/*

 * Windows Event Log binary XML document functions

 *

 * Copyright (C) 2011-2026, Joachim Metz <joachim.metz@gmail.com>

 *

 * Refer to AUTHORS for acknowledgements.

 *

 * This program is free software: you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>.

 */

#include <common.h>

#include <byte_stream.h>

#include <memory.h>

#include <system_string.h>

#include <types.h>

#include "libfwevt_debug.h"

#include "libfwevt_definitions.h"

#include "libfwevt_integer.h"

#include "libfwevt_libcdata.h"

#include "libfwevt_libcerror.h"

#include "libfwevt_libcnotify.h"

#include "libfwevt_libfguid.h"

#include "libfwevt_libuna.h"

#include "libfwevt_types.h"

#include "libfwevt_unused.h"

#include "libfwevt_xml_document.h"

#include "libfwevt_xml_template_value.h"

#include "libfwevt_xml_tag.h"

#include "libfwevt_xml_token.h"

/* Creates a binary XML document

 * Make sure the value xml_document is referencing, is set to NULL

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_initialize(

     libfwevt_xml_document_t **xml_document,

     libcerror_error_t **error )

{

  libfwevt_internal_xml_document_t *internal_xml_document = NULL;

  static char *function                                   = "libfwevt_xml_document_initialize";

  if( xml_document == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary XML document.",

     function );

    return( -1 );

  }

  if( *xml_document != NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,

     "%s: invalid binary XML document value already set.",

     function );

    return( -1 );

  }

  internal_xml_document = memory_allocate_structure(

                           libfwevt_internal_xml_document_t );

  if( internal_xml_document == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_MEMORY,

     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,

     "%s: unable to create binary XML document.",

     function );

    goto on_error;

  }

  if( memory_set(

       internal_xml_document,

       0,

       sizeof( libfwevt_internal_xml_document_t ) ) == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_MEMORY,

     LIBCERROR_MEMORY_ERROR_SET_FAILED,

     "%s: unable to clear binary XML document.",

     function );

    goto on_error;

  }

  *xml_document = (libfwevt_xml_document_t *) internal_xml_document;

  return( 1 );

on_error:

  if( internal_xml_document != NULL )

  {

    memory_free(

     internal_xml_document );

  }

  return( -1 );

}

/* Frees a binary XML document

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_free(

     libfwevt_xml_document_t **xml_document,

     libcerror_error_t **error )

{

  libfwevt_internal_xml_document_t *internal_xml_document = NULL;

  static char *function                                   = "libfwevt_xml_document_free";

  int result                                              = 1;

  if( xml_document == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary XML document.",

     function );

    return( -1 );

  }

  if( *xml_document != NULL )

  {

    internal_xml_document = (libfwevt_internal_xml_document_t *) *xml_document;

    *xml_document         = NULL;

    if( internal_xml_document->root_xml_tag != NULL )

    {

      if( libfwevt_internal_xml_tag_free(

           (libfwevt_internal_xml_tag_t **) &( internal_xml_document->root_xml_tag ),

           error ) != 1 )

      {

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

         "%s: unable to free root XML tag.",

         function );

        result = -1;

      }

    }

    memory_free(

     internal_xml_document );

  }

  return( result );

}

/* Retrieves the root XML tag

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_get_root_xml_tag(

     libfwevt_xml_document_t *xml_document,

     libfwevt_xml_tag_t **root_xml_tag,

     libcerror_error_t **error )

{

  libfwevt_internal_xml_document_t *internal_xml_document = NULL;

  static char *function                                   = "libfwevt_xml_document_get_root_xml_tag";

  if( xml_document == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary XML document.",

     function );

    return( -1 );

  }

  internal_xml_document = (libfwevt_internal_xml_document_t *) xml_document;

  if( root_xml_tag == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid root XML tag.",

     function );

    return( -1 );

  }

  *root_xml_tag = internal_xml_document->root_xml_tag;

  return( 1 );

}

/* Reads a binary XML document

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_read(

     libfwevt_xml_document_t *xml_document,

     const uint8_t *binary_data,

     size_t binary_data_size,

     size_t binary_data_offset,

     int ascii_codepage,

     uint8_t flags,

     libcerror_error_t **error )

