- subquery_count = (gint)(query_data64 >> 32);
- item_query = proto_tree_add_text(tree, tvb, offset, query_length,
- "%s, toc index: %u, children: %u",
- spotlight_get_cpx_qtype_string(complex_query_type),
- toc_index + 1,
- subquery_count);
- break;
- case SQ_CPX_TYPE_STRING:
- subquery_count = 1;
- query_data64 = spotlight_ntoh64(tvb, offset + 8, encoding);
- query_length = (query_data64 & 0xffff) * 8;
- item_query = proto_tree_add_text(tree, tvb, offset, query_length + 8,
- "%s, toc index: %u, string: '%s'",
- spotlight_get_cpx_qtype_string(complex_query_type),
- toc_index + 1,
- tvb_get_ephemeral_string(tvb, offset + 16, query_length - 8));
- break;
- case SQ_CPX_TYPE_UTF16_STRING:
- /*
- * This is an UTF-16 string.
- * Dissections show the typical byte order mark 0xFFFE or 0xFEFF, respectively.
- * However the existence of such a mark can not be assumed.
- * If the mark is missing, big endian encoding is assumed.
- */
-
- subquery_count = 1;
- query_data64 = spotlight_ntoh64(tvb, offset + 8, encoding);
- query_length = (query_data64 & 0xffff) * 8;
-
- unicode_encoding = spotlight_get_utf16_string_encoding(tvb, offset + 16, query_length - 8, encoding);
- mark_exists = (unicode_encoding & ENC_UTF_16);
- unicode_encoding &= ~ENC_UTF_16;
-
- item_query = proto_tree_add_text(tree, tvb, offset, query_length + 8,
- "%s, toc index: %u, utf-16 string: '%s'",
- spotlight_get_cpx_qtype_string(complex_query_type),
- toc_index + 1,
- tvb_get_ephemeral_unicode_string(tvb, offset + (mark_exists ? 18 : 16),
- query_length - (mark_exists? 10 : 8), unicode_encoding));
- break;
- default:
- subquery_count = 1;
- item_query = proto_tree_add_text(tree, tvb, offset, query_length,
- "type: %s (%s), toc index: %u, children: %u",
- spotlight_get_qtype_string(query_type),
- spotlight_get_cpx_qtype_string(complex_query_type),
- toc_index + 1,
- subquery_count);
- break;
- }
-
- sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
- offset += 8;
- offset = spotlight_dissect_query_loop(tvb, pinfo, sub_tree, offset, complex_query_type, subquery_count, toc_offset, encoding);
- count--;
- break;
- case SQ_TYPE_NULL:
- subquery_count = (gint)(query_data64 >> 32);
- if (subquery_count > count) {
- item_query = proto_tree_add_text(tree, tvb, offset, query_length, "null");
- expert_add_info_format(pinfo, item_query, PI_MALFORMED, PI_ERROR,
- "Subquery count (%d) > query count (%d)", subquery_count, count);
- count = 0;
- } else if (subquery_count > 20) {
- item_query = proto_tree_add_text(tree, tvb, offset, query_length, "null");
- expert_add_info_format(pinfo, item_query, PI_PROTOCOL, PI_WARN,
- "Abnormal number of subqueries (%d)", subquery_count);
- count -= subquery_count;
- } else {
- for (i = 0; i < subquery_count; i++, count--)
- proto_tree_add_text(tree, tvb, offset, query_length, "null");
- }
- offset += query_length;
- break;
- case SQ_TYPE_BOOL:
- proto_tree_add_text(tree, tvb, offset, query_length, "bool: %s",
- (query_data64 >> 32) ? "true" : "false");
- count--;
- offset += query_length;
- break;
- case SQ_TYPE_INT64:
- item_query = proto_tree_add_text(tree, tvb, offset, 8, "int64");
- sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
- j = spotlight_int64(tvb, sub_tree, offset, encoding);
- count -= j;
- offset += query_length;
- break;
- case SQ_TYPE_UUID:
- item_query = proto_tree_add_text(tree, tvb, offset, 8, "UUID");
- sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
- j = spotlight_uuid(tvb, sub_tree, offset, encoding);
- count -= j;
- offset += query_length;
- break;
- case SQ_TYPE_FLOAT:
- item_query = proto_tree_add_text(tree, tvb, offset, 8, "float");
- sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
- j = spotlight_float(tvb, sub_tree, offset, encoding);
- count -= j;
- offset += query_length;
- break;
- case SQ_TYPE_DATA:
- switch (cpx_query_type) {
- case SQ_CPX_TYPE_STRING:
- proto_tree_add_text(tree, tvb, offset, query_length, "string: '%s'",
- tvb_get_ephemeral_string(tvb, offset + 8, query_length - 8));
- break;
- case SQ_CPX_TYPE_UTF16_STRING: {
- /* description see above */
- unicode_encoding = spotlight_get_utf16_string_encoding(tvb, offset + 8, query_length, encoding);
- mark_exists = (unicode_encoding & ENC_UTF_16);
- unicode_encoding &= ~ENC_UTF_16;
-
- proto_tree_add_text(tree, tvb, offset, query_length, "utf-16 string: '%s'",
- tvb_get_ephemeral_unicode_string(tvb, offset + (mark_exists ? 10 : 8),
- query_length - (mark_exists? 10 : 8), unicode_encoding));
- break;
- }
- case SQ_CPX_TYPE_FILEMETA:
- if (query_length <= 8) {
- /* item_query = */ proto_tree_add_text(tree, tvb, offset, query_length, "filemeta (empty)");
- } else {
- item_query = proto_tree_add_text(tree, tvb, offset, query_length, "filemeta");
- sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
- (void)dissect_spotlight(tvb, pinfo, sub_tree, offset + 8);
- }
- break;
- }
- count--;
- offset += query_length;
- break;
- case SQ_TYPE_CNIDS:
- if (query_length <= 8) {
- /* item_query = */ proto_tree_add_text(tree, tvb, offset, query_length, "CNID Array (empty)");
- } else {
- item_query = proto_tree_add_text(tree, tvb, offset, query_length, "CNID Array");
- sub_tree = proto_item_add_subtree(item_query, ett_afp_spotlight_query_line);
- spotlight_CNID_array(tvb, sub_tree, offset + 8, encoding);
- }
- count--;
- offset += query_length;
- break;
- case SQ_TYPE_DATE:
- if ((j = spotlight_date(tvb, pinfo, tree, offset, encoding)) == -1)
- return offset;
- count -= j;
- offset += query_length;
- break;
- default:
- proto_tree_add_text(tree, tvb, offset, query_length, "type: %s",
- spotlight_get_qtype_string(query_type));