/src/libfwevt/libfwevt/libfwevt_template_item.c
Line  | Count  | Source (jump to first uncovered line)  | 
1  |  | /*  | 
2  |  |  * Template item functions  | 
3  |  |  *  | 
4  |  |  * Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>  | 
5  |  |  *  | 
6  |  |  * Refer to AUTHORS for acknowledgements.  | 
7  |  |  *  | 
8  |  |  * This program is free software: you can redistribute it and/or modify  | 
9  |  |  * it under the terms of the GNU Lesser General Public License as published by  | 
10  |  |  * the Free Software Foundation, either version 3 of the License, or  | 
11  |  |  * (at your option) any later version.  | 
12  |  |  *  | 
13  |  |  * This program is distributed in the hope that it will be useful,  | 
14  |  |  * but WITHOUT ANY WARRANTY; without even the implied warranty of  | 
15  |  |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  | 
16  |  |  * GNU General Public License for more details.  | 
17  |  |  *  | 
18  |  |  * You should have received a copy of the GNU Lesser General Public License  | 
19  |  |  * along with this program.  If not, see <https://www.gnu.org/licenses/>.  | 
20  |  |  */  | 
21  |  |  | 
22  |  | #include <common.h>  | 
23  |  | #include <byte_stream.h>  | 
24  |  | #include <memory.h>  | 
25  |  | #include <narrow_string.h>  | 
26  |  | #include <system_string.h>  | 
27  |  | #include <types.h>  | 
28  |  | #include <wide_string.h>  | 
29  |  |  | 
30  |  | #include "libfwevt_debug.h"  | 
31  |  | #include "libfwevt_template_item.h"  | 
32  |  | #include "libfwevt_libcerror.h"  | 
33  |  | #include "libfwevt_libcnotify.h"  | 
34  |  | #include "libfwevt_libuna.h"  | 
35  |  | #include "libfwevt_types.h"  | 
36  |  |  | 
37  |  | /* Creates a template item  | 
38  |  |  * Make sure the value template_item is referencing, is set to NULL  | 
39  |  |  * Returns 1 if successful or -1 on error  | 
40  |  |  */  | 
41  |  | int libfwevt_template_item_initialize(  | 
42  |  |      libfwevt_template_item_t **template_item,  | 
43  |  |      libcerror_error_t **error )  | 
44  | 1.85k  | { | 
45  | 1.85k  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
46  | 1.85k  |   static char *function                                     = "libfwevt_template_item_initialize";  | 
47  |  |  | 
48  | 1.85k  |   if( template_item == NULL )  | 
49  | 0  |   { | 
50  | 0  |     libcerror_error_set(  | 
51  | 0  |      error,  | 
52  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
53  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
54  | 0  |      "%s: invalid template item.",  | 
55  | 0  |      function );  | 
56  |  | 
  | 
57  | 0  |     return( -1 );  | 
58  | 0  |   }  | 
59  | 1.85k  |   if( *template_item != NULL )  | 
60  | 0  |   { | 
61  | 0  |     libcerror_error_set(  | 
62  | 0  |      error,  | 
63  | 0  |      LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
64  | 0  |      LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,  | 
65  | 0  |      "%s: invalid template item value already set.",  | 
66  | 0  |      function );  | 
67  |  | 
  | 
68  | 0  |     return( -1 );  | 
69  | 0  |   }  | 
70  | 1.85k  |   internal_template_item = memory_allocate_structure(  | 
71  | 1.85k  |                             libfwevt_internal_template_item_t );  | 
72  |  |  | 
73  | 1.85k  |   if( internal_template_item == NULL )  | 
74  | 0  |   { | 
75  | 0  |     libcerror_error_set(  | 
76  | 0  |      error,  | 
77  | 0  |      LIBCERROR_ERROR_DOMAIN_MEMORY,  | 
78  | 0  |      LIBCERROR_MEMORY_ERROR_INSUFFICIENT,  | 
79  | 0  |      "%s: unable to create template item.",  | 
80  | 0  |      function );  | 
81  |  | 
  | 
82  | 0  |     goto on_error;  | 
83  | 0  |   }  | 
84  | 1.85k  |   if( memory_set(  | 
85  | 1.85k  |        internal_template_item,  | 
86  | 1.85k  |        0,  | 
87  | 1.85k  |        sizeof( libfwevt_internal_template_item_t ) ) == NULL )  | 
88  | 0  |   { | 
89  | 0  |     libcerror_error_set(  | 
90  | 0  |      error,  | 
91  | 0  |      LIBCERROR_ERROR_DOMAIN_MEMORY,  | 
92  | 0  |      LIBCERROR_MEMORY_ERROR_SET_FAILED,  | 
93  | 0  |      "%s: unable to clear template item.",  | 
94  | 0  |      function );  | 
95  |  | 
  | 
96  | 0  |     goto on_error;  | 
97  | 0  |   }  | 
98  | 1.85k  |   *template_item = (libfwevt_template_item_t *) internal_template_item;  | 
99  |  |  | 
100  | 1.85k  |   return( 1 );  | 
101  |  |  | 
102  | 0  | on_error:  | 
103  | 0  |   if( internal_template_item != NULL )  | 
104  | 0  |   { | 
