/src/libfwsi/libfwsi/libfwsi_uri_values.c

Source (jump to first uncovered line)
/*
 * URI (shell item) values functions
 *
 * Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwsi_debug.h"
#include "libfwsi_libcerror.h"
#include "libfwsi_libcnotify.h"
#include "libfwsi_libfdatetime.h"
#include "libfwsi_libuna.h"
#include "libfwsi_uri_values.h"

/* Creates URI values
 * Make sure the value uri_values is referencing, is set to NULL
 * Returns 1 if successful or -1 on error
 */
int libfwsi_uri_values_initialize(
     libfwsi_uri_values_t **uri_values,
     libcerror_error_t **error )
{
  static char *function = "libfwsi_uri_values_initialize";

  if( uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid URI values.",
     function );

    return( -1 );
  }
  if( *uri_values != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid URI values value already set.",
     function );

    return( -1 );
  }
  *uri_values = memory_allocate_structure(
                 libfwsi_uri_values_t );

  if( *uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
     "%s: unable to create URI values.",
     function );

    goto on_error;
  }
  if( memory_set(
       *uri_values,
       0,
       sizeof( libfwsi_uri_values_t ) ) == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
     "%s: unable to clear URI values.",
     function );

    goto on_error;
  }
  return( 1 );

on_error:
  if( *uri_values != NULL )
  {
    memory_free(
     *uri_values );

    *uri_values = NULL;
  }
  return( -1 );
}

/* Frees URI values
 * Returns 1 if successful or -1 on error
 */
int libfwsi_uri_values_free(
     libfwsi_uri_values_t **uri_values,
     libcerror_error_t **error )
{
  static char *function = "libfwsi_uri_values_free";

  if( uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid URI values.",
     function );

    return( -1 );
  }
  if( *uri_values != NULL )
  {
    memory_free(
     *uri_values );

    *uri_values = NULL;
  }
  return( 1 );
}

/* Reads the URI values
 * Returns 1 if successful, 0 if not supported or -1 on error
 */
int libfwsi_uri_values_read_data(
     libfwsi_uri_values_t *uri_values,
     const uint8_t *data,
     size_t data_size,
     int ascii_codepage,
     libcerror_error_t **error )
{
  static char *function     = "libfwsi_uri_values_read_data";
  size_t data_offset        = 0;
  size_t string_size        = 0;
  uint32_t string_data_size = 0;
  uint16_t item_data_size   = 0;
  uint8_t flags             = 0;

#if defined( HAVE_DEBUG_OUTPUT )
  uint32_t value_32bit      = 0;
  uint16_t value_16bit      = 0;
#endif

  if( uri_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid URI values.",
     function );

    return( -1 );
  }
  if( data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid data.",
     function );

    return( -1 );
  }
  if( data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: data size exceeds maximum.",
     function );

    return( -1 );
  }
  /* Do not try to parse unsupported data sizes
   */
  if( data_size < 6 )
  {
    return( 0 );
  }
  /* Do not try to parse unsupported data
   */
  if( data[ 2 ] != 0x61 )
  {
    return( 0 );
  }
  flags = data[ 3 ];

  byte_stream_copy_to_uint16_little_endian(
   &( data[ 4 ] ),
   item_data_size );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: flags\t\t\t\t\t: 0x%02" PRIx8 "\n",
     function,
     flags );

    libcnotify_printf(
     "%s: data size\t\t\t\t\t: %" PRIu16 "\n",
     function,
     item_data_size );
  }
#endif
  data_offset = 6;

  if( item_data_size > 0 )
  {
    if( item_data_size > ( data_size - 6 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: data:\n",
       function );
      libcnotify_print_data(
       &( data[ 6 ] ),
       item_data_size,
       LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );
    }
#endif
  }
#if defined( HAVE_DEBUG_OUTPUT )
  else if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "\n" );
  }
#endif
  if( item_data_size >= 36 )
  {
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      byte_stream_copy_to_uint32_little_endian(
       &( data[ 6 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown1\t\t\t\t\t: %" PRIu32 "\n",
       function,
       value_32bit );

      byte_stream_copy_to_uint32_little_endian(
       &( data[ 10 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown2\t\t\t\t\t: %" PRIu32 "\n",
       function,
       value_32bit );

      if( libfwsi_debug_print_filetime_value(
           function,
           "unknown3 time\t\t\t\t",
           &( data[ 14 ] ),
           8,
           LIBFDATETIME_ENDIAN_LITTLE,
           LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print filetime value.",
         function );

