head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.4 netbsd-11-0-RC3:1.1.1.4 netbsd-11-0-RC2:1.1.1.4 netbsd-11-0-RC1:1.1.1.4 perseant-exfatfs-base-20250801:1.1.1.4 netbsd-11:1.1.1.4.0.6 netbsd-11-base:1.1.1.4 netbsd-10-1-RELEASE:1.1.1.4 perseant-exfatfs-base-20240630:1.1.1.4 perseant-exfatfs:1.1.1.4.0.4 perseant-exfatfs-base:1.1.1.4 netbsd-8-3-RELEASE:1.1.1.1 netbsd-9-4-RELEASE:1.1.1.3 netbsd-10-0-RELEASE:1.1.1.4 netbsd-10-0-RC6:1.1.1.4 netbsd-10-0-RC5:1.1.1.4 netbsd-10-0-RC4:1.1.1.4 netbsd-10-0-RC3:1.1.1.4 netbsd-10-0-RC2:1.1.1.4 netbsd-10-0-RC1:1.1.1.4 FILE5_45:1.1.1.4 netbsd-10:1.1.1.4.0.2 netbsd-10-base:1.1.1.4 FILE5_43:1.1.1.4 netbsd-9-3-RELEASE:1.1.1.3 cjep_sun2x-base1:1.1.1.3 cjep_sun2x:1.1.1.3.0.8 cjep_sun2x-base:1.1.1.3 cjep_staticlib_x-base1:1.1.1.3 netbsd-9-2-RELEASE:1.1.1.3 cjep_staticlib_x:1.1.1.3.0.6 cjep_staticlib_x-base:1.1.1.3 FILE5_40:1.1.1.3 netbsd-9-1-RELEASE:1.1.1.3 FILE5_39:1.1.1.3 phil-wifi-20200421:1.1.1.3 phil-wifi-20200411:1.1.1.3 is-mlppp:1.1.1.3.0.4 is-mlppp-base:1.1.1.3 phil-wifi-20200406:1.1.1.3 netbsd-8-2-RELEASE:1.1.1.1 netbsd-9-0-RELEASE:1.1.1.3 netbsd-9-0-RC2:1.1.1.3 FILE5_38:1.1.1.3 netbsd-9-0-RC1:1.1.1.3 phil-wifi-20191119:1.1.1.3 netbsd-9:1.1.1.3.0.2 netbsd-9-base:1.1.1.3 phil-wifi-20190609:1.1.1.3 netbsd-8-1-RELEASE:1.1.1.1 FILE5_37:1.1.1.3 netbsd-8-1-RC1:1.1.1.1 pgoyette-compat-merge-20190127:1.1.1.2 pgoyette-compat-20190127:1.1.1.2 pgoyette-compat-20190118:1.1.1.2 pgoyette-compat-1226:1.1.1.2 pgoyette-compat-1126:1.1.1.2 pgoyette-compat-1020:1.1.1.2 FILE5_35:1.1.1.2 pgoyette-compat-0930:1.1.1.2 pgoyette-compat-0906:1.1.1.2 pgoyette-compat-0728:1.1.1.2 netbsd-8-0-RELEASE:1.1.1.1 phil-wifi:1.1.1.2.0.4 phil-wifi-base:1.1.1.2 pgoyette-compat-0625:1.1.1.2 netbsd-8-0-RC2:1.1.1.1 pgoyette-compat-0521:1.1.1.2 pgoyette-compat-0502:1.1.1.2 pgoyette-compat-0422:1.1.1.2 netbsd-8-0-RC1:1.1.1.1 FILE5_33:1.1.1.2 pgoyette-compat-0415:1.1.1.2 pgoyette-compat-0407:1.1.1.2 pgoyette-compat-0330:1.1.1.2 pgoyette-compat-0322:1.1.1.2 pgoyette-compat-0315:1.1.1.2 pgoyette-compat:1.1.1.2.0.2 pgoyette-compat-base:1.1.1.2 matt-nb8-mediatek:1.1.1.1.0.12 matt-nb8-mediatek-base:1.1.1.1 FILE5_32:1.1.1.2 perseant-stdc-iso10646:1.1.1.1.0.10 perseant-stdc-iso10646-base:1.1.1.1 netbsd-8:1.1.1.1.0.8 netbsd-8-base:1.1.1.1 FILE5_31:1.1.1.1 prg-localcount2-base3:1.1.1.1 prg-localcount2-base2:1.1.1.1 prg-localcount2-base1:1.1.1.1 prg-localcount2:1.1.1.1.0.6 prg-localcount2-base:1.1.1.1 pgoyette-localcount-20170426:1.1.1.1 bouyer-socketcan:1.1.1.1.0.4 bouyer-socketcan-base1:1.1.1.1 pgoyette-localcount:1.1.1.1.0.2 pgoyette-localcount-20170320:1.1.1.1 FILE5_30:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2017.02.10.17.42.59; author christos; state Exp; branches 1.1.1.1; next ; commitid HAP3kn9Hn6ovMqFz; 1.1.1.1 date 2017.02.10.17.42.59; author christos; state Exp; branches 1.1.1.1.2.1 1.1.1.1.4.1; next 1.1.1.2; commitid HAP3kn9Hn6ovMqFz; 1.1.1.2 date 2017.09.08.13.22.45; author christos; state Exp; branches 1.1.1.2.4.1; next 1.1.1.3; commitid Hp7DmePhD4aVAo6A; 1.1.1.3 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.4; commitid VXeNRYYruN1MWdoB; 1.1.1.4 date 2022.09.24.20.07.54; author christos; state Exp; branches; next ; commitid Nf6F9kcpc0EPC9VD; 1.1.1.1.2.1 date 2017.02.10.17.42.59; author pgoyette; state dead; branches; next 1.1.1.1.2.2; commitid jjw7cAwgyKq7RfKz; 1.1.1.1.2.2 date 2017.03.20.06.52.20; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.1.4.1 date 2017.02.10.17.42.59; author bouyer; state dead; branches; next 1.1.1.1.4.2; commitid dUG7nkTKALCadqOz; 1.1.1.1.4.2 date 2017.04.21.16.51.24; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.1.1.2.4.