105  | 0  |     memory_free(  | 
106  | 0  |      internal_template_item );  | 
107  | 0  |   }  | 
108  | 0  |   return( -1 );  | 
109  | 1.85k  | }  | 
110  |  |  | 
111  |  | /* Frees a template item  | 
112  |  |  * Returns 1 if successful or -1 on error  | 
113  |  |  */  | 
114  |  | int libfwevt_template_item_free(  | 
115  |  |      libfwevt_template_item_t **template_item,  | 
116  |  |      libcerror_error_t **error )  | 
117  | 0  | { | 
118  | 0  |   static char *function = "libfwevt_template_item_free";  | 
119  |  | 
  | 
120  | 0  |   if( template_item == NULL )  | 
121  | 0  |   { | 
122  | 0  |     libcerror_error_set(  | 
123  | 0  |      error,  | 
124  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
125  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
126  | 0  |      "%s: invalid template item.",  | 
127  | 0  |      function );  | 
128  |  | 
  | 
129  | 0  |     return( -1 );  | 
130  | 0  |   }  | 
131  | 0  |   if( *template_item != NULL )  | 
132  | 0  |   { | 
133  | 0  |     *template_item = NULL;  | 
134  | 0  |   }  | 
135  | 0  |   return( 1 );  | 
136  | 0  | }  | 
137  |  |  | 
138  |  | /* Frees a template item  | 
139  |  |  * Returns 1 if successful or -1 on error  | 
140  |  |  */  | 
141  |  | int libfwevt_internal_template_item_free(  | 
142  |  |      libfwevt_internal_template_item_t **internal_template_item,  | 
143  |  |      libcerror_error_t **error )  | 
144  | 1.85k  | { | 
145  | 1.85k  |   static char *function = "libfwevt_internal_template_item_free";  | 
146  |  |  | 
147  | 1.85k  |   if( internal_template_item == NULL )  | 
148  | 0  |   { | 
149  | 0  |     libcerror_error_set(  | 
150  | 0  |      error,  | 
151  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
152  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
153  | 0  |      "%s: invalid template item.",  | 
154  | 0  |      function );  | 
155  |  | 
  | 
156  | 0  |     return( -1 );  | 
157  | 0  |   }  | 
158  | 1.85k  |   if( *internal_template_item != NULL )  | 
159  | 1.85k  |   { | 
160  | 1.85k  |     if( ( *internal_template_item )->name != NULL )  | 
161  | 241  |     { | 
162  | 241  |       memory_free(  | 
163  | 241  |        ( *internal_template_item )->name );  | 
164  | 241  |     }  | 
165  | 1.85k  |     memory_free(  | 
166  | 1.85k  |      *internal_template_item );  | 
167  |  |  | 
168  | 1.85k  |     *internal_template_item = NULL;  | 
169  | 1.85k  |   }  | 
170  | 1.85k  |   return( 1 );  | 
171  | 1.85k  | }  | 
172  |  |  | 
173  |  | /* Reads the template item  | 
174  |  |  * Returns 1 if successful or -1 on error  | 
175  |  |  */  | 
176  |  | int libfwevt_template_item_read_data(  | 
177  |  |      libfwevt_template_item_t *template_item,  | 
178  |  |      const uint8_t *data,  | 
179  |  |      size_t data_size,  | 
180  |  |      size_t data_offset,  | 
181  |  |      size_t template_data_offset,  | 
182  |  |      libcerror_error_t **error )  | 
183  | 1.85k  | { | 
184  | 1.85k  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
185  | 1.85k  |   static char *function                                     = "libfwevt_template_item_read_data";  | 
186  | 1.85k  |   uint32_t name_offset                                      = 0;  | 
187  | 1.85k  |   uint32_t name_size                                        = 0;  | 
188  |  |  | 
189  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
190  |  |   uint32_t value_32bit                                      = 0;  | 
191  |  |   uint16_t value_16bit                                      = 0;  | 
192  |  | #endif  | 
193  |  |  | 
194  | 1.85k  |   if( template_item == NULL )  | 
195  | 0  |   { | 
196  | 0  |     libcerror_error_set(  | 
197  | 0  |      error,  | 
198  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
199  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
200  | 0  |      "%s: invalid template item.",  | 
201  | 0  |      function );  | 
202  |  | 
  | 
203  | 0  |     return( -1 );  | 
204  | 0  |   }  | 
205  | 1.85k  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
206  |  |  | 
207  | 1.85k  |   if( internal_template_item->name != NULL )  | 
208  | 0  |   { | 
209  | 0  |     libcerror_error_set(  | 
210  | 0  |      error,  | 
211  | 0  |      LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
212  | 0  |      LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,  | 
213  | 0  |      "%s: invalid template item - name value already set.",  | 
