/src/libfwsi/libfwsi/libfwsi_uri_values.c

Source (jump to first uncovered line)
/*
 * URI (shell item) values functions
 *
 * Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwsi_debug.h"
#include "libfwsi_libcerror.h"
#include "libfwsi_libcnotify.h"
#include "libfwsi_libfdatetime.h"
#include "libfwsi_libuna.h"
#include "libfwsi_uri_values.h"

/* Creates URI values
 * Make sure the value uri_values is referencing, is set to NULL
 * Returns 1 if successful or -1 on error
 */
int libfwsi_uri_values_initialize(
     libfwsi_uri_values_t **uri_values,
     libcerror_error_t **error )
{
  static char *function = "libfwsi_uri_values_initialize";

  if( uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid URI values.",
     function );

    return( -1 );
  }
  if( *uri_values != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid URI values value already set.",
     function );

    return( -1 );
  }
  *uri_values = memory_allocate_structure(
                 libfwsi_uri_values_t );

  if( *uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
     "%s: unable to create URI values.",
     function );

    goto on_error;
  }
  if( memory_set(
       *uri_values,
       0,
       sizeof( libfwsi_uri_values_t ) ) == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
     "%s: unable to clear URI values.",
     function );

    goto on_error;
  }
  return( 1 );

on_error:
  if( *uri_values != NULL )
  {
    memory_free(
     *uri_values );

    *uri_values = NULL;
  }
  return( -1 );
}

/* Frees URI values
 * Returns 1 if successful or -1 on error
 */
int libfwsi_uri_values_free(
     libfwsi_uri_values_t **uri_values,
     libcerror_error_t **error )
{
  static char *function = "libfwsi_uri_values_free";

  if( uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid URI values.",
     function );

    return( -1 );
  }
  if( *uri_values != NULL )
  {
    memory_free(
     *uri_values );

    *uri_values = NULL;
  }
  return( 1 );
}

/* Reads the URI values
 * Returns 1 if successful, 0 if not supported or -1 on error
 */
int libfwsi_uri_values_read_data(
     libfwsi_uri_values_t *uri_values,
     const uint8_t *data,
     size_t data_size,
     int ascii_codepage,
     libcerror_error_t **error )
{
  static char *function     = "libfwsi_uri_values_read_data";
  size_t data_offset        = 0;
  size_t string_size        = 0;
  uint32_t string_data_size = 0;
  uint16_t item_data_size   = 0;
  uint8_t flags             = 0;

#if defined( HAVE_DEBUG_OUTPUT )
  uint32_t value_32bit      = 0;
  uint16_t value_16bit      = 0;
#endif

  if( uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid URI values.",
     function );

    return( -1 );
  }
  if( data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid data.",
     function );

    return( -1 );
  }
  if( data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: data size exceeds maximum.",
     function );

    return( -1 );
  }
  /* Do not try to parse unsupported data sizes
   */
  if( data_size < 6 )
  {
    return( 0 );
  }
  /* Do not try to parse unknown class type indicators
   */
  if( data[ 2 ] != 0x61 )
  {
    return( 0 );
  }
  flags = data[ 3 ];

  byte_stream_copy_to_uint16_little_endian(
   &( data[ 4 ] ),
   item_data_size );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: flags\t\t\t\t\t: 0x%02" PRIx8 "\n",
     function,
     flags );

    libcnotify_printf(
     "%s: data size\t\t\t\t\t: %" PRIu16 "\n",
     function,
     item_data_size );
  }
#endif
  data_offset = 6;

  if( item_data_size > 0 )
  {
    if( item_data_size > ( data_size - 6 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: data:\n",
       function );
      libcnotify_print_data(
       &( data[ 6 ] ),
       item_data_size,
       LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );
    }
#endif
  }
#if defined( HAVE_DEBUG_OUTPUT )
  else if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "\n" );
  }
#endif
  if( item_data_size >= 36 )
  {
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      byte_stream_copy_to_uint32_little_endian(
       &( data[ 6 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown1\t\t\t\t\t: %" PRIu32 "\n",
       function,
       value_32bit );

      byte_stream_copy_to_uint32_little_endian(
       &( data[ 10 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown2\t\t\t\t\t: %" PRIu32 "\n",
       function,
       value_32bit );

      if( libfwsi_debug_print_filetime_value(
           function,
           "unknown3 time\t\t\t\t",
           &( data[ 14 ] ),
           8,
           LIBFDATETIME_ENDIAN_LITTLE,
           LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print filetime value.",
         function );

