/builds/wireshark/wireshark/wiretap/file

Bug Summary

File:	wiretap/file_access.c
Warning:	line 2288, column 13 Potential leak of memory pointed to by 'wdh'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name file_access.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-21/lib/clang/21 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /usr/include/libxml2 -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -D wiretap_EXPORTS -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -I /builds/wireshark/wireshark/wiretap -I /builds/wireshark/wireshark/build/wiretap -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-21/lib/clang/21/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-truncation -Wno-format-nonliteral -Wno-pointer-sign -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fwrapv-pointer -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2025-10-27-100323-3623-1 -x c /builds/wireshark/wireshark/wiretap/file_access.c
1/* file_access.c
*
* Wiretap Library
* Copyright (c) 1998 by Gilbert Ramirez <[email protected]>
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/

9#include "config.h"
10#define WS_LOG_DOMAIN"Wiretap" LOG_DOMAIN_WIRETAP"Wiretap"
11#include "wtap-int.h"

13#include <assert.h>

15#include <string.h>
16#include <stdlib.h>

18#include <errno(*__errno_location ()).h>

20#include <wsutil/file_util.h>
21#include <wsutil/file_compressed.h>
22#include <wsutil/tempfile.h>
23#ifdef HAVE_PLUGINS1
24#include <wsutil/plugins.h>
25#endif
26#include <wsutil/ws_assert.h>

28#include "wtap_modules.h"
29#include "file_wrappers.h"
30#include "required_file_handlers.h"
31#include <wsutil/application_flavor.h>
32#include <wsutil/buffer.h>
33#include <wsutil/str_util.h>

35#include "lanalyzer.h"
36#include "ngsniffer.h"
37#include "radcom.h"
38#include "ascendtext.h"
39#include "nettl.h"
40#include "libpcap.h"
41#include "snoop.h"
42#include "iptrace.h"
43#include "iseries.h"
44#include "netmon.h"
45#include "netxray.h"
46#include "toshiba.h"
47#include "eyesdn.h"
48#include "i4btrace.h"
49#include "csids.h"
50#include "pppdump.h"
51#include "peekclassic.h"
52#include "peektagged.h"
53#include "vms.h"
54#include "dbs-etherwatch.h"
55#include "visual.h"
56#include "cosine.h"
57#include "5views.h"
58#include "erf.h"
59#include "hcidump.h"
60#include "logcat.h"
61#include "logcat_text.h"
62#include "json.h"
63#include "json_log.h"
64#include "mmodule.h"
65#include "observer.h"
66#include "k12.h"
67#include "ber.h"
68#include "catapult_dct2000.h"
69#include "mp4.h"
70#include "mp2t.h"
71#include "mpeg.h"
72#include "netscreen.h"
73#include "commview.h"
74#include "pcapng.h"
75#include "aethra.h"
76#include "btsnoop.h"
77#include "tnef.h"
78#include "dct3trace.h"
79#include "packetlogger.h"
80#include "daintree-sna.h"
81#include "netscaler.h"
82#include "mime_file.h"
83#include "ipfix.h"
84#include "vwr.h"
85#include "camins.h"
86#include "stanag4607.h"
87#include "capsa.h"
88#include "nettrace_3gpp_32_423.h"
89#include "mplog.h"
90#include "dpa400.h"
91#include "rfc7468.h"
92#include "ruby_marshal.h"
93#include "systemd_journal.h"
94#include "log3gpp.h"
95#include "candump.h"
96#include "busmaster.h"
97#include "cllog.h"
98#include "blf.h"
99#include "eri_enb_log.h"
100#include "autosar_dlt.h"
101#include "rtpdump.h"
102#include "ems.h"
103#include "ttl.h"
104#include "peak-trc.h"
105#include "netlog.h"
106#include "procmon.h"

108/*
* Add an extension, and all compressed versions thereof if requested,
* to a GSList of extensions.
*/
112static GSList *
113add_extensions(GSList *extensions, const char *extension,
  GSList *compression_type_extensions)
115{
/*
* Add the specified extension.
*/
extensions = g_slist_prepend(extensions, g_strdup(extension)g_strdup_inline (extension));

/*
* Add whatever compressed versions we were supplied.
*/
for (GSList *compression_type_extension = compression_type_extensions;
   compression_type_extension != NULL((void*)0);
   compression_type_extension = g_slist_next(compression_type_extension)((compression_type_extension) ? (((GSList *)(compression_type_extension
))->next) : ((void*)0))) {
extensions = g_slist_prepend(extensions,
    ws_strdup_printf("%s.%s", extension,wmem_strdup_printf(((void*)0), "%s.%s", extension, (const char
 *)compression_type_extension->data)
        (const char *)compression_type_extension->data)wmem_strdup_printf(((void*)0), "%s.%s", extension, (const char
 *)compression_type_extension->data));
}

return extensions;
133}

135/*
* File types that can be identified by file extensions.
*
* These are used in file open dialogs to offer choices of extensions
* for which to filter.  Note that the first field can list more than
* one type of file, because, for example, ".cap" is a popular
* extension used by a number of capture file types.
*
* File types that *don't* have a file extension used for them should
* *not* be placed here; if there's nothing to put in the last field
* of the structure, don't put an entry here, not even one with an
* empty string for the extensions list.
*
* All added file types, regardless of extension or lack thereof,
* must also be added open_info_base[] below.
*/
151static const struct file_extension_info wireshark_file_type_extensions_base[] = {
{ "Wireshark/tcpdump/... - pcap", true1, "pcap;cap;dmp" },
{ "Wireshark/... - pcapng", true1, "pcapng;ntar" },
{ "Network Monitor, Surveyor, NetScaler", true1, "cap" },
{ "Sun snoop", true1, "snoop" },
{ "InfoVista 5View capture", true1, "5vw" },
{ "Sniffer (DOS)", true1, "cap;enc;trc;fdc;syc" },
{ "Cinco NetXRay, Sniffer (Windows)", true1, "cap;caz" },
{ "Endace ERF capture", true1, "erf" },
{ "EyeSDN USB S0/E1 ISDN trace format", true1, "trc" },
{ "HP-UX nettl trace", true1, "trc0;trc1" },
{ "Viavi Observer", true1, "bfr" },
{ "Colasoft Capsa", true1, "cscpkt" },
{ "Novell LANalyzer", true1, "tr1" },
{ "Tektronix K12xx 32-bit .rf5 format", true1, "rf5" },
{ "Savvius *Peek", true1, "pkt;tpc;apc;wpz" },
{ "Catapult DCT2000 trace (.out format)", true1, "out" },
{ "Micropross mplog", true1, "mplog" },
{ "TamoSoft CommView NCF", true1, "ncf" },
{ "TamoSoft CommView NCFX", true1, "ncfx" },
{ "Symbian OS btsnoop", true1, "log" },
{ "XML files (including Gammu DCT3 traces)", true1, "xml" },
{ "macOS PacketLogger", true1, "pklg" },
{ "Daintree SNA", true1, "dcf" },
{ "IPFIX File Format", true1, "pfx;ipfix" },
{ "Aethra .aps file", true1, "aps" },
{ "MPEG2 transport stream", true1, "mp2t;ts;m2ts;mpg" },
{ "Ixia IxVeriWave .vwr Raw 802.11 Capture", true1, "vwr" },
{ "CAM Inspector file", true1, "camins" },
{ "BLF file", true1, "blf" },
{ "AUTOSAR DLT file", true1, "dlt" },
{ "TTL file", true1, "ttl" },
{ "MPEG files", false0, "mpeg;mpg;mp3" },
{ "Transport-Neutral Encapsulation Format", false0, "tnef" },
{ "JPEG/JFIF files", false0, "jpg;jpeg;jfif" },
{ "NetLog file", true1, "json" },
{ "JavaScript Object Notation file", false0, "json" },
{ "JSON Log", true1, "json;jsonl;log" },
{ "MP4 file", false0, "mp4" },
{ "RTPDump file", false0, "rtp;rtpdump" },
{ "EMS file", false0, "ems" },
{ "ASN.1 Basic Encoding Rules", false0, "cer;crl;csr;p10;p12;p772;p7c;p7s;p7m;p8;pfx;tsq;tsr" },
{ "RFC 7468 files", false0, "crt;pem" },
{ "PEAK CAN TRC log", true1, "trc" },
195};

197#define	N_WIRESHARK_FILE_TYPE_EXTENSIONS(sizeof (wireshark_file_type_extensions_base) / sizeof (wireshark_file_type_extensions_base
)[0]) array_length(wireshark_file_type_extensions_base)(sizeof (wireshark_file_type_extensions_base) / sizeof (wireshark_file_type_extensions_base
)[0])

199static const struct file_extension_info stratoshark_file_type_extensions_base[] = {
{ "Stratoshark/... - scap", true1, "scap"},
{ "JSON Log", true1, "json;jsonl;log" },
{"MS Procmon", true1, "pml"},
203};

205#define N_STRATOSHARK_FILE_TYPE_EXTENSIONS(sizeof (stratoshark_file_type_extensions_base) / sizeof (stratoshark_file_type_extensions_base
)[0]) array_length(stratoshark_file_type_extensions_base)(sizeof (stratoshark_file_type_extensions_base) / sizeof (stratoshark_file_type_extensions_base
)[0])

207static const struct file_extension_info* file_type_extensions;

209static GArray* file_type_extensions_arr;

211/* initialize the extensions array if it has not been initialized yet */
212static void
213init_file_type_extensions(void)
214{

if (file_type_extensions_arr) return;

file_type_extensions_arr = g_array_new(false0,true1,sizeof(struct file_extension_info));

if (application_flavor_is_wireshark()) {
g_array_append_vals(file_type_extensions_arr, wireshark_file_type_extensions_base, N_WIRESHARK_FILE_TYPE_EXTENSIONS(sizeof (wireshark_file_type_extensions_base) / sizeof (wireshark_file_type_extensions_base
)[0]));
} else {
g_array_append_vals(file_type_extensions_arr, stratoshark_file_type_extensions_base, N_STRATOSHARK_FILE_TYPE_EXTENSIONS(sizeof (stratoshark_file_type_extensions_base) / sizeof (stratoshark_file_type_extensions_base
)[0]));
}

file_type_extensions = (struct file_extension_info*)(void *)file_type_extensions_arr->data;
227}

229void
230wtap_register_file_type_extension(const struct file_extension_info *ei)
231{
init_file_type_extensions();

g_array_append_val(file_type_extensions_arr,*ei)g_array_append_vals (file_type_extensions_arr, &(*ei), 1);

file_type_extensions = (const struct file_extension_info*)(void *)file_type_extensions_arr->data;
237}

239int
240wtap_get_num_file_type_extensions(void)
241{
return file_type_extensions_arr->len;
243}

245const char *
246wtap_get_file_extension_type_name(int extension_type)
247{
return file_type_extensions[extension_type].name;
249}

251static GSList *
252add_extensions_for_file_extensions_type(int extension_type, GSList *extensions,
  GSList *compression_type_extensions)
254{
char **extensions_set, **extensionp, *extension;

/*
* Split the extension-list string into a set of extensions.
*/
extensions_set = g_strsplit(file_type_extensions[extension_type].extensions,
   ";", 0);

/*
* Add each of those extensions to the list.
*/
for (extensionp = extensions_set; *extensionp != NULL((void*)0); extensionp++) {
extension = *extensionp;

/*
 * Add the extension, and all compressed variants
 * of it.
 */
extensions = add_extensions(extensions, extension,
    compression_type_extensions);
}

g_strfreev(extensions_set);
return extensions;
279}

281/* Return a list of file extensions that are used by the specified file
* extension type.
*
* All strings in the list are allocated with g_malloc() and must be freed
* with g_free().
*/
287GSList *
288wtap_get_file_extension_type_extensions(unsigned extension_type)
289{
GSList *extensions, *compression_type_extensions;

if (extension_type >= file_type_extensions_arr->len)
return NULL((void*)0);	/* not a valid extension type */

extensions = NULL((void*)0);	/* empty list, to start with */

/*
* Get compression-type extensions, if any.
*/
compression_type_extensions = ws_get_all_compression_type_extensions_list();