214  | 0  |      function );  | 
215  |  | 
  | 
216  | 0  |     return( -1 );  | 
217  | 0  |   }  | 
218  | 1.85k  |   if( data == NULL )  | 
219  | 0  |   { | 
220  | 0  |     libcerror_error_set(  | 
221  | 0  |      error,  | 
222  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
223  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
224  | 0  |      "%s: invalid data.",  | 
225  | 0  |      function );  | 
226  |  | 
  | 
227  | 0  |     return( -1 );  | 
228  | 0  |   }  | 
229  | 1.85k  |   if( data_size > (size_t) SSIZE_MAX )  | 
230  | 0  |   { | 
231  | 0  |     libcerror_error_set(  | 
232  | 0  |      error,  | 
233  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
234  | 0  |      LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,  | 
235  | 0  |      "%s: invalid data size value exceeds maximum.",  | 
236  | 0  |      function );  | 
237  |  | 
  | 
238  | 0  |     return( -1 );  | 
239  | 0  |   }  | 
240  | 1.85k  |   if( data_offset >= data_size )  | 
241  | 0  |   { | 
242  | 0  |     libcerror_error_set(  | 
243  | 0  |      error,  | 
244  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
245  | 0  |      LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,  | 
246  | 0  |      "%s: invalid data offset value out of bounds.",  | 
247  | 0  |      function );  | 
248  |  | 
  | 
249  | 0  |     return( -1 );  | 
250  | 0  |   }  | 
251  | 1.85k  |   if( ( data_size < 20 )  | 
252  | 1.85k  |    || ( data_offset > ( data_size - 20 ) ) )  | 
253  | 19  |   { | 
254  | 19  |     libcerror_error_set(  | 
255  | 19  |      error,  | 
256  | 19  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
257  | 19  |      LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,  | 
258  | 19  |      "%s: invalid data value too small.",  | 
259  | 19  |      function );  | 
260  |  |  | 
261  | 19  |     return( -1 );  | 
262  | 19  |   }  | 
263  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
264  |  |   if( libcnotify_verbose != 0 )  | 
265  |  |   { | 
266  |  |     libcnotify_printf(  | 
267  |  |      "%s: template item data:\n",  | 
268  |  |      function );  | 
269  |  |     libcnotify_print_data(  | 
270  |  |      &( data[ data_offset ] ),  | 
271  |  |      20,  | 
272  |  |      0 );  | 
273  |  |   }  | 
274  |  | #endif  | 
275  |  | /* TODO change xml template value to handle this type */  | 
276  | 1.83k  |   internal_template_item->input_data_type = data[ data_offset + 4 ];  | 
277  |  |  | 
278  | 1.83k  |   internal_template_item->output_data_type = data[ data_offset + 5 ];  | 
279  |  |  | 
280  | 1.83k  |   byte_stream_copy_to_uint16_little_endian(  | 
281  | 1.83k  |    &( data[ data_offset + 12 ] ),  | 
282  | 1.83k  |    internal_template_item->number_of_values );  | 
283  |  |  | 
284  | 1.83k  |   byte_stream_copy_to_uint16_little_endian(  | 
285  | 1.83k  |    &( data[ data_offset + 14 ] ),  | 
286  | 1.83k  |    internal_template_item->value_data_size );  | 
287  |  |  | 
288  | 1.83k  |   byte_stream_copy_to_uint32_little_endian(  | 
289  | 1.83k  |    &( data[ data_offset + 16 ] ),  | 
290  | 1.83k  |    name_offset );  | 
291  |  |  | 
292  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
293  |  |   if( libcnotify_verbose != 0 )  | 
294  |  |   { | 
295  |  |     byte_stream_copy_to_uint32_little_endian(  | 
296  |  |      &( data[ data_offset ] ),  | 
297  |  |      value_32bit );  | 
298  |  |     libcnotify_printf(  | 
299  |  |      "%s: unknown1\t\t\t\t: 0x%08" PRIx32 "\n",  | 
300  |  |      function,  | 
301  |  |      value_32bit );  | 
302  |  |  | 
303  |  |     libcnotify_printf(  | 
304  |  |      "%s: input data type\t\t\t: 0x%02" PRIx8 " (", | 
305  |  |      function,  | 
306  |  |      internal_template_item->input_data_type );  | 
307  |  |     libfwevt_debug_print_input_data_type(  | 
308  |  |      internal_template_item->input_data_type );  | 
309  |  |     libcnotify_printf(  | 
310  |  |      ")\n" );  | 
311  |  |  | 
312  |  |     libcnotify_printf(  | 
313  |  |      "%s: output data type\t\t\t: 0x%02" PRIx8 " (", | 
314  |  |      function,  | 
315  |  |      internal_template_item->output_data_type );  | 
316  |  |     libfwevt_debug_print_output_data_type(  | 
317  |  |      internal_template_item->output_data_type );  | 
318  |  |     libcnotify_printf(  | 
319  |  |      ")\n" );  | 
320  |  |  | 
321  |  |     byte_stream_copy_to_uint16_little_endian(  | 
322  |  |      &( data[ data_offset + 6 ] ),  | 
