/src/libevtx/libfwevt/libfwevt_template_item.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Template item functions |
3 | | * |
4 | | * Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com> |
5 | | * |
6 | | * Refer to AUTHORS for acknowledgements. |
7 | | * |
8 | | * This program is free software: you can redistribute it and/or modify |
9 | | * it under the terms of the GNU Lesser General Public License as published by |
10 | | * the Free Software Foundation, either version 3 of the License, or |
11 | | * (at your option) any later version. |
12 | | * |
13 | | * This program is distributed in the hope that it will be useful, |
14 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | | * GNU General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
20 | | */ |
21 | | |
22 | | #include <common.h> |
23 | | #include <byte_stream.h> |
24 | | #include <memory.h> |
25 | | #include <narrow_string.h> |
26 | | #include <system_string.h> |
27 | | #include <types.h> |
28 | | #include <wide_string.h> |
29 | | |
30 | | #include "libfwevt_debug.h" |
31 | | #include "libfwevt_template_item.h" |
32 | | #include "libfwevt_libcerror.h" |
33 | | #include "libfwevt_libcnotify.h" |
34 | | #include "libfwevt_libuna.h" |
35 | | #include "libfwevt_types.h" |
36 | | |
37 | | /* Creates a template item |
38 | | * Make sure the value template_item is referencing, is set to NULL |
39 | | * Returns 1 if successful or -1 on error |
40 | | */ |
41 | | int libfwevt_template_item_initialize( |
42 | | libfwevt_template_item_t **template_item, |
43 | | libcerror_error_t **error ) |
44 | 2.44k | { |
45 | 2.44k | libfwevt_internal_template_item_t *internal_template_item = NULL; |
46 | 2.44k | static char *function = "libfwevt_template_item_initialize"; |
47 | | |
48 | 2.44k | if( template_item == NULL ) |
49 | 0 | { |
50 | 0 | libcerror_error_set( |
51 | 0 | error, |
52 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
53 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
54 | 0 | "%s: invalid template item.", |
55 | 0 | function ); |
56 | |
|
57 | 0 | return( -1 ); |
58 | 0 | } |
59 | 2.44k | if( *template_item != NULL ) |
60 | 0 | { |
61 | 0 | libcerror_error_set( |
62 | 0 | error, |
63 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
64 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
65 | 0 | "%s: invalid template item value already set.", |
66 | 0 | function ); |
67 | |
|
68 | 0 | return( -1 ); |
69 | 0 | } |
70 | 2.44k | internal_template_item = memory_allocate_structure( |
71 | 2.44k | libfwevt_internal_template_item_t ); |
72 | | |
73 | 2.44k | if( internal_template_item == NULL ) |
74 | 0 | { |
75 | 0 | libcerror_error_set( |
76 | 0 | error, |
77 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
78 | 0 | LIBCERROR_MEMORY_ERROR_INSUFFICIENT, |
79 | 0 | "%s: unable to create template item.", |
80 | 0 | function ); |
81 | |
|
82 | 0 | goto on_error; |
83 | 0 | } |
84 | 2.44k | if( memory_set( |
85 | 2.44k | internal_template_item, |
86 | 2.44k | 0, |
87 | 2.44k | sizeof( libfwevt_internal_template_item_t ) ) == NULL ) |
88 | 0 | { |
89 | 0 | libcerror_error_set( |
90 | 0 | error, |
91 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
92 | 0 | LIBCERROR_MEMORY_ERROR_SET_FAILED, |
93 | 0 | "%s: unable to clear template item.", |
94 | 0 | function ); |
95 | |
|
96 | 0 | goto on_error; |
97 | 0 | } |
98 | 2.44k | *template_item = (libfwevt_template_item_t *) internal_template_item; |
99 | | |
100 | 2.44k | return( 1 ); |
101 | | |
102 | 0 | on_error: |
103 | 0 | if( internal_template_item != NULL ) |
104 | 0 | { |
105 | 0 | memory_free( |
106 | 0 | internal_template_item ); |