/*
* Add all this file extension type's extensions, with compressed
* variants.
*/
extensions = add_extensions_for_file_extensions_type(extension_type,
   extensions, compression_type_extensions);

g_slist_free(compression_type_extensions);

return g_slist_reverse(extensions);
312}

314/*
* The open_file_* routines must return:
*
*	WTAP_OPEN_ERROR on an I/O error;
*
*	WTAP_OPEN_MINE if the file they're reading is one of the types
*	    it handles;
*
*	WTAP_OPEN_NOT_MINE if the file they're reading isn't the type
*	    they're checking for.
*
* If the routine handles this type of file, it must set the "file_type"
* field in the "struct wtap" to the type of the file.
*
* Note that the routine does *not* have to free the private data pointer on
* error. The caller takes care of that by calling wtap_close on error.
* (See https://gitlab.com/wireshark/wireshark/-/issues/8518)
*
* However, the caller *does* have to free the private data pointer when
* returning WTAP_OPEN_NOT_MINE, since the next file type will be called
* and will likely just overwrite the pointer.
*
* The names are used in file open dialogs to select, for files that
* don't have magic numbers and that could potentially be files of
* more than one type based on the heuristics, a particular file
* type to interpret it as, if the file name has no extension, the
* extension isn't sufficient to determine the appropriate file type,
* or the extension is wrong.
*
* NOTE: when adding file formats to this list you may also want to add them
* to the following files so that the various desktop environments will
* know that Wireshark can open the file:
*	1) resources/freedesktop/org.wireshark.Wireshark-mime.xml (for freedesktop.org environments)
*	2) packaging/macosx/WiresharkInfo.plist.in (for macOS)
*
* If your file format has a commonly-used extension (e.g., ".pcap") then you
* should probably also add it to file_type_extensions_base[] (in this file),
* to the list of "<glob pattern=...>" entries for this file format in
* resources/freedesktop/org.wireshark.Wireshark-mime.xml, to the
* CFBundleTypeExtensions array for this file format in
* packaging/macosx/WiresharkInfo.plist, and to the PushFileExtensions macro
* in packaging/nsis/wireshark-common.nsh and the File Associations in
* packaging/wix/ComponentGroups.wxi (for Windows).
*/
358static const struct open_info open_info_base[] = {
/* Open routines that look for magic numbers */
{ "Wireshark/tcpdump/... - pcap",           OPEN_INFO_MAGIC,     libpcap_open,             NULL((void*)0),   NULL((void*)0), NULL((void*)0) },
{ "Wireshark/... - pcapng",                 OPEN_INFO_MAGIC,     pcapng_open,              NULL((void*)0), NULL((void*)0), NULL((void*)0) },
{ "Sniffer (DOS)",                          OPEN_INFO_MAGIC,     ngsniffer_open,           NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Snoop, Shomiti/Finisar Surveyor",        OPEN_INFO_MAGIC,     snoop_open,               NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "AIX iptrace",                            OPEN_INFO_MAGIC,     iptrace_open,             NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Microsoft Network Monitor",              OPEN_INFO_MAGIC,     netmon_open,              NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Cinco NetXray/Sniffer (Windows)",        OPEN_INFO_MAGIC,     netxray_open,             NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "RADCOM WAN/LAN analyzer",                OPEN_INFO_MAGIC,     radcom_open,              NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "HP-UX nettl trace",                      OPEN_INFO_MAGIC,     nettl_open,               NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Visual Networks traffic capture",        OPEN_INFO_MAGIC,     visual_open,              NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "InfoVista 5View capture",                OPEN_INFO_MAGIC,     _5views_open,             NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Viavi Observer",                         OPEN_INFO_MAGIC,     observer_open,            NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Savvius tagged",                         OPEN_INFO_MAGIC,     peektagged_open,          NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Colasoft Capsa",                         OPEN_INFO_MAGIC,     capsa_open,               NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "DBS Etherwatch (VMS)",                   OPEN_INFO_MAGIC,     dbs_etherwatch_open,      NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Tektronix K12xx 32-bit .rf5 format",     OPEN_INFO_MAGIC,     k12_open,                 NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Catapult DCT2000 trace (.out format)",   OPEN_INFO_MAGIC,     catapult_dct2000_open,    NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Aethra .aps file",                       OPEN_INFO_MAGIC,     aethra_open,              NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Symbian OS btsnoop",                     OPEN_INFO_MAGIC,     btsnoop_open,             "log",      NULL((void*)0), NULL((void*)0) },
{ "EyeSDN USB S0/E1 ISDN trace format",     OPEN_INFO_MAGIC,     eyesdn_open,              NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Transport-Neutral Encapsulation Format", OPEN_INFO_MAGIC,     tnef_open,                NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
/* 3GPP TS 32.423 Trace must come before MIME Files as it's XML based*/
{ "3GPP TS 32.423 Trace format",            OPEN_INFO_MAGIC,     nettrace_3gpp_32_423_file_open, NULL((void*)0), NULL((void*)0), NULL((void*)0) },
/* Gammu DCT3 trace must come before MIME files as it's XML based*/
{ "Gammu DCT3 trace",                       OPEN_INFO_MAGIC,     dct3trace_open,           NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "BLF Logfile",                            OPEN_INFO_MAGIC,     blf_open,                 NULL((void*)0),     NULL((void*)0), NULL((void*)0) },
{ "AUTOSAR DLT Logfile",                    OPEN_INFO_MAGIC,     autosar_dlt_open,         NULL((void*)0),     NULL((void*)0), NULL((void*)0) },
{ "TTL Logfile",                            OPEN_INFO_MAGIC,     ttl_open,                 NULL((void*)0),     NULL((void*)0), NULL((void*)0) },
{ "RTPDump files",                          OPEN_INFO_MAGIC,     rtpdump_open,             NULL((void*)0), NULL((void*)0), NULL((void*)0) },
{ "MIME Files Format",                      OPEN_INFO_MAGIC,     mime_file_open,           NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Micropross mplog",                       OPEN_INFO_MAGIC,     mplog_open,               NULL((void*)0),   NULL((void*)0), NULL((void*)0) },
{ "Unigraf DPA-400 capture",                OPEN_INFO_MAGIC,     dpa400_open,              NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "RFC 7468 files",                         OPEN_INFO_MAGIC,     rfc7468_open,             NULL((void*)0),  NULL((void*)0), NULL((void*)0) },
{ "MS Procmon Files",                       OPEN_INFO_MAGIC,     procmon_open,             NULL((void*)0),  NULL((void*)0), NULL((void*)0) },

/* Open routines that have no magic numbers and require heuristics. */
{ "Novell LANalyzer",                       OPEN_INFO_HEURISTIC, lanalyzer_open,           "tr1",      NULL((void*)0), NULL((void*)0) },
/*
* PacketLogger must come before MPEG, because its files
* are sometimes grabbed by mpeg_open.
*/
{ "macOS PacketLogger",                     OPEN_INFO_HEURISTIC, packetlogger_open,        "pklg",     NULL((void*)0), NULL((void*)0) },
/* Some MPEG files have magic numbers, others just have heuristics. */
{ "MPEG",                                   OPEN_INFO_HEURISTIC, mpeg_open,                "mpeg;mpg;mp3",  NULL((void*)0), NULL((void*)0) },
{ "Daintree SNA",                           OPEN_INFO_HEURISTIC, daintree_sna_open,        "dcf",      NULL((void*)0), NULL((void*)0) },
{ "STANAG 4607 Format",                     OPEN_INFO_HEURISTIC, stanag4607_open,          NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "ASN.1 Basic Encoding Rules",             OPEN_INFO_HEURISTIC, ber_open,                 NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
/*
* I put NetScreen *before* erf, because there were some
* false positives with my test-files (Sake Blok, July 2007)
*
* I put VWR *after* ERF, because there were some cases where
* ERF files were misidentified as vwr files (Stephen
* Donnelly, August 2013; see bug 9054)
*
* I put VWR *after* Peek Classic, CommView, iSeries text,
* Toshiba text, K12 text, VMS tcpiptrace text, and NetScaler,
* because there were some cases where files of those types were
* misidentified as vwr files (Guy Harris, December 2013)
*/
{ "NetScreen snoop text file",              OPEN_INFO_HEURISTIC, netscreen_open,           "txt",      NULL((void*)0), NULL((void*)0) },
{ "Endace ERF capture",                     OPEN_INFO_HEURISTIC, erf_open,                 "erf",      NULL((void*)0), NULL((void*)0) },
{ "IPFIX File Format",                      OPEN_INFO_HEURISTIC, ipfix_open,               "pfx;ipfix",NULL((void*)0), NULL((void*)0) },
{ "K12 text file",                          OPEN_INFO_HEURISTIC, k12text_open,             "txt",      NULL((void*)0), NULL((void*)0) },
{ "Savvius classic",                        OPEN_INFO_HEURISTIC, peekclassic_open,         "pkt;tpc;apc;wpz", NULL((void*)0), NULL((void*)0) },
{ "pppd log (pppdump format)",              OPEN_INFO_HEURISTIC, pppdump_open,             NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "IBM iSeries comm. trace",                OPEN_INFO_HEURISTIC, iseries_open,             "txt",      NULL((void*)0), NULL((void*)0) },
{ "I4B ISDN trace",                         OPEN_INFO_HEURISTIC, i4btrace_open,            NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "MPEG2 transport stream",                 OPEN_INFO_HEURISTIC, mp2t_open,                "mp2t;ts;mpg",   NULL((void*)0), NULL((void*)0) },
{ "CSIDS IPLog",                            OPEN_INFO_HEURISTIC, csids_open,               NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "TCPIPtrace (VMS)",                       OPEN_INFO_HEURISTIC, vms_open,                 "txt",      NULL((void*)0), NULL((void*)0) },
{ "CoSine IPSX L2 capture",                 OPEN_INFO_HEURISTIC, cosine_open,              "txt",      NULL((void*)0), NULL((void*)0) },
{ "Bluetooth HCI dump",                     OPEN_INFO_HEURISTIC, hcidump_open,             NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "TamoSoft CommView NCF",                  OPEN_INFO_HEURISTIC, commview_ncf_open,        "ncf",      NULL((void*)0), NULL((void*)0) },
{ "TamoSoft CommView NCFX",                 OPEN_INFO_HEURISTIC, commview_ncfx_open,       "ncfx",      NULL((void*)0), NULL((void*)0) },
{ "NetScaler",                              OPEN_INFO_HEURISTIC, nstrace_open,             "cap",      NULL((void*)0), NULL((void*)0) },
{ "Android Logcat Binary format",           OPEN_INFO_HEURISTIC, logcat_open,              "logcat",   NULL((void*)0), NULL((void*)0) },
{ "Android Logcat Text formats",            OPEN_INFO_HEURISTIC, logcat_text_open,         "txt",      NULL((void*)0), NULL((void*)0) },
{ "Candump log",                            OPEN_INFO_HEURISTIC, candump_open,             NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Busmaster log",                          OPEN_INFO_HEURISTIC, busmaster_open,           NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "CSS Electronics CLX000 CAN log",         OPEN_INFO_MAGIC,     cllog_open,               "txt",      NULL((void*)0), NULL((void*)0) },
{ "Ericsson eNode-B raw log",               OPEN_INFO_MAGIC,     eri_enb_log_open,         NULL((void*)0),       NULL((void*)0), NULL((void*)0) },
{ "Systemd Journal",                        OPEN_INFO_HEURISTIC, systemd_journal_open,     "log;jnl;journal",      NULL((void*)0), NULL((void*)0) },
{ "PEAK CAN TRC log",                       OPEN_INFO_HEURISTIC, peak_trc_open,            "trc",      NULL((void*)0), NULL((void*)0) },

/* ASCII trace files from Telnet sessions. */
{ "Lucent/Ascend access server trace",      OPEN_INFO_HEURISTIC, ascend_open,              "txt",      NULL((void*)0), NULL((void*)0) },
{ "Toshiba Compact ISDN Router snoop",      OPEN_INFO_HEURISTIC, toshiba_open,             "txt",      NULL((void*)0), NULL((void*)0) },

{ "EGNOS Message Server (EMS) file",        OPEN_INFO_HEURISTIC, ems_open,                 "ems",      NULL((void*)0), NULL((void*)0) },

/* Extremely weak heuristics - put them at the end. */
{ "Ixia IxVeriWave .vwr Raw Capture",       OPEN_INFO_HEURISTIC, vwr_open,                 "vwr",      NULL((void*)0), NULL((void*)0) },
{ "CAM Inspector file",                     OPEN_INFO_HEURISTIC, camins_open,              "camins",   NULL((void*)0), NULL((void*)0) },
/* NetLog needs to be before JSON because it is a specifically formatted JSON file */
{ "NetLog",                                 OPEN_INFO_HEURISTIC, netlog_open,              "json",     NULL((void*)0), NULL((void*)0) },
/* JSON Log needs to be before JSON because it handles a variety of JSON logs */
{ "JSON Log",                               OPEN_INFO_HEURISTIC, json_log_open,            "json;jsonl;log", NULL((void*)0), NULL((void*)0) },
{ "JavaScript Object Notation",             OPEN_INFO_HEURISTIC, json_open,                "json",     NULL((void*)0), NULL((void*)0) },
{ "Bachmann M-Module File",                 OPEN_INFO_HEURISTIC, mmodule_open,             "m",        NULL((void*)0), NULL((void*)0) },
{ "Ruby Marshal Object",                    OPEN_INFO_HEURISTIC, ruby_marshal_open,        "",         NULL((void*)0), NULL((void*)0) },
{ "3gpp phone log",                         OPEN_INFO_MAGIC,     log3gpp_open,             "log",      NULL((void*)0), NULL((void*)0) },
{ "MP4 media file",                         OPEN_INFO_MAGIC,     mp4_open,                 "mp4",      NULL((void*)0), NULL((void*)0) },
463};

465/* this is only used to build the dynamic array on load, do NOT use this
* for anything else, because the size of the actual array will change if
* Lua scripts register a new file reader.
*/
469#define N_OPEN_INFO_ROUTINES(sizeof (open_info_base) / sizeof (open_info_base)[0])  array_length(open_info_base)(sizeof (open_info_base) / sizeof (open_info_base)[0])

471static GArray *open_info_arr;

473/* this always points to the top of the created array */
474struct open_info *open_routines;

476/* this points to the first OPEN_INFO_HEURISTIC type in the array */
477static unsigned heuristic_open_routine_idx;

479static void
480set_heuristic_routine(void)
481{
unsigned i;
ws_assert(open_info_arr != NULL)do { if ((1) && !(open_info_arr != ((void*)0))) ws_log_fatal_full
("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c", 483, __func__
, "assertion failed: %s", "open_info_arr != ((void*)0)"); } while
 (0);

for (i = 0; i < open_info_arr->len; i++) {
if (open_routines[i].type == OPEN_INFO_HEURISTIC) {
	heuristic_open_routine_idx = i;
	break;
}
/* sanity check */
ws_assert(open_routines[i].type == OPEN_INFO_MAGIC)do { if ((1) && !(open_routines[i].type == OPEN_INFO_MAGIC
)) ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 491, __func__, "assertion failed: %s", "open_routines[i].type == OPEN_INFO_MAGIC"
); } while (0);
}

ws_assert(heuristic_open_routine_idx > 0)do { if ((1) && !(heuristic_open_routine_idx > 0))
 ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 494, __func__, "assertion failed: %s", "heuristic_open_routine_idx > 0"
); } while (0);
495}

497void
498init_open_routines(void)
499{
unsigned int i;
struct open_info *i_open;

if (open_info_arr)
return;

open_info_arr = g_array_new(true1,true1,sizeof(struct open_info));

g_array_append_vals(open_info_arr, open_info_base, N_OPEN_INFO_ROUTINES(sizeof (open_info_base) / sizeof (open_info_base)[0]));

open_routines = (struct open_info *)(void*) open_info_arr->data;

