[File] [PATCH] lemsdosdate woes

[Christoph Biedl]

Hello,

commit b310a0c2d3e4a1c12d579ad5c0266f1092a91340
Author: Christos Zoulas <christos at zoulas.com>
Date:   Wed Nov 27 15:37:46 2024 +0000

    Use +4 in default reset previous negative offset in magic in zip entry

was included in the 5.46 release tarball although in the git repository
the FILE5_46 tag is a bit earlier. That was just an extra confusion
trying to understand the trouble it unveilled: At least for some .zip
files it changed the output, and that new output is inconsistent across
architectures. This was reported in Debian bug report #1100712.

Looking a bit closer:

It seems the 16 bit structure representing the "MS-DOS date" is always
understood in the host order, something plain "msdosdate" would do.

Reproducer:

Use a magic file:
| 0	lemsdosdate	x	date: %s
| 0	bemsdosdate	x	date: %s

on this sample (two octets).
| 0x5a 0x74

and add --keep-going to the invocation


Expected, two different dates, with the correct day of the week:

| date: Fri, Feb 26 2038\012- date: Thu, Mar 20 2025\012- , ASCII text, with no line terminators

On little endian (amd64) this yields:

| date: Sun, Mar 20 2025\012- date: Sun, Mar 20 2025\012- , ASCII text, with no line terminators

On big endian (powerpc) however:

| date: Sun, Feb 26 2038\012- date: Sun, Feb 26 2038\012- , ASCII text, with no line terminators


So it seems an endianess conversion is missing. For lemsdostime it's
obviously the same, very likely for the be* counterparts as well.

Also: strftime does not, or not on all platforms, recalculate the time
information - therefore %a does expand to Sunday in the above example
despite today is Thursday. Suggestion: Just drop %a.


And, minor, in magic/Magdir/zip:

| >>12  ulelong   x     \b, last modified
| >>14  lemsdosdate x   \b, last modified %s
| >>12  lemsdostime x   %s

The first line seems superflous as it causes a duplicate "last modified", for example in

| Zip archive data, (...), last modified, last modified Sun, Mar 04 2010 00:24:16,(...)


The patch attached handles these issues, also adds the inversions to
cvt_flip - I think they should be there, I might be wrong. That could
see a test.

Cheers,

    Christoph


-------------- next part --------------
diff --git a/magic/Magdir/zip b/magic/Magdir/zip
index abf52847..d51cc170 100644
--- a/magic/Magdir/zip
+++ b/magic/Magdir/zip
@@ -17,7 +17,6 @@
 >>6	leshort		x		\b, extract using at least
 >>6	use		zipversion
 # This is DOS date like: ledate 21:00:48 19 Dec 2001 != DOS 00:00 1 Jan 2010 ~ 0000213C
->>12	ulelong		x		\b, last modified
 >>14	lemsdosdate	x		\b, last modified %s
 >>12	lemsdostime	x		%s
 # uncompressed size of 1st entry; FFffFFff means real value stored in ZIP64 record
diff --git a/src/print.c b/src/print.c
index 8074cdc6..1a4cd657 100644
--- a/src/print.c
+++ b/src/print.c
@@ -358,7 +358,7 @@ file_fmtdate(char *buf, size_t bsize, uint16_t v)
 		tm.tm_mon = 0;
 	tm.tm_year = (v >> 9) + 80;
 
-	if (strftime(buf, bsize, "%a, %b %d %Y", &tm) == 0)
+	if (strftime(buf, bsize, "%b %d %Y", &tm) == 0)
 		goto out;
 
 	return buf;
diff --git a/src/softmagic.c b/src/softmagic.c
index 6987afc8..19e2a659 100644
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -1042,6 +1042,14 @@ cvt_flip(int type, int flip)
 		return FILE_LEDOUBLE;
 	case FILE_LEDOUBLE:
 		return FILE_BEDOUBLE;
+	case FILE_BEMSDOSDATE:
+		return FILE_LEMSDOSDATE;
+	case FILE_LEMSDOSDATE:
+		return FILE_BEMSDOSDATE;
+	case FILE_BEMSDOSTIME:
+		return FILE_LEMSDOSTIME;
+	case FILE_LEMSDOSTIME:
+		return FILE_BEMSDOSTIME;
 	default:
 		return type;
 	}
@@ -1166,11 +1174,7 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		return 1;
 	case FILE_SHORT:
 	case FILE_MSDOSDATE:
-	case FILE_LEMSDOSDATE:
-	case FILE_BEMSDOSDATE:
 	case FILE_MSDOSTIME:
-	case FILE_LEMSDOSTIME:
-	case FILE_BEMSDOSTIME:
 		if (cvt_16(p, m) == -1)
 			goto out;
 		return 1;
@@ -1224,6 +1228,8 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		return 1;
 	}
 	case FILE_BESHORT:
+	case FILE_BEMSDOSDATE:
+	case FILE_BEMSDOSTIME:
 		p->h = CAST(short, BE16(p->hs));
 		if (cvt_16(p, m) == -1)
 			goto out;
@@ -1244,6 +1250,8 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 			goto out;
 		return 1;
 	case FILE_LESHORT:
+	case FILE_LEMSDOSDATE:
+	case FILE_LEMSDOSTIME:
 		p->h = CAST(short, LE16(p->hs));
 		if (cvt_16(p, m) == -1)
 			goto out;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20250320/aceb042b/attachment.asc>