1 files changed, 211 insertions, 133 deletions

diff --git a/src/cdf.c b/src/cdf.c
index d38e793612fc..accfb325b999 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.85 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.106 2017/04/30 17:05:02 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -80,6 +80,34 @@ static union {
 			    CDF_TOLE8(CAST(uint64_t, x))))
 #define CDF_GETUINT32(x, y)	cdf_getuint32(x, y)
 
+#define CDF_MALLOC(n) cdf_malloc(__FILE__, __LINE__, (n))
+#define CDF_REALLOC(p, n) cdf_realloc(__FILE__, __LINE__, (p), (n))
+#define CDF_CALLOC(n, u) cdf_calloc(__FILE__, __LINE__, (n), (u))
+
+
+static void *
+cdf_malloc(const char *file __attribute__((__unused__)),
+    size_t line __attribute__((__unused__)), size_t n)
+{
+	DPRINTF(("%s,%zu: %s %zu\n", file, line, __func__, n));
+	return malloc(n);
+}
+
+static void *
+cdf_realloc(const char *file __attribute__((__unused__)),
+    size_t line __attribute__((__unused__)), void *p, size_t n)
+{
+	DPRINTF(("%s,%zu: %s %zu\n", file, line, __func__, n));
+	return realloc(p, n);
+}
+
+static void *
+cdf_calloc(const char *file __attribute__((__unused__)),
+    size_t line __attribute__((__unused__)), size_t n, size_t u)
+{
+	DPRINTF(("%s,%zu: %s %zu %zu\n", file, line, __func__, n, u));
+	return calloc(n, u);
+}
 
 /*
  * swap a short
@@ -340,18 +368,18 @@ cdf_read_header(const cdf_info_t *info, cdf_header_t *h)
 	cdf_unpack_header(h, buf);
 	cdf_swap_header(h);
 	if (h->h_magic != CDF_MAGIC) {
-		DPRINTF(("Bad magic 0x%" INT64_T_FORMAT "x != 0x%"
+		DPRINTF(("Bad magic %#" INT64_T_FORMAT "x != %#"
 		    INT64_T_FORMAT "x\n",
 		    (unsigned long long)h->h_magic,
 		    (unsigned long long)CDF_MAGIC));
 		goto out;
 	}
 	if (h->h_sec_size_p2 > 20) {
-		DPRINTF(("Bad sector size 0x%u\n", h->h_sec_size_p2));
+		DPRINTF(("Bad sector size %hu\n", h->h_sec_size_p2));
 		goto out;
 	}
 	if (h->h_short_sec_size_p2 > 20) {
-		DPRINTF(("Bad short sector size 0x%u\n",
+		DPRINTF(("Bad short sector size %hu\n",
 		    h->h_short_sec_size_p2));
 		goto out;
 	}
@@ -408,7 +436,7 @@ cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
 		if (h->h_master_sat[i] == CDF_SECID_FREE)
 			break;
 
-#define CDF_SEC_LIMIT (UINT32_MAX / (4 * ss))
+#define CDF_SEC_LIMIT (UINT32_MAX / (8 * ss))
 	if ((nsatpersec > 0 &&
 	    h->h_num_sectors_in_master_sat > CDF_SEC_LIMIT / nsatpersec) ||
 	    i > CDF_SEC_LIMIT) {
@@ -421,7 +449,7 @@ cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
 	sat->sat_len = h->h_num_sectors_in_master_sat * nsatpersec + i;
 	DPRINTF(("sat_len = %" SIZE_T_FORMAT "u ss = %" SIZE_T_FORMAT "u\n",
 	    sat->sat_len, ss));
-	if ((sat->sat_tab = CAST(cdf_secid_t *, calloc(sat->sat_len, ss)))
+	if ((sat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(sat->sat_len, ss)))
 	    == NULL)
 		return -1;
 
@@ -435,7 +463,7 @@ cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
 		}
 	}
 