107 | 0 | } |
108 | 0 | return( -1 ); |
109 | 2.44k | } |
110 | | |
111 | | /* Frees a template item |
112 | | * Returns 1 if successful or -1 on error |
113 | | */ |
114 | | int libfwevt_template_item_free( |
115 | | libfwevt_template_item_t **template_item, |
116 | | libcerror_error_t **error ) |
117 | 0 | { |
118 | 0 | static char *function = "libfwevt_template_item_free"; |
119 | |
|
120 | 0 | if( template_item == NULL ) |
121 | 0 | { |
122 | 0 | libcerror_error_set( |
123 | 0 | error, |
124 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
125 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
126 | 0 | "%s: invalid template item.", |
127 | 0 | function ); |
128 | |
|
129 | 0 | return( -1 ); |
130 | 0 | } |
131 | 0 | if( *template_item != NULL ) |
132 | 0 | { |
133 | 0 | *template_item = NULL; |
134 | 0 | } |
135 | 0 | return( 1 ); |
136 | 0 | } |
137 | | |
138 | | /* Frees a template item |
139 | | * Returns 1 if successful or -1 on error |
140 | | */ |
141 | | int libfwevt_internal_template_item_free( |
142 | | libfwevt_internal_template_item_t **internal_template_item, |
143 | | libcerror_error_t **error ) |
144 | 2.44k | { |
145 | 2.44k | static char *function = "libfwevt_internal_template_item_free"; |
146 | | |
147 | 2.44k | if( internal_template_item == NULL ) |
148 | 0 | { |
149 | 0 | libcerror_error_set( |
150 | 0 | error, |
151 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
152 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
153 | 0 | "%s: invalid template item.", |
154 | 0 | function ); |
155 | |
|
156 | 0 | return( -1 ); |
157 | 0 | } |
158 | 2.44k | if( *internal_template_item != NULL ) |
159 | 2.44k | { |
160 | 2.44k | if( ( *internal_template_item )->name != NULL ) |
161 | 278 | { |
162 | 278 | memory_free( |
163 | 278 | ( *internal_template_item )->name ); |
164 | 278 | } |
165 | 2.44k | memory_free( |
166 | 2.44k | *internal_template_item ); |
167 | | |
168 | 2.44k | *internal_template_item = NULL; |
169 | 2.44k | } |
170 | 2.44k | return( 1 ); |
171 | 2.44k | } |
172 | | |
173 | | /* Reads the template item |
174 | | * Returns 1 if successful or -1 on error |
175 | | */ |
176 | | int libfwevt_template_item_read_data( |
177 | | libfwevt_template_item_t *template_item, |
178 | | const uint8_t *data, |
179 | | size_t data_size, |
180 | | size_t data_offset, |
181 | | size_t template_data_offset, |
182 | | libcerror_error_t **error ) |
183 | 2.44k | { |
184 | 2.44k | libfwevt_internal_template_item_t *internal_template_item = NULL; |
185 | 2.44k | static char *function = "libfwevt_template_item_read_data"; |
186 | 2.44k | uint32_t name_offset = 0; |
187 | 2.44k | uint32_t name_size = 0; |
188 | | |
189 | | #if defined( HAVE_DEBUG_OUTPUT ) |
190 | | uint32_t value_32bit = 0; |
191 | | uint16_t value_16bit = 0; |
192 | | #endif |
193 | | |
194 | 2.44k | if( template_item == NULL ) |
195 | 0 | { |
196 | 0 | libcerror_error_set( |
197 | 0 | error, |
198 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
199 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
200 | 0 | "%s: invalid template item.", |
201 | 0 | function ); |
202 | |
|
203 | 0 | return( -1 ); |
204 | 0 | } |
205 | 2.44k | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
206 | | |
207 | 2.44k | if( internal_template_item->name != NULL ) |
208 | 0 | { |
209 | 0 | libcerror_error_set( |
210 | 0 | error, |
211 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
212 | 0 | LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET, |
213 | 0 | "%s: invalid template item - name value already set.", |
214 | 0 | function ); |
215 | |
|
216 | 0 | return( -1 ); |