        return( -1 );
      }
      byte_stream_copy_to_uint32_little_endian(
       &( data[ 22 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown4\t\t\t\t\t: 0x%08" PRIx32 "\n",
       function,
       value_32bit );

      libcnotify_printf(
       "%s: unknown5:\n",
       function );
      libcnotify_print_data(
       &( data[ 26 ] ),
       12,
       0 );

      byte_stream_copy_to_uint32_little_endian(
       &( data[ 38 ] ),
       value_32bit );
      libcnotify_printf(
       "%s: unknown6\t\t\t\t\t: %" PRIu32 "\n",
       function,
       value_32bit );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    data_offset    += 36;
    item_data_size -= 36;

    if( data_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ data_offset ] ),
     string_data_size );

    data_offset += 4;

    if( ( item_data_size < 4 )
     || ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid string1 data size value out of bounds.",
       function );

      return( -1 );
    }
    item_data_size -= 4;

    if( data_offset >= data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: string1 data size\t\t\t\t: %" PRIu32 "\n",
       function,
       string_data_size );

      libcnotify_printf(
       "%s: string1 data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       string_data_size,
       0 );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    data_offset    += string_data_size;
    item_data_size -= string_data_size;

    if( data_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ data_offset ] ),
     string_data_size );

    data_offset += 4;

    if( ( item_data_size < 4 )
     || ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid string2 data size value out of bounds.",
       function );

      return( -1 );
    }
    item_data_size -= 4;

    if( data_offset >= data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: string2 data size\t\t\t\t: %" PRIu32 "\n",
       function,
       string_data_size );

      libcnotify_printf(
       "%s: string2 data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       string_data_size,
       0 );
    }
#endif
    data_offset    += string_data_size;
    item_data_size -= string_data_size;

    if( data_offset >= ( data_size - 4 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
    byte_stream_copy_to_uint32_little_endian(
     &( data[ data_offset ] ),
     string_data_size );

    data_offset += 4;

    if( ( item_data_size < 4 )
     || ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid string3 data size value out of bounds.",
       function );

      return( -1 );
    }
    item_data_size -= 4;

    if( data_offset >= data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: string3 data size\t\t\t\t: %" PRIu32 "\n",
       function,
       string_data_size );

      if( string_data_size > item_data_size )
      {
        string_data_size = item_data_size;
      }
      libcnotify_printf(
       "%s: string3 data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       string_data_size,
       0 );
    }
#endif
    data_offset    += string_data_size;
    item_data_size -= string_data_size;
  }
  if( item_data_size > 0 )
  {
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: trailing data:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       item_data_size,
       0 );
    }
#endif
    data_offset += item_data_size;
  }
  if( data_offset >= data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid data size value out of bounds.",
     function );

    return( -1 );
  }
  /* Determine the URI size
   */
  if( ( flags & 0x80 ) != 0 )
  {
    for( string_size = data_offset;
         ( string_size + 1 ) < data_size;
         string_size += 2 )
    {
      if( ( data[ string_size ] == 0 )
       && ( data[ string_size + 1 ] == 0 ) )
      {
        string_size += 2;

        break;
      }
    }
    string_size -= data_offset;
  }
  else
  {
    for( string_size = data_offset;
         string_size < data_size;
         string_size++ )
    {
      if( data[ string_size ] == 0 )
      {
        string_size++;

        break;
      }
    }
    string_size -= data_offset;
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    if( ( flags & 0x80 ) != 0 )
    {
      if( libfwsi_debug_print_utf16_string_value(
           function,
           "URI\t\t\t\t\t",
           &( data[ data_offset ] ),
           string_size,
           LIBUNA_ENDIAN_LITTLE,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print UTF-16 string value.",
         function );

        return( -1 );
      }
    }
    else
    {
      if( libfwsi_debug_print_string_value(
           function,
           "URI\t\t\t\t\t",
           &( data[ data_offset ] ),
           string_size,
           ascii_codepage,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print string value.",
         function );

        return( -1 );
      }
    }
  }
#endif
  data_offset += string_size;

/* TODO value likely controlled by flags */
  if( data_offset < data_size )
  {
    if( data_offset >= ( data_size - 2 ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid data size value out of bounds.",
       function );

      return( -1 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      byte_stream_copy_to_uint16_little_endian(
       &( data[ data_offset ] ),
       value_16bit );

      libcnotify_printf(
       "%s: unknown9\t\t\t\t\t: %" PRIu16 "\n",
       function,
       value_16bit );
    }
#endif
    data_offset += 2;
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "\n" );
  }
#endif
  return( 1 );
}


