/*
 *  Copyright (C) 2006 Sensory Networks, Inc.
 *	      Written by Tomasz Kojm
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *  MA 02110-1301, USA.
 */

#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif

#if HAVE_MMAP

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/stat.h>
#ifdef	HAVE_UNISTD_H
#include <unistd.h>
#endif
#include <time.h>
#include <zlib.h>

#include "others.h"

#if HAVE_SYS_MMAN_H
#include <sys/mman.h>
#else /* HAVE_SYS_MMAN_H */
#undef HAVE_MMAP
#endif

#include "clamav.h"
#include "scanners.h"
#include "cltypes.h"
#include "sis.h"

#define EC32(x) le32_to_host(x) /* Convert little endian to host */
#define EC16(x) le16_to_host(x) /* Convert little endian to host */

static const char *langcodes[] = {
    "",   "EN", "FR", "GE", "SP", "IT", "SW", "DA", "NO", "FI", "AM",
    "SF", "SG", "PO", "TU", "IC", "RU", "HU", "DU", "BL", "AU", "BG",
    "AS", "NZ", "IF", "CS", "SK", "PL", "SL", "TC", "HK", "ZH", "JA",
    "TH", "AF", "SQ", "AH", "AR", "HY", "TL", "BE", "BN", "BG", "MY",
    "CA", "HR", "CE", "IE", "SF", "ET", "FA", "CF", "GD", "KA", "EL",
    "CG", "GU", "HE", "HI", "IN", "GA", "SZ", "KN", "KK", "KM", "KO",
    "LO", "LV", "LT", "MK", "MS", "ML", "MR", "MO", "MN", "NN", "BP",
    "PA", "RO", "SR", "SI", "SO", "OS", "LS", "SH", "FS", "TA", "TE",
    "BO", "TI", "CT", "TK", "UK", "UR", "",   "VI", "CY", "ZU"
};

#ifndef O_BINARY
#define O_BINARY 0
#endif

#define SIS_MAX_NAME 512
#define SIS_MAX_SIZE 134217728

static char *sis_utf16_decode(const char *str, uint32_t length)
{
	char *decoded;
	uint32_t i, j;


    if(!length || length % 2) {
	cli_dbgmsg("SIS: sis_utf16_decode: Broken filename (length == %d)\n", length);
	return NULL;
    }

    if(!(decoded = cli_calloc(length / 2 + 1, sizeof(char))))
	return NULL;

    for(i = 0, j = 0; i < length; i += 2, j++) {
       decoded[j] = str[i + 1] << 4;
       decoded[j] += str[i];
       if(decoded[j] == '%')
	   decoded[j] = '_';
    }

    return decoded;
}

static int sis_extract_simple(int fd, char *mfile, uint32_t length, uint32_t offset, uint16_t nlangs, uint8_t compressed, uint8_t *ifile, const char *dir, cli_ctx *ctx)
{
	const char *typedir = NULL;
	char *sname = NULL, *dname = NULL, *subdir, *fname, *buff;
	int desc, i;
	uint8_t get_dname = 1;
	uint32_t namelen, nameoff, filelen, fileoff, val;
	struct stat sb;
	uLong osize = 0;
	uLongf csize = 0;


    if(offset + 24 + 8 * nlangs >= length) {
	cli_errmsg("SIS: sis_extract_simple: Broken file record\n");
	return CL_EFORMAT;
    }