323  |  |      value_16bit );  | 
324  |  |     libcnotify_printf(  | 
325  |  |      "%s: unknown3\t\t\t\t: 0x%04" PRIx16 "\n",  | 
326  |  |      function,  | 
327  |  |      value_16bit );  | 
328  |  |  | 
329  |  |     byte_stream_copy_to_uint32_little_endian(  | 
330  |  |      &( data[ data_offset + 8 ] ),  | 
331  |  |      value_32bit );  | 
332  |  |     libcnotify_printf(  | 
333  |  |      "%s: unknown4\t\t\t\t: 0x%08" PRIx32 "\n",  | 
334  |  |      function,  | 
335  |  |      value_32bit );  | 
336  |  |  | 
337  |  |     libcnotify_printf(  | 
338  |  |      "%s: number of values\t\t\t: %" PRIu16 "\n",  | 
339  |  |      function,  | 
340  |  |      internal_template_item->number_of_values );  | 
341  |  |  | 
342  |  |     libcnotify_printf(  | 
343  |  |      "%s: value data size\t\t\t: %" PRIu16 "\n",  | 
344  |  |      function,  | 
345  |  |      internal_template_item->value_data_size );  | 
346  |  |  | 
347  |  |     libcnotify_printf(  | 
348  |  |      "%s: name offset\t\t\t\t: 0x%08" PRIx32 "\n",  | 
349  |  |      function,  | 
350  |  |      name_offset );  | 
351  |  |   }  | 
352  |  | #endif /* defined( HAVE_DEBUG_OUTPUT ) */  | 
353  |  |  | 
354  | 1.83k  |   internal_template_item->name_offset = name_offset;  | 
355  |  |  | 
356  | 1.83k  |   if( name_offset > 0 )  | 
357  | 834  |   { | 
358  | 834  |     if( name_offset < template_data_offset )  | 
359  | 3  |     { | 
360  | 3  |       libcerror_error_set(  | 
361  | 3  |        error,  | 
362  | 3  |        LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
363  | 3  |        LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,  | 
364  | 3  |        "%s: invalid name offset value out of bounds.",  | 
365  | 3  |        function );  | 
366  |  |  | 
367  | 3  |       goto on_error;  | 
368  | 3  |     }  | 
369  | 831  |     name_offset -= template_data_offset;  | 
370  |  |  | 
371  | 831  |     if( name_offset >= ( data_size - 4 ) )  | 
372  | 76  |     { | 
373  | 76  |       libcerror_error_set(  | 
374  | 76  |        error,  | 
375  | 76  |        LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
376  | 76  |        LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,  | 
377  | 76  |        "%s: invalid name offset value out of bounds.",  | 
378  | 76  |        function );  | 
379  |  |  | 
380  | 76  |       goto on_error;  | 
381  | 76  |     }  | 
382  | 755  |     byte_stream_copy_to_uint32_little_endian(  | 
383  | 755  |      &( data[ name_offset ] ),  | 
384  | 755  |      name_size );  | 
385  |  |  | 
386  | 755  |     if( ( data_size < name_size )  | 
387  | 755  |      || ( name_offset > ( data_size - name_size ) ) )  | 
388  | 63  |     { | 
389  | 63  |       libcerror_error_set(  | 
390  | 63  |        error,  | 
391  | 63  |        LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
392  | 63  |        LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,  | 
393  | 63  |        "%s: invalid name size value out of bounds.",  | 
394  | 63  |        function );  | 
395  |  |  | 
396  | 63  |       goto on_error;  | 
397  | 63  |     }  | 
398  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
399  |  |     if( libcnotify_verbose != 0 )  | 
400  |  |     { | 
401  |  |       libcnotify_printf(  | 
402  |  |        "%s: data:\n",  | 
403  |  |        function );  | 
404  |  |       libcnotify_print_data(  | 
405  |  |        &( data[ name_offset ] ),  | 
406  |  |        name_size,  | 
407  |  |        0 );  | 
408  |  |     }  | 
409  |  | #endif /* defined( HAVE_DEBUG_OUTPUT ) */  | 
410  |  |  | 
411  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
412  |  |     if( libcnotify_verbose != 0 )  | 
413  |  |     { | 
414  |  |       libcnotify_printf(  | 
415  |  |        "%s: name size\t\t\t\t: %" PRIu32 "\n",  | 
416  |  |        function,  | 
417  |  |        name_size );  | 
418  |  |     }  | 
419  |  | #endif /* defined( HAVE_DEBUG_OUTPUT ) */  | 
420  |  |  | 
421  | 692  |     if( name_size >= 4 )  | 
422  | 242  |     { | 
423  | 242  |       name_offset += 4;  | 
424  | 242  |       name_size   -= 4;  | 
425  |  |  | 
426  | 242  |       if( ( name_size == 0 )  | 
427  | 242  |        || ( name_size > ( MEMORY_MAXIMUM_ALLOCATION_SIZE / sizeof( uint8_t ) ) ) )  | 
428  | 1  |       { | 
429  | 1  |         libcerror_error_set(  | 
430  | 1  |          error,  | 
431  | 1  |          LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