Coverage Report

Created: 2025-06-22 07:35

Line	Count	Source (jump to first uncovered line)
1		/*
2		* URI (shell item) values functions
3		*
4		* Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwsi_debug.h"
28		#include "libfwsi_libcerror.h"
29		#include "libfwsi_libcnotify.h"
30		#include "libfwsi_libfdatetime.h"
31		#include "libfwsi_libuna.h"
32		#include "libfwsi_uri_values.h"
33
34		/* Creates URI values
35		* Make sure the value uri_values is referencing, is set to NULL
36		* Returns 1 if successful or -1 on error
37		*/
38		int libfwsi_uri_values_initialize(
39		libfwsi_uri_values_t **uri_values,
40		libcerror_error_t **error )
41	0	{
42	0	static char *function = "libfwsi_uri_values_initialize";
43
44	0	if( uri_values == NULL )
45	0	{
46	0	libcerror_error_set(
47	0	error,
48	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
49	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
50	0	"%s: invalid URI values.",
51	0	function );
52
53	0	return( -1 );
54	0	}
55	0	if( *uri_values != NULL )
56	0	{
57	0	libcerror_error_set(
58	0	error,
59	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
60	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
61	0	"%s: invalid URI values value already set.",
62	0	function );
63
64	0	return( -1 );
65	0	}
66	0	*uri_values = memory_allocate_structure(
67	0	libfwsi_uri_values_t );
68
69	0	if( *uri_values == NULL )
70	0	{
71	0	libcerror_error_set(
72	0	error,
73	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
74	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
75	0	"%s: unable to create URI values.",
76	0	function );
77
78	0	goto on_error;
79	0	}
80	0	if( memory_set(
81	0	*uri_values,
82	0	0,
83	0	sizeof( libfwsi_uri_values_t ) ) == NULL )
84	0	{
85	0	libcerror_error_set(
86	0	error,
87	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
88	0	LIBCERROR_MEMORY_ERROR_SET_FAILED,
89	0	"%s: unable to clear URI values.",
90	0	function );
91
92	0	goto on_error;
93	0	}
94	0	return( 1 );
95
96	0	on_error:
97	0	if( *uri_values != NULL )
98	0	{
99	0	memory_free(
100	0	*uri_values );
101
102	0	*uri_values = NULL;
103	0	}
104	0	return( -1 );
105	0	}
106
107		/* Frees URI values
108		* Returns 1 if successful or -1 on error
109		*/
110		int libfwsi_uri_values_free(
111		libfwsi_uri_values_t **uri_values,
112		libcerror_error_t **error )
113	0	{
114	0	static char *function = "libfwsi_uri_values_free";
115
116	0	if( uri_values == NULL )
117	0	{
118	0	libcerror_error_set(
119	0	error,
120	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
121	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
122	0	"%s: invalid URI values.",
123	0	function );
124
125	0	return( -1 );
126	0	}
127	0	if( *uri_values != NULL )
128	0	{
129	0	memory_free(
130	0	*uri_values );
131
132	0	*uri_values = NULL;
133	0	}
134	0	return( 1 );
135	0	}
136
137		/* Reads the URI values
138		* Returns 1 if successful, 0 if not supported or -1 on error
139		*/
140		int libfwsi_uri_values_read_data(
141		libfwsi_uri_values_t *uri_values,
142		const uint8_t *data,
143		size_t data_size,
144		int ascii_codepage,
145		libcerror_error_t **error )
146	0	{
147	0	static char *function = "libfwsi_uri_values_read_data";
148	0	size_t data_offset = 0;
149	0	size_t string_size = 0;
150	0	uint32_t string_data_size = 0;
151	0	uint16_t item_data_size = 0;
152	0	uint8_t flags = 0;
153
154		#if defined( HAVE_DEBUG_OUTPUT )
155		uint32_t value_32bit = 0;
156		uint16_t value_16bit = 0;
157		#endif
158
159	0	if( uri_values == NULL )
160	0	{
161	0	libcerror_error_set(
162	0	error,
163	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
164	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
165	0	"%s: invalid URI values.",
166	0	function );
167
168	0	return( -1 );
169	0	}
170	0	if( data == NULL )
171	0	{
172	0	libcerror_error_set(
173	0	error,
174	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
175	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