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next ; commitid jtc8rnCzWiEEHGqB; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # $File: yara,v 1.1 2016/10/30 00:38:01 christos Exp $ # yara: file(1) magic for http://virustotal.github.io/yara/ # 0 string YARA >4 lelong >2047 >8 byte <20 YARA 3.x compiled rule set # version >>8 clear >>8 byte 6 created with version 3.3.0 >>8 byte 8 created with version 3.4.0 >>8 byte 11 created with version 3.5.0 >>8 default x >>>8 byte x development version 0x%02x @ 1.1.1.1 log @2017-02-10 12:24 Christos Zoulas * release 5.30 2017-02-07 23:27 Christos Zoulas * If we exceeded the offset in a search return no match (Christoph Biedl) * Be more lenient on corrupt CDF files (Christoph Biedl) 2017-02-04 16:46 Christos Zoulas * pacify ubsan sign extension (oss-fuzz/524) 2017-02-01 12:42 Christos Zoulas * off by one in cdf parsing (PR/593) * report debugging sections in elf (PR/591) 2016-11-06 10:52 Christos Zoulas * Allow @@@@@@ in extensions * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas * release 5.29 2016-10-24 11:20 Christos Zoulas * der getlength overflow (Jonas Wagner) * multiple magic file load failure (Christoph Biedl) 2016-10-17 11:26 Christos Zoulas * CDF parsing improvements (Guy Helmer) 2016-07-20 7:26 Christos Zoulas * Add support for signed indirect offsets 2016-07-18 7:41 Christos Zoulas * cat /dev/null | file - should print empty (Christoph Biedl) 2016-07-05 15:20 Christos Zoulas * Bump string size from 64 to 96. 2016-06-13 20:20 Christos Zoulas * PR/556: Fix separators on annotations. 2016-06-13 19:40 Christos Zoulas * release 5.28 * fix leak on allocation failure 2016-06-01 1:20 Christos Zoulas * PR/555: Avoid overflow for offset > nbytes * PR/550: Segv on DER parsing: - use the correct variable for length - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas * release 5.27 2016-04-18 9:35 Christos Zoulas * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. * Offset comparison was off-by-one. * Fix compression code (Werner Fink) * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas * release 5.26 2016-03-31 13:50 Christos Zoulas * make the number of bytes read from files configurable. 2016-03-21 13:40 Christos Zoulas * Add bounds checks for DER code (discovered by Thomas Jarosch) * Change indirect recursion limit to indirect use count and bump from 15 to 50 to prevent abuse. 2016-03-13 20:39 Christos Zoulas * Add -00 which prints filename\0description\0 2016-03-01 13:28 Christos Zoulas * Fix ID3 indirect parsing 2016-01-19 10:18 Christos Zoulas * add DER parsing capability 2015-11-13 10:35 Christos Zoulas * provide dprintf(3) for the OS's that don't have it. 2015-11-11 16:25 Christos Zoulas * redo the compression code report decompression errors 2015-11-10 23:25 Christos Zoulas * REG_STARTEND code is not working as expected, delete it. 2015-11-09 16:05 Christos Zoulas * Add zlib support if we have it. 2015-11-05 11:22 Christos Zoulas * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas * release 5.25 2015-09-11 13:25 Christos Zoulas * add a limit to the length of regex searches 2015-09-08 9:50 Christos Zoulas * fix problems with --parameter (Christoph Biedl) 