217 | 0 | } |
218 | 2.44k | if( data == NULL ) |
219 | 0 | { |
220 | 0 | libcerror_error_set( |
221 | 0 | error, |
222 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
223 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
224 | 0 | "%s: invalid data.", |
225 | 0 | function ); |
226 | |
|
227 | 0 | return( -1 ); |
228 | 0 | } |
229 | 2.44k | if( data_size > (size_t) SSIZE_MAX ) |
230 | 0 | { |
231 | 0 | libcerror_error_set( |
232 | 0 | error, |
233 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
234 | 0 | LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, |
235 | 0 | "%s: invalid data size value exceeds maximum.", |
236 | 0 | function ); |
237 | |
|
238 | 0 | return( -1 ); |
239 | 0 | } |
240 | 2.44k | if( data_offset >= data_size ) |
241 | 0 | { |
242 | 0 | libcerror_error_set( |
243 | 0 | error, |
244 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
245 | 0 | LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS, |
246 | 0 | "%s: invalid data offset value out of bounds.", |
247 | 0 | function ); |
248 | |
|
249 | 0 | return( -1 ); |
250 | 0 | } |
251 | 2.44k | if( ( data_size < 20 ) |
252 | 2.44k | || ( data_offset > ( data_size - 20 ) ) ) |
253 | 8 | { |
254 | 8 | libcerror_error_set( |
255 | 8 | error, |
256 | 8 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
257 | 8 | LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL, |
258 | 8 | "%s: invalid data value too small.", |
259 | 8 | function ); |
260 | | |
261 | 8 | return( -1 ); |
262 | 8 | } |
263 | | #if defined( HAVE_DEBUG_OUTPUT ) |
264 | | if( libcnotify_verbose != 0 ) |
265 | | { |
266 | | libcnotify_printf( |
267 | | "%s: template item data:\n", |
268 | | function ); |
269 | | libcnotify_print_data( |
270 | | &( data[ data_offset ] ), |
271 | | 20, |
272 | | 0 ); |
273 | | } |
274 | | #endif |
275 | | /* TODO change xml template value to handle this type */ |
276 | 2.43k | internal_template_item->input_data_type = data[ data_offset + 4 ]; |
277 | | |
278 | 2.43k | internal_template_item->output_data_type = data[ data_offset + 5 ]; |
279 | | |
280 | 2.43k | byte_stream_copy_to_uint16_little_endian( |
281 | 2.43k | &( data[ data_offset + 12 ] ), |
282 | 2.43k | internal_template_item->number_of_values ); |
283 | | |
284 | 2.43k | byte_stream_copy_to_uint16_little_endian( |
285 | 2.43k | &( data[ data_offset + 14 ] ), |
286 | 2.43k | internal_template_item->value_data_size ); |
287 | | |
288 | 2.43k | byte_stream_copy_to_uint32_little_endian( |
289 | 2.43k | &( data[ data_offset + 16 ] ), |
290 | 2.43k | name_offset ); |
291 | | |
292 | | #if defined( HAVE_DEBUG_OUTPUT ) |
293 | | if( libcnotify_verbose != 0 ) |
294 | | { |
295 | | byte_stream_copy_to_uint32_little_endian( |
296 | | &( data[ data_offset ] ), |
297 | | value_32bit ); |
298 | | libcnotify_printf( |
299 | | "%s: unknown1\t\t\t\t: 0x%08" PRIx32 "\n", |
300 | | function, |
301 | | value_32bit ); |
302 | | |
303 | | libcnotify_printf( |
304 | | "%s: input data type\t\t\t: 0x%02" PRIx8 " (", |
305 | | function, |
306 | | internal_template_item->input_data_type ); |
307 | | libfwevt_debug_print_input_data_type( |
308 | | internal_template_item->input_data_type ); |
309 | | libcnotify_printf( |
310 | | ")\n" ); |
311 | | |
312 | | libcnotify_printf( |
313 | | "%s: output data type\t\t\t: 0x%02" PRIx8 " (", |
314 | | function, |
315 | | internal_template_item->output_data_type ); |
316 | | libfwevt_debug_print_output_data_type( |
317 | | internal_template_item->output_data_type ); |
318 | | libcnotify_printf( |
319 | | ")\n" ); |
320 | | |
321 | | byte_stream_copy_to_uint16_little_endian( |