/* Populate the extensions_set list now */
for (i = 0, i_open = open_routines; i < open_info_arr->len; i++, i_open++) {
if (i_open->extensions != NULL((void*)0))
	i_open->extensions_set = g_strsplit(i_open->extensions, ";", 0);
}

set_heuristic_routine();
519}

521/*
* Registers a new file reader - currently only called by wslua code for
* Lua readers and by compiled file reader plugins.
*
* If first_routine is true, the reader added before other readers of its
* type (magic or heuristic).  This should be done only in cases where
* this reader's open test must be performed early, to avoid false
* positives for other readers' tests treating files for this reader
* as being for another reader.
*
* XXX - given that there is no guarantee that registration routines will
* be called in a given order, all this really does is divide readers for
* a given type (magic or heuristic) into two categories, with open routines
* for readers in the first category (first_routine true) all being called
* before readers in the second category; it does not guarantee a particular
* total order for open routines.
*
* Checks for an existing reader of the same name and errors if it finds one;
* if you want to handle that condition more gracefully, call
* wtap_has_open_info() first.
*/
542void
543wtap_register_open_info(struct open_info *oi, const bool_Bool first_routine)
544{
if (!oi || !oi->name) {
ws_error("No open_info name given to register")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 546, __func__, "No open_info name given to register");
return;
}

/* verify name doesn't already exist */
if (wtap_has_open_info(oi->name)) {
ws_error("Name given to register_open_info already exists")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 552, __func__, "Name given to register_open_info already exists"
);
return;
}

if (oi->extensions != NULL((void*)0))
oi->extensions_set = g_strsplit(oi->extensions, ";", 0);

/* if it's magic and first, prepend it; if it's heuristic and not first,
  append it; if it's anything else, stick it in the middle */
if (first_routine && oi->type == OPEN_INFO_MAGIC) {
g_array_prepend_val(open_info_arr, *oi)g_array_prepend_vals (open_info_arr, &(*oi), 1);
} else if (!first_routine && oi->type == OPEN_INFO_HEURISTIC) {
g_array_append_val(open_info_arr, *oi)g_array_append_vals (open_info_arr, &(*oi), 1);
} else {
g_array_insert_val(open_info_arr, heuristic_open_routine_idx, *oi)g_array_insert_vals (open_info_arr, heuristic_open_routine_idx
, &(*oi), 1);
}

open_routines = (struct open_info *)(void*) open_info_arr->data;
set_heuristic_routine();
571}

573/* De-registers a file reader by removing it from the GArray based on its name.
* This function must NOT be called during wtap_open_offline(), since it changes the array.
* Note: this function will error if it doesn't find the given name; if you want to handle
* that condition more gracefully, call wtap_has_open_info() first.
*/
578void
579wtap_deregister_open_info(const char *name)
580{
unsigned i;

if (!name) {
ws_error("Missing open_info name to de-register")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 584, __func__, "Missing open_info name to de-register");
return;
}

for (i = 0; i < open_info_arr->len; i++) {
if (open_routines[i].name && strcmp(open_routines[i].name, name) == 0) {
	g_strfreev(open_routines[i].extensions_set);
	open_info_arr = g_array_remove_index(open_info_arr, i);
	set_heuristic_routine();
	return;
}
}

ws_error("deregister_open_info: name not found")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 597, __func__, "deregister_open_info: name not found");
598}

600/* Determines if a open routine short name already exists
*/
602bool_Bool
603wtap_has_open_info(const char *name)
604{
unsigned i;

if (!name) {
ws_error("No name given to wtap_has_open_info!")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 608, __func__, "No name given to wtap_has_open_info!");
return false0;
}


for (i = 0; i < open_info_arr->len; i++) {
if (open_routines[i].name && strcmp(open_routines[i].name, name) == 0) {
	return true1;
}
}

return false0;
620}

622bool_Bool
623wtap_uses_lua_filehandler(const wtap* wth)
624{
if (wth && wth->wslua_data != NULL((void*)0)) {
/*
 * Currently, wslua_data is set if and only if using a Lua
 * file handler.
 */
return true1;
}

return false0;
634}

636/*
* Visual C++ on Win32 systems doesn't define these.  (Old UNIX systems don't
* define them either.)
*
* Visual C++ on Win32 systems doesn't define S_IFIFO, it defines _S_IFIFO.
*/
642#ifndef S_ISREG
643#define S_ISREG(mode)((((mode)) & 0170000) == (0100000))   (((mode) & S_IFMT0170000) == S_IFREG0100000)
644#endif
645#ifndef S_IFIFO0010000
646#define S_IFIFO0010000	_S_IFIFO
647#endif
648#ifndef S_ISFIFO
649#define S_ISFIFO(mode)((((mode)) & 0170000) == (0010000))  (((mode) & S_IFMT0170000) == S_IFIFO0010000)
650#endif
651#ifndef S_ISDIR
652#define S_ISDIR(mode)((((mode)) & 0170000) == (0040000))   (((mode) & S_IFMT0170000) == S_IFDIR0040000)
653#endif

655/* returns the 'type' number to use for wtap_open_offline based on the
* passed-in name (the name in the open_info struct). It returns WTAP_TYPE_AUTO
* on failure, which is the number 0. The 'type' number is the entry's index+1,
* because that's what wtap_open_offline() expects it to be.
*/
660unsigned int
661open_info_name_to_type(const char *name)
662{
unsigned int i;

if (!name)
return WTAP_TYPE_AUTO0;

for (i = 0; i < open_info_arr->len; i++) {
if (open_routines[i].name != NULL((void*)0) &&
    strcmp(name, open_routines[i].name) == 0)
	return i+1;
}

return WTAP_TYPE_AUTO0; /* no such file type */
675}

677static char *
678get_file_extension(const char *pathname)
679{
char *filename;
char **components;
size_t ncomponents;
char *extensionp;

/*
* Is the pathname empty?
*/
if (strcmp(pathname, "") == 0)
return NULL((void*)0);	/* no extension */

/*
* Find the last component of the pathname.
*/
filename = g_path_get_basename(pathname);

/*
* Does it have an extension?
*/
if (strchr(filename, '.') == NULL((void*)0)) {
g_free(filename);
return NULL((void*)0);	/* no extension whatsoever */
}

/*
* Yes. Fold it to lowercase, since open_routines[] has
* its extensions in lowercase.
*/
ascii_strdown_inplace(filename);

/*
* Split it into components separated by ".".
*/
components = g_strsplit(filename, ".", 0);
g_free(filename);

/*
* Count the components.
*/
for (ncomponents = 0; components[ncomponents] != NULL((void*)0); ncomponents++)
;

if (ncomponents == 0) {
g_strfreev(components);
return NULL((void*)0);	/* no components */
}
if (ncomponents == 1) {
g_strfreev(components);
return NULL((void*)0);	/* only one component, with no "." */
}

/*
* Get compression-type extensions, if any.
*/
GSList *compression_type_extensions = ws_get_all_compression_type_extensions_list();

/*
* Is the last component one of the extensions used for compressed
* files?
*/
extensionp = components[ncomponents - 1];
for (GSList *compression_type_extension = compression_type_extensions;
   compression_type_extension != NULL((void*)0);
   compression_type_extension = g_slist_next(compression_type_extension)((compression_type_extension) ? (((GSList *)(compression_type_extension
))->next) : ((void*)0))) {
if (strcmp(extensionp, (const char *)compression_type_extension->data) == 0) {
	/*
	 * Yes, so it's one of the compressed-file extensions.
	 * Is there an extension before that?
	 */
	if (ncomponents == 2) {
		g_slist_free(compression_type_extensions);
		g_strfreev(components);
		return NULL((void*)0);	/* no, only two components */
	}

	/*
	 * Yes, return that extension.
	 */
	g_slist_free(compression_type_extensions);
	extensionp = g_strdup(components[ncomponents - 2])g_strdup_inline (components[ncomponents - 2]);
	g_strfreev(components);
	return extensionp;
}
}

g_slist_free(compression_type_extensions);

/*
* The extension isn't one of the compressed-file extensions;
* return it.
*/
extensionp = g_strdup(extensionp)g_strdup_inline (extensionp);
g_strfreev(components);
return extensionp;
774}

776/*
* Check if file extension is used in this heuristic
*/
779static bool_Bool
780heuristic_uses_extension(unsigned int i, const char *extension)
781{
char **extensionp;

/*
* Does this file type *have* any extensions?
*/
if (open_routines[i].extensions == NULL((void*)0))
return false0;	/* no */

/*
* Check each of them against the specified extension.
*/
for (extensionp = open_routines[i].extensions_set; *extensionp != NULL((void*)0);
   extensionp++) {
if (strcmp(extension, *extensionp) == 0) {
	return true1;	/* it's one of them */
}
}

return false0;	/* it's not one of them */
801}

803/*
* Attempt to open the file corresponding to "wth" using the file format
* handler in "candidate".
*
* Returns WTAP_OPEN_MINE upon success, WTAP_OPEN_NOT_MINE if the file is not
* in a suitable format for "candidate", or WTAP_OPEN_ERROR if a failure
* occurred while reading the input.
*/
811static int
812try_one_open(wtap *wth, const struct open_info *candidate, int *err, char **err_info)
813{
/* Seek back to the beginning of the file; the open routine for the
* previous file type may have left the file position somewhere other
* than the beginning, and the open routine for this file type will
* probably want to start reading at the beginning.
*
* Initialize the data offset while we're at it.
*/
if (file_seek(wth->fh, 0, SEEK_SET0, err) == -1) {
/* Error - give up */
return WTAP_OPEN_ERROR;
}

/* Set wth with wslua data if any - this is how we pass the data to the
* file reader, kinda like the priv member but not free'd later.
* It's ok for this to copy a NULL.
*/
wth->wslua_data = candidate->wslua_data;

return candidate->open_routine(wth, err, err_info);
833}

835/*
* Attempt to open the file corresponding to "wth".  If "type" is supplied
* (i.e. other than WTAP_TYPE_AUTO), that will be the only type attempted.
* Otherwise, heuristic detection of the file format will be performed,
* possibly guided by the extension part of "filename".
*
* Returns WTAP_OPEN_MINE upon success, WTAP_OPEN_NOT_MINE if it was not
* possible to determine a suitable format for the file, or WTAP_OPEN_ERROR if
* a failure occurred while reading the input.
*/
845static int
846try_open(wtap *wth, unsigned int type, int *err, char **err_info)
847{
int result = WTAP_OPEN_NOT_MINE;
unsigned i;
char *extension;

/* 'type' is 1-based. */
if (type != WTAP_TYPE_AUTO0 && type <= open_info_arr->len) {
/* Try only the specified type. */
return try_one_open(wth, &open_routines[type - 1], err, err_info);
}

/* First, all file types that support magic numbers. */
for (i = 0; i < heuristic_open_routine_idx && result == WTAP_OPEN_NOT_MINE; i++) {
result = try_one_open(wth, &open_routines[i], err, err_info);
}

if (result != WTAP_OPEN_NOT_MINE) {
return result;
}

/* Does this file's name have an extension? */
extension = get_file_extension(wth->pathname);
if (extension != NULL((void*)0)) {
unsigned pass;

/*
 * Yes, the filename has an extension.
 *
 * The heuristic types fall into one of three categories, which
 * we attempt in order by scanning for each category in turn.
 *
 * First pass selects the heuristic types that list this file's
 * extension, as these are most likely to be the correct choice
 * for this file.
 *
 * Second pass selects heuristic types which have no
 * extensions.  We try those before the ones that have
 * extensions that *don't* match this file's extension, on the
 * theory that files of those types generally have one of the
 * type's extensions, and, as this file *doesn't* have one of
 * those extensions, it's probably *not* one of those files.
 *
 * Third pass selects heuristic types which support extensions
 * but where none of them matches this file's extension.
 *
 * We need only continue searching until we find a match or an
 * error occurs.
 */

for (pass = 0; pass < 3 && result == WTAP_OPEN_NOT_MINE; pass++) {
	for (i = heuristic_open_routine_idx; i < open_info_arr->len && result == WTAP_OPEN_NOT_MINE; i++) {
		if (   (pass == 0 && heuristic_uses_extension(i, extension))
		    || (pass == 1 && open_routines[i].extensions == NULL((void*)0))
		    || (pass == 2 && open_routines[i].extensions != NULL((void*)0)
		                  && !heuristic_uses_extension(i, extension))) {
			result = try_one_open(wth, &open_routines[i], err, err_info);
		}
	}
}

g_free(extension);
} else {
/* No extension.  Try all the heuristic types in order. */
for (i = heuristic_open_routine_idx; i < open_info_arr->len && result == WTAP_OPEN_NOT_MINE; i++) {
	result = try_one_open(wth, &open_routines[i], err, err_info);
}
}

return result;
916}

918/* Opens a file and prepares a wtap struct.
* If "do_random" is true, it opens the file twice; the second open
* allows the application to do random-access I/O without moving
* the seek offset for sequential I/O, which is used by Wireshark
* so that it can do sequential I/O to a capture file that's being
* written to as new packets arrive independently of random I/O done
* to display protocol trees for packets when they're selected.
*/
926wtap *
927wtap_open_offline(const char *filename, unsigned int type, int *err, char **err_info,
  bool_Bool do_random)
929{
int	fd;
ws_statb64struct stat statb;
bool_Bool ispipe = false0;
wtap	*wth;
bool_Bool use_stdin = false0;
wtap_block_t shb;

*err = 0;
*err_info = NULL((void*)0);

/* open standard input if filename is '-' */
if (strcmp(filename, "-") == 0)
use_stdin = true1;

