Coverage Report

Created: 2025-06-13 07:22

/src/libesedb/libesedb/libesedb_record.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Record (row) functions
3
 *
4
 * Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
5
 *
6
 * Refer to AUTHORS for acknowledgements.
7
 *
8
 * This program is free software: you can redistribute it and/or modify
9
 * it under the terms of the GNU Lesser General Public License as published by
10
 * the Free Software Foundation, either version 3 of the License, or
11
 * (at your option) any later version.
12
 *
13
 * This program is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16
 * GNU General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU Lesser General Public License
19
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
20
 */
21
22
#include <common.h>
23
#include <memory.h>
24
#include <types.h>
25
26
#include "libesedb_compression.h"
27
#include "libesedb_data_definition.h"
28
#include "libesedb_data_segment.h"
29
#include "libesedb_definitions.h"
30
#include "libesedb_io_handle.h"
31
#include "libesedb_libbfio.h"
32
#include "libesedb_libcdata.h"
33
#include "libesedb_libcerror.h"
34
#include "libesedb_libcnotify.h"
35
#include "libesedb_libfcache.h"
36
#include "libesedb_libfdata.h"
37
#include "libesedb_libfvalue.h"
38
#include "libesedb_long_value.h"
39
#include "libesedb_multi_value.h"
40
#include "libesedb_page_tree.h"
41
#include "libesedb_page_tree_key.h"
42
#include "libesedb_record.h"
43
#include "libesedb_record_value.h"
44
#include "libesedb_table_definition.h"
45
#include "libesedb_types.h"
46
47
/* Creates a record
48
 * Make sure the value record is referencing, is set to NULL
49
 * Returns 1 if successful or -1 on error
50
 */
51
int libesedb_record_initialize(
52
     libesedb_record_t **record,
53
     libbfio_handle_t *file_io_handle,
54
     libesedb_io_handle_t *io_handle,
55
     libesedb_table_definition_t *table_definition,
56
     libesedb_table_definition_t *template_table_definition,
57
     libfdata_vector_t *pages_vector,
58
     libfcache_cache_t *pages_cache,
59
     libfdata_vector_t *long_values_pages_vector,
60
     libfcache_cache_t *long_values_pages_cache,
61
     libesedb_data_definition_t *data_definition,
62
     libesedb_page_tree_t *long_values_page_tree,
63
     libcerror_error_t **error )
64
338
{
65
338
  libesedb_internal_record_t *internal_record = NULL;
66
338
  static char *function                       = "libesedb_record_initialize";
67
68
338
  if( record == NULL )
69
0
  {
70
0
    libcerror_error_set(
71
0
     error,
72
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
73
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
74
0
     "%s: invalid record.",
75
0
     function );
76
77
0
    return( -1 );
78
0
  }
79
338
  if( *record != NULL )
80
0
  {
81
0
    libcerror_error_set(
82
0
     error,
83
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
84
0
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
85
0
     "%s: invalid record value already set.",
86
0
     function );
87
88
0
    return( -1 );
89
0
  }
90
338
  if( table_definition == NULL )
91
0
  {
92
0
    libcerror_error_set(
93
0
     error,
94
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
95
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
96
0
     "%s: invalid table definition.",
97
0
     function );
98
99
0
    return( -1 );
100
0
  }
101
338
  if( table_definition->table_catalog_definition == NULL )
102
0
  {
103
0
    libcerror_error_set(
104
0
     error,
105
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
106
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
107
0
     "%s: invalid table definition - missing table catalog definition.",
108
0
     function );
109
110
0
    return( -1 );
111
0
  }
112
338
  internal_record = memory_allocate_structure(
113
338
                     libesedb_internal_record_t );
114
115
338
  if( internal_record == NULL )
116
0
  {
117
0
    libcerror_error_set(
118
0
     error,
119
0
     LIBCERROR_ERROR_DOMAIN_MEMORY,
120
0
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
121
0
     "%s: unable to create record.",
122
0
     function );
123
124
0
    goto on_error;
125
0
  }
126
338
  if( memory_set(
127
338
       internal_record,
128
338
       0,
129
338
       sizeof( libesedb_internal_record_t ) ) == NULL )
130
0
  {
131
0
    libcerror_error_set(
132
0
     error,
133
0
     LIBCERROR_ERROR_DOMAIN_MEMORY,
134
0
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
135
0
     "%s: unable to clear record.",
136
0
     function );
137
138
0
    memory_free(
139
0
     internal_record );
140
141
0
    return( -1 );
142
0
  }
143
338
  if( libcdata_array_initialize(
144
338
       &( internal_record->values_array ),
145
338
       0,
146
338
       error ) != 1 )
147
0
  {
148
0
    libcerror_error_set(
149
0
     error,
150
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
151
0
     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
152
0
     "%s: unable to create values array.",
153
0
     function );
154
155
0