322 | | &( data[ data_offset + 6 ] ), |
323 | | value_16bit ); |
324 | | libcnotify_printf( |
325 | | "%s: unknown3\t\t\t\t: 0x%04" PRIx16 "\n", |
326 | | function, |
327 | | value_16bit ); |
328 | | |
329 | | byte_stream_copy_to_uint32_little_endian( |
330 | | &( data[ data_offset + 8 ] ), |
331 | | value_32bit ); |
332 | | libcnotify_printf( |
333 | | "%s: unknown4\t\t\t\t: 0x%08" PRIx32 "\n", |
334 | | function, |
335 | | value_32bit ); |
336 | | |
337 | | libcnotify_printf( |
338 | | "%s: number of values\t\t\t: %" PRIu16 "\n", |
339 | | function, |
340 | | internal_template_item->number_of_values ); |
341 | | |
342 | | libcnotify_printf( |
343 | | "%s: value data size\t\t\t: %" PRIu16 "\n", |
344 | | function, |
345 | | internal_template_item->value_data_size ); |
346 | | |
347 | | libcnotify_printf( |
348 | | "%s: name offset\t\t\t\t: 0x%08" PRIx32 "\n", |
349 | | function, |
350 | | name_offset ); |
351 | | } |
352 | | #endif /* defined( HAVE_DEBUG_OUTPUT ) */ |
353 | | |
354 | 2.43k | internal_template_item->name_offset = name_offset; |
355 | | |
356 | 2.43k | if( name_offset > 0 ) |
357 | 1.01k | { |
358 | 1.01k | if( name_offset < template_data_offset ) |
359 | 5 | { |
360 | 5 | libcerror_error_set( |
361 | 5 | error, |
362 | 5 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
363 | 5 | LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, |
364 | 5 | "%s: invalid name offset value out of bounds.", |
365 | 5 | function ); |
366 | | |
367 | 5 | goto on_error; |
368 | 5 | } |
369 | 1.00k | name_offset -= template_data_offset; |
370 | | |
371 | 1.00k | if( name_offset >= ( data_size - 4 ) ) |
372 | 117 | { |
373 | 117 | libcerror_error_set( |
374 | 117 | error, |
375 | 117 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
376 | 117 | LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, |
377 | 117 | "%s: invalid name offset value out of bounds.", |
378 | 117 | function ); |
379 | | |
380 | 117 | goto on_error; |
381 | 117 | } |
382 | 889 | byte_stream_copy_to_uint32_little_endian( |
383 | 889 | &( data[ name_offset ] ), |
384 | 889 | name_size ); |
385 | | |
386 | 889 | if( ( data_size < name_size ) |
387 | 889 | || ( name_offset > ( data_size - name_size ) ) ) |
388 | 31 | { |
389 | 31 | libcerror_error_set( |
390 | 31 | error, |
391 | 31 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
392 | 31 | LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, |
393 | 31 | "%s: invalid name size value out of bounds.", |
394 | 31 | function ); |
395 | | |
396 | 31 | goto on_error; |
397 | 31 | } |
398 | | #if defined( HAVE_DEBUG_OUTPUT ) |
399 | | if( libcnotify_verbose != 0 ) |
400 | | { |
401 | | libcnotify_printf( |
402 | | "%s: data:\n", |
403 | | function ); |
404 | | libcnotify_print_data( |
405 | | &( data[ name_offset ] ), |
406 | | name_size, |
407 | | 0 ); |
408 | | } |
409 | | #endif /* defined( HAVE_DEBUG_OUTPUT ) */ |
410 | | |
411 | | #if defined( HAVE_DEBUG_OUTPUT ) |
412 | | if( libcnotify_verbose != 0 ) |
413 | | { |
414 | | libcnotify_printf( |
415 | | "%s: name size\t\t\t\t: %" PRIu32 "\n", |
416 | | function, |
417 | | name_size ); |
418 | | } |
419 | | #endif /* defined( HAVE_DEBUG_OUTPUT ) */ |
420 | | |
421 | 858 | if( name_size >= 4 ) |
422 | 279 | { |
423 | 279 | name_offset += 4; |
424 | 279 | name_size -= 4; |
425 | | |
426 | 279 | if( ( name_size == 0 ) |
427 | 279 | || ( name_size > ( MEMORY_MAXIMUM_ALLOCATION_SIZE / sizeof( uint8_t ) ) ) ) |
428 | 1 | { |
429 | 1 | libcerror_error_set( |
430 | 1 | error, |
431 | 1 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
432 | 1 | LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, |