2015-07-11 10:35 Christos Zoulas * Windows fixes PR/466 (Jason Hood) 2015-07-09 10:35 Christos Zoulas * release 5.24 2015-06-11 8:52 Christos Zoulas * redo long option encoding to fix off-by-one in 5.23 2015-06-10 13:50 Christos Zoulas * release 5.23 2015-06-09 16:10 Christos Zoulas * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic * PR/459: Don't insert magic entries to the list if there are parsing errors for them. 2015-06-03 16:00 Christos Zoulas * PR/455: Add utf-7 encoding 2015-06-03 14:30 Christos Zoulas * PR/455: Implement -Z, look inside, but don't report on compression * PR/454: Fix allocation error on bad magic. 2015-05-29 10:30 Christos Zoulas * handle MAGIC_CONTINUE everywhere, not just in softmagic 2015-05-21 14:30 Christos Zoulas * don't print descriptions for NAME types when mime. 2015-04-09 15:59 Christos Zoulas * Add --extension to list the known extensions for this file type Idea by Andrew J Roazen 2015-02-14 12:23 Christos Zoulas * Bump file search buffer size to 1M. 2015-01-09 14:35 Christos Zoulas * Fix multiple issues with date formats reported by Christoph Biedl: - T_LOCAL meaning was reversed - Arithmetic did not work Also stop adjusting daylight savings for gmt printing. 2015-01-05 13:00 Christos Zoulas * PR/411: Fix memory corruption from corrupt cdf file. @ text @@ 1.1.1.2 log @2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() 2017-05-23 13:55 Christos Zoulas * release 5.31 2017-03-17 20:32 Christos Zoulas * remove trailing spaces from magic files * refactor is_tar * better bounds checks for cdf @ text @d4 1 a4 1 # $File: yara,v 1.2 2017/05/25 20:07:23 christos Exp $ d12 1 a12 1 >>8 clear x @ 1.1.1.2.4.1 log @Sync with HEAD @ text @d4 2 a5 2 # $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $ # yara: file(1) magic for https://virustotal.github.io/yara/ @ 1.1.1.3 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d4 2 a5 2 # $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $ # yara: file(1) magic for https://virustotal.github.io/yara/ @ 1.1.1.4 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d4 1 a4 1 # $File: yara,v 1.4 2021/04/26 15:56:00 christos Exp $ d17 1 a17 1 >>>8 byte x development version %#02x @ 1.1.1.1.4.1 log @file yara was added on branch bouyer-socketcan on 2017-04-21 16:51:24 +0000 @ text @d1 17 @ 1.1.1.1.4.2 log @Sync with HEAD @ text @a0 17 #------------------------------------------------------------------------------ # $File: yara,v 1.1 2016/10/30 00:38:01 christos Exp $ # yara: file(1) magic for http://virustotal.github.io/yara/ # 0 string YARA >4 lelong >2047 >8 byte <20 YARA 3.x compiled rule set # version >>8 clear >>8 byte 6 created with version 3.3.0 >>8 byte 8 created with version 3.4.0 >>8 byte 11 created with version 3.5.0 >>8 default x >>>8 byte x development version 0x%02x @ 1.1.1.1.2.1 log @file yara was added on branch pgoyette-localcount on 2017-03-20 06:52:20 +0000 @ text @d1 17 @ 1.1.1.1.2.2 log @Sync with HEAD @ text @a0 17 #------------------------------------------------------------------------------ # $File: yara,v 1.1 2016/10/30 00:38:01 christos Exp $ # yara: file(1) magic for http://virustotal.github.io/yara/ # 0 string YARA >4 lelong >2047 >8 byte <20 YARA 3.x compiled rule set # version >>8 clear >>8 byte 6 created with version 3.3.0 >>8 byte 8 created with version 3.4.0 >>8 byte 11 created with version 3.5.0 >>8 default x >>>8 byte x development version 0x%02x @