-	if ((msa = CAST(cdf_secid_t *, calloc(1, ss))) == NULL)
+	if ((msa = CAST(cdf_secid_t *, CDF_CALLOC(1, ss))) == NULL)
 		goto out1;
 
 	mid = h->h_secid_first_sector_in_master_sat;
@@ -527,13 +555,16 @@ cdf_read_long_sector_chain(const cdf_info_t *info, const cdf_header_t *h,
 	ssize_t nr;
 	scn->sst_tab = NULL;
 	scn->sst_len = cdf_count_chain(sat, sid, ss);
-	scn->sst_dirlen = len;
+	scn->sst_dirlen = MAX(h->h_min_size_standard_stream, len);
 	scn->sst_ss = ss;
 
+	if (sid == CDF_SECID_END_OF_CHAIN || len == 0)
+		return cdf_zero_stream(scn);
+
 	if (scn->sst_len == (size_t)-1)
 		goto out;
 
-	scn->sst_tab = calloc(scn->sst_len, ss);
+	scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
 	if (scn->sst_tab == NULL)
 		return cdf_zero_stream(scn);
 
@@ -579,7 +610,7 @@ cdf_read_short_sector_chain(const cdf_header_t *h,
 	if (scn->sst_len == (size_t)-1)
 		goto out;
 
-	scn->sst_tab = calloc(scn->sst_len, ss);
+	scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
 	if (scn->sst_tab == NULL)
 		return cdf_zero_stream(scn);
 
@@ -637,11 +668,11 @@ cdf_read_dir(const cdf_info_t *info, const cdf_header_t *h,
 
 	dir->dir_len = ns * nd;
 	dir->dir_tab = CAST(cdf_directory_t *,
-	    calloc(dir->dir_len, sizeof(dir->dir_tab[0])));
+	    CDF_CALLOC(dir->dir_len, sizeof(dir->dir_tab[0])));
 	if (dir->dir_tab == NULL)
 		return -1;
 
-	if ((buf = CAST(char *, malloc(ss))) == NULL) {
+	if ((buf = CAST(char *, CDF_MALLOC(ss))) == NULL) {
 		free(dir->dir_tab);
 		return -1;
 	}
@@ -687,7 +718,7 @@ cdf_read_ssat(const cdf_info_t *info, const cdf_header_t *h,
 	if (ssat->sat_len == (size_t)-1)
 		goto out;
 
-	ssat->sat_tab = CAST(cdf_secid_t *, calloc(ssat->sat_len, ss));
+	ssat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(ssat->sat_len, ss));
 	if (ssat->sat_tab == NULL)
 		goto out1;
 
@@ -808,13 +839,107 @@ cdf_find_stream(const cdf_dir_t *dir, const char *name, int type)
 		    == 0)
 			break;
 	if (i > 0)
-		return i;
+		return CAST(int, i);
 
 	DPRINTF(("Cannot find type %d `%s'\n", type, name));
 	errno = ESRCH;
 	return 0;
 }
 