432  | 1  |          LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,  | 
433  | 1  |          "%s: invalid name size value out of bounds.",  | 
434  | 1  |          function );  | 
435  |  |  | 
436  | 1  |         goto on_error;  | 
437  | 1  |       }  | 
438  | 241  |       internal_template_item->name = (uint8_t *) memory_allocate(  | 
439  | 241  |                                                   sizeof( uint8_t ) * name_size );  | 
440  |  |  | 
441  | 241  |       if( internal_template_item->name == NULL )  | 
442  | 0  |       { | 
443  | 0  |         libcerror_error_set(  | 
444  | 0  |          error,  | 
445  | 0  |          LIBCERROR_ERROR_DOMAIN_MEMORY,  | 
446  | 0  |          LIBCERROR_MEMORY_ERROR_INSUFFICIENT,  | 
447  | 0  |          "%s: unable to create name.",  | 
448  | 0  |          function );  | 
449  |  | 
  | 
450  | 0  |         goto on_error;  | 
451  | 0  |       }  | 
452  | 241  |       internal_template_item->name_size = (size_t) name_size;  | 
453  |  |  | 
454  | 241  |       if( memory_copy(  | 
455  | 241  |            internal_template_item->name,  | 
456  | 241  |            &( data[ name_offset ] ),  | 
457  | 241  |            (size_t) name_size ) == NULL )  | 
458  | 0  |       { | 
459  | 0  |         libcerror_error_set(  | 
460  | 0  |          error,  | 
461  | 0  |          LIBCERROR_ERROR_DOMAIN_MEMORY,  | 
462  | 0  |          LIBCERROR_MEMORY_ERROR_COPY_FAILED,  | 
463  | 0  |          "%s: unable to copy name.",  | 
464  | 0  |          function );  | 
465  |  | 
  | 
466  | 0  |         goto on_error;  | 
467  | 0  |       }  | 
468  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
469  |  |       if( libcnotify_verbose != 0 )  | 
470  |  |       { | 
471  |  |         if( libfwevt_debug_print_utf16_string_value(  | 
472  |  |              function,  | 
473  |  |              "name\t\t\t\t\t",  | 
474  |  |              internal_template_item->name,  | 
475  |  |              internal_template_item->name_size,  | 
476  |  |              LIBUNA_ENDIAN_LITTLE,  | 
477  |  |              error ) != 1 )  | 
478  |  |         { | 
479  |  |           libcerror_error_set(  | 
480  |  |            error,  | 
481  |  |            LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
482  |  |            LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,  | 
483  |  |            "%s: unable to print UTF-16 string value.",  | 
484  |  |            function );  | 
485  |  |  | 
486  |  |           goto on_error;  | 
487  |  |         }  | 
488  |  |       }  | 
489  |  | #endif /* defined( HAVE_DEBUG_OUTPUT ) */  | 
490  | 241  |     }  | 
491  | 692  |   }  | 
492  |  | #if defined( HAVE_DEBUG_OUTPUT )  | 
493  |  |   if( libcnotify_verbose != 0 )  | 
494  |  |   { | 
495  |  |     libcnotify_printf(  | 
496  |  |      "\n" );  | 
497  |  |   }  | 
498  |  | #endif  | 
499  | 1.68k  |   return( 1 );  | 
500  |  |  | 
501  | 143  | on_error:  | 
502  | 143  |   if( internal_template_item->name != NULL )  | 
503  | 0  |   { | 
504  | 0  |     memory_free(  | 
505  | 0  |      internal_template_item->name );  | 
506  |  | 
  | 
507  | 0  |     internal_template_item->name = NULL;  | 
508  | 0  |   }  | 
509  | 143  |   internal_template_item->name_size = 0;  | 
510  |  |  | 
511  | 143  |   return( -1 );  | 
512  | 1.83k  | }  | 
513  |  |  | 
514  |  | /* Retrieves the input data type  | 
515  |  |  * Returns 1 if successful or -1 on error  | 
516  |  |  */  | 
517  |  | int libfwevt_template_item_get_input_data_type(  | 
518  |  |      libfwevt_template_item_t *template_item,  | 
519  |  |      uint8_t *input_data_type,  | 
520  |  |      libcerror_error_t **error )  | 
521  | 0  | { | 
522  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
523  | 0  |   static char *function                                     = "libfwevt_template_item_get_input_data_type";  | 
524  |  | 
  | 
525  | 0  |   if( template_item == NULL )  | 
526  | 0  |   { | 
527  | 0  |     libcerror_error_set(  | 
528  | 0  |      error,  | 
529  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
530  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
531  | 0  |      "%s: invalid template item.",  | 
532  | 0  |      function );  | 
533  |  | 
  | 
534  | 0  |     return( -1 );  | 
535  | 0  |   }  | 
536  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
537  |  | 
  | 
538  | 0  |   if( input_data_type == NULL )  | 
539  | 0  |   { | 
540  | 0  |     libcerror_error_set(  | 
541  | 0  |      error,  | 