/* First, make sure the file is valid */
if (use_stdin) {
if (ws_fstat64fstat(0, &statb) < 0) {
	*err = errno(*__errno_location ());
	return NULL((void*)0);
}
} else {
if (ws_stat64stat(filename, &statb) < 0) {
	*err = errno(*__errno_location ());
	return NULL((void*)0);
}
}
if (S_ISFIFO(statb.st_mode)((((statb.st_mode)) & 0170000) == (0010000))) {
/*
 * Opens of FIFOs are allowed only when not opening
 * for random access.
 *
 * Currently, we do seeking when trying to find out
 * the file type, but our I/O routines do some amount
 * of buffering, and do backward seeks within the buffer
 * if possible, so at least some file types can be
 * opened from pipes, so we don't completely disallow opens
 * of pipes.
 */
if (do_random) {
	*err = WTAP_ERR_RANDOM_OPEN_PIPE-2;
	return NULL((void*)0);
}
ispipe = true1;
} else if (S_ISDIR(statb.st_mode)((((statb.st_mode)) & 0170000) == (0040000))) {
/*
 * Return different errors for "this is a directory"
 * and "this is some random special file type", so
 * the user can get a potentially more helpful error.
 */
*err = EISDIR21;
return NULL((void*)0);
} else if (! S_ISREG(statb.st_mode)((((statb.st_mode)) & 0170000) == (0100000))) {
*err = WTAP_ERR_NOT_REGULAR_FILE-1;
return NULL((void*)0);
}

/*
* We need two independent descriptors for random access, so
* they have different file positions.  If we're opening the
* standard input, we can only dup it to get additional
* descriptors, so we can't have two independent descriptors,
* and thus can't do random access.
*/
if (use_stdin && do_random) {
*err = WTAP_ERR_RANDOM_OPEN_STDIN-16;
return NULL((void*)0);
}

errno(*__errno_location ()) = ENOMEM12;
wth = g_new0(wtap, 1)((wtap *) g_malloc0_n ((1), sizeof (wtap)));

/* Open the file */
errno(*__errno_location ()) = WTAP_ERR_CANT_OPEN-6;
if (use_stdin) {
/*
 * We dup FD 0, so that we don't have to worry about
 * a file_close of wth->fh closing the standard
 * input of the process.
 */
fd = ws_dupdup(0);
if (fd < 0) {
	*err = errno(*__errno_location ());
	g_free(wth);
	return NULL((void*)0);
}
1015#ifdef _WIN32
if (_setmode(fd, O_BINARY0) == -1) {
	/* "Shouldn't happen" */
	*err = errno(*__errno_location ());
	g_free(wth);
	return NULL((void*)0);
}
1022#endif
if (!(wth->fh = file_fdopen(fd))) {
	*err = errno(*__errno_location ());
	ws_closeclose(fd);
	g_free(wth);
	return NULL((void*)0);
}
} else {
if (!(wth->fh = file_open(filename))) {
	*err = errno(*__errno_location ());
	g_free(wth);
	return NULL((void*)0);
}
}

if (do_random) {
if (!(wth->random_fh = file_open(filename))) {
	*err = errno(*__errno_location ());
	file_close(wth->fh);
	g_free(wth);
	return NULL((void*)0);
}
} else
wth->random_fh = NULL((void*)0);

/* initialization */
wth->ispipe = ispipe;
wth->file_encap = WTAP_ENCAP_UNKNOWN0;
wth->subtype_sequential_close = NULL((void*)0);
wth->subtype_close = NULL((void*)0);
wth->file_tsprec = WTAP_TSPREC_USEC6;
nstime_set_unset(&wth->file_start_ts);
nstime_set_unset(&wth->file_end_ts);
wth->pathname = g_strdup(filename)g_strdup_inline (filename);
wth->priv = NULL((void*)0);
wth->wslua_data = NULL((void*)0);
wth->shb_hdrs = g_array_new(false0, false0, sizeof(wtap_block_t));
shb = wtap_block_create(WTAP_BLOCK_SECTION);
if (shb)
g_array_append_val(wth->shb_hdrs, shb)g_array_append_vals (wth->shb_hdrs, &(shb), 1);

/* Initialize the array containing a list of interfaces. pcapng_open and
* erf_open needs this (and libpcap_open for ERF encapsulation types).
* Always initing it here saves checking for a NULL ptr later. */
wth->interface_data = g_array_new(false0, false0, sizeof(wtap_block_t));
/*
* Next interface data that wtap_get_next_interface_description()
* will return.
*/
wth->next_interface_data = 0;

wth->shb_iface_to_global = g_array_new(false0, false0, sizeof(unsigned));
g_array_append_val(wth->shb_iface_to_global, wth->interface_data->len)g_array_append_vals (wth->shb_iface_to_global, &(wth->
interface_data->len), 1);

if (wth->random_fh) {
wth->fast_seek = g_ptr_array_new();

file_set_random_access(wth->fh, false0, wth->fast_seek);
file_set_random_access(wth->random_fh, true1, wth->fast_seek);
}

/* Find a file format handler which can read the file. */
switch (try_open(wth, type, err, err_info)) {
case WTAP_OPEN_NOT_MINE:
/* Well, it's not one of the types of file we know about. */
*err = WTAP_ERR_FILE_UNKNOWN_FORMAT-3;
/* FALLTHROUGH */

case WTAP_OPEN_ERROR:
wtap_close(wth);
wth = NULL((void*)0);
}

return wth;
1096}

1098/*
* Given the pathname of the file we just closed with wtap_fdclose(), attempt
* to reopen that file and assign the new file descriptor(s) to the sequential
* stream and, if do_random is true, to the random stream.  Used on Windows
* after the rename of a file we had open was done or if the rename of a
* file on top of a file we had open failed.
*
* This is only required by Wireshark, not TShark, and, at the point that
* Wireshark is doing this, the sequential stream is closed, and the
* random stream is open, so this refuses to open pipes, and only
* reopens the random stream.
*/
1110bool_Bool
1111wtap_fdreopen(wtap *wth, const char *filename, int *err)
1112{
ws_statb64struct stat statb;

/*
* We need two independent descriptors for random access, so
* they have different file positions.  If we're opening the
* standard input, we can only dup it to get additional
* descriptors, so we can't have two independent descriptors,
* and thus can't do random access.
*/
if (strcmp(filename, "-") == 0) {
*err = WTAP_ERR_RANDOM_OPEN_STDIN-16;
return false0;
}

/* First, make sure the file is valid */
if (ws_stat64stat(filename, &statb) < 0) {
*err = errno(*__errno_location ());
return false0;
}
if (S_ISFIFO(statb.st_mode)((((statb.st_mode)) & 0170000) == (0010000))) {
/*
 * Opens of FIFOs are not allowed; see above.
 */
*err = WTAP_ERR_RANDOM_OPEN_PIPE-2;
return false0;
} else if (S_ISDIR(statb.st_mode)((((statb.st_mode)) & 0170000) == (0040000))) {
/*
 * Return different errors for "this is a directory"
 * and "this is some random special file type", so
 * the user can get a potentially more helpful error.
 */
*err = EISDIR21;
return false0;
} else if (! S_ISREG(statb.st_mode)((((statb.st_mode)) & 0170000) == (0100000))) {
*err = WTAP_ERR_NOT_REGULAR_FILE-1;
return false0;
}

/* Open the file */
errno(*__errno_location ()) = WTAP_ERR_CANT_OPEN-6;
if (!file_fdreopen(wth->random_fh, filename)) {
*err = errno(*__errno_location ());
return false0;
}
if (strcmp(filename, wth->pathname) != 0) {
g_free(wth->pathname);
wth->pathname = g_strdup(filename)g_strdup_inline (filename);
}
return true1;
1162}

1164/* Table of the file types and subtypes for which we have support. */

1166/*
* Pointer to the GArray holding the registered file types.
*/
1169static GArray*  file_type_subtype_table_arr;

1171/*
* Pointer to the table of registered file types in that GArray.
*/
1174static const struct file_type_subtype_info* file_type_subtype_table;

1176/*
* Number of elements in the table for builtin file types/subtypes.
*/
1179static unsigned wtap_num_builtin_file_types_subtypes;

1181/*
* Required builtin types.
*/
1184int pcap_file_type_subtype = -1;
1185int pcap_nsec_file_type_subtype = -1;
1186int pcapng_file_type_subtype = -1;

1188/*
* Table for mapping old file type/subtype names to new ones for
* backwards compatibility.
*/
1192static GHashTable *type_subtype_name_map;

1194/*
* Initialize the table of file types/subtypes with all the builtin
* types/subtypes.
*/
1198void
1199wtap_init_file_type_subtypes(void)
1200{
/* Don't do this twice. */
ws_assert(file_type_subtype_table_arr == NULL)do { if ((1) && !(file_type_subtype_table_arr == ((void
*)0))) ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 1202, __func__, "assertion failed: %s", "file_type_subtype_table_arr == ((void*)0)"
); } while (0);

/*
* Estimate the number of file types/subtypes as twice the
* number of modules; that's probably an overestimate, as
* the average number of file types/subtypes registered by
* a module is > 1 but probably < 2, but that shouldn't
* waste too much memory.
*
* Add on 7 more for pcapng, pcap, nanosecond pcap, and the
* extra modified flavors of pcap.
*/
file_type_subtype_table_arr = g_array_sized_new(false0, true1,
   sizeof(struct file_type_subtype_info), wtap_module_count*2 + 7);
file_type_subtype_table = (const struct file_type_subtype_info*)(void *)file_type_subtype_table_arr->data;

/*
* Initialize the hash table for mapping old file type/subtype
* names to the corresponding new names.
*/
type_subtype_name_map = g_hash_table_new_full(g_str_hash,
   g_str_equal, g_free, g_free);

/* No entries yet, so no builtin entries yet. */
wtap_num_builtin_file_types_subtypes = 0;

/*
* Register the builtin entries that aren't in the table.
* First, do the required ones; register pcapng first, then
* pcap, so, at the beginning of the table, we have pcapng,
* pcap, nanosecond pcap, and the weird modified pcaps, so
* searches for file types that can write a file format
* start with pcapng, pcap, and nanosecond pcap.
*/
register_pcapng();
register_pcap();

/* Now register the ones found by the build process */
for (unsigned i = 0; i < wtap_module_count; i++)
wtap_module_reg[i].cb_func();

/* Update the number of builtin entries. */
wtap_num_builtin_file_types_subtypes = file_type_subtype_table_arr->len;
1245}

1247/*
* Attempt to register a new file type/subtype; fails if a type/subtype
* with that name is already registered.
*/
1251int
1252wtap_register_file_type_subtype(const struct file_type_subtype_info* fi)
1253{
struct file_type_subtype_info* finfo;
unsigned file_type_subtype;

/*
* Check for required fields (description and name).
*/
if (!fi || !fi->description || !fi->name) {
ws_warning("no file type info")do { if (1) { ws_log_full("Wiretap", LOG_LEVEL_WARNING, "wiretap/file_access.c"
, 1261, __func__, "no file type info"); } } while (0);
return -1;
}

/*
* There must be at least one block type that this file
* type/subtype supports.
*/
if (fi->num_supported_blocks == 0 || fi->supported_blocks == NULL((void*)0)) {
ws_warning("no blocks supported by file type \"%s\"", fi->name)do { if (1) { ws_log_full("Wiretap", LOG_LEVEL_WARNING, "wiretap/file_access.c"
, 1270, __func__, "no blocks supported by file type \"%s\"", fi
->name); } } while (0);
return -1;
}

/*
* Is this type already registered?
*/
if (wtap_name_to_file_type_subtype(fi->name) != -1) {
/*
 * Yes.  You don't get to replace an existing handler.
 */
ws_warning("file type \"%s\" is already registered", fi->name)do { if (1) { ws_log_full("Wiretap", LOG_LEVEL_WARNING, "wiretap/file_access.c"
, 1281, __func__, "file type \"%s\" is already registered", fi
->name); } } while (0);
return -1;
}

/*
* Is there a freed entry in the array, due to a file type
* being de-registered?
*
* Skip the built-in entries, as they're never deregistered.
*/
for (file_type_subtype = wtap_num_builtin_file_types_subtypes;
   file_type_subtype < file_type_subtype_table_arr->len;
   file_type_subtype++) {
if (file_type_subtype_table[file_type_subtype].name == NULL((void*)0)) {
	/*
	 * We found such an entry.
	 *
	 * Get the pointer from the GArray, so that we get a
	 * non-const pointer.
	 */
	finfo = &g_array_index(file_type_subtype_table_arr, struct file_type_subtype_info, file_type_subtype)(((struct file_type_subtype_info*) (void *) (file_type_subtype_table_arr
)->data) [(file_type_subtype)]);

	/*
	 * Fill in the entry with the new values.
	 */
	*finfo = *fi;

	return (int)file_type_subtype;
}
}

/*
* There aren't any free slots, so add a new entry.
* Get the number of current number of entries, which will
* be the index of the new entry, then append this entry
* to the end of the array, change file_type_subtype_table
* in case the array had to get reallocated, and return
* the index of the new entry.
*/
file_type_subtype = file_type_subtype_table_arr->len;
g_array_append_val(file_type_subtype_table_arr, *fi)g_array_append_vals (file_type_subtype_table_arr, &(*fi),
 1);
file_type_subtype_table = (const struct file_type_subtype_info*)(void *)file_type_subtype_table_arr->data;
return file_type_subtype;
1324}

1326/* De-registers a file writer - they can never be removed from the GArray, but we can "clear" an entry.
*/
1328void
1329wtap_deregister_file_type_subtype(const int subtype)
1330{
struct file_type_subtype_info* finfo;

if (subtype < 0 || subtype >= (int)file_type_subtype_table_arr->len) {
ws_error("invalid file type to de-register")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 1334, __func__, "invalid file type to de-register");
return;
}
if ((unsigned)subtype < wtap_num_builtin_file_types_subtypes) {
ws_error("built-in file types cannot be de-registered")ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 1338, __func__, "built-in file types cannot be de-registered"
);
return;
}

/*
* Get the pointer from the GArray, so that we get a non-const
* pointer.
*/
finfo = &g_array_index(file_type_subtype_table_arr, struct file_type_subtype_info, subtype)(((struct file_type_subtype_info*) (void *) (file_type_subtype_table_arr
)->data) [(subtype)]);
/*
* Clear out this entry.
*/
finfo->description = NULL((void*)0);
finfo->name = NULL((void*)0);
finfo->default_file_extension = NULL((void*)0);
finfo->additional_file_extensions = NULL((void*)0);
finfo->writing_must_seek = false0;
finfo->num_supported_blocks = 0;
finfo->supported_blocks = NULL((void*)0);
finfo->can_write_encap = NULL((void*)0);
finfo->dump_open = NULL((void*)0);
finfo->wslua_info = NULL((void*)0);
1360}