        return( -1 );
      }
      byte_stream_copy_to_uint32_little_endian(
       &( data[ 22 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown4\t\t\t\t\t: 0x%08" PRIx32 "\n",
       function,
       value_32bit );

      libcnotify_printf(
       "%s: unknown5:\n",
       function );
      libcnotify_print_data(
       &( data[ 26 ] ),
       12,
       0 );

      byte_stream_copy_to_uint32_little_endian(
       &( data[ 38 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown6\t\t\t\t\t: %" PRIu32 "\n",
       function,
       value_32bit );
    }
#endif
    data_offset    += 36;
    item_data_size -= 36;

    if( data_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ data_offset ] ),
     string_data_size );

    data_offset += 4;

    if( ( item_data_size < 4 )
     || ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid string1 data size value out of bounds.",
       function );

      return( -1 );
    }
    item_data_size -= 4;

    if( data_offset >= data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: string1 data size\t\t\t\t: %" PRIu32 "\n",
       function,
       string_data_size );

      libcnotify_printf(
       "%s: string1 data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       string_data_size,
       0 );
    }
#endif
    data_offset    += string_data_size;
    item_data_size -= string_data_size;

    if( data_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ data_offset ] ),
     string_data_size );

    data_offset += 4;

    if( ( item_data_size < 4 )
     || ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid string2 data size value out of bounds.",
       function );

      return( -1 );
    }
    item_data_size -= 4;

    if( data_offset >= data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: string2 data size\t\t\t\t: %" PRIu32 "\n",
       function,
       string_data_size );

      libcnotify_printf(
       "%s: string2 data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       string_data_size,
       0 );
    }
#endif
    data_offset    += string_data_size;
    item_data_size -= string_data_size;

    if( data_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ data_offset ] ),
     string_data_size );

    data_offset += 4;

    if( ( item_data_size < 4 )
     || ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid string3 data size value out of bounds.",
       function );

      return( -1 );
    }
    item_data_size -= 4;

    if( data_offset >= data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: string3 data size\t\t\t\t: %" PRIu32 "\n",
       function,
       string_data_size );

      if( string_data_size > item_data_size )
      {
        string_data_size = item_data_size;
      }
      libcnotify_printf(
       "%s: string3 data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       string_data_size,
       0 );
    }
#endif
    data_offset    += string_data_size;
    item_data_size -= string_data_size;
  }
  if( item_data_size > 0 )
  {
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: trailing data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       item_data_size,
       0 );
    }
#endif
    data_offset += item_data_size;
  }
  if( data_offset >= data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid data size value out of bounds.",
     function );

    return( -1 );
  }
  /* Determine the URI size
   */
  if( ( flags & 0x80 ) != 0 )
  {
    for( string_size = data_offset;
         ( string_size + 1 ) < data_size;
         string_size += 2 )
    {
      if( ( data[ string_size ] == 0 )
       && ( data[ string_size + 1 ] == 0 ) )
      {
        string_size += 2;

        break;
      }
    }
    string_size -= data_offset;
  }
  else
  {
    for( string_size = data_offset;
         string_size < data_size;
         string_size++ )
    {
      if( data[ string_size ] == 0 )
      {
        string_size++;

        break;
      }
    }
    string_size -= data_offset;
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    if( ( flags & 0x80 ) != 0 )
    {
      if( libfwsi_debug_print_utf16_string_value(
           function,
           "URI\t\t\t\t\t",
           &( data[ data_offset ] ),
           string_size,
           LIBUNA_ENDIAN_LITTLE,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print UTF-16 string value.",
         function );

        return( -1 );
      }
    }
    else
    {
      if( libfwsi_debug_print_string_value(
           function,
           "URI\t\t\t\t\t",
           &( data[ data_offset ] ),
           string_size,
           ascii_codepage,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print string value.",
         function );

        return( -1 );
      }
    }
  }
#endif
  data_offset += string_size;

/* TODO value likely controlled by flags */
  if( data_offset < data_size )
  {
    if( data_offset >= ( data_size - 2 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      byte_stream_copy_to_uint16_little_endian(
       &( data[ data_offset ] ),
       value_16bit );

      libcnotify_printf(
       "%s: unknown9\t\t\t\t\t: %" PRIu16 "\n",
       function,
       value_16bit );
    }
#endif
    data_offset += 2;
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "\n" );
  }
#endif
  return( 1 );
}