542  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
543  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
544  | 0  |      "%s: invalid input data type.",  | 
545  | 0  |      function );  | 
546  |  | 
  | 
547  | 0  |     return( -1 );  | 
548  | 0  |   }  | 
549  | 0  |   *input_data_type = internal_template_item->input_data_type;  | 
550  |  | 
  | 
551  | 0  |   return( 1 );  | 
552  | 0  | }  | 
553  |  |  | 
554  |  | /* Retrieves the output data type  | 
555  |  |  * Returns 1 if successful or -1 on error  | 
556  |  |  */  | 
557  |  | int libfwevt_template_item_get_output_data_type(  | 
558  |  |      libfwevt_template_item_t *template_item,  | 
559  |  |      uint8_t *output_data_type,  | 
560  |  |      libcerror_error_t **error )  | 
561  | 0  | { | 
562  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
563  | 0  |   static char *function                                     = "libfwevt_template_item_get_output_data_type";  | 
564  |  | 
  | 
565  | 0  |   if( template_item == NULL )  | 
566  | 0  |   { | 
567  | 0  |     libcerror_error_set(  | 
568  | 0  |      error,  | 
569  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
570  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
571  | 0  |      "%s: invalid template item.",  | 
572  | 0  |      function );  | 
573  |  | 
  | 
574  | 0  |     return( -1 );  | 
575  | 0  |   }  | 
576  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
577  |  | 
  | 
578  | 0  |   if( output_data_type == NULL )  | 
579  | 0  |   { | 
580  | 0  |     libcerror_error_set(  | 
581  | 0  |      error,  | 
582  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
583  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
584  | 0  |      "%s: invalid output data type.",  | 
585  | 0  |      function );  | 
586  |  | 
  | 
587  | 0  |     return( -1 );  | 
588  | 0  |   }  | 
589  | 0  |   *output_data_type = internal_template_item->output_data_type;  | 
590  |  | 
  | 
591  | 0  |   return( 1 );  | 
592  | 0  | }  | 
593  |  |  | 
594  |  | /* Retrieves the number of values  | 
595  |  |  * Returns 1 if successful or -1 on error  | 
596  |  |  */  | 
597  |  | int libfwevt_template_item_get_number_of_values(  | 
598  |  |      libfwevt_template_item_t *template_item,  | 
599  |  |      uint16_t *number_of_values,  | 
600  |  |      libcerror_error_t **error )  | 
601  | 0  | { | 
602  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
603  | 0  |   static char *function                                     = "libfwevt_template_item_get_number_of_values";  | 
604  |  | 
  | 
605  | 0  |   if( template_item == NULL )  | 
606  | 0  |   { | 
607  | 0  |     libcerror_error_set(  | 
608  | 0  |      error,  | 
609  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
610  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
611  | 0  |      "%s: invalid template item.",  | 
612  | 0  |      function );  | 
613  |  | 
  | 
614  | 0  |     return( -1 );  | 
615  | 0  |   }  | 
616  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
617  |  | 
  | 
618  | 0  |   if( number_of_values == NULL )  | 
619  | 0  |   { | 
620  | 0  |     libcerror_error_set(  | 
621  | 0  |      error,  | 
622  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
623  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
624  | 0  |      "%s: invalid number of values.",  | 
625  | 0  |      function );  | 
626  |  | 
  | 
627  | 0  |     return( -1 );  | 
628  | 0  |   }  | 
629  | 0  |   *number_of_values = internal_template_item->number_of_values;  | 
630  |  | 
  | 
631  | 0  |   return( 1 );  | 
632  | 0  | }  | 
633  |  |  | 
634  |  | /* Retrieves the value data size  | 
635  |  |  * Returns 1 if successful or -1 on error  | 
636  |  |  */  | 
637  |  | int libfwevt_template_item_get_value_data_size(  | 
638  |  |      libfwevt_template_item_t *template_item,  | 
639  |  |      uint16_t *value_data_size,  | 
640  |  |      libcerror_error_t **error )  | 
641  | 0  | { | 
642  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
643  | 0  |   static char *function                                     = "libfwevt_template_item_get_value_data_size";  | 
644  |  | 
  | 
645  | 0  |   if( template_item == NULL )  | 
646  | 0  |   { | 
647  | 0  |     libcerror_error_set(  | 
648  | 0  |      error,  | 
649  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
650  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
651  | 0  |      "%s: invalid template item.",  | 
