Mac Archive Type Sniffing

chrome/browser/safe_browsing/mac_archive_type_sniffer.cc

Index: chrome/browser/safe_browsing/mac_archive_type_sniffer.cc
diff --git a/chrome/browser/safe_browsing/mac_archive_type_sniffer.cc b/chrome/browser/safe_browsing/mac_archive_type_sniffer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..1298d414f0e8536a1c34be6c556f1af7c0eef3a5
--- /dev/null
+++ b/chrome/browser/safe_browsing/mac_archive_type_sniffer.cc
@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#define SIZE_KOLY_SIGNATURE_IN_BYTES 4

[Jialiu Lin, 2017/06/13 20:55:38]

nit Can you use constant instead of defines?
e.g. 
namespace safe_browsing {

namespace  {
const int kSizeKolySignatureInByte = 4;
const int kSizeKolyTrailer = 512;

}  // namespace

....

[mortonm, 2017/06/13 22:09:44]

Done.

+#define SIZE_KOLY_TRAILER 512
+
+#include "chrome/browser/safe_browsing/mac_archive_type_sniffer.h"
+#include "content/public/browser/browser_thread.h"
+
+namespace safe_browsing {
+
+MacArchiveTypeSniffer::MacArchiveTypeSniffer() {}
+
+// static
+bool MacArchiveTypeSniffer::IsAppleDiskImage(const base::FilePath& dmg_file) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::FILE);
+
+  base::File file(dmg_file, base::File::FLAG_OPEN | base::File::FLAG_READ);
+  DCHECK(file.IsValid());
+  if (!file.IsValid())
+    return false;
+
+  char data[SIZE_KOLY_SIGNATURE_IN_BYTES];
+
+  if (file.Seek(base::File::FROM_END, -1 * SIZE_KOLY_TRAILER) == -1)
+    return false;
+
+  if (file.ReadAtCurrentPos(data, SIZE_KOLY_SIGNATURE_IN_BYTES) !=
+      SIZE_KOLY_SIGNATURE_IN_BYTES)
+    return false;
+
+  // Compare 4 bytes at given position in file to 'koly' in ascii.
+  return (strncmp(data, "\x6b\x6f\x6c\x79", SIZE_KOLY_SIGNATURE_IN_BYTES) == 0);
+}
+
+MacArchiveTypeSniffer::~MacArchiveTypeSniffer() = default;
+
+}  // namespace safe_browsing