Coverage Report

Created: 2024-02-25 07:20

Line	Count	Source (jump to first uncovered line)
1		/*
2		* URI (shell item) values functions
3		*
4		* Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwsi_debug.h"
28		#include "libfwsi_libcerror.h"
29		#include "libfwsi_libcnotify.h"
30		#include "libfwsi_libfdatetime.h"
31		#include "libfwsi_libuna.h"
32		#include "libfwsi_uri_values.h"
33
34		/* Creates URI values
35		* Make sure the value uri_values is referencing, is set to NULL
36		* Returns 1 if successful or -1 on error
37		*/
38		int libfwsi_uri_values_initialize(
39		libfwsi_uri_values_t **uri_values,
40		libcerror_error_t **error )
41	0	{
42	0	static char *function = "libfwsi_uri_values_initialize";
43
44	0	if( uri_values == NULL )
45	0	{
46	0	libcerror_error_set(
47	0	error,
48	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
49	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
50	0	"%s: invalid URI values.",
51	0	function );
52
53	0	return( -1 );
54	0	}
55	0	if( *uri_values != NULL )
56	0	{
57	0	libcerror_error_set(
58	0	error,
59	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
60	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
61	0	"%s: invalid URI values value already set.",
62	0	function );
63
64	0	return( -1 );
65	0	}
66	0	*uri_values = memory_allocate_structure(
67	0	libfwsi_uri_values_t );
68
69	0	if( *uri_values == NULL )
70	0	{
71	0	libcerror_error_set(
72	0	error,
73	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
74	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
75	0	"%s: unable to create URI values.",
76	0	function );
77
78	0	goto on_error;
79	0	}
80	0	if( memory_set(
81	0	*uri_values,
82	0	0,
83	0	sizeof( libfwsi_uri_values_t ) ) == NULL )
84	0	{
85	0	libcerror_error_set(
86	0	error,
87	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
88	0	LIBCERROR_MEMORY_ERROR_SET_FAILED,
89	0	"%s: unable to clear URI values.",
90	0	function );
91
92	0	goto on_error;
93	0	}
94	0	return( 1 );
95
96	0	on_error:
97	0	if( *uri_values != NULL )
98	0	{
99	0	memory_free(
100	0	*uri_values );
101
102	0	*uri_values = NULL;
103	0	}
104	0	return( -1 );
105	0	}
106
107		/* Frees URI values
108		* Returns 1 if successful or -1 on error
109		*/
110		int libfwsi_uri_values_free(
111		libfwsi_uri_values_t **uri_values,
112		libcerror_error_t **error )
113	0	{
114	0	static char *function = "libfwsi_uri_values_free";
115
116	0	if( uri_values == NULL )
117	0	{
118	0	libcerror_error_set(
119	0	error,
120	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
121	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
122	0	"%s: invalid URI values.",
123	0	function );
124
125	0	return( -1 );
126	0	}
127	0	if( *uri_values != NULL )
128	0	{
129	0	memory_free(
130	0	*uri_values );
131
132	0	*uri_values = NULL;
133	0	}
134	0	return( 1 );
135	0	}
136
137		/* Reads the URI values
138		* Returns 1 if successful, 0 if not supported or -1 on error
139		*/
140		int libfwsi_uri_values_read_data(
141		libfwsi_uri_values_t *uri_values,
142		const uint8_t *data,
143		size_t data_size,
144		int ascii_codepage,
145		libcerror_error_t **error )
146	0	{
147	0	static char *function = "libfwsi_uri_values_read_data";
148	0	size_t data_offset = 0;
149	0	size_t string_size = 0;
150	0	uint32_t string_data_size = 0;
151	0	uint16_t item_data_size = 0;
152	0	uint8_t flags = 0;
153
154		#if defined( HAVE_DEBUG_OUTPUT )
155		uint32_t value_32bit = 0;
156		uint16_t value_16bit = 0;
157		#endif
158
159	0	if( uri_values == NULL )
160	0	{
161	0	libcerror_error_set(
162	0	error,
163	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
164	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
165	0	"%s: invalid URI values.",
166	0	function );
167
168	0	return( -1 );
169	0	}
170	0	if( data == NULL )
171	0	{
172	0	libcerror_error_set(
173	0	error,
174	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
175	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