{

  static char *function = "libfwevt_xml_document_read";

  if( libfwevt_xml_document_read_with_template_values(

       xml_document,

       binary_data,

       binary_data_size,

       binary_data_offset,

       ascii_codepage,

       flags,

       NULL,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_IO,

     LIBCERROR_IO_ERROR_READ_FAILED,

     "%s: unable to read XML document.",

     function );

    return( -1 );

  }

  return( 1 );

}

/* Reads a binary XML document with template values

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_read_with_template_values(

     libfwevt_xml_document_t *xml_document,

     const uint8_t *binary_data,

     size_t binary_data_size,

     size_t binary_data_offset,

     int ascii_codepage,

     uint8_t flags,

     libcdata_array_t *template_values_array,

     libcerror_error_t **error )

{

  libfwevt_internal_xml_document_t *internal_xml_document = NULL;

  libfwevt_xml_token_t *xml_token                         = NULL;

  static char *function                                   = "libfwevt_xml_document_read_with_template_values";

  uint8_t supported_flags                                 = 0;

  if( xml_document == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary XML document.",

     function );

    return( -1 );

  }

  internal_xml_document = (libfwevt_internal_xml_document_t *) xml_document;

  if( internal_xml_document->root_xml_tag != NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,

     "%s: invalid binary XML document - root XML tag already set.",

     function );

    return( -1 );

  }

  if( binary_data == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary data.",

     function );

    return( -1 );

  }

  if( binary_data_size > (size_t) SSIZE_MAX )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,

     "%s: invalid binary XML document data size value exceeds maximum.",

     function );

    return( -1 );

  }

  if( binary_data_offset >= binary_data_size )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid binary data offset value out of bounds.",

     function );

    return( -1 );

  }

  supported_flags = LIBFWEVT_XML_DOCUMENT_READ_FLAG_HAS_DATA_OFFSETS

                  | LIBFWEVT_XML_DOCUMENT_READ_FLAG_HAS_DEPENDENCY_IDENTIFIERS;

  if( ( flags & ~( supported_flags ) ) != 0 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

     "%s: unsupported flags: 0x%02" PRIx8 ".",

     function,

     flags );

    return( -1 );

  }

  if( libfwevt_xml_token_initialize(

       &xml_token,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,

     "%s: unable to create binary XML token.",

     function );

    goto on_error;

  }

  while( binary_data_offset < binary_data_size )

  {

    if( libfwevt_xml_token_read_data(

         xml_token,

         binary_data,

         binary_data_size,

         binary_data_offset,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_IO,

       LIBCERROR_IO_ERROR_READ_FAILED,

       "%s: unable to read binary XML token.",

       function );

      goto on_error;

    }

/* TODO check for prologue */

/* TODO validate the order */

/* TODO check for Miscellaneous before end of file token */

    switch( xml_token->type & 0xbf )

    {

      case LIBFWEVT_XML_TOKEN_END_OF_FILE:

        if( ( binary_data_size < 1 )

         || ( binary_data_offset >= ( binary_data_size - 1 ) ) )

        {

          libcerror_error_set(

           error,

           LIBCERROR_ERROR_DOMAIN_RUNTIME,

           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

           "%s: invalid binary XML document data size value too small.",

           function );

          goto on_error;

        }

#if defined( HAVE_DEBUG_OUTPUT )

        if( libcnotify_verbose != 0 )

        {

          libcnotify_printf(

           "%s: data offset\t\t: 0x%08" PRIzx "\n",

           function,

           binary_data_offset );

          libcnotify_printf(

           "%s: end of file data:\n",

           function );

          libcnotify_print_data(

           &( binary_data[ binary_data_offset ] ),

           1,

           0 );

        }

#endif

#if defined( HAVE_DEBUG_OUTPUT )

        if( libcnotify_verbose != 0 )

        {

          libcnotify_printf(

           "%s: type\t\t\t: 0x%02" PRIx8 "\n",

           function,

           binary_data[ binary_data_offset ] );

          libcnotify_printf(

           "\n" );

        }

#endif

        xml_token->size = 1;

        break;

      case LIBFWEVT_XML_TOKEN_FRAGMENT_HEADER:

        if( libfwevt_xml_document_read_fragment(

             internal_xml_document,

             xml_token,

             binary_data,

             binary_data_size,

             binary_data_offset,

             ascii_codepage,

             flags,

             template_values_array,

             internal_xml_document->root_xml_tag,

             0,

             0,

             error ) != 1 )