433 | 1 | "%s: invalid name size value out of bounds.", |
434 | 1 | function ); |
435 | | |
436 | 1 | goto on_error; |
437 | 1 | } |
438 | 278 | internal_template_item->name = (uint8_t *) memory_allocate( |
439 | 278 | sizeof( uint8_t ) * name_size ); |
440 | | |
441 | 278 | if( internal_template_item->name == NULL ) |
442 | 0 | { |
443 | 0 | libcerror_error_set( |
444 | 0 | error, |
445 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
446 | 0 | LIBCERROR_MEMORY_ERROR_INSUFFICIENT, |
447 | 0 | "%s: unable to create name.", |
448 | 0 | function ); |
449 | |
|
450 | 0 | goto on_error; |
451 | 0 | } |
452 | 278 | internal_template_item->name_size = (size_t) name_size; |
453 | | |
454 | 278 | if( memory_copy( |
455 | 278 | internal_template_item->name, |
456 | 278 | &( data[ name_offset ] ), |
457 | 278 | (size_t) name_size ) == NULL ) |
458 | 0 | { |
459 | 0 | libcerror_error_set( |
460 | 0 | error, |
461 | 0 | LIBCERROR_ERROR_DOMAIN_MEMORY, |
462 | 0 | LIBCERROR_MEMORY_ERROR_COPY_FAILED, |
463 | 0 | "%s: unable to copy name.", |
464 | 0 | function ); |
465 | |
|
466 | 0 | goto on_error; |
467 | 0 | } |
468 | | #if defined( HAVE_DEBUG_OUTPUT ) |
469 | | if( libcnotify_verbose != 0 ) |
470 | | { |
471 | | if( libfwevt_debug_print_utf16_string_value( |
472 | | function, |
473 | | "name\t\t\t\t\t", |
474 | | internal_template_item->name, |
475 | | internal_template_item->name_size, |
476 | | LIBUNA_ENDIAN_LITTLE, |
477 | | error ) != 1 ) |
478 | | { |
479 | | libcerror_error_set( |
480 | | error, |
481 | | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
482 | | LIBCERROR_RUNTIME_ERROR_PRINT_FAILED, |
483 | | "%s: unable to print UTF-16 string value.", |
484 | | function ); |
485 | | |
486 | | goto on_error; |
487 | | } |
488 | | } |
489 | | #endif /* defined( HAVE_DEBUG_OUTPUT ) */ |
490 | 278 | } |
491 | 858 | } |
492 | | #if defined( HAVE_DEBUG_OUTPUT ) |
493 | | if( libcnotify_verbose != 0 ) |
494 | | { |
495 | | libcnotify_printf( |
496 | | "\n" ); |
497 | | } |
498 | | #endif |
499 | 2.28k | return( 1 ); |
500 | | |
501 | 154 | on_error: |
502 | 154 | if( internal_template_item->name != NULL ) |
503 | 0 | { |
504 | 0 | memory_free( |
505 | 0 | internal_template_item->name ); |
506 | |
|
507 | 0 | internal_template_item->name = NULL; |
508 | 0 | } |
509 | 154 | internal_template_item->name_size = 0; |
510 | | |
511 | 154 | return( -1 ); |
512 | 2.43k | } |
513 | | |
514 | | /* Retrieves the input data type |
515 | | * Returns 1 if successful or -1 on error |
516 | | */ |
517 | | int libfwevt_template_item_get_input_data_type( |
518 | | libfwevt_template_item_t *template_item, |
519 | | uint8_t *input_data_type, |
520 | | libcerror_error_t **error ) |
521 | 0 | { |
522 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
523 | 0 | static char *function = "libfwevt_template_item_get_input_data_type"; |
524 | |
|
525 | 0 | if( template_item == NULL ) |
526 | 0 | { |
527 | 0 | libcerror_error_set( |
528 | 0 | error, |
529 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
530 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
531 | 0 | "%s: invalid template item.", |
532 | 0 | function ); |
533 | |
|
534 | 0 | return( -1 ); |
535 | 0 | } |
536 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
537 | |
|
538 | 0 | if( input_data_type == NULL ) |
539 | 0 | { |
540 | 0 | libcerror_error_set( |
541 | 0 | error, |
542 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
543 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
544 | 0 | "%s: invalid input data type.", |
545 | 0 | function ); |
546 | |
|
547 | 0 | return( -1 ); |
548 | 0 | } |