176	0	"%s: invalid data.",
177	0	function );
178
179	0	return( -1 );
180	0	}
181	0	if( data_size > (size_t) SSIZE_MAX )
182	0	{
183	0	libcerror_error_set(
184	0	error,
185	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
186	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
187	0	"%s: data size exceeds maximum.",
188	0	function );
189
190	0	return( -1 );
191	0	}
192		/* Do not try to parse unsupported data sizes
193		*/
194	0	if( data_size < 6 )
195	0	{
196	0	return( 0 );
197	0	}
198		/* Do not try to parse unknown class type indicators
199		*/
200	0	if( data[ 2 ] != 0x61 )
201	0	{
202	0	return( 0 );
203	0	}
204	0	flags = data[ 3 ];
205
206	0	byte_stream_copy_to_uint16_little_endian(
207	0	&( data[ 4 ] ),
208	0	item_data_size );
209
210		#if defined( HAVE_DEBUG_OUTPUT )
211		if( libcnotify_verbose != 0 )
212		{
213		libcnotify_printf(
214		"%s: flags\t\t\t\t\t: 0x%02" PRIx8 "\n",
215		function,
216		flags );
217
218		libcnotify_printf(
219		"%s: data size\t\t\t\t\t: %" PRIu16 "\n",
220		function,
221		item_data_size );
222		}
223		#endif
224	0	data_offset = 6;
225
226	0	if( item_data_size > 0 )
227	0	{
228	0	if( item_data_size > ( data_size - 6 ) )
229	0	{
230	0	libcerror_error_set(
231	0	error,
232	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
233	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
234	0	"%s: invalid data size value out of bounds.",
235	0	function );
236
237	0	return( -1 );
238	0	}
239		#if defined( HAVE_DEBUG_OUTPUT )
240		if( libcnotify_verbose != 0 )
241		{
242		libcnotify_printf(
243		"%s: data:\n",
244		function );
245		libcnotify_print_data(
246		&( data[ 6 ] ),
247		item_data_size,
248		LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );
249		}
250		#endif
251	0	}
252		#if defined( HAVE_DEBUG_OUTPUT )
253		else if( libcnotify_verbose != 0 )
254		{
255		libcnotify_printf(
256		"\n" );
257		}
258		#endif
259	0	if( item_data_size >= 36 )
260	0	{
261		#if defined( HAVE_DEBUG_OUTPUT )
262		if( libcnotify_verbose != 0 )
263		{
264		byte_stream_copy_to_uint32_little_endian(
265		&( data[ 6 ] ),
266		value_32bit );
267		libcnotify_printf(
268		"%s: unknown1\t\t\t\t\t: %" PRIu32 "\n",
269		function,
270		value_32bit );
271
272		byte_stream_copy_to_uint32_little_endian(
273		&( data[ 10 ] ),
274		value_32bit );
275		libcnotify_printf(
276		"%s: unknown2\t\t\t\t\t: %" PRIu32 "\n",
277		function,
278		value_32bit );
279
280		if( libfwsi_debug_print_filetime_value(
281		function,
282		"unknown3 time\t\t\t\t",
283		&( data[ 14 ] ),
284		8,
285		LIBFDATETIME_ENDIAN_LITTLE,
286		LIBFDATETIME_STRING_FORMAT_TYPE_CTIME \| LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,
287		error ) != 1 )
288		{
289		libcerror_error_set(
290		error,
291		LIBCERROR_ERROR_DOMAIN_RUNTIME,
292		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
293		"%s: unable to print filetime value.",
294		function );
295
296		return( -1 );
297		}
298		byte_stream_copy_to_uint32_little_endian(
299		&( data[ 22 ] ),
300		value_32bit );
301		libcnotify_printf(
302		"%s: unknown4\t\t\t\t\t: 0x%08" PRIx32 "\n",
303		function,
304		value_32bit );
305
306		libcnotify_printf(
307		"%s: unknown5:\n",
308		function );
309		libcnotify_print_data(
310		&( data[ 26 ] ),
311		12,
312		0 );
313
314		byte_stream_copy_to_uint32_little_endian(
315		&( data[ 38 ] ),
316		value_32bit );
317		libcnotify_printf(
318		"%s: unknown6\t\t\t\t\t: %" PRIu32 "\n",
319		function,
320		value_32bit );
321		}
322		#endif
323	0	data_offset += 36;
324	0	item_data_size -= 36;
325
326	0	if( data_offset >= ( data_size - 4 ) )
327	0	{
328	0	libcerror_error_set(
329	0	error,
330	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
331	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
332	0	"%s: invalid data size value out of bounds.",
333	0	function );
334
335	0	return( -1 );
336	0	}
337	0	byte_stream_copy_to_uint32_little_endian(