1362/*
* Given a GArray of WTAP_ENCAP_ types, return the per-file encapsulation
* type that would be needed to write out a file with those types.  If
* there's only one type, it's that type, otherwise it's
* WTAP_ENCAP_PER_PACKET.
*/
1368int
1369wtap_dump_required_file_encap_type(const GArray *file_encaps)
1370{
int encap;

encap = WTAP_ENCAP_PER_PACKET-1;
if (file_encaps->len == 1) {
/* OK, use the one-and-only encapsulation type. */
encap = g_array_index(file_encaps, int, 0)(((int*) (void *) (file_encaps)->data) [(0)]);
}
return encap;
1379}

1381bool_Bool
1382wtap_dump_can_write_encap(int file_type_subtype, int encap)
1383{
int result = 0;

if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len ||
   file_type_subtype_table[file_type_subtype].can_write_encap == NULL((void*)0))
return false0;

result = (*file_type_subtype_table[file_type_subtype].can_write_encap)(encap);

if (result != 0) {
/* if the err said to check wslua's can_write_encap, try that */
if (result == WTAP_ERR_CHECK_WSLUA-23
	&& file_type_subtype_table[file_type_subtype].wslua_info != NULL((void*)0)
	&& file_type_subtype_table[file_type_subtype].wslua_info->wslua_can_write_encap != NULL((void*)0)) {

	result = (*file_type_subtype_table[file_type_subtype].wslua_info->wslua_can_write_encap)(encap, file_type_subtype_table[file_type_subtype].wslua_info->wslua_data);

}

if (result != 0)
	return false0;
}

return true1;
1408}

1410/*
* Return true if a capture with a given GArray of encapsulation types
* and a given bitset of comment types can be written in a specified
* format, and false if it can't.
*/
1415static bool_Bool
1416wtap_dump_can_write_format(int ft, const GArray *file_encaps,
  uint32_t required_comment_types)
1418{
unsigned i;

/*
* Can we write in this format?
*/
if (!wtap_dump_can_open(ft)) {
/* No. */
return false0;
}

/*
* Yes.  Can we write out all the required comments in this
* format?
*/
if (required_comment_types & WTAP_COMMENT_PER_SECTION0x00000001) {
if (wtap_file_type_subtype_supports_option(ft,
    WTAP_BLOCK_SECTION, OPT_COMMENT1) == OPTION_NOT_SUPPORTED) {
	/* Not section comments. */
	return false0;
}
}
if (required_comment_types & WTAP_COMMENT_PER_INTERFACE0x00000002) {
if (wtap_file_type_subtype_supports_option(ft,
    WTAP_BLOCK_IF_ID_AND_INFO, OPT_COMMENT1) == OPTION_NOT_SUPPORTED) {
	/* Not interface comments. */
	return false0;
}
}
if (required_comment_types & WTAP_COMMENT_PER_PACKET0x00000004) {
if (wtap_file_type_subtype_supports_option(ft,
    WTAP_BLOCK_PACKET, OPT_COMMENT1) == OPTION_NOT_SUPPORTED) {
	/* Not packet comments. */
	return false0;
}
}

/*
* Yes.  Is the required per-file encapsulation type supported?
* This might be WTAP_ENCAP_PER_PACKET.
*/
if (!wtap_dump_can_write_encap(ft, wtap_dump_required_file_encap_type(file_encaps))) {
/* No. */
return false0;
}

/*
* Yes.  Are all the individual encapsulation types supported?
*/
for (i = 0; i < file_encaps->len; i++) {
if (!wtap_dump_can_write_encap(ft,
    g_array_index(file_encaps, int, i)(((int*) (void *) (file_encaps)->data) [(i)]))) {
	/* No - one of them isn't. */
	return false0;
}
}

/* Yes - we're OK. */
return true1;
1477}

1479/*
* Return true if we can write a file with the given GArray of
* encapsulation types and the given bitmask of comment types.
*/
1483bool_Bool
1484wtap_dump_can_write(const GArray *file_encaps, uint32_t required_comment_types)
1485{
int ft;

for (ft = 0; ft < (int)file_type_subtype_table_arr->len; ft++) {
/* To save a file with Wiretap, Wiretap has to handle that format,
 * and its code to handle that format must be able to write a file
 * with this file's encapsulation types.
 */
if (wtap_dump_can_write_format(ft, file_encaps, required_comment_types)) {
	/* OK, we can write it out in this type. */
	return true1;
}
}

/* No, we couldn't save it in any format. */
return false0;
1501}

1503/*
* Sort by file type/subtype name.
*/
1506static int
1507compare_file_type_subtypes_by_name(const void *a, const void *b)
1508{
int file_type_subtype_a = *(const int *)a;
int file_type_subtype_b = *(const int *)b;

return strcmp(wtap_file_type_subtype_name(file_type_subtype_a),
             wtap_file_type_subtype_name(file_type_subtype_b));
1514}

1516/*
* Sort by file type/subtype description.
*/
1519static int
1520compare_file_type_subtypes_by_description(const void *a, const void *b)
1521{
int file_type_subtype_a = *(const int *)a;
int file_type_subtype_b = *(const int *)b;

return strcmp(wtap_file_type_subtype_description(file_type_subtype_a),
             wtap_file_type_subtype_description(file_type_subtype_b));
1527}

1529/*
* Get a GArray of file type/subtype values for file types/subtypes
* that can be used to save a file of a given type/subtype with a given
* GArray of encapsulation types and the given bitmask of comment types.
*/
1534GArray *
1535wtap_get_savable_file_types_subtypes_for_file(int file_type_subtype,
  const GArray *file_encaps, uint32_t required_comment_types,
  ft_sort_order sort_order)
1538{
GArray *savable_file_types_subtypes;
int ft;
int default_file_type_subtype = -1;
int other_file_type_subtype = -1;

/* Can we save this file in its own file type/subtype? */
if (wtap_dump_can_write_format(file_type_subtype, file_encaps,
		       required_comment_types)) {
/* Yes - make that the default file type/subtype. */
default_file_type_subtype = file_type_subtype;
} else if (wtap_dump_can_write_format(pcap_file_type_subtype,
			      file_encaps,
			      required_comment_types)) {
/*
 * No, but we can write it as a pcap file; make that
 * the default file type/subtype.
 */
default_file_type_subtype = pcap_file_type_subtype;
} else if (wtap_dump_can_write_format(pcapng_file_type_subtype,
			      file_encaps,
			      required_comment_types)) {
/*
 * No, but we can write it as a pcapng file; make that
 * the default file type/subtype.
 */
default_file_type_subtype = pcapng_file_type_subtype;
} else {
/* OK, find the first file type/subtype we *can* save it as. */
default_file_type_subtype = -1;
for (ft = 0; ft < (int)file_type_subtype_table_arr->len; ft++) {
	if (wtap_dump_can_write_format(ft, file_encaps,
				       required_comment_types)) {
		/* OK, got it. */
		default_file_type_subtype = ft;
		break;
	}
}
}

if (default_file_type_subtype == -1) {
/* We don't support writing this file as any file type/subtype. */
return NULL((void*)0);
}

/*
* If the default is pcap, put pcapng right after it if we can
* also write it in pcapng format; otherwise, if the default is
* pcapng, put pcap right after it if we can also write it in
* pcap format.
*/
if (default_file_type_subtype == pcap_file_type_subtype) {
if (wtap_dump_can_write_format(pcapng_file_type_subtype,
                               file_encaps,
                               required_comment_types))
	other_file_type_subtype = pcapng_file_type_subtype;
} else if (default_file_type_subtype == pcapng_file_type_subtype) {
if (wtap_dump_can_write_format(pcap_file_type_subtype,
                               file_encaps,
			       required_comment_types))
	other_file_type_subtype = pcap_file_type_subtype;
}

/* Allocate the array. */
savable_file_types_subtypes = g_array_new(false0, false0,
   sizeof (int));

/*
* First, add the types we don't want to force to the
* beginning of the list.
*/
for (ft = 0; ft < (int)file_type_subtype_table_arr->len; ft++) {
if (ft == default_file_type_subtype ||
    ft == other_file_type_subtype)
	continue;	/* we will done this one later */
if (wtap_dump_can_write_format(ft, file_encaps,
			       required_comment_types)) {
	/* OK, we can write it out in this type. */
	g_array_append_val(savable_file_types_subtypes, ft)g_array_append_vals (savable_file_types_subtypes, &(ft), 1
);
}
}

/* Now, sort the list. */
g_array_sort(savable_file_types_subtypes,
   (sort_order == FT_SORT_BY_NAME) ? compare_file_type_subtypes_by_name :
                                     compare_file_type_subtypes_by_description);

/*
* If we have a type/subtype to put above the default one,
* do so.
*
* We put this type at the beginning before putting the
* default there, so the default is at the top.
*/
if (other_file_type_subtype != -1)
g_array_prepend_val(savable_file_types_subtypes,g_array_prepend_vals (savable_file_types_subtypes, &(other_file_type_subtype
), 1)
    other_file_type_subtype)g_array_prepend_vals (savable_file_types_subtypes, &(other_file_type_subtype
), 1);

/* Put the default file type/subtype first in the list. */
g_array_prepend_val(savable_file_types_subtypes,g_array_prepend_vals (savable_file_types_subtypes, &(default_file_type_subtype
), 1)
   default_file_type_subtype)g_array_prepend_vals (savable_file_types_subtypes, &(default_file_type_subtype
), 1);

return savable_file_types_subtypes;
1641}

1643/*
* Get a GArray of all writable file type/subtype values.
*/
1646GArray *
1647wtap_get_writable_file_types_subtypes(ft_sort_order sort_order)
1648{
GArray *writable_file_types_subtypes;
int ft;

/*
* Allocate the array.
* Pre-allocate room enough for all types.
* XXX - that's overkill; just scan the table to find all the
* writable types and count them.
*/
writable_file_types_subtypes = g_array_sized_new(false0, false0,
   sizeof (int), file_type_subtype_table_arr->len);

/*
* First, add the types we don't want to force to the
* beginning of the list.
*/
for (ft = 0; ft < (int)file_type_subtype_table_arr->len; ft++) {
if (ft == pcap_file_type_subtype ||
    ft == pcapng_file_type_subtype)
	continue;	/* we've already done these two */
if (wtap_dump_can_open(ft)) {
	/* OK, we can write this type. */
	g_array_append_val(writable_file_types_subtypes, ft)g_array_append_vals (writable_file_types_subtypes, &(ft),
 1);
}
}

/* Now, sort the list. */
g_array_sort(writable_file_types_subtypes,
   (sort_order == FT_SORT_BY_NAME) ? compare_file_type_subtypes_by_name :
                                     compare_file_type_subtypes_by_description);

/*
* Now, put pcap and pcapng at the beginning, as they're
* our "native" formats.  Put pcapng there first, and
* pcap before it.
*/
if (pcapng_file_type_subtype != -1 &&
   wtap_dump_can_open(pcapng_file_type_subtype)) {
/*
 * We can write pcapng.  (If we can't, that's a huge
 * mistake.)
 */
g_array_prepend_val(writable_file_types_subtypes,g_array_prepend_vals (writable_file_types_subtypes, &(pcapng_file_type_subtype
), 1)
    pcapng_file_type_subtype)g_array_prepend_vals (writable_file_types_subtypes, &(pcapng_file_type_subtype
), 1);
}
if (pcap_file_type_subtype != -1 &&
   wtap_dump_can_open(pcap_file_type_subtype)) {
/*
 * We can write pcap.  (If we can't, that's a huge
 * mistake.)
 */
g_array_prepend_val(writable_file_types_subtypes,g_array_prepend_vals (writable_file_types_subtypes, &(pcap_file_type_subtype
), 1)
    pcap_file_type_subtype)g_array_prepend_vals (writable_file_types_subtypes, &(pcap_file_type_subtype
), 1);
}

return writable_file_types_subtypes;
1705}

1707/*
* String describing the file type/subtype.
*/
1710const char *
1711wtap_file_type_subtype_description(int file_type_subtype)
1712{
if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len)
return NULL((void*)0);
else
return file_type_subtype_table[file_type_subtype].description;
1718}

1720/*
* Name to use in, say, a command-line flag specifying the type/subtype.
*/
1723const char *
1724wtap_file_type_subtype_name(int file_type_subtype)
1725{
if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len)
return NULL((void*)0);
else
return file_type_subtype_table[file_type_subtype].name;
1731}

1733/*
* Register a backwards-compatibility name.
*/
1736void
1737wtap_register_compatibility_file_subtype_name(const char *old_name,
  const char *new_name)
1739{
g_hash_table_insert(type_subtype_name_map, g_strdup(old_name)g_strdup_inline (old_name),
   g_strdup(new_name)g_strdup_inline (new_name));
1742}

1744/*
* Translate a name to a capture file type/subtype.
*/
1747int
1748wtap_name_to_file_type_subtype(const char *name)
1749{
char *new_name;
int file_type_subtype;

/*
* Is this name a backwards-compatibility name?
*/
new_name = (char *)g_hash_table_lookup(type_subtype_name_map,
   (void *)name);
if (new_name != NULL((void*)0)) {
/*
 * Yes, and new_name is the name to which it should
 * be mapped.
 */
name = new_name;
}
for (file_type_subtype = 0;
   file_type_subtype < (int)file_type_subtype_table_arr->len;
   file_type_subtype++) {
if (file_type_subtype_table[file_type_subtype].name != NULL((void*)0) &&
    strcmp(name, file_type_subtype_table[file_type_subtype].name) == 0)
	return file_type_subtype;
}

return -1;	/* no such file type, or we can't write it */
1774}

1776/*
* Provide the file type/subtype for pcap.
*/
1779int
1780wtap_pcap_file_type_subtype(void)
1781{
/*
* Make sure pcap was registered as a file type/subtype;
* it's one of our "native" formats.
*/
ws_assert(pcap_file_type_subtype != -1)do { if ((1) && !(pcap_file_type_subtype != -1)) ws_log_fatal_full
("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c", 1786, __func__
, "assertion failed: %s", "pcap_file_type_subtype != -1"); } while
 (0);
return pcap_file_type_subtype;
1788}