        {

          libcerror_error_set(

           error,

           LIBCERROR_ERROR_DOMAIN_IO,

           LIBCERROR_IO_ERROR_READ_FAILED,

           "%s: unable to read fragment header.",

           function );

          goto on_error;

        }

        break;

      default:

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

         "%s: invalid binary XML token - unsupported type: 0x%02" PRIx8 ".",

         function,

         xml_token->type );

        goto on_error;

    }

    internal_xml_document->size += xml_token->size;

    binary_data_offset          += xml_token->size;

    if( xml_token->type == LIBFWEVT_XML_TOKEN_END_OF_FILE )

    {

      break;

    }

  }

  if( libfwevt_xml_token_free(

       &xml_token,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

     "%s: unable to free binary XML token.",

     function );

    goto on_error;

  }

  return( 1 );

on_error:

  if( xml_token != NULL )

  {

    libfwevt_xml_token_free(

     &xml_token,

     NULL );

  }

  return( -1 );

}

/* Reads an attribute from a binary XML document

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_read_attribute(

     libfwevt_internal_xml_document_t *internal_xml_document,

     libfwevt_xml_token_t *xml_token,

     const uint8_t *binary_data,

     size_t binary_data_size,

     size_t binary_data_offset,

     int ascii_codepage,

     uint8_t flags,

     libcdata_array_t *template_values_array,

     libfwevt_xml_tag_t *xml_tag,

     int element_recursion_depth,

     int template_instance_recursion_depth,

     libcerror_error_t **error )

{

  libfwevt_xml_tag_t *attribute_xml_tag    = NULL;

  libfwevt_xml_token_t *xml_sub_token      = NULL;

  const uint8_t *xml_document_data         = NULL;

  static char *function                    = "libfwevt_xml_document_read_attribute";

  size_t additional_value_size             = 0;

  size_t template_value_offset             = 0;

  size_t trailing_data_size                = 0;

  size_t xml_document_data_offset          = 0;

  size_t xml_document_data_size            = 0;

  uint32_t attribute_name_offset           = 0;

  uint32_t attribute_name_size             = 0;

  int result                               = 0;

  int template_value_array_recursion_depth = 0;

  if( internal_xml_document == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary XML document.",

     function );

    return( -1 );

  }

  if( xml_token == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary XML token.",

     function );

    return( -1 );

  }

  if( ( xml_token->type & 0xbf ) != LIBFWEVT_XML_TOKEN_ATTRIBUTE )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

     "%s: invalid binary XML token - unsupported type: 0x%02" PRIx8 ".",

     function,

     xml_token->type );

    return( -1 );

  }

  if( binary_data == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid binary data.",

     function );

    return( -1 );

  }

  if( binary_data_size > (size_t) SSIZE_MAX )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,

     "%s: invalid binary XML document data size value exceeds maximum.",

     function );

    return( -1 );

  }

  if( binary_data_offset >= binary_data_size )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid binary data offset value out of bounds.",

     function );

    return( -1 );

  }

  if( ( flags & LIBFWEVT_XML_DOCUMENT_READ_FLAG_HAS_DATA_OFFSETS ) != 0 )

  {

    additional_value_size = 4;

    if( ( binary_data_size < 4 )

     || ( binary_data_offset > ( binary_data_size - 4 ) ) )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

       LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid binary data offset value out of bounds.",

       function );

      return( -1 );

    }

  }

  xml_document_data      = &( binary_data[ binary_data_offset ] );

  xml_document_data_size = binary_data_size - binary_data_offset;

  if( libfwevt_xml_token_initialize(

       &xml_sub_token,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,

     "%s: unable to create binary XML sub token.",

     function );

    goto on_error;

  }

  do

  {

    if( ( template_value_array_recursion_depth < 0 )

     || ( template_value_array_recursion_depth > LIBFWEVT_XML_DOCUMENT_TEMPLATE_VALUE_ARRAY_RECURSION_DEPTH ) )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid template value array recursion depth value out of bounds.",

       function );

      goto on_error;

    }

    if( ( xml_document_data_size < ( additional_value_size + 1 ) )

     || ( xml_document_data_offset > ( xml_document_data_size - ( additional_value_size + 1 ) ) ) )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid binary XML document data size value too small.",

       function );

      goto on_error;

    }

#if defined( HAVE_DEBUG_OUTPUT )

    if( libcnotify_verbose != 0 )