338	0	&( data[ data_offset ] ),
339	0	string_data_size );
340
341	0	data_offset += 4;
342
343	0	if( ( item_data_size < 4 )
344	0	\|\| ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
345	0	{
346	0	libcerror_error_set(
347	0	error,
348	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
349	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
350	0	"%s: invalid string1 data size value out of bounds.",
351	0	function );
352
353	0	return( -1 );
354	0	}
355	0	item_data_size -= 4;
356
357	0	if( data_offset >= data_size )
358	0	{
359	0	libcerror_error_set(
360	0	error,
361	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
362	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
363	0	"%s: invalid data size value out of bounds.",
364	0	function );
365
366	0	return( -1 );
367	0	}
368		#if defined( HAVE_DEBUG_OUTPUT )
369		if( libcnotify_verbose != 0 )
370		{
371		libcnotify_printf(
372		"%s: string1 data size\t\t\t\t: %" PRIu32 "\n",
373		function,
374		string_data_size );
375
376		libcnotify_printf(
377		"%s: string1 data:\n",
378		function );
379		libcnotify_print_data(
380		&( data[ data_offset ] ),
381		string_data_size,
382		0 );
383		}
384		#endif
385	0	data_offset += string_data_size;
386	0	item_data_size -= string_data_size;
387
388	0	if( data_offset >= ( data_size - 4 ) )
389	0	{
390	0	libcerror_error_set(
391	0	error,
392	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
393	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
394	0	"%s: invalid data size value out of bounds.",
395	0	function );
396
397	0	return( -1 );
398	0	}
399	0	byte_stream_copy_to_uint32_little_endian(
400	0	&( data[ data_offset ] ),
401	0	string_data_size );
402
403	0	data_offset += 4;
404
405	0	if( ( item_data_size < 4 )
406	0	\|\| ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
407	0	{
408	0	libcerror_error_set(
409	0	error,
410	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
411	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
412	0	"%s: invalid string2 data size value out of bounds.",
413	0	function );
414
415	0	return( -1 );
416	0	}
417	0	item_data_size -= 4;
418
419	0	if( data_offset >= data_size )
420	0	{
421	0	libcerror_error_set(
422	0	error,
423	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
424	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
425	0	"%s: invalid data size value out of bounds.",
426	0	function );
427
428	0	return( -1 );
429	0	}
430		#if defined( HAVE_DEBUG_OUTPUT )
431		if( libcnotify_verbose != 0 )
432		{
433		libcnotify_printf(
434		"%s: string2 data size\t\t\t\t: %" PRIu32 "\n",
435		function,
436		string_data_size );
437
438		libcnotify_printf(
439		"%s: string2 data:\n",
440		function );
441		libcnotify_print_data(
442		&( data[ data_offset ] ),
443		string_data_size,
444		0 );
445		}
446		#endif
447	0	data_offset += string_data_size;
448	0	item_data_size -= string_data_size;
449
450	0	if( data_offset >= ( data_size - 4 ) )
451	0	{
452	0	libcerror_error_set(
453	0	error,
454	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
455	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
456	0	"%s: invalid data size value out of bounds.",
457	0	function );
458
459	0	return( -1 );
460	0	}
461	0	byte_stream_copy_to_uint32_little_endian(
462	0	&( data[ data_offset ] ),
463	0	string_data_size );
464
465	0	data_offset += 4;
466
467	0	if( ( item_data_size < 4 )
468	0	\|\| ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
469	0	{
470	0	libcerror_error_set(
471	0	error,
472	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
473	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
474	0	"%s: invalid string3 data size value out of bounds.",
475	0	function );
476
477	0	return( -1 );
478	0	}
479	0	item_data_size -= 4;
480
481	0	if( data_offset >= data_size )
482	0	{
483	0	libcerror_error_set(
484	0	error,
485	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
486	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
