gio/thumbnail-verify.c

   1 /* Copyright © 2013 Canonical Limited
   2  *
   3  * This library is free software; you can redistribute it and/or
   4  * modify it under the terms of the GNU Lesser General Public
   5  * License as published by the Free Software Foundation; either
   6  * version 2 of the License, or (at your option) any later version.
   7  *
   8  * This library is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  11  * Lesser General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU Lesser General
  14  * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
  15  *
  16  * Author: Ryan Lortie <desrt@desrt.ca>
  17  */
  18
  19 #include "config.h"
  20
  21 #include "thumbnail-verify.h"
  22
  23 #include <string.h>
  24
  25 /* Begin code to check the validity of thumbnail files.  In order to do
  26  * that we need to parse enough PNG in order to get the Thumb::URI,
  27  * Thumb::MTime and Thumb::Size tags out of the file.  Fortunately this
  28  * is relatively easy.
  29  */
  30 typedef struct
  31 {
  32   const gchar *uri;
  33   guint64      mtime;
  34   guint64      size;
  35 } ExpectedInfo;
  36
  37 /* We *require* matches on URI and MTime, but the Size field is optional
  38  * (as per the spec).
  39  *
  40  * http://specifications.freedesktop.org/thumbnail-spec/thumbnail-spec-latest.html
  41  */
  42 #define MATCHED_URI    (1u << 0)
  43 #define MATCHED_MTIME  (1u << 1)
  44 #define MATCHED_ALL    (MATCHED_URI | MATCHED_MTIME)
  45
  46 static gboolean
  47 check_integer_match (guint64      expected,
  48                      const gchar *value,
  49                      guint32      value_size)
  50 {
  51   /* Would be nice to g_ascii_strtoll here, but we don't have a variant
  52    * that works on strings that are not nul-terminated.
  53    *
  54    * It's easy enough to do it ourselves...
  55    */
  56   if (expected == 0)  /* special case: "0" */
  57     return value_size == 1 && value[0] == '0';
  58
  59   /* Check each digit, as long as we have data from both */
  60   while (expected && value_size)
  61     {
  62       /* Check the low-order digit */
  63       if (value[value_size - 1] != (gchar) ((expected % 10) + '0'))
  64         return FALSE;
  65
  66       /* Move on... */
  67       expected /= 10;
  68       value_size--;
  69     }
  70
  71   /* Make sure nothing is left over, on either side */
  72   return !expected && !value_size;
  73 }
  74
  75 static gboolean
  76 check_png_info_chunk (ExpectedInfo *expected_info,
  77                       const gchar  *key,
  78                       guint32       key_size,
  79                       const gchar  *value,
  80                       guint32       value_size,
  81                       guint        *required_matches)
  82 {
  83   if (key_size == 10 && memcmp (key, "Thumb::URI", 10) == 0)
  84     {
  85       gsize expected_size;
  86
  87       expected_size = strlen (expected_info->uri);
  88
  89       if (expected_size != value_size)
  90         return FALSE;
  91
  92       if (memcmp (expected_info->uri, value, value_size) != 0)
  93         return FALSE;
  94
  95       *required_matches |= MATCHED_URI;
  96     }
  97
  98   else if (key_size == 12 && memcmp (key, "Thumb::MTime", 12) == 0)
  99     {
 100       if (!check_integer_match (expected_info->mtime, value, value_size))
 101         return FALSE;
 102
 103       *required_matches |= MATCHED_MTIME;
 104     }
 105
 106   else if (key_size == 11 && memcmp (key, "Thumb::Size", 11) == 0)
 107     {
 108       /* A match on Thumb::Size is not required for success, but if we
 109        * find this optional field and it's wrong, we should reject the
 110        * thumbnail.
 111        */
 112       if (!check_integer_match (expected_info->size, value, value_size))
 113         return FALSE;
 114     }
 115
 116   return TRUE;
 117 }
 118
 119 static gboolean
 120 check_thumbnail_validity (ExpectedInfo *expected_info,
 121                           const gchar  *contents,
 122                           gsize         size)
 123 {
 124   guint required_matches = 0;
 125
 126   /* Reference: http://www.w3.org/TR/PNG/ */
 127   if (size < 8)
 128     return FALSE;
 129
 130   if (memcmp (contents, "\x89PNG\r\n\x1a\n", 8) != 0)
 131     return FALSE;
 132
 133   contents += 8, size -= 8;
 134
 135   /* We need at least 12 bytes to have a chunk... */
 136   while (size >= 12)
 137     {
 138       guint32 chunk_size_be;
 139       guint32 chunk_size;
 140
 141       /* PNG is not an aligned file format so we have to be careful
 142        * about reading integers...