549 | 0 | *input_data_type = internal_template_item->input_data_type; |
550 | |
|
551 | 0 | return( 1 ); |
552 | 0 | } |
553 | | |
554 | | /* Retrieves the output data type |
555 | | * Returns 1 if successful or -1 on error |
556 | | */ |
557 | | int libfwevt_template_item_get_output_data_type( |
558 | | libfwevt_template_item_t *template_item, |
559 | | uint8_t *output_data_type, |
560 | | libcerror_error_t **error ) |
561 | 0 | { |
562 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
563 | 0 | static char *function = "libfwevt_template_item_get_output_data_type"; |
564 | |
|
565 | 0 | if( template_item == NULL ) |
566 | 0 | { |
567 | 0 | libcerror_error_set( |
568 | 0 | error, |
569 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
570 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
571 | 0 | "%s: invalid template item.", |
572 | 0 | function ); |
573 | |
|
574 | 0 | return( -1 ); |
575 | 0 | } |
576 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
577 | |
|
578 | 0 | if( output_data_type == NULL ) |
579 | 0 | { |
580 | 0 | libcerror_error_set( |
581 | 0 | error, |
582 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
583 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
584 | 0 | "%s: invalid output data type.", |
585 | 0 | function ); |
586 | |
|
587 | 0 | return( -1 ); |
588 | 0 | } |
589 | 0 | *output_data_type = internal_template_item->output_data_type; |
590 | |
|
591 | 0 | return( 1 ); |
592 | 0 | } |
593 | | |
594 | | /* Retrieves the number of values |
595 | | * Returns 1 if successful or -1 on error |
596 | | */ |
597 | | int libfwevt_template_item_get_number_of_values( |
598 | | libfwevt_template_item_t *template_item, |
599 | | uint16_t *number_of_values, |
600 | | libcerror_error_t **error ) |
601 | 0 | { |
602 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
603 | 0 | static char *function = "libfwevt_template_item_get_number_of_values"; |
604 | |
|
605 | 0 | if( template_item == NULL ) |
606 | 0 | { |
607 | 0 | libcerror_error_set( |
608 | 0 | error, |
609 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
610 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
611 | 0 | "%s: invalid template item.", |
612 | 0 | function ); |
613 | |
|
614 | 0 | return( -1 ); |
615 | 0 | } |
616 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
617 | |
|
618 | 0 | if( number_of_values == NULL ) |
619 | 0 | { |
620 | 0 | libcerror_error_set( |
621 | 0 | error, |
622 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
623 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
624 | 0 | "%s: invalid number of values.", |
625 | 0 | function ); |
626 | |
|
627 | 0 | return( -1 ); |
628 | 0 | } |
629 | 0 | *number_of_values = internal_template_item->number_of_values; |
630 | |
|
631 | 0 | return( 1 ); |
632 | 0 | } |
633 | | |
634 | | /* Retrieves the value data size |
635 | | * Returns 1 if successful or -1 on error |
636 | | */ |
637 | | int libfwevt_template_item_get_value_data_size( |
638 | | libfwevt_template_item_t *template_item, |
639 | | uint16_t *value_data_size, |
640 | | libcerror_error_t **error ) |
641 | 0 | { |
642 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
643 | 0 | static char *function = "libfwevt_template_item_get_value_data_size"; |
644 | |
|
645 | 0 | if( template_item == NULL ) |
646 | 0 | { |
647 | 0 | libcerror_error_set( |
648 | 0 | error, |
649 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
650 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
651 | 0 | "%s: invalid template item.", |
652 | 0 | function ); |
653 | |
|
654 | 0 | return( -1 ); |
655 | 0 | } |
656 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
