Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: workarounds for older libmagics.

Browse source 
Some of the unit tests revealed different versions of libmagic could
give different mime types for the same input file and magic database.

One way that could happen is because of the use of hardcoded/builtin
token (word) comparisons for ascii files -- MAGIC_NO_CHECK_TOKENS flag
will prevent that from being used (and it's obsoleted in newer
libmagics).

The other problem looked like a bug fixed as of 5.05 where
a match in the magic database that doesn't have a verbose description
but does have a mime type won't actually return that mime type due to
the the missing description.  The one case where that kept popping up
was in 5.04 not beign able to identify application/x-dosexec, so I added
a description to the top-level match for that to workaround the issue.
This commit is contained in:
Jon Siwek 2013-04-18 18:09:48 -05:00
parent 037d582b0e
commit cd2a6aa33a
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
cmake

@ -1 +1 @@
Subproject commit 1bfdacb8921ab0b40099f5fde7a611167bf310c3
Subproject commit e1a7fd00a0a66d6831a239fe84f5fcfaa54e2c35

2
magic/msdos
View file

@ -20,7 +20,7 @@
#
# Many of the compressed formats were extraced from IDARC 1.23 source code.
#
0 string/b MZ
0 string/b MZ DOS MZ
!:mime application/x-dosexec
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
>0x18 leshort <0x40 MS-DOS executable

2
src/util.cc
View file

@ -1568,7 +1568,7 @@ void bro_init_magic(magic_t* cookie_ptr, int flags)
if ( ! cookie_ptr || *cookie_ptr )
return;
*cookie_ptr = magic_open(flags);
*cookie_ptr = magic_open(flags|MAGIC_NO_CHECK_TOKENS);
// Use our custom database for mime types, but the default database
// from libmagic for the verbose file type.