 143        */
 144       memcpy (&chunk_size_be, contents, 4);
 145       chunk_size = GUINT32_FROM_BE (chunk_size_be);
 146
 147       contents += 4, size -= 4;
 148
 149       /* After consuming the size field, we need to have enough bytes
 150        * for 4 bytes type field, chunk_size bytes for data, then 4 byte
 151        * for CRC (which we ignore)
 152        *
 153        * We just read chunk_size from the file, so it may be very large.
 154        * Make sure it won't wrap when we add 8 to it.
 155        */
 156       if (G_MAXUINT32 - chunk_size < 8 || size < chunk_size + 8)
 157         goto out;
 158
 159       /* We are only interested in tEXt fields */
 160       if (memcmp (contents, "tEXt", 4) == 0)
 161         {
 162           const gchar *key = contents + 4;
 163           guint32 key_size;
 164
 165           /* We need to find the nul separator character that splits the
 166            * key/value.  The value is not terminated.
 167            *
 168            * If we find no nul then we just ignore the field.
 169            *
 170            * value may contain extra nuls, but check_png_info_chunk()
 171            * can handle that.
 172            */
 173           for (key_size = 0; key_size < chunk_size; key_size++)
 174             {
 175               if (key[key_size] == '\0')
 176                 {
 177                   const gchar *value;
 178                   guint32 value_size;
 179
 180                   /* Since key_size < chunk_size, value_size is
 181                    * definitely non-negative.
 182                    */
 183                   value_size = chunk_size - key_size - 1;
 184                   value = key + key_size + 1;
 185
 186                   /* We found the separator character. */
 187                   if (!check_png_info_chunk (expected_info,
 188                                              key, key_size,
 189                                              value, value_size,
 190                                              &required_matches))
 191                     return FALSE;
 192                 }
 193             }
 194         }
 195       else
 196         {
 197           /* A bit of a hack: assume that all tEXt chunks will appear
 198            * together.  Therefore, if we have already seen both required
 199            * fields and then see a non-tEXt chunk then we can assume we
 200            * are done.
 201            *
 202            * The common case is that the tEXt chunks come at the start
 203            * of the file before any of the image data.  This trick means
 204            * that we will only fault in a single page (4k) whereas many
 205            * thumbnails (particularly the large ones) can approach 100k
 206            * in size.
 207            */
 208           if (required_matches == MATCHED_ALL)
 209             goto out;
 210         }
 211
 212       /* skip to the next chunk, ignoring CRC. */
 213       contents += 4, size -= 4;                         /* type field */
 214       contents += chunk_size, size -= chunk_size;       /* data */
 215       contents += 4, size -= 4;                         /* CRC */
 216     }
 217
 218 out:
 219   return required_matches == MATCHED_ALL;
 220 }
 221
 222 gboolean
 223 thumbnail_verify (const char     *thumbnail_path,
 224                   const gchar    *file_uri,
 225                   const GLocalFileStat *file_stat_buf)
 226 {
 227   gboolean thumbnail_is_valid = FALSE;
 228   ExpectedInfo expected_info;
 229   GMappedFile *file;
 230
 231   if (file_stat_buf == NULL)
 232     return FALSE;
 233
 234   expected_info.uri = file_uri;
 235   expected_info.mtime = file_stat_buf->st_mtime;
 236   expected_info.size = file_stat_buf->st_size;
 237
 238   file = g_mapped_file_new (thumbnail_path, FALSE, NULL);
 239   if (file)
 240     {
 241       thumbnail_is_valid = check_thumbnail_validity (&expected_info,
 242                                                      g_mapped_file_get_contents (file),
 243                                                      g_mapped_file_get_length (file));
 244       g_mapped_file_unref (file);
 245     }
 246
 247   return thumbnail_is_valid;
 248 }