+#define CDF_SHLEN_LIMIT (UINT32_MAX / 8)
+#define CDF_PROP_LIMIT (UINT32_MAX / (8 * sizeof(cdf_property_info_t)))
+
+static const void *
+cdf_offset(const void *p, size_t l)
+{
+	return CAST(const void *, CAST(const uint8_t *, p) + l);
+}
+
+static const uint8_t *
+cdf_get_property_info_pos(const cdf_stream_t *sst, const cdf_header_t *h, 
+    const uint8_t *p, const uint8_t *e, size_t i)
+{
+	size_t tail = (i << 1) + 1;
+	size_t ofs;
+	const uint8_t *q;
+
+	if (p >= e) {
+		DPRINTF(("Past end %p < %p\n", e, p));
+		return NULL;
+	}
+	if (cdf_check_stream_offset(sst, h, p, (tail + 1) * sizeof(uint32_t),
+	    __LINE__) == -1)
+		return NULL;
+	ofs = CDF_GETUINT32(p, tail);
+	q = CAST(const uint8_t *, cdf_offset(CAST(const void *, p), 
+	    ofs - 2 * sizeof(uint32_t)));
+
+	if (q < p) {
+		DPRINTF(("Wrapped around %p < %p\n", q, p));
+		return NULL;
+	}
+
+	if (q >= e) {
+		DPRINTF(("Ran off the end %p >= %p\n", q, e));
+		return NULL;
+	}
+	return q;
+}
+
+static cdf_property_info_t *
+cdf_grow_info(cdf_property_info_t **info, size_t *maxcount, size_t incr)
+{
+	cdf_property_info_t *inp;
+	size_t newcount = *maxcount + incr;
+
+	if (newcount > CDF_PROP_LIMIT) {
+		DPRINTF(("exceeded property limit %zu > %zu\n", 
+		    newcount, CDF_PROP_LIMIT));
+		goto out;
+	}
+	inp = CAST(cdf_property_info_t *,
+	    CDF_REALLOC(*info, newcount * sizeof(*inp)));
+	if (inp == NULL)
+		goto out;
+
+	*info = inp;
+	*maxcount = newcount;
+	return inp;
+out:
+	free(*info);
+	*maxcount = 0;
+	*info = NULL;
+	return NULL;
+}
+
+static int
+cdf_copy_info(cdf_property_info_t *inp, const void *p, const void *e,
+    size_t len)
+{
+	if (inp->pi_type & CDF_VECTOR)
+		return 0;
+
+	if ((size_t)(CAST(const char *, e) - CAST(const char *, p)) < len)
+		return 0;
+
+	(void)memcpy(&inp->pi_val, p, len);
+
+	switch (len) {
+	case 2:
+		inp->pi_u16 = CDF_TOLE2(inp->pi_u16);
+		break;
+	case 4:
+		inp->pi_u32 = CDF_TOLE4(inp->pi_u32);
+		break;
+	case 8:
+		inp->pi_u64 = CDF_TOLE8(inp->pi_u64);
+		break;
+	default:
+		abort();
+	}
+	return 1;
+}
+
 int
 cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
     uint32_t offs, cdf_property_info_t **info, size_t *count, size_t *maxcount)
@@ -822,92 +947,69 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	const cdf_section_header_t *shp;
 	cdf_section_header_t sh;
 	const uint8_t *p, *q, *e;
-	int16_t s16;
-	int32_t s32;
-	uint32_t u32;
-	int64_t s64;
-	uint64_t u64;
-	cdf_timestamp_t tp;
-	size_t i, o, o4, nelements, j;
+	size_t i, o4, nelements, j, slen, left;
 	cdf_property_info_t *inp;
 