    {

      libcnotify_printf(

       "%s: data offset\t\t\t: 0x%08" PRIzx "\n",

       function,

       binary_data_offset + xml_document_data_offset );

      libcnotify_printf(

       "%s: attribute data:\n",

       function );

      libcnotify_print_data(

       &( xml_document_data[ xml_document_data_offset ] ),

       additional_value_size + 1,

       LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

    }

#endif

#if defined( HAVE_DEBUG_OUTPUT )

    if( libcnotify_verbose != 0 )

    {

      libcnotify_printf(

       "%s: type\t\t\t\t: 0x%02" PRIx8 "\n",

       function,

       xml_document_data[ xml_document_data_offset ] );

    }

#endif

    xml_document_data_offset += 1;

    if( ( flags & LIBFWEVT_XML_DOCUMENT_READ_FLAG_HAS_DATA_OFFSETS ) == 0 )

    {

      attribute_name_offset = (uint32_t) ( binary_data_offset + xml_document_data_offset );

    }

    else

    {

      if( ( xml_document_data_size < 4 )

       || ( xml_document_data_offset >= ( xml_document_data_size - 4 ) ) )

      {

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

         "%s: invalid binary XML document data size value too small.",

         function );

        goto on_error;

      }

      byte_stream_copy_to_uint32_little_endian(

       &( xml_document_data[ xml_document_data_offset ] ),

       attribute_name_offset );

#if defined( HAVE_DEBUG_OUTPUT )

      if( libcnotify_verbose != 0 )

      {

        libcnotify_printf(

         "%s: name offset\t\t\t: 0x%08" PRIx32 "\n",

         function,

         attribute_name_offset );

      }

#endif

      xml_document_data_offset += 4;

    }

#if defined( HAVE_DEBUG_OUTPUT )

    if( libcnotify_verbose != 0 )

    {

      libcnotify_printf(

       "\n" );

    }

#endif

    if( attribute_name_offset > ( binary_data_offset + xml_document_data_offset ) )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

       LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid attribute data offset value out of bounds.",

       function );

      goto on_error;

    }

    if( ( binary_data_offset + xml_document_data_offset ) < attribute_name_offset )

    {

      trailing_data_size = attribute_name_offset - ( binary_data_offset - xml_document_data_offset );

#if defined( HAVE_DEBUG_OUTPUT )

      if( libcnotify_verbose != 0 )

      {

        libcnotify_printf(

         "%s: data offset\t\t: 0x%08" PRIzx "\n",

         function,

         binary_data_offset + xml_document_data_offset );

        libcnotify_printf(

         "%s: trailing data:\n",

         function );

        libcnotify_print_data(

         &( xml_document_data[ xml_document_data_offset ] ),

         trailing_data_size,

         LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

      }

#endif

      xml_document_data_offset += trailing_data_size;

    }

    if( libfwevt_xml_tag_initialize(

         &attribute_xml_tag,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,

       "%s: unable to create attribute XML tag.",

       function );

      goto on_error;

    }

    if( libfwevt_xml_document_read_name(

         internal_xml_document,

         binary_data,

         binary_data_size,

         attribute_name_offset,

         flags,

         &attribute_name_size,

         attribute_xml_tag,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_IO,

       LIBCERROR_IO_ERROR_READ_FAILED,

       "%s: unable to read attribute name.",

       function );

      goto on_error;

    }

    if( ( binary_data_offset + xml_document_data_offset ) == attribute_name_offset )

    {

      xml_document_data_offset += attribute_name_size;

    }

    if( libfwevt_xml_token_read_data(

         xml_sub_token,

         binary_data,

         binary_data_size,

         binary_data_offset + xml_document_data_offset,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_IO,

       LIBCERROR_IO_ERROR_READ_FAILED,

       "%s: unable to read binary XML sub token.",

       function );

      goto on_error;

    }

    result = 1;

    switch( xml_sub_token->type & 0xbf )

    {

      case LIBFWEVT_XML_TOKEN_VALUE:

        if( template_value_offset != 0 )

        {

          libcerror_error_set(

           error,

           LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

           LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

           "%s: invalid template value offset value out of bounds.",

           function );

          goto on_error;

        }

        if( libfwevt_xml_document_read_value(

             internal_xml_document,

             xml_sub_token,

             binary_data,

             binary_data_size,

             binary_data_offset + xml_document_data_offset,

             attribute_xml_tag,

             ascii_codepage,

             error ) != 1 )