    switch(cli_readint32(mfile + offset)) {
	case 0x00:
	    cli_dbgmsg("SIS: File type: Standard file\n");
	    typedir = "standard";
	    break;
	case 0x01:
	    cli_dbgmsg("SIS: File type: Text file\n");
	    typedir = "text";
	    get_dname = 0;
	    break;
	case 0x02:
	    cli_dbgmsg("SIS: File type: Component file\n");
	    typedir = "component";
	    get_dname = 0;
	    break;
	case 0x03:
	    cli_dbgmsg("SIS: File type: Run file\n");
	    typedir = "run";
	    val = cli_readint32(mfile + offset + 4);
	    switch(val & 0xff) {
		case 0x00:
		    cli_dbgmsg("SIS:    * During installation only\n");
		    break;
		case 0x01:
		    cli_dbgmsg("SIS:    * During removal only\n");
		    break;
		case 0x02:
		    cli_dbgmsg("SIS:    * During installation and removal\n");
		    break;
		default:
		    cli_warnmsg("SIS: sis_extract_simple: Unknown value in file details (0x%x)\n", cli_readint32(mfile + offset + 4));
	    }
	    switch(val & 0xff00) {
		case 0x0000:
		    break;
		case 0x0100:
		    cli_dbgmsg("SIS:    * Ends when installation finished\n");
		    break;
		case 0x0200:
		    cli_dbgmsg("SIS:    * Waits until closed before continuing\n");
		    break;
		default:
		    cli_warnmsg("SIS: sis_extract_simple: Unknown value in file details (0x%x)\n", cli_readint32(mfile + offset + 4));
	    }
	    break;
	case 0x04:
	    cli_dbgmsg("SIS: File type: Null file\n");
	    return CL_CLEAN;
	case 0x05:
	    cli_dbgmsg("SIS: File type: MIME file\n");
	    return CL_CLEAN;
	default:
	    cli_warnmsg("SIS: Unknown file type in file record\n");
    }

    /* Source name */
    namelen = (uint32_t) cli_readint32(mfile + offset + 8);
    if(namelen > SIS_MAX_NAME) {
	cli_warnmsg("SIS: sis_extract_simple: Source name too long and will not be decoded\n");
    } else {
	nameoff = cli_readint32(mfile + offset + 12);
	if(nameoff >= length || nameoff + namelen >= length) {
	    cli_errmsg("SIS: sis_extract_simple: Broken source name data\n");
	    return CL_EFORMAT;
	}

	if((sname = sis_utf16_decode(mfile + nameoff, namelen)))
	    cli_dbgmsg("SIS: Source name: %s\n", sname);
	else
	    cli_warnmsg("SIS: Source name not decoded\n");
    }

    /* Destination name */
    if(get_dname) {
	namelen = (uint32_t) cli_readint32(mfile + offset + 16);
	if(namelen > SIS_MAX_NAME) {
	    cli_warnmsg("SIS: sis_extract_simple: Destination name too long and will not be decoded\n");
	} else {
	    nameoff = cli_readint32(mfile + offset + 20);
	    if(nameoff >= length || nameoff + namelen >= length) {
		cli_errmsg("SIS: sis_extract_simple: Broken destination name data\n");
		if(sname)
		    free(sname);
		return CL_EFORMAT;
	    }

	    if((dname = sis_utf16_decode(mfile + nameoff, namelen)))
		cli_dbgmsg("SIS: Destination name: %s\n", dname);
	    else
		cli_warnmsg("SIS: Destination name not decoded\n");
	}
    }

    if(!cli_leavetemps_flag) {
	if(sname)
	    free(sname);
	if(dname)
	    free(dname);
    }

    /* Files */
    if(typedir) {
	if(!(subdir = cli_malloc(strlen(dir) + strlen(typedir) + 2)))
	    return CL_EMEM;
	sprintf(subdir, "%s/%s", dir, typedir);
    } else {
	if(!(subdir = cli_strdup(dir)))
	    return CL_EMEM;
    }

    if(stat(subdir, &sb) == -1) {
	if(mkdir(subdir, 0700) == -1) {
	    free(subdir);
	    return CL_EIO;
	}
    }

    for(i = 0; i < nlangs; i++) {
	filelen = cli_readint32(mfile + offset + 24 + 4 * i);
	fileoff = cli_readint32(mfile + offset + 24 + 4 * i + 4 * nlangs);