 	if (offs > UINT32_MAX / 4) {
 		errno = EFTYPE;
 		goto out;
 	}
-	shp = CAST(const cdf_section_header_t *, (const void *)
-	    ((const char *)sst->sst_tab + offs));
+	shp = CAST(const cdf_section_header_t *,
+	    cdf_offset(sst->sst_tab, offs));
 	if (cdf_check_stream_offset(sst, h, shp, sizeof(*shp), __LINE__) == -1)
 		goto out;
 	sh.sh_len = CDF_TOLE4(shp->sh_len);
-#define CDF_SHLEN_LIMIT (UINT32_MAX / 8)
 	if (sh.sh_len > CDF_SHLEN_LIMIT) {
 		errno = EFTYPE;
 		goto out;
 	}
-	sh.sh_properties = CDF_TOLE4(shp->sh_properties);
-#define CDF_PROP_LIMIT (UINT32_MAX / (4 * sizeof(*inp)))
-	if (sh.sh_properties > CDF_PROP_LIMIT)
+
+	if (cdf_check_stream_offset(sst, h, shp, sh.sh_len, __LINE__) == -1)
 		goto out;
+
+	sh.sh_properties = CDF_TOLE4(shp->sh_properties);
 	DPRINTF(("section len: %u properties %u\n", sh.sh_len,
 	    sh.sh_properties));
-	if (*maxcount) {
-		if (*maxcount > CDF_PROP_LIMIT)
-			goto out;
-		*maxcount += sh.sh_properties;
-		inp = CAST(cdf_property_info_t *,
-		    realloc(*info, *maxcount * sizeof(*inp)));
-	} else {
-		*maxcount = sh.sh_properties;
-		inp = CAST(cdf_property_info_t *,
-		    malloc(*maxcount * sizeof(*inp)));
-	}
+	if (sh.sh_properties > CDF_PROP_LIMIT)
+		goto out;
+	inp = cdf_grow_info(info, maxcount, sh.sh_properties);
 	if (inp == NULL)
-		goto out1;
-	*info = inp;
+		goto out;
 	inp += *count;
 	*count += sh.sh_properties;
-	p = CAST(const uint8_t *, (const void *)
-	    ((const char *)(const void *)sst->sst_tab +
-	    offs + sizeof(sh)));
-	e = CAST(const uint8_t *, (const void *)
-	    (((const char *)(const void *)shp) + sh.sh_len));
-	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
+	p = CAST(const uint8_t *, cdf_offset(sst->sst_tab, offs + sizeof(sh)));
+	e = CAST(const uint8_t *, cdf_offset(shp, sh.sh_len));
+	if (p >= e || cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
+
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t tail = (i << 1) + 1;
-		size_t ofs;
-		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
-		    __LINE__) == -1)
-			goto out;
-		ofs = CDF_GETUINT32(p, tail);
-		q = (const uint8_t *)(const void *)
-		    ((const char *)(const void *)p + ofs
-		    - 2 * sizeof(uint32_t));
-		if (q < p) {
-			DPRINTF(("Wrapped around %p < %p\n", q, p));
+		if ((q = cdf_get_property_info_pos(sst, h, p, e, i)) == NULL)
 			goto out;
-		}
-		if (q > e) {
-			DPRINTF(("Ran of the end %p > %p\n", q, e));
+		inp[i].pi_id = CDF_GETUINT32(p, i << 1);
+		left = CAST(size_t, e - q);
+		if (left < sizeof(uint32_t)) {
+			DPRINTF(("short info (no type)_\n"));
 			goto out;
 		}
-		inp[i].pi_id = CDF_GETUINT32(p, i << 1);
 		inp[i].pi_type = CDF_GETUINT32(q, 0);
-		DPRINTF(("%" SIZE_T_FORMAT "u) id=%x type=%x offs=0x%tx,0x%x\n",
+		DPRINTF(("%" SIZE_T_FORMAT "u) id=%#x type=%#x offs=%#tx,%#x\n",
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
+			if (left < sizeof(uint32_t) * 2) {
+				DPRINTF(("missing CDF_VECTOR length\n"));
+				goto out;
+			}
 			nelements = CDF_GETUINT32(q, 1);
 			if (nelements == 0) {
 				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
 				goto out;
 			}
-			o = 2;
+			slen = 2;
 		} else {
 			nelements = 1;
-			o = 1;
+			slen = 1;
 		}
-		o4 = o * sizeof(uint32_t);
+		o4 = slen * sizeof(uint32_t);
 		if (inp[i].pi_type & (CDF_ARRAY|CDF_BYREF|CDF_RESERVED))
 			goto unknown;
 		switch (inp[i].pi_type & CDF_TYPEMASK) {
@@ -915,109 +1017,83 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		case CDF_EMPTY:
 			break;
 		case CDF_SIGNED16:
