#include "detect.h"

Include dependency graph for util-file-decompression.h:

This graph shows which files directly or indirectly include this file:

Macros
#define	SWF_HEADER_LEN 8

#define	SWF_LZMA_HEADER_LEN 13

#define	MAX_SWF_DECOMPRESS_DEPTH (UINT32_MAX / 2 + 1 - SWF_HEADER_LEN)

#define	MAX_SWF_COMPRESS_DEPTH (UINT32_MAX - SWF_LZMA_HEADER_LEN)

Enumerations
enum	{ FILE_IS_NOT_SWF = 0, FILE_SWF_NO_COMPRESSION, FILE_SWF_ZLIB_COMPRESSION, FILE_SWF_LZMA_COMPRESSION }

Functions
int	FileIsSwfFile (const uint8_t *buffer, uint32_t buffer_len)

int	FileSwfDecompression (const uint8_t buffer, uint32_t buffer_len, DetectEngineThreadCtx det_ctx, InspectionBuffer *out_buffer, int swf_type, uint32_t decompress_depth, uint32_t compress_depth)
	This function decompresses a buffer with zlib/lzma algorithm. More...

Detailed Description

Author: Giuseppe Longo giuse.nosp@m.ppe@.nosp@m.glong.nosp@m.o.it

Definition in file util-file-decompression.h.

Macro Definition Documentation

◆ MAX_SWF_COMPRESS_DEPTH

#define MAX_SWF_COMPRESS_DEPTH (UINT32_MAX - SWF_LZMA_HEADER_LEN)

Definition at line 35 of file util-file-decompression.h.

◆ MAX_SWF_DECOMPRESS_DEPTH

#define MAX_SWF_DECOMPRESS_DEPTH (UINT32_MAX / 2 + 1 - SWF_HEADER_LEN)

Definition at line 34 of file util-file-decompression.h.

◆ SWF_HEADER_LEN

#define SWF_HEADER_LEN 8

Definition at line 31 of file util-file-decompression.h.

◆ SWF_LZMA_HEADER_LEN

#define SWF_LZMA_HEADER_LEN 13

Definition at line 32 of file util-file-decompression.h.

Enumeration Type Documentation

◆ anonymous enum

anonymous enum

Enumerator
FILE_IS_NOT_SWF
FILE_SWF_NO_COMPRESSION
FILE_SWF_ZLIB_COMPRESSION
FILE_SWF_LZMA_COMPRESSION

Definition at line 36 of file util-file-decompression.h.

Function Documentation

◆ FileIsSwfFile()

int FileIsSwfFile	(	const uint8_t *	buffer,
		uint32_t	buffer_len
	)

Definition at line 42 of file util-file-decompression.c.

References FILE_IS_NOT_SWF, FILE_SWF_LZMA_COMPRESSION, FILE_SWF_NO_COMPRESSION, and FILE_SWF_ZLIB_COMPRESSION.

Referenced by FileSwfDecompression().

Here is the caller graph for this function:

◆ FileSwfDecompression()

int FileSwfDecompression	(	const uint8_t *	buffer,
		uint32_t	buffer_len,
		DetectEngineThreadCtx *	det_ctx,
		InspectionBuffer *	out_buffer,
		int	swf_type,
		uint32_t	decompress_depth,
		uint32_t	compress_depth
	)

This function decompresses a buffer with zlib/lzma algorithm.

Parameters

buffer	compressed buffer
buffer_len	compressed buffer length
out_buffer	inspection buffer that stores decompressed data
swf_type	decompression algorithm to use
decompress_depth	how much decompressed data we want to store
compress_depth	how much compressed data we want to decompress

Return values

1	if decompression works
0	an error occurred, and event set

Definition at line 71 of file util-file-decompression.c.

References InspectionBuffer::buf, DEBUG_VALIDATE_BUG_ON, DetectEngineSetEvent(), FILE_DECODER_EVENT_INVALID_SWF_LENGTH, FILE_DECODER_EVENT_INVALID_SWF_VERSION, FILE_DECODER_EVENT_NO_MEM, FILE_SWF_LZMA_COMPRESSION, FILE_SWF_NO_COMPRESSION, FILE_SWF_ZLIB_COMPRESSION, FileGetSwfVersion(), FileIsSwfFile(), FileSwfLzmaDecompression(), FileSwfZlibDecompression(), HTTP_SWF_COMPRESSION_BOTH, HTTP_SWF_COMPRESSION_LZMA, HTTP_SWF_COMPRESSION_ZLIB, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::len, MAX_SWF_COMPRESS_DEPTH, MAX_SWF_DECOMPRESS_DEPTH, MAX_SWF_DECOMPRESSED_LEN, MIN, offset, SCCalloc, SCFree, SCInspectionBufferCheckAndExpand(), SWF_DECOMPRESS_INITIAL_BUFFER_LEN, SWF_HEADER_LEN, SWF_LZMA_HEADER_LEN, SWF_LZMA_MIN_VERSION, and SWF_ZLIB_MIN_VERSION.

Here is the call graph for this function:

Macros

Enumerations

Functions