	if(fileoff == length) {
	    cli_dbgmsg("SIS: Null file (installation record)\n");
	    *ifile = 1;
	    continue;
	} else if (fileoff > length) {
	    if(!*ifile) {
		cli_errmsg("SIS: sis_extract_simple: Broken file data (fileoff)\n");
		free(subdir);
		return CL_EFORMAT;
	    } else {
		cli_dbgmsg("SIS: Null file (installation track)\n");
		continue;
	    }
	}

	if(filelen >= length || filelen + fileoff > length) {
	    cli_errmsg("SIS: sis_extract_simple: Broken file data (filelen, fileoff)\n");
	    free(subdir);
	    return CL_EFORMAT;
	}

	if(!(fname = cli_gentemp(subdir))) {
	    free(subdir);
	    return CL_EMEM;
	}

	if(compressed) {
	    csize = (uLong) filelen;
	    filelen = cli_readint32(mfile + offset + 24 + 4 * i + 8 * nlangs);
	    osize = (uLongf) filelen;

	    if(!osize) {
		cli_dbgmsg("SIS: Empty file, skipping\n");
		free(fname);
		continue;
	    }

	    cli_dbgmsg("SIS: Compressed size: %u\n", (unsigned int) csize);
	    cli_dbgmsg("SIS: Original size: %u\n", (unsigned int) osize);

	    if(ctx->limits && ctx->limits->maxfilesize && osize > ctx->limits->maxfilesize) {
		cli_dbgmsg("SIS: Size exceeded (%u, max: %lu)\n", (unsigned int) osize, ctx->limits->maxfilesize);
		if(BLOCKMAX) {
		    *ctx->virname = "SIS.ExceededFileSize";
		    free(subdir);
		    free(fname);
		    return CL_VIRUS;
		}
		/* osize is not reliable so continue */
	    }

	    if((osize <= 3 * csize) || (ctx->limits && ctx->limits->maxfilesize && osize > ctx->limits->maxfilesize))
		osize = 3 * csize;

	    if(!(buff = cli_malloc((size_t) osize))) {
		cli_errmsg("SIS: sis_extract_simple: Can't allocate decompression buffer\n");
		free(subdir);
		free(fname);
		return CL_EIO;
	    } 

	    if(uncompress((Bytef *) buff, &osize , (Bytef *) mfile + fileoff, csize) != Z_OK) {
		cli_dbgmsg("SIS: sis_extract_simple: File decompression failed\n");
		free(buff);
		free(subdir);
		free(fname);
		return CL_EIO;
	    }

	    if(osize != (uLongf) filelen) {
		cli_dbgmsg("SIS: WARNING: Real original size: %u\n", (unsigned int) osize);
		filelen = (uint32_t) osize;
	    }

	} else {
	    buff = mfile + fileoff;
	}

	if((desc = open(fname, O_CREAT|O_WRONLY|O_TRUNC|O_BINARY, S_IRUSR|S_IWUSR)) == -1) {
	    cli_errmsg("SIS: sis_extract_simple: Can't create new file %s\n", fname);
	    free(subdir);
	    free(fname);
	    if(compressed)
		free(buff);
	    return CL_EIO;
	} 

	if((uint32_t) cli_writen(desc, buff, filelen) != filelen) {
	    cli_errmsg("SIS: sis_extract_simple: Can't write %d bytes to %s\n", filelen, fname);
	    free(subdir);
	    free(fname);
	    if(compressed)
		free(buff);
	    close(desc);
	    return CL_EIO;
	} else {
	    if(compressed)
		cli_dbgmsg("SIS: File decompressed into %s\n", fname);
	    else
		cli_dbgmsg("SIS: File saved into %s\n", fname);
	}

	if(close(desc) == -1) {
	    cli_errmsg("SIS: sis_extract_simple: Can't close descriptor %d\n", desc);
	    free(subdir);
	    free(fname);
	    if(compressed)
		free(buff);
	    return CL_EIO;
	} 

	free(fname);