-			if (inp[i].pi_type & CDF_VECTOR)
+			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int16_t)))
 				goto unknown;
-			(void)memcpy(&s16, &q[o4], sizeof(s16));
-			inp[i].pi_s16 = CDF_TOLE2(s16);
 			break;
 		case CDF_SIGNED32:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&s32, &q[o4], sizeof(s32));
-			inp[i].pi_s32 = CDF_TOLE4((uint32_t)s32);
-			break;
 		case CDF_BOOL:
 		case CDF_UNSIGNED32:
-			if (inp[i].pi_type & CDF_VECTOR)
+		case CDF_FLOAT:
+			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int32_t)))
 				goto unknown;
-			(void)memcpy(&u32, &q[o4], sizeof(u32));
-			inp[i].pi_u32 = CDF_TOLE4(u32);
 			break;
 		case CDF_SIGNED64:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&s64, &q[o4], sizeof(s64));
-			inp[i].pi_s64 = CDF_TOLE8((uint64_t)s64);
-			break;
 		case CDF_UNSIGNED64:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&u64, &q[o4], sizeof(u64));
-			inp[i].pi_u64 = CDF_TOLE8((uint64_t)u64);
-			break;
-		case CDF_FLOAT:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&u32, &q[o4], sizeof(u32));
-			u32 = CDF_TOLE4(u32);
-			memcpy(&inp[i].pi_f, &u32, sizeof(inp[i].pi_f));
-			break;
 		case CDF_DOUBLE:
-			if (inp[i].pi_type & CDF_VECTOR)
+		case CDF_FILETIME:
+			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int64_t)))
 				goto unknown;
-			(void)memcpy(&u64, &q[o4], sizeof(u64));
-			u64 = CDF_TOLE8((uint64_t)u64);
-			memcpy(&inp[i].pi_d, &u64, sizeof(inp[i].pi_d));
 			break;
 		case CDF_LENGTH32_STRING:
 		case CDF_LENGTH32_WSTRING:
 			if (nelements > 1) {
 				size_t nelem = inp - *info;
-				if (*maxcount > CDF_PROP_LIMIT
-				    || nelements > CDF_PROP_LIMIT)
-					goto out;
-				*maxcount += nelements;
-				inp = CAST(cdf_property_info_t *,
-				    realloc(*info, *maxcount * sizeof(*inp)));
+				inp = cdf_grow_info(info, maxcount, nelements);
 				if (inp == NULL)
-					goto out1;
-				*info = inp;
-				inp = *info + nelem;
+					goto out;
+				inp += nelem;
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
-				uint32_t l = CDF_GETUINT32(q, o);
+				uint32_t l;
+
+				if (o4 + sizeof(uint32_t) > left)
+					goto out;
+
+				l = CDF_GETUINT32(q, slen);
+				o4 += sizeof(uint32_t);
+				if (o4 + l > left)
+					goto out;
+
 				inp[i].pi_str.s_len = l;
-				inp[i].pi_str.s_buf = (const char *)
-				    (const void *)(&q[o4 + sizeof(l)]);
-				DPRINTF(("l = %d, r = %" SIZE_T_FORMAT
-				    "u, s = %s\n", l,
-				    CDF_ROUND(l, sizeof(l)),
+				inp[i].pi_str.s_buf = CAST(const char *,
+				    CAST(const void *, &q[o4]));
+
+				DPRINTF(("o=%zu l=%d(%" SIZE_T_FORMAT
+				    "u), t=%zu s=%s\n", o4, l,
+				    CDF_ROUND(l, sizeof(l)), left,
 				    inp[i].pi_str.s_buf));
+
 				if (l & 1)
 					l++;
-				o += l >> 1;
-				if (q + o >= e)
-					goto out;
-				o4 = o * sizeof(uint32_t);
+
+				slen += l >> 1;
+				o4 = slen * sizeof(uint32_t);
 			}
 			i--;
 			break;
-		case CDF_FILETIME:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&tp, &q[o4], sizeof(tp));
-			inp[i].pi_tp = CDF_TOLE8((uint64_t)tp);
-			break;
 		case CDF_CLIPBOARD:
 			if (inp[i].pi_type & CDF_VECTOR)
 				goto unknown;
 			break;
 		default:
 		unknown:
-			DPRINTF(("Don't know how to deal with %x\n",
+			memset(&inp[i].pi_val, 0, sizeof(inp[i].pi_val));
+			DPRINTF(("Don't know how to deal with %#x\n",
 			    inp[i].pi_type));
 			break;
 		}
 	}
 	return 0;
 out:
-	errno = EFTYPE;
-out1:
 	free(*info);
+	*info = NULL;
+	*count = 0;
+	*maxcount = 0;
+	errno = EFTYPE;
 	return -1;
 }
 