1790/*
* Provide the file type/subtype for nanosecond-resolution pcap.
*/
1793int
1794wtap_pcap_nsec_file_type_subtype(void)
1795{
/*
* Make sure nanosecond-resolution pcap was registered
* as a file type/subtype; it's one of our "native" formats.
*/
ws_assert(pcap_nsec_file_type_subtype != -1)do { if ((1) && !(pcap_nsec_file_type_subtype != -1))
 ws_log_fatal_full("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c"
, 1800, __func__, "assertion failed: %s", "pcap_nsec_file_type_subtype != -1"
); } while (0);
return pcap_nsec_file_type_subtype;
1802}

1804/*
* Provide the file type/subtype for pcapng.
*/
1807int
1808wtap_pcapng_file_type_subtype(void)
1809{
/*
* Make sure pcapng was registered as a file type/subtype;
* it's one of our "native" formats.
*/
ws_assert(pcapng_file_type_subtype != -1)do { if ((1) && !(pcapng_file_type_subtype != -1)) ws_log_fatal_full
("Wiretap", LOG_LEVEL_ERROR, "wiretap/file_access.c", 1814, __func__
, "assertion failed: %s", "pcapng_file_type_subtype != -1"); }
 while (0);
return pcapng_file_type_subtype;
1816}

1818/*
* Determine if a file type/subtype can write a block of the given type.
*/
1821block_support_t
1822wtap_file_type_subtype_supports_block(int file_type_subtype,
  wtap_block_type_t type)
1824{
size_t num_supported_blocks;
const struct supported_block_type *supported_blocks;

if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len) {
/*
 * There's no such file type, so it can't support any
 * blocks.
 */
return BLOCK_NOT_SUPPORTED;
}

num_supported_blocks = file_type_subtype_table[file_type_subtype].num_supported_blocks;
supported_blocks = file_type_subtype_table[file_type_subtype].supported_blocks;

for (size_t block_idx = 0; block_idx < num_supported_blocks;
   block_idx++) {
if (supported_blocks[block_idx].type == type)
	return supported_blocks[block_idx].support;
}

/*
* Not found, which means not supported.
*/
return BLOCK_NOT_SUPPORTED;
1850}

1852/*
* Determine if a file type/subtype, when writing a block of the given type,
* can support adding the given option to the block.
*/
1856option_support_t
1857wtap_file_type_subtype_supports_option(int file_type_subtype,
  wtap_block_type_t type, unsigned option)
1859{
size_t num_supported_blocks;
const struct supported_block_type *supported_blocks;

if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len) {
/*
 * There's no such file type, so it can't support any
 * blocks, and thus can't support any options.
 */
return OPTION_NOT_SUPPORTED;
}

num_supported_blocks = file_type_subtype_table[file_type_subtype].num_supported_blocks;
supported_blocks = file_type_subtype_table[file_type_subtype].supported_blocks;

for (size_t block_idx = 0; block_idx < num_supported_blocks;
   block_idx++) {
if (supported_blocks[block_idx].type == type) {
	/*
	 * OK, that block is known.
	 * Is it supported?
	 */
	if (supported_blocks[block_idx].support == BLOCK_NOT_SUPPORTED) {
		/*
		 * No, so clearly the option isn't
		 * supported in that block.
		 */
		return OPTION_NOT_SUPPORTED;
	}

	/*
	 * Yes, so check the options.
	 */
	size_t num_supported_options;
	const struct supported_option_type *supported_options;

	num_supported_options = supported_blocks[block_idx].num_supported_options;
	supported_options = supported_blocks[block_idx].supported_options;
	for (size_t opt_idx = 0; opt_idx < num_supported_options;
	    opt_idx++) {
		if (supported_options[opt_idx].opt == option)
			return supported_options[opt_idx].support;
	}

	/*
	 * Not found, which means not supported.
	 */
	return OPTION_NOT_SUPPORTED;
}
}

/*
* The block type wasn't found, which means it's not supported,
* which means the option isn't supported in that block.
*/
return OPTION_NOT_SUPPORTED;
1916}

1918static GSList *
1919add_extensions_for_file_type_subtype(int file_type_subtype, GSList *extensions,
  GSList *compression_type_extensions)
1921{
char **extensions_set, **extensionp;
char *extension;

if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len) {
/*
 * There's no such file type, so it has no extensions
 * to add.
 */
return extensions;
}

/*
* Add the default extension, and all of the compressed variants
* from the list of compressed-file extensions, if there is a
* default extension.
*/
if (file_type_subtype_table[file_type_subtype].default_file_extension != NULL((void*)0)) {
extensions = add_extensions(extensions,
    file_type_subtype_table[file_type_subtype].default_file_extension,
    compression_type_extensions);
}

if (file_type_subtype_table[file_type_subtype].additional_file_extensions != NULL((void*)0)) {
/*
 * We have additional extensions; add them.
 *
 * First, split the extension-list string into a set of
 * extensions.
 */
extensions_set = g_strsplit(file_type_subtype_table[file_type_subtype].additional_file_extensions,
    ";", 0);

/*
 * Add each of those extensions to the list.
 */
for (extensionp = extensions_set; *extensionp != NULL((void*)0);
    extensionp++) {
	extension = *extensionp;

	/*
	 * Add the extension, and all compressed variants
	 * of it if requested.
	 */
	extensions = add_extensions(extensions, extension,
	    compression_type_extensions);
}

g_strfreev(extensions_set);
}
return extensions;
1973}

1975/* Return a list of file extensions that are used by the specified file
* type/subtype.
*
* If include_compressed is true, the list will include compressed
* extensions, e.g. not just "pcap" but also "pcap.gz" if we can read
* gzipped files.
*
* All strings in the list are allocated with g_malloc() and must be freed
* with g_free().
*/
1985GSList *
1986wtap_get_file_extensions_list(int file_type_subtype, bool_Bool include_compressed)
1987{
GSList *extensions, *compression_type_extensions;

if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len)
return NULL((void*)0);	/* not a valid file type */

if (file_type_subtype_table[file_type_subtype].default_file_extension == NULL((void*)0))
return NULL((void*)0);	/* valid, but no extensions known */

extensions = NULL((void*)0);	/* empty list, to start with */

/*
* Add all this file type's extensions, with compressed
* variants if include_compressed is true.
*/
if (include_compressed) {
/*
 * Get compression-type extensions, if any.
 */
compression_type_extensions = ws_get_all_compression_type_extensions_list();
} else {
/*
 * We don't want the compressed file extensions.
 */
compression_type_extensions = NULL((void*)0);
}
extensions = add_extensions_for_file_type_subtype(file_type_subtype, extensions,
   compression_type_extensions);

g_slist_free(compression_type_extensions);

return g_slist_reverse(extensions);
2020}

2022/* Return a list of all extensions that are used by all capture file
* types, including compressed extensions, e.g. not just "pcap" but
* also "pcap.gz" if we can read gzipped files.
*
* "Capture files" means "include file types that correspond to
* collections of network packets, but not file types that
* store data that just happens to be transported over protocols
* such as HTTP but that aren't collections of network packets",
* so that it could be used for "All Capture Files" without picking
* up JPEG files or files such as that - those aren't capture files,
* and we *do* have them listed in the long list of individual file
* types, so omitting them from "All Capture Files" is the right
* thing to do.
*
* All strings in the list are allocated with g_malloc() and must be freed
* with g_free().
*
* This is used to generate a list of extensions to look for if the user
* chooses "All Capture Files" in a file open dialog.
*/
2042GSList *
2043wtap_get_all_capture_file_extensions_list(void)
2044{
GSList *extensions, *compression_type_extensions;
unsigned int i;

init_file_type_extensions();

extensions = NULL((void*)0);	/* empty list, to start with */

/*
* Get compression-type extensions, if any.
*/
compression_type_extensions = ws_get_all_compression_type_extensions_list();

for (i = 0; i < file_type_extensions_arr->len; i++) {
/*
 * Is this a capture file, rather than one of the
 * other random file types we can read?
 */
if (file_type_extensions[i].is_capture_file) {
	/*
	 * Yes.  Add all this file extension type's
	 * extensions, with compressed variants.
	 */
	extensions = add_extensions_for_file_extensions_type(i,
	    extensions, compression_type_extensions);
}
}

g_slist_free(compression_type_extensions);

return g_slist_reverse(extensions);
2075}

2077/* Return a list of all extensions that are used by all file types that
* we can read, including compressed extensions, e.g. not just "pcap" but
* also "pcap.gz" if we can read gzipped files.
*
* "File type" means "include file types that correspond to collections
* of network packets, as well as file types that store data that just
* happens to be transported over protocols such as HTTP but that aren't
* collections of network packets, and plain text files".
*
* All strings in the list are allocated with g_malloc() and must be freed
* with g_free().
*
* This is used to get the "base name" for a file, by stripping off
* compressed-file extensions and extensions that correspond to file
* types that we know about.
*/
2093GSList *
2094wtap_get_all_file_extensions_list(void)
2095{
GSList *extensions, *compression_type_extensions;

extensions = NULL((void*)0);	/* empty list, to start with */

/*
* Get compression-type extensions, if any.
*/
compression_type_extensions = ws_get_all_compression_type_extensions_list();

for (int ft = 0; ft < (int)file_type_subtype_table_arr->len; ft++) {
extensions = add_extensions_for_file_type_subtype(ft, extensions,
    compression_type_extensions);
}

g_slist_free(compression_type_extensions);

return g_slist_reverse(extensions);
2113}

2115/*
* Free a list returned by wtap_get_file_extension_type_extensions(),
* wtap_get_all_capture_file_extensions_list, wtap_get_file_extensions_list(),
* or wtap_get_all_file_extensions_list().
*/
2120void
2121wtap_free_extensions_list(GSList *extensions)
2122{
GSList *extension;

for (extension = extensions; extension != NULL((void*)0);
   extension = g_slist_next(extension)((extension) ? (((GSList *)(extension))->next) : ((void*)0
))) {
g_free(extension->data);
}
g_slist_free(extensions);
2130}

2132/*
* Return the default file extension to use with the specified file type
* and subtype; that's just the extension, without any ".".
*/
2136const char *
2137wtap_default_file_extension(int file_type_subtype)
2138{
if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len)
return NULL((void*)0);
else
return file_type_subtype_table[file_type_subtype].default_file_extension;
2144}

2146/*
* Return whether we know how to write the specified file type.
*/
2149bool_Bool
2150wtap_dump_can_open(int file_type_subtype)
2151{
if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len ||
   file_type_subtype_table[file_type_subtype].dump_open == NULL((void*)0))
return false0;

return true1;
2158}

2160/*
* Return whether we know how to write a compressed file of the specified
* file type.
*/
2164#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG) || defined (HAVE_LZ4FRAME_H1)
2165bool_Bool
2166wtap_dump_can_compress(int file_type_subtype)
2167{
/*
* If this is an unknown file type, or if we have to
* seek when writing out a file with this file type,
* return false.
*/
if (file_type_subtype < 0 ||
   file_type_subtype >= (int)file_type_subtype_table_arr->len ||
   file_type_subtype_table[file_type_subtype].writing_must_seek)
return false0;

return true1;
2179}
2180#else
2181bool_Bool
2182wtap_dump_can_compress(int file_type_subtype _U___attribute__((unused)))
2183{
return false0;
2185}
2186#endif

2188static bool_Bool wtap_dump_open_finish(wtap_dumper *wdh, int *err,
		      char **err_info);

2191static WFILE_T wtap_dump_file_open(const wtap_dumper *wdh, const char *filename);
2192static WFILE_T wtap_dump_file_fdopen(const wtap_dumper *wdh, int fd);
2193static int wtap_dump_file_close(wtap_dumper *wdh);
2194static bool_Bool wtap_dump_fix_idb(wtap_dumper *wdh, wtap_block_t idb, int *err);

2196static wtap_dumper *
2197wtap_dump_init_dumper(int file_type_subtype, ws_compression_type compression_type,
                    const wtap_dump_params *params, int *err)
2199{
wtap_dumper *wdh;
wtap_block_t descr, file_int_data;
wtapng_if_descr_mandatory_t *descr_mand, *file_int_data_mand;
GArray *interfaces = params->idb_inf ? params->idb_inf->interface_data : NULL((void*)0);
4
←
Assuming field 'idb_inf' is non-null→
5
←
'?' condition is true→

/* Can we write files of this file type/subtype?
*
* This will fail if file_type_subtype isn't a valid
* file type/subtype value, so, if it doesn't fail,
* we know file_type_subtype is within the bounds of
* the table of file types/subtypes.
*/
if (!wtap_dump_can_open(file_type_subtype)) {
6
←
Taking false branch→
/* Invalid type, or type we don't know how to write. */
*err = WTAP_ERR_UNWRITABLE_FILE_TYPE-7;
return NULL((void*)0);
}

/* OK, we know how to write that file type/subtype; can we write
* the specified encapsulation type in that file type/subtype?
*/
*err = (*file_type_subtype_table[file_type_subtype].can_write_encap)(params->encap);
/* if the err said to check wslua's can_write_encap, try that */
if (*err == WTAP_ERR_CHECK_WSLUA-23
7
←
Assuming the condition is false→
&& file_type_subtype_table[file_type_subtype].wslua_info != NULL((void*)0)
&& file_type_subtype_table[file_type_subtype].wslua_info->wslua_can_write_encap != NULL((void*)0)) {

*err = (*file_type_subtype_table[file_type_subtype].wslua_info->wslua_can_write_encap)(params->encap, file_type_subtype_table[file_type_subtype].wslua_info->wslua_data);
}

if (*err != 0) {
8
←
Assuming the condition is false→
/* No, we can't. */
return NULL((void*)0);
}