487	0	"%s: invalid data size value out of bounds.",
488	0	function );
489
490	0	return( -1 );
491	0	}
492		#if defined( HAVE_DEBUG_OUTPUT )
493		if( libcnotify_verbose != 0 )
494		{
495		libcnotify_printf(
496		"%s: string3 data size\t\t\t\t: %" PRIu32 "\n",
497		function,
498		string_data_size );
499
500		if( string_data_size > item_data_size )
501		{
502		string_data_size = item_data_size;
503		}
504		libcnotify_printf(
505		"%s: string3 data:\n",
506		function );
507		libcnotify_print_data(
508		&( data[ data_offset ] ),
509		string_data_size,
510		0 );
511		}
512		#endif
513	0	data_offset += string_data_size;
514	0	item_data_size -= string_data_size;
515	0	}
516	0	if( item_data_size > 0 )
517	0	{
518		#if defined( HAVE_DEBUG_OUTPUT )
519		if( libcnotify_verbose != 0 )
520		{
521		libcnotify_printf(
522		"%s: trailing data:\n",
523		function );
524		libcnotify_print_data(
525		&( data[ data_offset ] ),
526		item_data_size,
527		0 );
528		}
529		#endif
530	0	data_offset += item_data_size;
531	0	}
532	0	if( data_offset >= data_size )
533	0	{
534	0	libcerror_error_set(
535	0	error,
536	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
537	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
538	0	"%s: invalid data size value out of bounds.",
539	0	function );
540
541	0	return( -1 );
542	0	}
543		/* Determine the URI size
544		*/
545	0	if( ( flags & 0x80 ) != 0 )
546	0	{
547	0	for( string_size = data_offset;
548	0	( string_size + 1 ) < data_size;
549	0	string_size += 2 )
550	0	{
551	0	if( ( data[ string_size ] == 0 )
552	0	&& ( data[ string_size + 1 ] == 0 ) )
553	0	{
554	0	string_size += 2;
555
556	0	break;
557	0	}
558	0	}
559	0	string_size -= data_offset;
560	0	}
561	0	else
562	0	{
563	0	for( string_size = data_offset;
564	0	string_size < data_size;
565	0	string_size++ )
566	0	{
567	0	if( data[ string_size ] == 0 )
568	0	{
569	0	string_size++;
570
571	0	break;
572	0	}
573	0	}
574	0	string_size -= data_offset;
575	0	}
576		#if defined( HAVE_DEBUG_OUTPUT )
577		if( libcnotify_verbose != 0 )
578		{
579		if( ( flags & 0x80 ) != 0 )
580		{
581		if( libfwsi_debug_print_utf16_string_value(
582		function,
583		"URI\t\t\t\t\t",
584		&( data[ data_offset ] ),
585		string_size,
586		LIBUNA_ENDIAN_LITTLE,
587		error ) != 1 )
588		{
589		libcerror_error_set(
590		error,
591		LIBCERROR_ERROR_DOMAIN_RUNTIME,
592		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
593		"%s: unable to print UTF-16 string value.",
594		function );
595
596		return( -1 );
597		}
598		}
599		else
600		{
601		if( libfwsi_debug_print_string_value(
602		function,
603		"URI\t\t\t\t\t",
604		&( data[ data_offset ] ),
605		string_size,
606		ascii_codepage,
607		error ) != 1 )
608		{
609		libcerror_error_set(
610		error,
611		LIBCERROR_ERROR_DOMAIN_RUNTIME,
612		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
613		"%s: unable to print string value.",
614		function );
615
616		return( -1 );
617		}
618		}
619		}
620		#endif
621	0	data_offset += string_size;
622
623		/* TODO value likely controlled by flags */
624	0	if( data_offset < data_size )
625	0	{
626	0	if( data_offset >= ( data_size - 2 ) )
627	0	{
628	0	libcerror_error_set(
629	0	error,
630	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
631	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
632	0	"%s: invalid data size value out of bounds.",
633	0	function );
634
635	0	return( -1 );
636	0	}
637		#if defined( HAVE_DEBUG_OUTPUT )
638		if( libcnotify_verbose != 0 )
639		{
640		byte_stream_copy_to_uint16_little_endian(
641		&( data[ data_offset ] ),
642		value_16bit );
643
644		libcnotify_printf(
645		"%s: unknown9\t\t\t\t\t: %" PRIu16 "\n",
646		function,
647		value_16bit );
648		}
649		#endif
650	0	data_offset += 2;
651	0	}
652		#if defined( HAVE_DEBUG_OUTPUT )
653		if( libcnotify_verbose != 0 )
654		{
655		libcnotify_printf(
656		"\n" );
657		}
658		#endif
659	0	return( 1 );
660	0	}
661