        {

          libcerror_error_set(

           error,

           LIBCERROR_ERROR_DOMAIN_IO,

           LIBCERROR_IO_ERROR_READ_FAILED,

           "%s: unable to read value.",

           function );

          goto on_error;

        }

        break;

      case LIBFWEVT_XML_TOKEN_NORMAL_SUBSTITUTION:

        result = libfwevt_xml_document_read_normal_substitution(

                  internal_xml_document,

                  xml_sub_token,

                  binary_data,

                  binary_data_size,

                  binary_data_offset + xml_document_data_offset,

                  ascii_codepage,

                  flags,

                  template_values_array,

                  &template_value_offset,

                  attribute_xml_tag,

                  element_recursion_depth,

                  template_instance_recursion_depth,

                  error );

        if( result == -1 )

        {

          libcerror_error_set(

           error,

           LIBCERROR_ERROR_DOMAIN_IO,

           LIBCERROR_IO_ERROR_READ_FAILED,

           "%s: unable to read normal substitution.",

           function );

          goto on_error;

        }

        break;

      case LIBFWEVT_XML_TOKEN_OPTIONAL_SUBSTITUTION:

        result = libfwevt_xml_document_read_optional_substitution(

            internal_xml_document,

            xml_sub_token,

            binary_data,

            binary_data_size,

            binary_data_offset + xml_document_data_offset,

            ascii_codepage,

            flags,

            template_values_array,

            &template_value_offset,

            attribute_xml_tag,

                  element_recursion_depth,

                  template_instance_recursion_depth,

            error );

        if( result == -1 )

        {

          libcerror_error_set(

           error,

           LIBCERROR_ERROR_DOMAIN_IO,

           LIBCERROR_IO_ERROR_READ_FAILED,

           "%s: unable to read optional substitution.",

           function );

          goto on_error;

        }

        break;

      default:

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

         "%s: invalid binary XML sub token - unsupported type: 0x%02" PRIx8 ".",

         function,

         xml_sub_token->type );

        goto on_error;

    }

    if( result != 0 )

    {

      if( libfwevt_xml_tag_append_attribute(

           xml_tag,

           attribute_xml_tag,

           error ) != 1 )

      {

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_APPEND_FAILED,

         "%s: unable to append attribute to XML tag.",

         function );

        goto on_error;

      }

      attribute_xml_tag = NULL;

    }

    xml_document_data_offset += xml_sub_token->size;

    template_value_array_recursion_depth++;

  }

  while( template_value_offset > 0 );

  xml_token->size = xml_document_data_offset;

  if( attribute_xml_tag != NULL )

  {

    if( libfwevt_internal_xml_tag_free(

         (libfwevt_internal_xml_tag_t **) &attribute_xml_tag,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

       "%s: unable to free attribute XML tag.",

       function );

      goto on_error;

    }

  }

  if( libfwevt_xml_token_free(

       &xml_sub_token,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

     "%s: unable to free binary XML sub token.",

     function );

    goto on_error;

  }

  return( 1 );

on_error:

  if( attribute_xml_tag != NULL )

  {

    libfwevt_internal_xml_tag_free(

     (libfwevt_internal_xml_tag_t **) &attribute_xml_tag,

     NULL );

  }

  if( xml_sub_token != NULL )

  {

    libfwevt_xml_token_free(

     &xml_sub_token,

     NULL );

  }

  return( -1 );

}

/* Reads a CDATA section from a binary XML document

 * Returns 1 if successful or -1 on error

 */

int libfwevt_xml_document_read_cdata_section(

     libfwevt_internal_xml_document_t *internal_xml_document,

     libfwevt_xml_token_t *xml_token,

     const uint8_t *binary_data,

     size_t binary_data_size,

     size_t binary_data_offset,

     libfwevt_xml_tag_t *xml_tag,

     int ascii_codepage LIBFWEVT_ATTRIBUTE_UNUSED,

     libcerror_error_t **error )

{

  const uint8_t *xml_document_data = NULL;

  static char *function            = "libfwevt_xml_document_read_cdata_section";

  size_t value_data_size           = 0;

  size_t xml_document_data_size    = 0;

  LIBFWEVT_UNREFERENCED_PARAMETER( ascii_codepage )

  if( internal_xml_document == NULL )

  {