Mac Archive Type Sniffing

chrome/browser/safe_browsing/mac_archive_type_sniffer.cc

Index: chrome/browser/safe_browsing/mac_archive_type_sniffer.cc
diff --git a/chrome/browser/safe_browsing/mac_archive_type_sniffer.cc b/chrome/browser/safe_browsing/mac_archive_type_sniffer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..de77b47e6c9abd2fa9cf2d2dc0dce4da1a378add
--- /dev/null
+++ b/chrome/browser/safe_browsing/mac_archive_type_sniffer.cc
@@ -0,0 +1,43 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/safe_browsing/mac_archive_type_sniffer.h"
+#include "content/public/browser/browser_thread.h"
+
+namespace safe_browsing {
+
+namespace {
+
+const int kSizeKolySignatureInBytes = 4;
+const int kSizeKolyTrailer = 512;

[Robert Sesek, 2017/06/13 22:18:56]

…InBytes just like the other

[mortonm, 2017/06/13 23:45:45]

Done.

+
+}  // namespace
+
+MacArchiveTypeSniffer::MacArchiveTypeSniffer() {}
+
+// static
+bool MacArchiveTypeSniffer::IsAppleDiskImage(const base::FilePath& dmg_file) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::FILE);
+
+  base::File file(dmg_file, base::File::FLAG_OPEN | base::File::FLAG_READ);
+  DCHECK(file.IsValid());
+  if (!file.IsValid())
+    return false;
+
+  char data[kSizeKolySignatureInBytes];
+
+  if (file.Seek(base::File::FROM_END, -1 * kSizeKolyTrailer) == -1)
+    return false;
+
+  if (file.ReadAtCurrentPos(data, kSizeKolySignatureInBytes) !=
+      kSizeKolySignatureInBytes)
+    return false;
+
+  // Compare 4 bytes at given position in file to 'koly' in ascii.
+  return (strncmp(data, "\x6b\x6f\x6c\x79", kSizeKolySignatureInBytes) == 0);

[Robert Sesek, 2017/06/13 22:18:56]

strncmp is meant for null-terminated strings. Instead, you could do:

(in the constants section):
const uint32_t kKolySignature = 'koly';

And here: return memcmp(data, &kKolySignature, kSizeKolySignatureInBytes) == 0;

[mortonm, 2017/06/13 23:45:45]

Done. I used a 4-element array of uint8_t for the constant instead of packing
into a multi-byte integer type in order to avoid the big vs little endian
problem -- since the koly trailer is formatted as big endian.

+}
+
+MacArchiveTypeSniffer::~MacArchiveTypeSniffer() = default;
+
+}  // namespace safe_browsing