176	0	"%s: invalid data.",
177	0	function );
178
179	0	return( -1 );
180	0	}
181	0	if( data_size > (size_t) SSIZE_MAX )
182	0	{
183	0	libcerror_error_set(
184	0	error,
185	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
186	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
187	0	"%s: data size exceeds maximum.",
188	0	function );
189
190	0	return( -1 );
191	0	}
192		/* Do not try to parse unsupported data sizes
193		*/
194	0	if( data_size < 6 )
195	0	{
196	0	return( 0 );
197	0	}
198		/* Do not try to parse unsupported data
199		*/
200	0	if( data[ 2 ] != 0x61 )
201	0	{
202	0	return( 0 );
203	0	}
204	0	flags = data[ 3 ];
205
206	0	byte_stream_copy_to_uint16_little_endian(
207	0	&( data[ 4 ] ),
208	0	item_data_size );
209
210		#if defined( HAVE_DEBUG_OUTPUT )
211		if( libcnotify_verbose != 0 )
212		{
213		libcnotify_printf(
214		"%s: flags\t\t\t\t\t: 0x%02" PRIx8 "\n",
215		function,
216		flags );
217
218		libcnotify_printf(
219		"%s: data size\t\t\t\t\t: %" PRIu16 "\n",
220		function,
221		item_data_size );
222		}
223		#endif
224	0	data_offset = 6;
225
226	0	if( item_data_size > 0 )
227	0	{
228	0	if( item_data_size > ( data_size - 6 ) )
229	0	{
230	0	libcerror_error_set(
231	0	error,
232	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
233	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
234	0	"%s: invalid data size value out of bounds.",
235	0	function );
236
237	0	return( -1 );
238	0	}
239		#if defined( HAVE_DEBUG_OUTPUT )
240		if( libcnotify_verbose != 0 )
241		{
242		libcnotify_printf(
243		"%s: data:\n",
244		function );
245		libcnotify_print_data(
246		&( data[ 6 ] ),
247		item_data_size,
248		LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );
249		}
250		#endif
251	0	}
252		#if defined( HAVE_DEBUG_OUTPUT )
253		else if( libcnotify_verbose != 0 )
254		{
255		libcnotify_printf(
256		"\n" );
257		}
258		#endif
259	0	if( item_data_size >= 36 )
260	0	{
261		#if defined( HAVE_DEBUG_OUTPUT )
262		if( libcnotify_verbose != 0 )
263		{
264		byte_stream_copy_to_uint32_little_endian(
265		&( data[ 6 ] ),
266		value_32bit );
267		libcnotify_printf(
268		"%s: unknown1\t\t\t\t\t: %" PRIu32 "\n",
269		function,
270		value_32bit );
271
272		byte_stream_copy_to_uint32_little_endian(
273		&( data[ 10 ] ),
274		value_32bit );
275		libcnotify_printf(
276		"%s: unknown2\t\t\t\t\t: %" PRIu32 "\n",
277		function,
278		value_32bit );
279
280		if( libfwsi_debug_print_filetime_value(
281		function,
282		"unknown3 time\t\t\t\t",
283		&( data[ 14 ] ),
284		8,
285		LIBFDATETIME_ENDIAN_LITTLE,
286		LIBFDATETIME_STRING_FORMAT_TYPE_CTIME \| LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME_NANO_SECONDS,
287		error ) != 1 )
288		{
289		libcerror_error_set(
290		error,
291		LIBCERROR_ERROR_DOMAIN_RUNTIME,
292		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
293		"%s: unable to print filetime value.",
294		function );
295
296		return( -1 );
297		}
298		byte_stream_copy_to_uint32_little_endian(
299		&( data[ 22 ] ),
300		value_32bit );
301		libcnotify_printf(
302		"%s: unknown4\t\t\t\t\t: 0x%08" PRIx32 "\n",
303		function,
304		value_32bit );
305
306		libcnotify_printf(
307		"%s: unknown5:\n",
308		function );
309		libcnotify_print_data(
310		&( data[ 26 ] ),
311		12,
312		0 );
313
314		byte_stream_copy_to_uint32_little_endian(
315		&( data[ 38 ] ),
316		value_32bit );
317		libcnotify_printf(
318		"%s: unknown6\t\t\t\t\t: %" PRIu32 "\n",
319		function,
320		value_32bit );
321		}
322		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
323
324	0	data_offset += 36;
325	0	item_data_size -= 36;
326
327	0	if( data_offset >= ( data_size - 4 ) )
328	0	{
329	0	libcerror_error_set(
330	0	error,
331	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
332	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
333	0	"%s: invalid data size value out of bounds.",
334	0	function );
335
336	0	return( -1 );
337	0	}
338	0	byte_stream_copy_to_uint32_little_endian(
339	0	&( data[ data_offset ] ),