	if(compressed)
	    free(buff);
    }

    free(subdir);
    return CL_SUCCESS;
}

int cli_scansis(int desc, cli_ctx *ctx)
{
	struct sis_file_hdr file_hdr;
	struct sis_file_hdr6 file_hdr6;
	uint8_t release = 0, compressed, ifile = 0;
	uint16_t opts, nlangs, *langrecs, nfiles;
	uint32_t frecord, n;
	size_t length;
	char *mfile = NULL, *langs, *dir;
	struct stat sb;
	int i, ret;


    if(fstat(desc, &sb) == -1) {
	cli_errmsg("SIS: fstat() failed\n");
	return CL_EIO;
    }

    if(sb.st_size < (off_t) sizeof(struct sis_file_hdr)) {
	cli_dbgmsg("SIS: Broken or not a SIS file (too small)\n");
	return CL_CLEAN;
    }

    length = sb.st_size;

    if(length <= SIS_MAX_SIZE) {
	mfile = (char *) mmap(NULL, length, PROT_READ, MAP_PRIVATE, desc, 0);
	if(mfile == MAP_FAILED) {
	    cli_errmsg("SIS: mmap() failed\n");
	    return CL_EMEM;
	} else {
	    cli_dbgmsg("SIS: mmap'ed file\n");
	    memcpy(&file_hdr, mfile, sizeof(struct sis_file_hdr));
	}
    } else {
	cli_warnmsg("SIS: File too large (> %d)\n", SIS_MAX_SIZE);
	return CL_CLEAN;
    }

    if(EC32(file_hdr.uid3) != 0x10000419) {
	cli_dbgmsg("SIS: Not a SIS file\n");
	munmap(mfile, length);
	return CL_CLEAN;
    }

    switch(EC32(file_hdr.uid2)) {
	case 0x1000006d:
	    cli_dbgmsg("SIS: EPOC release 3, 4 or 5\n");
	    release = 3;
	    break;
	case 0x10003a12:
	    cli_dbgmsg("SIS: EPOC release 6\n");
	    release = 6;
	    break;
	case 0x100039ce:
	case 0x10003a38:
	    cli_dbgmsg("SIS: Application(?)\n");
	    return CL_CLEAN;
	default:
	    cli_warnmsg("SIS: Unknown value of UID 2 (EPOC release == 0x%x) -> not a real SIS file??\n", EC32(file_hdr.uid2));
	    munmap(mfile, length);
	    return CL_CLEAN;
    }

    /* TODO: Verify checksums (uid4 and checksum) */

    /* Languages */
    nlangs = EC16(file_hdr.nlangs);
    cli_dbgmsg("SIS: Number of languages: %d\n", nlangs);

    if(nlangs && nlangs < 100) {

	if(EC32(file_hdr.plangs) >= length || EC32(file_hdr.plangs) + nlangs * 2 >= (uint32_t) sb.st_size) {
	    cli_errmsg("SIS: Broken file structure (language records)\n");
	    munmap(mfile, length);
	    return CL_EFORMAT;
	}

	if(!(langrecs = (uint16_t *) cli_malloc(nlangs * 2))) {
	    munmap(mfile, length);
	    return CL_EMEM;
	}

	memcpy(langrecs, mfile + EC32(file_hdr.plangs), nlangs * 2);

	if(!(langs = (char *) cli_calloc(nlangs * 3 + 1, sizeof(char)))) {
	    munmap(mfile, length);
	    free(langrecs);
	    return CL_EMEM;
	}

	for(i = 0; i < nlangs; i++) {
	    strncat(langs, langcodes[EC16(langrecs[i]) % 98], 2);
	    if(i != nlangs - 1)
		strncat(langs, " ", 1);
	}
	cli_dbgmsg("SIS: Supported languages: %s\n", langs);
	free(langrecs);
	free(langs);

    } else  {
	cli_errmsg("SIS: Incorrect number of languages (%d)\n", nlangs);
	munmap(mfile, length);
	return CL_EFORMAT;
    }

    cli_dbgmsg("SIS: Offset of languages records: %d\n", EC32(file_hdr.plangs));

    if(EC16(file_hdr.ilang))
	cli_dbgmsg("SIS: Installation language: %d\n", EC16(file_hdr.ilang));