/* Check whether we can open a capture file with that file type
* and that encapsulation, and, if the compression type isn't
* "uncompressed", whether we can write a *compressed* file
* of that file type.
* If we're doing compression, can this file type/subtype be
  written in compressed form?
*
* (The particular type doesn't matter - if the file can't
* be written 100% sequentially, we can't compress it,
* because we can't go back and overwrite something we've
* already written.
*/
if (compression_type != WS_FILE_UNCOMPRESSED &&
9
←
Assuming 'compression_type' is equal to WS_FILE_UNCOMPRESSED→
   !wtap_dump_can_compress(file_type_subtype)) {
*err = WTAP_ERR_COMPRESSION_NOT_SUPPORTED-17;
return NULL((void*)0);
}

/* Allocate a data structure for the output stream. */
wdh = g_new0(wtap_dumper, 1)((wtap_dumper *) g_malloc0_n ((1), sizeof (wtap_dumper)));
10
←
Memory is allocated→
if (wdh == NULL((void*)0)) {
11
←
Assuming 'wdh' is not equal to NULL→
12
←
Taking false branch→
*err = errno(*__errno_location ());
return NULL((void*)0);
}

wdh->file_type_subtype = file_type_subtype;
wdh->snaplen = params->snaplen;
wdh->file_encap = params->encap;
wdh->compression_type = compression_type;
wdh->wslua_data = NULL((void*)0);
wdh->shb_iface_to_global = params->shb_iface_to_global;
wdh->interface_data = g_array_new(false0, false0, sizeof(wtap_block_t));

/* Set Section Header Block data */
wdh->shb_hdrs = params->shb_hdrs;
/* Set Name Resolution Block data */
wdh->nrbs_growing = params->nrbs_growing;
/* Set Interface Description Block data */
if (interfaces && interfaces->len) {
13
←
Assuming 'interfaces' is non-null→
14
←
Assuming field 'len' is not equal to 0→
15
←
Taking true branch→
if (!params->dont_copy_idbs) {	/* XXX */
16
←
Assuming field 'dont_copy_idbs' is false→
17
←
Taking true branch→
	unsigned itf_count;

	/* Note: this memory is owned by wtap_dumper and will become
	 * invalid after wtap_dump_close. */
	for (itf_count = 0; itf_count17.1
'itf_count' is < field 'len'
 < interfaces->len; itf_count++) {
18
←
Loop condition is true.  Entering loop body→
		file_int_data = g_array_index(interfaces, wtap_block_t, itf_count)(((wtap_block_t*) (void *) (interfaces)->data) [(itf_count
)]);
		file_int_data_mand = (wtapng_if_descr_mandatory_t*)wtap_block_get_mandatory_data(file_int_data);
		descr = wtap_block_make_copy(file_int_data);
		if ((params->encap != WTAP_ENCAP_PER_PACKET-1) && (params->encap != file_int_data_mand->wtap_encap)) {
19
←
Assuming the condition is false→
			descr_mand = (wtapng_if_descr_mandatory_t*)wtap_block_get_mandatory_data(descr);
			descr_mand->wtap_encap = params->encap;
		}
		if (!wtap_dump_fix_idb(wdh, descr, err)) {
20
←
Taking true branch→
			return NULL((void*)0);
21
←
Potential leak of memory pointed to by 'wdh'
		}
		g_array_append_val(wdh->interface_data, descr)g_array_append_vals (wdh->interface_data, &(descr), 1);
	}
}
} else if (params->encap != WTAP_ENCAP_NONE-2 && params->encap != WTAP_ENCAP_PER_PACKET-1) {
/* Generate a fake IDB if we don't have one, unless the
 * file encapsulation is none. (WTAP_ENCAP_NONE either
 * means that there are no interfaces, or they will be
 * provided later when reading the file in single-pass mode.)
 *
 * For WTAP_ENCAP_PER_PACKET, we'll have to generate IDBs
 * from packet records as they come in. (pcapng does this now.)
 *
 * XXX File types should provide their own IDBs (possibly
 * fake ones generated by wtap_add_generated_idb()), in
 * order to support being used as inputs for mergecap where
 * pcapng is the output.
 */
descr = wtap_dump_params_generate_idb(params);
g_array_append_val(wdh->interface_data, descr)g_array_append_vals (wdh->interface_data, &(descr), 1);
}
/* Set Decryption Secrets Blocks */
wdh->dsbs_initial = params->dsbs_initial;
wdh->dsbs_growing = params->dsbs_growing;
/* Set Sysdig meta events */
wdh->mevs_growing = params->mevs_growing;
/* Set DPIBs */
wdh->dpibs_growing = params->dpibs_growing;
return wdh;
2318}

2320wtap_dumper *
2321wtap_dump_open(const char *filename, int file_type_subtype,
  ws_compression_type compression_type, const wtap_dump_params *params,
  int *err, char **err_info)
2324{
wtap_dumper *wdh;
WFILE_T fh;

*err = 0;
*err_info = NULL((void*)0);

/* Allocate and initialize a data structure for the output stream. */
wdh = wtap_dump_init_dumper(file_type_subtype, compression_type, params,
   err);
if (wdh == NULL((void*)0))
return NULL((void*)0);

/* In case "fopen()" fails but doesn't set "errno", set "errno"
  to a generic "the open failed" error. */
errno(*__errno_location ()) = WTAP_ERR_CANT_OPEN-6;
fh = wtap_dump_file_open(wdh, filename);
if (fh == NULL((void*)0)) {
*err = errno(*__errno_location ());
g_free(wdh);
return NULL((void*)0);	/* can't create file */
}
wdh->fh = fh;

if (!wtap_dump_open_finish(wdh, err, err_info)) {
/* Get rid of the file we created; we couldn't finish
   opening it. */
wtap_dump_file_close(wdh);
ws_unlinkunlink(filename);
g_free(wdh);
return NULL((void*)0);
}
return wdh;
2357}

2359wtap_dumper *
2360wtap_dump_open_tempfile(const char *tmpdir, char **filenamep, const char *pfx,
  int file_type_subtype, ws_compression_type compression_type,
  const wtap_dump_params *params, int *err, char **err_info)
2363{
int fd;
const char *ext;
char sfx[16];
wtap_dumper *wdh;
WFILE_T fh;

/* No path name for the temporary file yet. */
*filenamep = NULL((void*)0);

*err = 0;
*err_info = NULL((void*)0);

/* Allocate and initialize a data structure for the output stream. */
wdh = wtap_dump_init_dumper(file_type_subtype, compression_type, params,
   err);
if (wdh == NULL((void*)0))
return NULL((void*)0);

/* Choose an appropriate suffix for the file */
ext = wtap_default_file_extension(file_type_subtype);
if (ext == NULL((void*)0))
ext = "tmp";
sfx[0] = '.';
sfx[1] = '\0';
(void) g_strlcat(sfx, ext, 16);

/* Choose a random name for the file */
fd = create_tempfile(tmpdir, filenamep, pfx, sfx, NULL((void*)0));
if (fd == -1) {
*err = WTAP_ERR_CANT_OPEN-6;
g_free(wdh);
return NULL((void*)0);	/* can't create file */
}

/* In case "fopen()" fails but doesn't set "errno", set "errno"
  to a generic "the open failed" error. */
errno(*__errno_location ()) = WTAP_ERR_CANT_OPEN-6;
fh = wtap_dump_file_fdopen(wdh, fd);
if (fh == NULL((void*)0)) {
*err = errno(*__errno_location ());
ws_closeclose(fd);
g_free(wdh);
return NULL((void*)0);	/* can't create file */
}
wdh->fh = fh;

if (!wtap_dump_open_finish(wdh, err, err_info)) {
/* Get rid of the file we created; we couldn't finish
   opening it. */
wtap_dump_file_close(wdh);
ws_unlinkunlink(*filenamep);
g_free(wdh);
return NULL((void*)0);
}
return wdh;
2419}

2421wtap_dumper *
2422wtap_dump_fdopen(int fd, int file_type_subtype, ws_compression_type compression_type,
  const wtap_dump_params *params, int *err, char **err_info)
2424{
wtap_dumper *wdh;
WFILE_T fh;

*err = 0;
*err_info = NULL((void*)0);

/* Allocate and initialize a data structure for the output stream. */
wdh = wtap_dump_init_dumper(file_type_subtype, compression_type, params,
3
←
Calling 'wtap_dump_init_dumper'→
   err);
if (wdh == NULL((void*)0))
return NULL((void*)0);

/* In case "fopen()" fails but doesn't set "errno", set "errno"
  to a generic "the open failed" error. */
errno(*__errno_location ()) = WTAP_ERR_CANT_OPEN-6;
fh = wtap_dump_file_fdopen(wdh, fd);
if (fh == NULL((void*)0)) {
*err = errno(*__errno_location ());
g_free(wdh);
return NULL((void*)0);	/* can't create standard I/O stream */
}
wdh->fh = fh;

if (!wtap_dump_open_finish(wdh, err, err_info)) {
wtap_dump_file_close(wdh);
g_free(wdh);
return NULL((void*)0);
}
return wdh;
2454}

2456wtap_dumper *
2457wtap_dump_open_stdout(int file_type_subtype, ws_compression_type compression_type,
  const wtap_dump_params *params, int *err, char **err_info)
2459{
int new_fd;
wtap_dumper *wdh;

/*
* Duplicate the file descriptor, so that we can close the
* wtap_dumper handle the same way we close any other
* wtap_dumper handle, without closing the standard output.
*/
new_fd = ws_dupdup(1);
if (new_fd == -1) {
1
Taking false branch→
/* dup failed */
*err = errno(*__errno_location ());
return NULL((void*)0);
}
2474#ifdef _WIN32
/*
* Put the new descriptor into binary mode.
*
* XXX - even if the file format we're writing is a text
* format?
*/
if (_setmode(new_fd, O_BINARY0) == -1) {
/* "Should not happen" */
*err = errno(*__errno_location ());
ws_closeclose(new_fd);
return NULL((void*)0);
}
2487#endif

wdh = wtap_dump_fdopen(new_fd, file_type_subtype, compression_type,
2
←
Calling 'wtap_dump_fdopen'→
   params, err, err_info);
if (wdh == NULL((void*)0)) {
/* Failed; close the new FD */
ws_closeclose(new_fd);
return NULL((void*)0);
}
return wdh;
2497}

2499static bool_Bool
2500wtap_dump_open_finish(wtap_dumper *wdh, int *err, char **err_info)
2501{
int fd;
bool_Bool cant_seek;

/* Can we do a seek on the file descriptor?
  If not, note that fact. */
if (wdh->compression_type != WS_FILE_UNCOMPRESSED) {
cant_seek = true1;
} else {
fd = ws_filenofileno((FILE *)wdh->fh);
if (ws_lseek64lseek(fd, 1, SEEK_CUR1) == (off_t) -1)
	cant_seek = true1;
else {
	/* Undo the seek. */
	ws_lseek64lseek(fd, 0, SEEK_SET0);
	cant_seek = false0;
}
}

/* If this file type requires seeking, and we can't seek, fail. */
if (file_type_subtype_table[wdh->file_type_subtype].writing_must_seek && cant_seek) {
*err = WTAP_ERR_CANT_WRITE_TO_PIPE-5;
return false0;
}

/* Set wdh with wslua data if any - this is how we pass the data
* to the file writer.
*/
if (file_type_subtype_table[wdh->file_type_subtype].wslua_info)
wdh->wslua_data = file_type_subtype_table[wdh->file_type_subtype].wslua_info->wslua_data;

/* Now try to open the file for writing. */
if (!(*file_type_subtype_table[wdh->file_type_subtype].dump_open)(wdh, err,
   err_info)) {
return false0;
}

return true1;	/* success! */
2539}

2541/* XXX - Temporary hack to deal with nstime_t, and thus wtap_rec and libwiretap
* in general, not storing precision greater than nanoseconds yet. Despite
* whatever precision an IDB claims, we can't write finer than nanosecond.
* Eventually this should be removed.
* Fix a given IDB to indicate no greater than nanosecond precision. */
2546static bool_Bool
2547wtap_dump_fix_idb(wtap_dumper *wdb _U___attribute__((unused)), wtap_block_t idb, int *err)
2548{
wtapng_if_descr_mandatory_t *idb_mand;
int64_t tsoffset;
idb_mand = (wtapng_if_descr_mandatory_t*)wtap_block_get_mandatory_data(idb);

/*
* nstime_t only stores nanoseconds, so instead of claiming false
* precision, fix things up.
*/
if (idb_mand->time_units_per_second > 1000000000) {
ws_warning("original time precision reduced to nanoseconds")do { if (1) { ws_log_full("Wiretap", LOG_LEVEL_WARNING, "wiretap/file_access.c"
, 2558, __func__, "original time precision reduced to nanoseconds"
); } } while (0);
idb_mand->time_units_per_second = 1000000000;
switch (wtap_block_set_uint8_option_value(idb, OPT_IDB_TSRESOL9, 9)) {
case WTAP_OPTTYPE_SUCCESS:
	break;
case WTAP_OPTTYPE_NOT_FOUND:
	// This "should not" happen, because no if_tsresol means 6,
	// and time_units_per_second should be 1000000;
	if (wtap_block_add_uint8_option(idb, OPT_IDB_TSRESOL9, 9) == WTAP_OPTTYPE_SUCCESS) {
		break;
	}
	/* FALLTHROUGH */
default:
	// These "should not" happen either.
	*err = WTAP_ERR_INTERNAL-21;
	return false0;
}
}

/*
* Since we're not writing more than nanosecond resolution, if_tsoffset
* isn't necessary, as anything we can store in absolute timestamps in
* Wireshark records we can write to a file without an offset (unless
* we have 32-bit time_t, but that's rare these days.) So we remove it
* here, though in the long term we should keep it.
*/
if (wtap_block_get_int64_option_value(idb, OPT_IDB_TSOFFSET14, &tsoffset) == WTAP_OPTTYPE_SUCCESS) {
wtap_block_remove_option(idb, OPT_IDB_TSOFFSET14);
}

return true1;
2589}

2591bool_Bool
2592wtap_dump_add_idb(wtap_dumper *wdh, wtap_block_t idb, int *err,
                char **err_info)
2594{
wtap_block_t idb_copy;

if (wdh->subtype_add_idb == NULL((void*)0)) {
/* Not supported. */
*err = WTAP_ERR_UNWRITABLE_REC_TYPE-24;
*err_info = g_strdup("Adding IDBs isn't supported by this file type")g_strdup_inline ("Adding IDBs isn't supported by this file type"
);
return false0;
}