340	0	string_data_size );
341
342	0	data_offset += 4;
343
344	0	if( ( item_data_size < 4 )
345	0	\|\| ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
346	0	{
347	0	libcerror_error_set(
348	0	error,
349	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
350	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
351	0	"%s: invalid string1 data size value out of bounds.",
352	0	function );
353
354	0	return( -1 );
355	0	}
356	0	item_data_size -= 4;
357
358	0	if( data_offset >= data_size )
359	0	{
360	0	libcerror_error_set(
361	0	error,
362	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
363	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
364	0	"%s: invalid data size value out of bounds.",
365	0	function );
366
367	0	return( -1 );
368	0	}
369		#if defined( HAVE_DEBUG_OUTPUT )
370		if( libcnotify_verbose != 0 )
371		{
372		libcnotify_printf(
373		"%s: string1 data size\t\t\t\t: %" PRIu32 "\n",
374		function,
375		string_data_size );
376
377		libcnotify_printf(
378		"%s: string1 data:\n",
379		function );
380		libcnotify_print_data(
381		&( data[ data_offset ] ),
382		string_data_size,
383		0 );
384		}
385		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
386
387	0	data_offset += string_data_size;
388	0	item_data_size -= string_data_size;
389
390	0	if( data_offset >= ( data_size - 4 ) )
391	0	{
392	0	libcerror_error_set(
393	0	error,
394	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
395	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
396	0	"%s: invalid data size value out of bounds.",
397	0	function );
398
399	0	return( -1 );
400	0	}
401	0	byte_stream_copy_to_uint32_little_endian(
402	0	&( data[ data_offset ] ),
403	0	string_data_size );
404
405	0	data_offset += 4;
406
407	0	if( ( item_data_size < 4 )
408	0	\|\| ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
409	0	{
410	0	libcerror_error_set(
411	0	error,
412	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
413	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
414	0	"%s: invalid string2 data size value out of bounds.",
415	0	function );
416
417	0	return( -1 );
418	0	}
419	0	item_data_size -= 4;
420
421	0	if( data_offset >= data_size )
422	0	{
423	0	libcerror_error_set(
424	0	error,
425	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
426	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
427	0	"%s: invalid data size value out of bounds.",
428	0	function );
429
430	0	return( -1 );
431	0	}
432		#if defined( HAVE_DEBUG_OUTPUT )
433		if( libcnotify_verbose != 0 )
434		{
435		libcnotify_printf(
436		"%s: string2 data size\t\t\t\t: %" PRIu32 "\n",
437		function,
438		string_data_size );
439
440		libcnotify_printf(
441		"%s: string2 data:\n",
442		function );
443		libcnotify_print_data(
444		&( data[ data_offset ] ),
445		string_data_size,
446		0 );
447		}
448		#endif
449	0	data_offset += string_data_size;
450	0	item_data_size -= string_data_size;
451
452	0	if( data_offset >= ( data_size - 4 ) )
453	0	{
454	0	libcerror_error_set(
455	0	error,
456	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
457	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
458	0	"%s: invalid data size value out of bounds.",
459	0	function );
460
461	0	return( -1 );
462	0	}
463	0	byte_stream_copy_to_uint32_little_endian(
464	0	&( data[ data_offset ] ),
465	0	string_data_size );
466
467	0	data_offset += 4;
468
469	0	if( ( item_data_size < 4 )
470	0	\|\| ( string_data_size > (uint32_t) ( item_data_size - 4 ) ) )
471	0	{
472	0	libcerror_error_set(
473	0	error,
474	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
475	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
476	0	"%s: invalid string3 data size value out of bounds.",
477	0	function );
478
479	0	return( -1 );
480	0	}
481	0	item_data_size -= 4;
482
483	0	if( data_offset >= data_size )
484	0	{
485	0	libcerror_error_set(
486	0	error,
487	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