657 | |
|
658 | 0 | if( value_data_size == NULL ) |
659 | 0 | { |
660 | 0 | libcerror_error_set( |
661 | 0 | error, |
662 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
663 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
664 | 0 | "%s: invalid value data size.", |
665 | 0 | function ); |
666 | |
|
667 | 0 | return( -1 ); |
668 | 0 | } |
669 | 0 | *value_data_size = internal_template_item->value_data_size; |
670 | |
|
671 | 0 | return( 1 ); |
672 | 0 | } |
673 | | |
674 | | /* Retrieves the size of the UTF-8 formatted name |
675 | | * Returns 1 if successful, 0 if not available or -1 on error |
676 | | */ |
677 | | int libfwevt_template_item_get_utf8_name_size( |
678 | | libfwevt_template_item_t *template_item, |
679 | | size_t *utf8_string_size, |
680 | | libcerror_error_t **error ) |
681 | 0 | { |
682 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
683 | 0 | static char *function = "libfwevt_template_item_get_utf8_name_size"; |
684 | |
|
685 | 0 | if( template_item == NULL ) |
686 | 0 | { |
687 | 0 | libcerror_error_set( |
688 | 0 | error, |
689 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
690 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
691 | 0 | "%s: invalid template item.", |
692 | 0 | function ); |
693 | |
|
694 | 0 | return( -1 ); |
695 | 0 | } |
696 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
697 | |
|
698 | 0 | if( ( internal_template_item->name == NULL ) |
699 | 0 | || ( internal_template_item->name_size == 0 ) ) |
700 | 0 | { |
701 | 0 | return( 0 ); |
702 | 0 | } |
703 | 0 | if( libuna_utf8_string_size_from_utf16_stream( |
704 | 0 | internal_template_item->name, |
705 | 0 | internal_template_item->name_size, |
706 | 0 | LIBUNA_ENDIAN_LITTLE, |
707 | 0 | utf8_string_size, |
708 | 0 | error ) != 1 ) |
709 | 0 | { |
710 | 0 | libcerror_error_set( |
711 | 0 | error, |
712 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
713 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
714 | 0 | "%s: unable to retrieve UTF-8 string size.", |
715 | 0 | function ); |
716 | |
|
717 | 0 | return( -1 ); |
718 | 0 | } |
719 | 0 | return( 1 ); |
720 | 0 | } |
721 | | |
722 | | /* Retrieves the UTF-8 formatted name |
723 | | * Returns 1 if successful, 0 if not available or -1 on error |
724 | | */ |
725 | | int libfwevt_template_item_get_utf8_name( |
726 | | libfwevt_template_item_t *template_item, |
727 | | uint8_t *utf8_string, |
728 | | size_t utf8_string_size, |
729 | | libcerror_error_t **error ) |
730 | 0 | { |
731 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
732 | 0 | static char *function = "libfwevt_template_item_get_utf8_name"; |
733 | |
|
734 | 0 | if( template_item == NULL ) |
735 | 0 | { |
736 | 0 | libcerror_error_set( |
737 | 0 | error, |
738 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
739 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
740 | 0 | "%s: invalid template item.", |
741 | 0 | function ); |
742 | |
|
743 | 0 | return( -1 ); |
744 | 0 | } |
745 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
746 | |
|
747 | 0 | if( ( internal_template_item->name == NULL ) |
748 | 0 | || ( internal_template_item->name_size == 0 ) ) |
749 | 0 | { |
750 | 0 | return( 0 ); |
751 | 0 | } |
752 | 0 | if( libuna_utf8_string_copy_from_utf16_stream( |
753 | 0 | utf8_string, |
754 | 0 | utf8_string_size, |
755 | 0 | internal_template_item->name, |
756 | 0 | internal_template_item->name_size, |
757 | 0 | LIBUNA_ENDIAN_LITTLE, |
758 | 0 | error ) != 1 ) |
759 | 0 | { |
760 | 0 | libcerror_error_set( |
761 | 0 | error, |
762 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