652  | 0  |      function );  | 
653  |  | 
  | 
654  | 0  |     return( -1 );  | 
655  | 0  |   }  | 
656  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
657  |  | 
  | 
658  | 0  |   if( value_data_size == NULL )  | 
659  | 0  |   { | 
660  | 0  |     libcerror_error_set(  | 
661  | 0  |      error,  | 
662  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
663  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
664  | 0  |      "%s: invalid value data size.",  | 
665  | 0  |      function );  | 
666  |  | 
  | 
667  | 0  |     return( -1 );  | 
668  | 0  |   }  | 
669  | 0  |   *value_data_size = internal_template_item->value_data_size;  | 
670  |  | 
  | 
671  | 0  |   return( 1 );  | 
672  | 0  | }  | 
673  |  |  | 
674  |  | /* Retrieves the size of the UTF-8 formatted name  | 
675  |  |  * Returns 1 if successful, 0 if not available or -1 on error  | 
676  |  |  */  | 
677  |  | int libfwevt_template_item_get_utf8_name_size(  | 
678  |  |      libfwevt_template_item_t *template_item,  | 
679  |  |      size_t *utf8_string_size,  | 
680  |  |      libcerror_error_t **error )  | 
681  | 0  | { | 
682  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
683  | 0  |   static char *function                                     = "libfwevt_template_item_get_utf8_name_size";  | 
684  |  | 
  | 
685  | 0  |   if( template_item == NULL )  | 
686  | 0  |   { | 
687  | 0  |     libcerror_error_set(  | 
688  | 0  |      error,  | 
689  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
690  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
691  | 0  |      "%s: invalid template item.",  | 
692  | 0  |      function );  | 
693  |  | 
  | 
694  | 0  |     return( -1 );  | 
695  | 0  |   }  | 
696  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
697  |  | 
  | 
698  | 0  |   if( ( internal_template_item->name == NULL )  | 
699  | 0  |    || ( internal_template_item->name_size == 0 ) )  | 
700  | 0  |   { | 
701  | 0  |     return( 0 );  | 
702  | 0  |   }  | 
703  | 0  |   if( libuna_utf8_string_size_from_utf16_stream(  | 
704  | 0  |        internal_template_item->name,  | 
705  | 0  |        internal_template_item->name_size,  | 
706  | 0  |        LIBUNA_ENDIAN_LITTLE,  | 
707  | 0  |        utf8_string_size,  | 
708  | 0  |        error ) != 1 )  | 
709  | 0  |   { | 
710  | 0  |     libcerror_error_set(  | 
711  | 0  |      error,  | 
712  | 0  |      LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
713  | 0  |      LIBCERROR_RUNTIME_ERROR_GET_FAILED,  | 
714  | 0  |      "%s: unable to retrieve UTF-8 string size.",  | 
715  | 0  |      function );  | 
716  |  | 
  | 
717  | 0  |     return( -1 );  | 
718  | 0  |   }  | 
719  | 0  |   return( 1 );  | 
720  | 0  | }  | 
721  |  |  | 
722  |  | /* Retrieves the UTF-8 formatted name  | 
723  |  |  * Returns 1 if successful, 0 if not available or -1 on error  | 
724  |  |  */  | 
725  |  | int libfwevt_template_item_get_utf8_name(  | 
726  |  |      libfwevt_template_item_t *template_item,  | 
727  |  |      uint8_t *utf8_string,  | 
728  |  |      size_t utf8_string_size,  | 
729  |  |      libcerror_error_t **error )  | 
730  | 0  | { | 
731  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
732  | 0  |   static char *function                                     = "libfwevt_template_item_get_utf8_name";  | 
733  |  | 
  | 
734  | 0  |   if( template_item == NULL )  | 
735  | 0  |   { | 
736  | 0  |     libcerror_error_set(  | 
737  | 0  |      error,  | 
738  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
739  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
740  | 0  |      "%s: invalid template item.",  | 
741  | 0  |      function );  | 
742  |  | 
  | 
743  | 0  |     return( -1 );  | 
744  | 0  |   }  | 
745  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
746  |  | 
  | 
747  | 0  |   if( ( internal_template_item->name == NULL )  | 
748  | 0  |    || ( internal_template_item->name_size == 0 ) )  | 
749  | 0  |   { | 
750  | 0  |     return( 0 );  | 
751  | 0  |   }  | 
752  | 0  |   if( libuna_utf8_string_copy_from_utf16_stream(  | 
753  | 0  |        utf8_string,  | 
754  | 0  |        utf8_string_size,  | 
755  | 0  |        internal_template_item->name,  | 
756  | 0  |        internal_template_item->name_size,  | 
757  | 0  |        LIBUNA_ENDIAN_LITTLE,  | 
758  | 0  |        error ) != 1 )  | 
759  | 0  |   { | 
760  | 0  |     libcerror_error_set(  | 
761  | 0  |      error,  | 