    /* Requisites */
    cli_dbgmsg("SIS: Number of requisites: %d\n", EC16(file_hdr.nreqs));
    cli_dbgmsg("SIS: Offset of requisites records: %d\n", EC32(file_hdr.preqs));

    /* Options flags */
    opts = EC16(file_hdr.options);
    cli_dbgmsg("SIS: Options:\n");
    if(opts & 0x0001)
	cli_dbgmsg("SIS:    * File is in Unicode format\n");
    if(opts & 0x0002)
	cli_dbgmsg("SIS:    * File is distributable\n");
    if(opts & 0x0008) {
	cli_dbgmsg("SIS:    * Archived files are not compressed\n");
	compressed = 0;
    } else {
	cli_dbgmsg("SIS:    * Archived files are compressed\n");
	compressed = 1;
    }
    if(opts & 0x0010)
	cli_dbgmsg("SIS:    * File installation shuts down all applications\n");

    /* Type flags */
    switch(EC16(file_hdr.type)) {
	case 0x0000:
	    cli_dbgmsg("SIS: Type: Contains an application\n");
	    break;
	case 0x0001:
	    cli_dbgmsg("SIS: Type: Contains a shared/system component\n");
	    break;
	case 0x0002:
	    cli_dbgmsg("SIS: Type: Contains an optional (selectable) component\n");
	    break;
	case 0x0003:
	    cli_dbgmsg("SIS: Type: Configures an existing application or service\n");
	    break;
	case 0x0004:
	    cli_dbgmsg("SIS: Type: Patches an existing component\n");
	    break;
	case 0x0005:
	    cli_dbgmsg("SIS: Type: Upgrades an existing component\n");
	    break;
	default:
	    cli_warnmsg("SIS: Unknown value of type\n");
    } 

    cli_dbgmsg("SIS: Major version: %d\n", EC16(file_hdr.majorver));
    cli_dbgmsg("SIS: Minor version: %d\n", EC16(file_hdr.minorver));

    if(release == 6) {

	if(sizeof(struct sis_file_hdr) + sizeof(struct sis_file_hdr6) >= length) {
	    cli_errmsg("SIS: Broken file structure (language records)\n");
	    munmap(mfile, length);
	    return CL_EFORMAT;
	}

	memcpy(&file_hdr6, mfile + sizeof(struct sis_file_hdr), sizeof(struct sis_file_hdr6));
	cli_dbgmsg("SIS: Maximum space required: %d\n", EC32(file_hdr6.maxispace));
    }

    /* Files */
    nfiles = EC16(file_hdr.nfiles);

    if(ctx->limits && ctx->limits->maxfiles && nfiles > ctx->limits->maxfiles) {
	cli_dbgmsg("SIS: Files limit reached (max: %d)\n", ctx->limits->maxfiles);
	if(BLOCKMAX) {
	    *ctx->virname = "SIS.ExceededFilesLimit";
	    munmap(mfile, length);
	    return CL_VIRUS;
	}
	return CL_CLEAN;
    }

    cli_dbgmsg("SIS: Number of files: %d\n", nfiles);
    cli_dbgmsg("SIS: Offset of files records: %d\n", EC32(file_hdr.pfiles));

    if((frecord = EC32(file_hdr.pfiles)) >= length) {
	cli_errmsg("SIS: Broken file structure (frecord)\n");
	munmap(mfile, length);
	return CL_EFORMAT;
    }

    dir = cli_gentemp(NULL);
    if(!dir || mkdir(dir, 0700) == -1) {
	cli_errmsg("SIS: Can't create temporary directory %s\n", dir ? dir : "");
	munmap(mfile, length);
	return CL_ETMPDIR;
    }

    for(i = 0; i < nfiles; i++) {

	cli_dbgmsg("SIS: -----\n");

