0	if( channel == NULL )
475	0	{
476	0	libcerror_error_set(
477	0	error,
478	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
479	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
480	0	"%s: invalid channel.",
481	0	function );
482
483	0	return( -1 );
484	0	}
485	0	internal_channel = (libfwevt_internal_channel_t *) channel;
486
487	0	if( identifier == NULL )
488	0	{
489	0	libcerror_error_set(
490	0	error,
491	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
492	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
493	0	"%s: invalid identifier.",
494	0	function );
495
496	0	return( -1 );
497	0	}
498	0	*identifier = internal_channel->identifier;
499
500	0	return( 1 );
501	0	}
502
503		/* Retrieves the size of the UTF-8 formatted name
504		* Returns 1 if successful, 0 if not available or -1 on error
505		*/
506		int libfwevt_channel_get_utf8_name_size(
507		libfwevt_channel_t *channel,
508		size_t *utf8_string_size,
509		libcerror_error_t **error )
510	0	{
511	0	libfwevt_internal_channel_t *internal_channel = NULL;
512	0	static char *function = "libfwevt_channel_get_utf8_name_size";
513
514	0	if( channel == NULL )
515	0	{
516	0	libcerror_error_set(
517	0	error,
518	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
519	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
520	0	"%s: invalid channel.",
521	0	function );
522
523	0	return( -1 );
524	0	}
525	0	internal_channel = (libfwevt_internal_channel_t *) channel;
526
527	0	if( ( internal_channel->name == NULL )
528	0	\|\| ( internal_channel->name_size == 0 ) )
529	0	{
530	0	return( 0 );
531	0	}
532	0	if( libuna_utf8_string_size_from_utf16_stream(
533	0	internal_channel->name,
534	0	internal_channel->name_size,
535	0	LIBUNA_ENDIAN_LITTLE,
536	0	utf8_string_size,
537	0	error ) != 1 )
538	0	{
539	0	libcerror_error_set(
540	0	error,
541	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
542	0	LIBCERROR_RUNTIME_ERROR_GET_FAILED,
543	0	"%s: unable to retrieve UTF-8 string size.",
544	0	function );
545
546	0	return( -1 );
547	0	}
548	0	return( 1 );
549	0	}
550
551		/* Retrieves the UTF-8 formatted name
552		* Returns 1 if successful, 0 if not available or -1 on error
553		*/
554		int libfwevt_channel_get_utf8_name(
555		libfwevt_channel_t *channel,
556		uint8_t *utf8_string,
557		size_t utf8_string_size,
558		libcerror_error_t **error )
559	0	{
560	0	libfwevt_internal_channel_t *internal_channel = NULL;
561	0	static char *function = "libfwevt_channel_get_utf8_name";
562
563	0	if( channel == NULL )
564	0	{
565	0	libcerror_error_set(
566	0	error,
567	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
568	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
569	0	"%s: invalid channel.",
570	0	function );
571
572	0	return( -1 );
573	0	}
574	0	internal_channel = (libfwevt_internal_channel_t *) channel;
575
576	0	if( ( internal_channel->name == NULL )
577	0	\|\| ( internal_channel->name_size == 0 ) )
578	0	{
579	0	return( 0 );
580	0	}
581	0	if( libuna_utf8_string_copy_from_utf16_stream(
582	0	utf8_string,
583	0	utf8_string_size,
584	0	internal_channel->name,
585	0	internal_channel->name_size,
586	0	LIBUNA_ENDIAN_LITTLE,
587	0	error ) != 1 )
588	0	{
589	0	libcerror_error_set(
590	0	error,
591	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
592	0	LIBCERROR_RUNTIME_ERROR_GET_FAILED,
593	0	"%s: unable to retrieve UTF-8 string.",
594	0	function );
595
596	0	return( -1 );
597	0	}
598	0	return( 1 );
599	0	}
600
601		/* Retrieves the size of the UTF-16 formatted name
602		* Returns 1 if successful, 0 if not available or -1 on error
603		*/
604		int libfwevt_channel_get_utf16_name_size(
605		libfwevt_channel_t *channel,
606		size_t *utf16_string_size,
607		libcerror_error_t **error )
608	0	{
609	0	libfwevt_internal_channel_t *internal_channel = NULL;
610	0	static char *function = "libfwevt_channel_get_utf16_name_size";
611
612	0	if( channel == NULL )
613	0	{
614	0	libcerror_error_set(
615	0	error,
616	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
617	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
618	0	"%s: invalid channel.",
619	0	function );
620
621	0	return( -1 );
622	0	}
623	0	internal_channel = (libfwevt_internal_channel_t *) channel;
624
625	0	if( ( internal_channel->name == NULL )
626	0	\|\| ( internal_channel->name_size == 0 ) )
627	0	{
628	0	return( 0 );
629	0	}
630	0	if( libuna_utf16_string_size_from_utf16_stream(
631	0	internal_channel->name,
632	0	internal_channel->name_size,
633	0	LIBUNA_ENDIAN_LITTLE,
634	0	utf16_string_size,
635	0	error ) != 1 )
636	0	{
637	0	libcerror_error_set(
638	0	error,
639	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
640	0	LIBCERROR_RUNTIME_ERROR_GET_FAILED,
641	0	"%s: unable to retrieve UTF-16 string size.",
642	0	function );
643
644	0	return( -1 );
645	0	}
646	0	return( 1 );
647	0	}
648
649		/* Retrieves the UTF-16 formatted name
650		* Returns 1 if successful, 0 if not available or -1 on error
651		*/
652		int libfwevt_channel_get_utf16_name(
653		libfwevt_channel_t *channel,
654		uint16_t *utf16_string,
655		size_t utf16_string_size,
656		libcerror_error_t **error )
657	0	{
658	0	libfwevt_internal_channel_t *internal_channel = NULL;
659	0	static char *function = "libfwevt_channel_get_utf16_name";
660
661	0	if( channel == NULL )
662	0	{
663	0	libcerror_error_set(
664	0	error,
665	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
666	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
667	0	"%s: invalid channel.",
668	0	function );
669
670	0	return( -1 );
671	0	}
672	0	internal_channel = (libfwevt_internal_channel_t *) channel;
673
674	0	if( ( internal_channel->name == NULL )
675	0	\|\| ( internal_channel->name_size == 0 ) )
676	0	{
677	0	return( 0 );
678	0	}
679	0	if( libuna_utf16_string_copy_from_utf16_stream(
680	0	utf16_string,
681	0	utf16_string_size,
682	0	internal_channel->name,
683	0	internal_channel->name_size,
684	0	LIBUNA_ENDIAN_LITTLE,
685	0	error ) != 1 )
686	0	{
687	0	libcerror_error_set(
688	0	error,
689	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
690	0	LIBCERROR_RUNTIME_ERROR_GET_FAILED,
691	0	"%s: unable to retrieve UTF-8 string.",
692	0	function );
693
694	0	return( -1 );
695	0	}
696	0	return( 1 );
697	0	}
698