762  | 0  |      LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
763  | 0  |      LIBCERROR_RUNTIME_ERROR_GET_FAILED,  | 
764  | 0  |      "%s: unable to retrieve UTF-8 string.",  | 
765  | 0  |      function );  | 
766  |  | 
  | 
767  | 0  |     return( -1 );  | 
768  | 0  |   }  | 
769  | 0  |   return( 1 );  | 
770  | 0  | }  | 
771  |  |  | 
772  |  | /* Retrieves the size of the UTF-16 formatted name  | 
773  |  |  * Returns 1 if successful, 0 if not available or -1 on error  | 
774  |  |  */  | 
775  |  | int libfwevt_template_item_get_utf16_name_size(  | 
776  |  |      libfwevt_template_item_t *template_item,  | 
777  |  |      size_t *utf16_string_size,  | 
778  |  |      libcerror_error_t **error )  | 
779  | 0  | { | 
780  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
781  | 0  |   static char *function                                     = "libfwevt_template_item_get_utf16_name_size";  | 
782  |  | 
  | 
783  | 0  |   if( template_item == NULL )  | 
784  | 0  |   { | 
785  | 0  |     libcerror_error_set(  | 
786  | 0  |      error,  | 
787  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
788  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
789  | 0  |      "%s: invalid template item.",  | 
790  | 0  |      function );  | 
791  |  | 
  | 
792  | 0  |     return( -1 );  | 
793  | 0  |   }  | 
794  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
795  |  | 
  | 
796  | 0  |   if( ( internal_template_item->name == NULL )  | 
797  | 0  |    || ( internal_template_item->name_size == 0 ) )  | 
798  | 0  |   { | 
799  | 0  |     return( 0 );  | 
800  | 0  |   }  | 
801  | 0  |   if( libuna_utf16_string_size_from_utf16_stream(  | 
802  | 0  |        internal_template_item->name,  | 
803  | 0  |        internal_template_item->name_size,  | 
804  | 0  |        LIBUNA_ENDIAN_LITTLE,  | 
805  | 0  |        utf16_string_size,  | 
806  | 0  |        error ) != 1 )  | 
807  | 0  |   { | 
808  | 0  |     libcerror_error_set(  | 
809  | 0  |      error,  | 
810  | 0  |      LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
811  | 0  |      LIBCERROR_RUNTIME_ERROR_GET_FAILED,  | 
812  | 0  |      "%s: unable to retrieve UTF-16 string size.",  | 
813  | 0  |      function );  | 
814  |  | 
  | 
815  | 0  |     return( -1 );  | 
816  | 0  |   }  | 
817  | 0  |   return( 1 );  | 
818  | 0  | }  | 
819  |  |  | 
820  |  | /* Retrieves the UTF-16 formatted name  | 
821  |  |  * Returns 1 if successful, 0 if not available or -1 on error  | 
822  |  |  */  | 
823  |  | int libfwevt_template_item_get_utf16_name(  | 
824  |  |      libfwevt_template_item_t *template_item,  | 
825  |  |      uint16_t *utf16_string,  | 
826  |  |      size_t utf16_string_size,  | 
827  |  |      libcerror_error_t **error )  | 
828  | 0  | { | 
829  | 0  |   libfwevt_internal_template_item_t *internal_template_item = NULL;  | 
830  | 0  |   static char *function                                     = "libfwevt_template_item_get_utf16_name";  | 
831  |  | 
  | 
832  | 0  |   if( template_item == NULL )  | 
833  | 0  |   { | 
834  | 0  |     libcerror_error_set(  | 
835  | 0  |      error,  | 
836  | 0  |      LIBCERROR_ERROR_DOMAIN_ARGUMENTS,  | 
837  | 0  |      LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,  | 
838  | 0  |      "%s: invalid template item.",  | 
839  | 0  |      function );  | 
840  |  | 
  | 
841  | 0  |     return( -1 );  | 
842  | 0  |   }  | 
843  | 0  |   internal_template_item = (libfwevt_internal_template_item_t *) template_item;  | 
844  |  | 
  | 
845  | 0  |   if( ( internal_template_item->name == NULL )  | 
846  | 0  |    || ( internal_template_item->name_size == 0 ) )  | 
847  | 0  |   { | 
848  | 0  |     return( 0 );  | 
849  | 0  |   }  | 
850  | 0  |   if( libuna_utf16_string_copy_from_utf16_stream(  | 
851  | 0  |        utf16_string,  | 
852  | 0  |        utf16_string_size,  | 
853  | 0  |        internal_template_item->name,  | 
854  | 0  |        internal_template_item->name_size,  | 
855  | 0  |        LIBUNA_ENDIAN_LITTLE,  | 
856  | 0  |        error ) != 1 )  | 
857  | 0  |   { | 
858  | 0  |     libcerror_error_set(  | 
859  | 0  |      error,  | 
860  | 0  |      LIBCERROR_ERROR_DOMAIN_RUNTIME,  | 
861  | 0  |      LIBCERROR_RUNTIME_ERROR_GET_FAILED,  | 
862  | 0  |      "%s: unable to retrieve UTF-8 string.",  | 
863  | 0  |      function );  | 
864  |  | 
  | 
865  | 0  |     return( -1 );  | 
866  | 0  |   }  | 
867  | 0  |   return( 1 );  | 
868  | 0  | }  | 
869  |  |  |