763 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
764 | 0 | "%s: unable to retrieve UTF-8 string.", |
765 | 0 | function ); |
766 | |
|
767 | 0 | return( -1 ); |
768 | 0 | } |
769 | 0 | return( 1 ); |
770 | 0 | } |
771 | | |
772 | | /* Retrieves the size of the UTF-16 formatted name |
773 | | * Returns 1 if successful, 0 if not available or -1 on error |
774 | | */ |
775 | | int libfwevt_template_item_get_utf16_name_size( |
776 | | libfwevt_template_item_t *template_item, |
777 | | size_t *utf16_string_size, |
778 | | libcerror_error_t **error ) |
779 | 0 | { |
780 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
781 | 0 | static char *function = "libfwevt_template_item_get_utf16_name_size"; |
782 | |
|
783 | 0 | if( template_item == NULL ) |
784 | 0 | { |
785 | 0 | libcerror_error_set( |
786 | 0 | error, |
787 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
788 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
789 | 0 | "%s: invalid template item.", |
790 | 0 | function ); |
791 | |
|
792 | 0 | return( -1 ); |
793 | 0 | } |
794 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
795 | |
|
796 | 0 | if( ( internal_template_item->name == NULL ) |
797 | 0 | || ( internal_template_item->name_size == 0 ) ) |
798 | 0 | { |
799 | 0 | return( 0 ); |
800 | 0 | } |
801 | 0 | if( libuna_utf16_string_size_from_utf16_stream( |
802 | 0 | internal_template_item->name, |
803 | 0 | internal_template_item->name_size, |
804 | 0 | LIBUNA_ENDIAN_LITTLE, |
805 | 0 | utf16_string_size, |
806 | 0 | error ) != 1 ) |
807 | 0 | { |
808 | 0 | libcerror_error_set( |
809 | 0 | error, |
810 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
811 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
812 | 0 | "%s: unable to retrieve UTF-16 string size.", |
813 | 0 | function ); |
814 | |
|
815 | 0 | return( -1 ); |
816 | 0 | } |
817 | 0 | return( 1 ); |
818 | 0 | } |
819 | | |
820 | | /* Retrieves the UTF-16 formatted name |
821 | | * Returns 1 if successful, 0 if not available or -1 on error |
822 | | */ |
823 | | int libfwevt_template_item_get_utf16_name( |
824 | | libfwevt_template_item_t *template_item, |
825 | | uint16_t *utf16_string, |
826 | | size_t utf16_string_size, |
827 | | libcerror_error_t **error ) |
828 | 0 | { |
829 | 0 | libfwevt_internal_template_item_t *internal_template_item = NULL; |
830 | 0 | static char *function = "libfwevt_template_item_get_utf16_name"; |
831 | |
|
832 | 0 | if( template_item == NULL ) |
833 | 0 | { |
834 | 0 | libcerror_error_set( |
835 | 0 | error, |
836 | 0 | LIBCERROR_ERROR_DOMAIN_ARGUMENTS, |
837 | 0 | LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, |
838 | 0 | "%s: invalid template item.", |
839 | 0 | function ); |
840 | |
|
841 | 0 | return( -1 ); |
842 | 0 | } |
843 | 0 | internal_template_item = (libfwevt_internal_template_item_t *) template_item; |
844 | |
|
845 | 0 | if( ( internal_template_item->name == NULL ) |
846 | 0 | || ( internal_template_item->name_size == 0 ) ) |
847 | 0 | { |
848 | 0 | return( 0 ); |
849 | 0 | } |
850 | 0 | if( libuna_utf16_string_copy_from_utf16_stream( |
851 | 0 | utf16_string, |
852 | 0 | utf16_string_size, |
853 | 0 | internal_template_item->name, |
854 | 0 | internal_template_item->name_size, |
855 | 0 | LIBUNA_ENDIAN_LITTLE, |
856 | 0 | error ) != 1 ) |
857 | 0 | { |
858 | 0 | libcerror_error_set( |
859 | 0 | error, |
860 | 0 | LIBCERROR_ERROR_DOMAIN_RUNTIME, |
861 | 0 | LIBCERROR_RUNTIME_ERROR_GET_FAILED, |
862 | 0 | "%s: unable to retrieve UTF-8 string.", |
863 | 0 | function ); |
864 | |
|
865 | 0 | return( -1 ); |
866 | 0 | } |
867 | 0 | return( 1 ); |
868 | 0 | } |
869 | | |