	if(frecord + 4 >= length) {
	    cli_errmsg("SIS: Broken file structure (frecord)\n");
	    munmap(mfile, length);
	    if(!cli_leavetemps_flag)
		cli_rmdirs(dir);
	    free(dir);
	    return CL_EFORMAT;
	}

	switch(cli_readint32(mfile + frecord)) {
	    case 0x00000000:
		cli_dbgmsg("SIS: Simple file record\n");
		if((ret = sis_extract_simple(desc, mfile, sb.st_size, frecord + 4, 1, compressed, &ifile, dir, ctx))) {
		    munmap(mfile, length);
		    if(!cli_leavetemps_flag)
			cli_rmdirs(dir);
		    free(dir);
		    return ret;
		}

		if(release == 6)
		    frecord += 32 + 12 + 4;
		else
		    frecord += 28 + 4 + 4;

		break;
	    case 0x00000001:
		cli_dbgmsg("SIS: Multiple languages file record\n");
		/* TODO: Pass language strings into sis_extract */
		if((ret = sis_extract_simple(desc, mfile, sb.st_size, frecord + 4, nlangs, compressed, &ifile, dir, ctx))) {
		    munmap(mfile, length);
		    if(!cli_leavetemps_flag)
			cli_rmdirs(dir);
		    free(dir);
		    return ret;
		}

		if(release == 6)
		    frecord += 32 + 12 * nlangs + 4;
		else
		    frecord += 28 + 4 * nlangs + 4;

		break;
	    case 0x00000002:
		cli_dbgmsg("SIS: Options record\n");
		if(frecord + 8 >= length) {
		    munmap(mfile, length);
		    if(!cli_leavetemps_flag)
			cli_rmdirs(dir);
		    free(dir);
		    return CL_EFORMAT;
		}

		n = cli_readint32(mfile + frecord + 4);
		cli_dbgmsg("SIS: Number of options: %d\n", n);

		if(n > 128 || frecord + 8 * n * nlangs >= length) {
		    cli_errmsg("SIS: Incorrect number of options\n");
		    munmap(mfile, length);
		    if(!cli_leavetemps_flag)
			cli_rmdirs(dir);
		    free(dir);
		    return CL_EFORMAT;
		}

		frecord += 8 + 8 * n * nlangs + 16;

		break;
	    case 0x00000003:
	    case 0x00000004:
		cli_dbgmsg("SIS: If/ElseIf record\n");
		if(frecord + 8 >= length) {
		    munmap(mfile, length);
		    if(!cli_leavetemps_flag)
			cli_rmdirs(dir);
		    free(dir);
		    return CL_EFORMAT;
		}

		n = cli_readint32(mfile + frecord + 4);
		cli_dbgmsg("SIS: Size of conditional expression: %d\n", n);

		if(n >= length) {
		    cli_errmsg("SIS: Incorrect size of conditional expression\n");
		    munmap(mfile, length);
		    if(!cli_leavetemps_flag)
			cli_rmdirs(dir);
		    free(dir);
		    return CL_EFORMAT;
		}

		frecord += 8 + n;
		break;
	    case 0x00000005:
		cli_dbgmsg("SIS: Else record\n");
		frecord += 4;
		break;
	    case 0x00000006:
		cli_dbgmsg("SIS: EndIf record\n");
		frecord += 4;
		break;
	    default:
		cli_warnmsg("SIS: Unknown file record type\n");
	}
    }

    /* scan extracted files */
    cli_dbgmsg("SIS:  ****** Scanning extracted files ******\n");
    ret = cli_scandir(dir, ctx);

    if(!cli_leavetemps_flag)
	cli_rmdirs(dir);

    free(dir);
    munmap(mfile, length);

    return ret;
}

#else /* HAVE_MMAP */

#include "clamav.h"
#include "others.h"
#include "sis.h"

int cli_scansis(int desc, cli_ctx *ctx)
{
    cli_warnmsg("Support for SIS files not compiled in!\n");
    return CL_CLEAN;
}

#endif /* HAVE_MMAP */