@@ -1065,7 +1141,7 @@ cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
 {
 	size_t ss = cdf_check_stream(sst, h);
 	const char *b = CAST(const char *, sst->sst_tab);
-	const char *eb = b + ss * sst->sst_len;
+	const char *nb, *eb = b + ss * sst->sst_len;
 	size_t nr, i, j, k;
 	cdf_catalog_entry_t *ce;
 	uint16_t reclen;
@@ -1084,7 +1160,7 @@ cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
 		return -1;
 	nr--;
 	*cat = CAST(cdf_catalog_t *,
-	    malloc(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
+	    CDF_MALLOC(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
 	if (*cat == NULL)
 		return -1;
 	ce = (*cat)->cat_e;
@@ -1110,7 +1186,9 @@ cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
 			cep->ce_namlen = rlen;
 
 		np = CAST(const uint16_t *, CAST(const void *, (b + 16)));
-		if (RCAST(const char *, np + cep->ce_namlen) > eb) {
+		nb = CAST(const char *, CAST(const void *,
+		    (np + cep->ce_namlen)));
+		if (nb > eb) {
 			cep->ce_namlen = 0;
 			break;
 		}
@@ -1169,7 +1247,7 @@ cdf_print_property_name(char *buf, size_t bufsiz, uint32_t p)
 	for (i = 0; i < __arraycount(vn); i++)
 		if (vn[i].v == p)
 			return snprintf(buf, bufsiz, "%s", vn[i].n);
-	return snprintf(buf, bufsiz, "0x%x", p);
+	return snprintf(buf, bufsiz, "%#x", p);
 }
 
 int
@@ -1228,7 +1306,7 @@ cdf_dump_header(const cdf_header_t *h)
     h->h_ ## b, 1 << h->h_ ## b)
 	DUMP("%d", revision);
 	DUMP("%d", version);
-	DUMP("0x%x", byte_order);
+	DUMP("%#x", byte_order);
 	DUMP2("%d", sec_size_p2);
 	DUMP2("%d", short_sec_size_p2);
 	DUMP("%d", num_sectors_in_sat);
@@ -1322,7 +1400,7 @@ cdf_dump_dir(const cdf_info_t *info, const cdf_header_t *h,
 		    d->d_color ? "black" : "red");
 		(void)fprintf(stderr, "Left child: %d\n", d->d_left_child);
 		(void)fprintf(stderr, "Right child: %d\n", d->d_right_child);
-		(void)fprintf(stderr, "Flags: 0x%x\n", d->d_flags);
+		(void)fprintf(stderr, "Flags: %#x\n", d->d_flags);
 		cdf_timestamp_to_timespec(&ts, d->d_created);
 		(void)fprintf(stderr, "Created %s", cdf_ctime(&ts.tv_sec, buf));
 		cdf_timestamp_to_timespec(&ts, d->d_modified);
@@ -1415,7 +1493,7 @@ cdf_dump_property_info(const cdf_property_info_t *info, size_t count)
 			(void)fprintf(stderr, "CLIPBOARD %u\n", info[i].pi_u32);
 			break;
 		default:
-			DPRINTF(("Don't know how to deal with %x\n",
+			DPRINTF(("Don't know how to deal with %#x\n",
 			    info[i].pi_type));
 			break;
 		}
@@ -1434,7 +1512,7 @@ cdf_dump_summary_info(const cdf_header_t *h, const cdf_stream_t *sst)
 	(void)&h;
 	if (cdf_unpack_summary_info(sst, h, &ssi, &info, &count) == -1)
 		return;
-	(void)fprintf(stderr, "Endian: %x\n", ssi.si_byte_order);
+	(void)fprintf(stderr, "Endian: %#x\n", ssi.si_byte_order);
 	(void)fprintf(stderr, "Os Version %d.%d\n", ssi.si_os_version & 0xff,
 	    ssi.si_os_version >> 8);
 	(void)fprintf(stderr, "Os %d\n", ssi.si_os);