488	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
489	0	"%s: invalid data size value out of bounds.",
490	0	function );
491
492	0	return( -1 );
493	0	}
494		#if defined( HAVE_DEBUG_OUTPUT )
495		if( libcnotify_verbose != 0 )
496		{
497		libcnotify_printf(
498		"%s: string3 data size\t\t\t\t: %" PRIu32 "\n",
499		function,
500		string_data_size );
501
502		if( string_data_size > item_data_size )
503		{
504		string_data_size = item_data_size;
505		}
506		libcnotify_printf(
507		"%s: string3 data:\n",
508		function );
509		libcnotify_print_data(
510		&( data[ data_offset ] ),
511		string_data_size,
512		0 );
513		}
514		#endif
515	0	data_offset += string_data_size;
516	0	item_data_size -= string_data_size;
517	0	}
518	0	if( item_data_size > 0 )
519	0	{
520		#if defined( HAVE_DEBUG_OUTPUT )
521		if( libcnotify_verbose != 0 )
522		{
523		libcnotify_printf(
524		"%s: trailing data:\n",
525		function );
526		libcnotify_print_data(
527		&( data[ data_offset ] ),
528		item_data_size,
529		0 );
530		}
531		#endif
532	0	data_offset += item_data_size;
533	0	}
534	0	if( data_offset >= data_size )
535	0	{
536	0	libcerror_error_set(
537	0	error,
538	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
539	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
540	0	"%s: invalid data size value out of bounds.",
541	0	function );
542
543	0	return( -1 );
544	0	}
545		/* Determine the URI size
546		*/
547	0	if( ( flags & 0x80 ) != 0 )
548	0	{
549	0	for( string_size = data_offset;
550	0	( string_size + 1 ) < data_size;
551	0	string_size += 2 )
552	0	{
553	0	if( ( data[ string_size ] == 0 )
554	0	&& ( data[ string_size + 1 ] == 0 ) )
555	0	{
556	0	string_size += 2;
557
558	0	break;
559	0	}
560	0	}
561	0	string_size -= data_offset;
562	0	}
563	0	else
564	0	{
565	0	for( string_size = data_offset;
566	0	string_size < data_size;
567	0	string_size++ )
568	0	{
569	0	if( data[ string_size ] == 0 )
570	0	{
571	0	string_size++;
572
573	0	break;
574	0	}
575	0	}
576	0	string_size -= data_offset;
577	0	}
578		#if defined( HAVE_DEBUG_OUTPUT )
579		if( libcnotify_verbose != 0 )
580		{
581		if( ( flags & 0x80 ) != 0 )
582		{
583		if( libfwsi_debug_print_utf16_string_value(
584		function,
585		"URI\t\t\t\t\t",
586		&( data[ data_offset ] ),
587		string_size,
588		LIBUNA_ENDIAN_LITTLE,
589		error ) != 1 )
590		{
591		libcerror_error_set(
592		error,
593		LIBCERROR_ERROR_DOMAIN_RUNTIME,
594		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
595		"%s: unable to print UTF-16 string value.",
596		function );
597
598		return( -1 );
599		}
600		}
601		else
602		{
603		if( libfwsi_debug_print_string_value(
604		function,
605		"URI\t\t\t\t\t",
606		&( data[ data_offset ] ),
607		string_size,
608		ascii_codepage,
609		error ) != 1 )
610		{
611		libcerror_error_set(
612		error,
613		LIBCERROR_ERROR_DOMAIN_RUNTIME,
614		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
615		"%s: unable to print string value.",
616		function );
617
618		return( -1 );
619		}
620		}
621		}
622		#endif
623	0	data_offset += string_size;
624
625		/* TODO value likely controlled by flags */
626	0	if( data_offset < data_size )
627	0	{
628	0	if( data_offset >= ( data_size - 2 ) )
629	0	{
630	0	libcerror_error_set(
631	0	error,
632	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
633	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
634	0	"%s: invalid data size value out of bounds.",
635	0	function );
636
637	0	return( -1 );
638	0	}
639		#if defined( HAVE_DEBUG_OUTPUT )
640		if( libcnotify_verbose != 0 )
641		{
642		byte_stream_copy_to_uint16_little_endian(
643		&( data[ data_offset ] ),
644		value_16bit );
645
646		libcnotify_printf(
647		"%s: unknown9\t\t\t\t\t: %" PRIu16 "\n",
648		function,
649		value_16bit );
650		}
651		#endif
652	0	data_offset += 2;
653	0	}
654		#if defined( HAVE_DEBUG_OUTPUT )
655		if( libcnotify_verbose != 0 )
656		{
657		libcnotify_printf(
658		"\n" );
659		}
660		#endif
661	0	return( 1 );
662	0	}
663