Skip to main content

apply_value_transform

Function apply_value_transform 

Source
pub fn apply_value_transform(
    value: &Value,
    transform: ValueTransform,
) -> Result<Value, EvaluationError>
Expand description

Apply a magic-file pre-comparison ValueTransform to a numeric value read from the file. The result is what the rule’s comparison operator sees, and what printf-style format specifiers (%d, %x, …) render into the message.

Magic file usage examples:

  • lelong+1 x volume %d – read a long, add 1, format as %d
  • ulequad/1073741824 x size %lluGB – read a quad, divide by 1 GiB

§Numeric promotion

Both Value::Uint and Value::Int operands are supported. The transform is computed in the value’s existing type:

  • Uint op i64 -> the i64 operand is reinterpreted bitwise as u64 for Mul/Or/Xor and as i64 for the others (matching libmagic’s apprentice.c::mconvert, which treats the operand as a raw machine word for bitwise ops and a signed integer for arithmetic). Sub on a Uint is rejected if it would underflow; Add clamps a negative operand to subtraction.
  • Int uses signed arithmetic throughout.

Float, String, and Bytes values are left unchanged because magic-file arithmetic transforms are only meaningful on integer reads. Returning the value unchanged keeps the comparison flow well-defined while preserving the GOTCHAS S2.3 catch-all discipline for unknown Value variants.

§Errors

Returns EvaluationError::InvalidValueTransform when:

  • Div or Mod is applied with a zero operand;
  • any arithmetic op overflows the natural integer range.