/*
* Add a copy of this IDB to our array of IDBs.
*/
idb_copy = wtap_block_create(WTAP_BLOCK_IF_ID_AND_INFO);
wtap_block_copy(idb_copy, idb);
g_array_append_val(wdh->interface_data, idb_copy)g_array_append_vals (wdh->interface_data, &(idb_copy),
 1);

if (!wtap_dump_fix_idb(wdh, idb_copy, err)) {
*err_info = ws_strdup_printf("pcapng: failed to lower time resolution to nanoseconds")wmem_strdup_printf(((void*)0), "pcapng: failed to lower time resolution to nanoseconds"
);
return false0;
}

*err = 0;
*err_info = NULL((void*)0);
return (wdh->subtype_add_idb)(wdh, idb, err, err_info);
2619}

2621bool_Bool
2622wtap_dump(wtap_dumper *wdh, const wtap_rec *rec, int *err, char **err_info)
2623{
*err = 0;
*err_info = NULL((void*)0);
return (wdh->subtype_write)(wdh, rec, err, err_info);
2627}

2629bool_Bool
2630wtap_dump_flush(wtap_dumper *wdh, int *err)
2631{
switch (wdh->compression_type) {
2633#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG)
case WS_FILE_GZIP_COMPRESSED:
if (gzwfile_flush((GZWFILE_T)wdh->fh) == -1) {
	*err = gzwfile_geterr((GZWFILE_T)wdh->fh);
	return false0;
}
break;
2640#endif
2641#ifdef HAVE_LZ4FRAME_H1
case WS_FILE_LZ4_COMPRESSED:
if (lz4wfile_flush((LZ4WFILE_T)wdh->fh) == -1) {
	*err = lz4wfile_geterr((LZ4WFILE_T)wdh->fh);
	return false0;
}
break;
2648#endif /* HAVE_LZ4FRAME_H */
default:
if (fflush((FILE *)wdh->fh) == EOF(-1)) {
	*err = errno(*__errno_location ());
	return false0;
}
}
return true1;
2656}

2658bool_Bool
2659wtap_dump_close(wtap_dumper *wdh, bool_Bool *needs_reload,
  int *err, char **err_info)
2661{
bool_Bool ret = true1;

*err = 0;
*err_info = NULL((void*)0);
if (wdh->subtype_finish != NULL((void*)0)) {
/* There's a finish routine for this dump stream. */
if (!(wdh->subtype_finish)(wdh, err, err_info))
	ret = false0;
}
errno(*__errno_location ()) = WTAP_ERR_CANT_CLOSE-11;
if (wtap_dump_file_close(wdh) == EOF(-1)) {
if (ret) {
	/* The per-format finish function succeeded,
	   but the stream close didn't.  Save the
	   reason why, if our caller asked for it. */
	if (err != NULL((void*)0))
		*err = errno(*__errno_location ());
}
ret = false0;
}
if (needs_reload != NULL((void*)0))
*needs_reload = wdh->needs_reload;
g_free(wdh->priv);
wtap_block_array_free(wdh->interface_data);
wtap_block_array_unref(wdh->dsbs_initial);
g_free(wdh);
return ret;
2689}

2691int
2692wtap_dump_file_type_subtype(const wtap_dumper *wdh)
2693{
return wdh->file_type_subtype;
2695}

2697int64_t
2698wtap_get_bytes_dumped(const wtap_dumper *wdh)
2699{
return wdh->bytes_dumped;
2701}

2703void
2704wtap_set_bytes_dumped(wtap_dumper *wdh, int64_t bytes_dumped)
2705{
wdh->bytes_dumped = bytes_dumped;
2707}

2709bool_Bool
2710wtap_addrinfo_list_empty(const addrinfo_lists_t *addrinfo_lists)
2711{
return (addrinfo_lists == NULL((void*)0)) ||
   ((addrinfo_lists->ipv4_addr_list == NULL((void*)0)) &&
    (addrinfo_lists->ipv6_addr_list == NULL((void*)0)));
2715}

2717bool_Bool
2718wtap_dump_set_addrinfo_list(wtap_dumper *wdh, addrinfo_lists_t *addrinfo_lists)
2719{
if (!wdh || wdh->file_type_subtype < 0 ||
   wdh->file_type_subtype >= (int)file_type_subtype_table_arr->len ||
   wtap_file_type_subtype_supports_block(wdh->file_type_subtype, WTAP_BLOCK_NAME_RESOLUTION) == BLOCK_NOT_SUPPORTED)
return false0;
wdh->addrinfo_lists = addrinfo_lists;
return true1;
2726}

2728void
2729wtap_dump_discard_name_resolution(wtap_dumper *wdh)
2730{
/* As below for DSBs. */
if (wdh->nrbs_growing) {
/*
 * Pretend we've written all of them.
 */
wdh->nrbs_growing_written = wdh->nrbs_growing->len;
}
2738}

2740void
2741wtap_dump_discard_decryption_secrets(wtap_dumper *wdh)
2742{
/*
* This doesn't free the data, as it might be pointed to
* from other structures; it merely marks all of them as
* having been written to the file, so that they don't
* get written by wtap_dump().
*
* XXX - our APIs for dealing with some metadata, such as
* resolved names, decryption secrets, and interface
* statistics is not very well oriented towards one-pass
* programs; this needs to be cleaned up.  See bug 15502.
*/
if (wdh->dsbs_growing) {
/*
 * Pretend we've written all of them.
 */
wdh->dsbs_growing_written = wdh->dsbs_growing->len;
}
2760}

2762void
2763wtap_dump_discard_sysdig_meta_events(wtap_dumper *wdh)
2764{
/* As above for DSBs. */
if (wdh->mevs_growing) {
/*
 * Pretend we've written all of them.
 */
wdh->mevs_growing_written = wdh->mevs_growing->len;
}
2772}

2774/* internally open a file for writing (compressed or not) */
2775static WFILE_T
2776wtap_dump_file_open(const wtap_dumper *wdh, const char *filename)
2777{
switch (wdh->compression_type) {
2779#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG)
case WS_FILE_GZIP_COMPRESSED:
return gzwfile_open(filename);
2782#endif /* defined (HAVE_ZLIB) || defined (HAVE_ZLIBNG) */
2783#ifdef HAVE_LZ4FRAME_H1
case WS_FILE_LZ4_COMPRESSED:
return lz4wfile_open(filename);
2786#endif /* HAVE_LZ4FRAME_H */
default:
return ws_fopenfopen(filename, "wb");
}
2790}

2792/* internally open a file for writing (compressed or not) */
2793static WFILE_T
2794wtap_dump_file_fdopen(const wtap_dumper *wdh, int fd)
2795{
switch (wdh->compression_type) {
2797#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG)
case WS_FILE_GZIP_COMPRESSED:
return gzwfile_fdopen(fd);
2800#endif /* defined (HAVE_ZLIB) || defined (HAVE_ZLIBNG) */
2801#ifdef HAVE_LZ4FRAME_H1
case WS_FILE_LZ4_COMPRESSED:
return lz4wfile_fdopen(fd);
2804#endif /* HAVE_LZ4FRAME_H */
default:
return ws_fdopenfdopen(fd, "wb");
}
2808}

2810/* internally writing raw bytes (compressed or not). Updates wdh->bytes_dumped on success */
2811bool_Bool
2812wtap_dump_file_write(wtap_dumper *wdh, const void *buf, size_t bufsize, int *err)
2813{
size_t nwritten;

switch (wdh->compression_type) {
2817#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG)
case WS_FILE_GZIP_COMPRESSED:
nwritten = gzwfile_write((GZWFILE_T)wdh->fh, buf, (unsigned int) bufsize);
/*
 * gzwfile_write() returns 0 on error.
 */
if (nwritten == 0) {
	*err = gzwfile_geterr((GZWFILE_T)wdh->fh);
	return false0;
}
break;
2828#endif
2829#ifdef HAVE_LZ4FRAME_H1
case WS_FILE_LZ4_COMPRESSED:
nwritten = lz4wfile_write((LZ4WFILE_T)wdh->fh, buf, bufsize);
/*
 * lz4wfile_write() returns 0 on error.
 */
if (nwritten == 0) {
	*err = lz4wfile_geterr((LZ4WFILE_T)wdh->fh);
	return false0;
}
break;
2840#endif /* HAVE_LZ4FRAME_H */
default:
errno(*__errno_location ()) = WTAP_ERR_CANT_WRITE-10;
nwritten = fwrite(buf, 1, bufsize, (FILE *)wdh->fh);
/*
 * At least according to the macOS man page,
 * this can return a short count on an error.
 */
if (nwritten != bufsize) {
	if (ferror((FILE *)wdh->fh))
		*err = errno(*__errno_location ());
	else
		*err = WTAP_ERR_SHORT_WRITE-14;
	return false0;
}
}
wdh->bytes_dumped += bufsize;
return true1;
2858}

2860/* internally close a file for writing (compressed or not) */
2861static int
2862wtap_dump_file_close(wtap_dumper *wdh)
2863{
switch (wdh->compression_type) {
2865#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG)
case WS_FILE_GZIP_COMPRESSED:
return gzwfile_close((GZWFILE_T)wdh->fh);
2868#endif
2869#ifdef HAVE_LZ4FRAME_H1
case WS_FILE_LZ4_COMPRESSED:
return lz4wfile_close((LZ4WFILE_T)wdh->fh);
2872#endif /* HAVE_LZ4FRAME_H */
default:
return fclose((FILE *)wdh->fh);
}
2876}

2878int64_t
2879wtap_dump_file_seek(wtap_dumper *wdh, int64_t offset, int whence, int *err)
2880{
2881#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG) || defined (HAVE_LZ4FRAME_H1)
if (wdh->compression_type != WS_FILE_UNCOMPRESSED) {
*err = WTAP_ERR_CANT_SEEK_COMPRESSED-19;
return -1;
} else
2886#endif
{
if (-1 == ws_fseek64fseeko((FILE *)wdh->fh, offset, whence)) {
	*err = errno(*__errno_location ());
	return -1;
} else
{
	return 0;
}
}
2896}

2898int64_t
2899wtap_dump_file_tell(wtap_dumper *wdh, int *err)
2900{
int64_t rval;
2902#if defined (HAVE_ZLIB1) || defined (HAVE_ZLIBNG) || defined (HAVE_LZ4FRAME_H1)
if (wdh->compression_type != WS_FILE_UNCOMPRESSED) {
*err = WTAP_ERR_CANT_SEEK_COMPRESSED-19;
return -1;
} else
2907#endif
{
if (-1 == (rval = ws_ftell64ftello((FILE *)wdh->fh))) {
	*err = errno(*__errno_location ());
	return -1;
} else
{
	return rval;
}
}
2917}

2919void
2920cleanup_open_routines(void)
2921{
unsigned i;
struct open_info *i_open;

if (open_routines != NULL((void*)0) && open_info_arr) {
for (i = 0, i_open = open_routines; i < open_info_arr->len; i++, i_open++) {
	if (i_open->extensions != NULL((void*)0))
		g_strfreev(i_open->extensions_set);
}

g_array_free(open_info_arr, true1);
open_info_arr = NULL((void*)0);
}
2934}

2936/*
* Allow built-in file handlers (but *not* plugin file handlers!) to
* register a "backwards-compatibility" name and file type value, to
* put in the Lua wtap_filetypes table.
*
* This is only to be used as long as we have that table; new Lua
* code should use wtap_name_to_file_type_subtype() to look up
* file types by their name, just as C code should.
*
* The backwards-compatibility names are the old WTAP_FILE_TYPE_SUBTYPE_
* #define name, with WTAP_FILE_TYPE_SUBTYPE_ removed.
*/

2949static GArray *backwards_compatibility_lua_names;

2951void
2952// NOLINTNEXTLINE(misc-no-recursion)
2953wtap_register_backwards_compatibility_lua_name(const char *name, int ft)
2954{
struct backwards_compatibiliity_lua_name entry;

/*
* Create the table if it doesn't already exist.
* Use the same size as we do for the file type/subtype table.
*/
if (backwards_compatibility_lua_names == NULL((void*)0)) {
backwards_compatibility_lua_names = g_array_sized_new(false0,
    true1, sizeof(struct backwards_compatibiliity_lua_name),
    wtap_module_count*2);

/*
 * Extra backwards compatibility hack - add entries
 * for time stamp precision values(!), as well as
 * for "UNKNOWN" and types that don't yet register
 * themselves.
 *
 * If new WS_TSPREC_ value are added, don't bother
 * adding them to this table; any Lua program that
 * would use them should use the wtap_tsprecs type.
 *
 * (Recursion: see "recursion".)
 */
wtap_register_backwards_compatibility_lua_name("TSPREC_SEC",
    WTAP_TSPREC_SEC0);
wtap_register_backwards_compatibility_lua_name("TSPREC_DSEC",
    WTAP_TSPREC_100_MSEC1);
wtap_register_backwards_compatibility_lua_name("TSPREC_CSEC",
    WTAP_TSPREC_10_MSEC2);
wtap_register_backwards_compatibility_lua_name("TSPREC_MSEC",
    WTAP_TSPREC_MSEC3);
wtap_register_backwards_compatibility_lua_name("TSPREC_USEC",
    WTAP_TSPREC_USEC6);
wtap_register_backwards_compatibility_lua_name("TSPREC_NSEC",
    WTAP_TSPREC_NSEC9);
wtap_register_backwards_compatibility_lua_name("UNKNOWN",
    WTAP_FILE_TYPE_SUBTYPE_UNKNOWN-1);
}
entry.name = name;
entry.ft = ft;
g_array_append_val(backwards_compatibility_lua_names, entry)g_array_append_vals (backwards_compatibility_lua_names, &
(entry), 1);
2996}

2998const GArray *
2999get_backwards_compatibility_lua_table(void)
3000{
return backwards_compatibility_lua_names;
3002}

3004/*
* Editor modelines  -  https://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/