    goto on_error;
156
0
  }
157
338
  if( libesedb_data_definition_read_record(
158
338
       data_definition,
159
338
       file_io_handle,
160
338
       io_handle,
161
338
       pages_vector,
162
338
       pages_cache,
163
338
       table_definition,
164
338
       template_table_definition,
165
338
       internal_record->values_array,
166
338
       &( internal_record->flags ),
167
338
       error ) != 1 )
168
178
  {
169
178
    libcerror_error_set(
170
178
     error,
171
178
     LIBCERROR_ERROR_DOMAIN_IO,
172
178
     LIBCERROR_IO_ERROR_READ_FAILED,
173
178
     "%s: unable to read data definition record.",
174
178
     function );
175
176
178
    goto on_error;
177
178
  }
178
160
  internal_record->file_io_handle            = file_io_handle;
179
160
  internal_record->io_handle                 = io_handle;
180
160
  internal_record->table_definition          = table_definition;
181
160
  internal_record->template_table_definition = template_table_definition;
182
160
  internal_record->pages_vector              = pages_vector;
183
160
  internal_record->pages_cache               = pages_cache;
184
160
  internal_record->long_values_pages_vector  = long_values_pages_vector;
185
160
  internal_record->long_values_pages_cache   = long_values_pages_cache;
186
160
  internal_record->data_definition           = data_definition;
187
160
  internal_record->long_values_page_tree     = long_values_page_tree;
188
189
160
  *record = (libesedb_record_t *) internal_record;
190
191
160
  return( 1 );
192
193
178
on_error:
194
178
  if( internal_record != NULL )
195
178
  {
196
178
    if( internal_record->values_array != NULL )
197
178
    {
198
      /* Note that if libesedb_data_definition_read_record fails values_array
199
       * can contain values that need to be freed with libfvalue_value_free.
200
       */
201
178
      libcdata_array_free(
202
178
       &( internal_record->values_array ),
203
178
       (int (*)(intptr_t **, libcerror_error_t **)) &libfvalue_value_free,
204
178
       NULL );
205
178
    }
206
178
    memory_free(
207
178
     internal_record );
208
178
  }
209
178
  return( -1 );
210
338
}
211
212
/* Frees a record
213
 * Returns 1 if successful or -1 on error
214
 */
215
int libesedb_record_free(
216
     libesedb_record_t **record,
217
     libcerror_error_t **error )
218
160
{
219
160
  libesedb_internal_record_t *internal_record = NULL;
220
160
  static char *function                       = "libesedb_record_free";
221
160
  int result                                  = 1;
222
223
160
  if( record == NULL )
224
0
  {
225
0
    libcerror_error_set(
226
0
     error,
227
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
228
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
229
0
     "%s: invalid record.",
230
0
     function );
231
232
0
    return( -1 );
233
0
  }
234
160
  if( *record != NULL )
235
160
  {
236
160
    internal_record = (libesedb_internal_record_t *) *record;
237
160
    *record         = NULL;
238
239
    /* The io_handle, file_io_handle, table_definition, template_table_definition, pages_vector,
240
     * pages_cache, * long_values_pages_vector, long_values_pages_cache and long_values_page_tree
241
     * references are freed elsewhere
242
     */
243
160
    if( internal_record->data_definition != NULL )
244
160
    {
245
160
      if( libesedb_data_definition_free(
246
160
           &( internal_record->data_definition ),
247
160
           error ) != 1 )
248
0
      {
249
0
        libcerror_error_set(
250
0
         error,
251
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
252
0
         LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
253
0
         "%s: unable to free data definition.",
254
0
         function );
255
256
0
        result = -1;
257
0
      }
258
160
    }
259
160
    if( libcdata_array_free(
260
160
         &( internal_record->values_array ),
261
160
         (int (*)(intptr_t **, libcerror_error_t **)) &libfvalue_value_free,
262
160
         error ) != 1 )
263
0
    {
264
0
      libcerror_error_set(
265
0
       error,
266
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
267
0
       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
268
0
       "%s: unable to free values array.",
269
0
       function );
270
271
0
      result = -1;
272
0
    }
273
160
    memory_free(
274
160
     internal_record );
275
160
  }
276
160
  return( result );
277
160
}
278
279
/* Retrieves the number of values in the record
280
 * Returns 1 if successful or -1 on error
281
 */
282
int libesedb_record_get_number_of_values(
283
     libesedb_record_t *record,
284
     int *number_of_values,
285
     libcerror_error_t **error )
286
0
{
287
0
  libesedb_internal_record_t *internal_record = NULL;
288
0
  static char *function                       = "libesedb_record_get_number_of_values";
289
290
0
  if( record == NULL )
291
0
  {
292
0
    libcerror_error_set(
293
0
     error,
294
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
295
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
296
0
     "%s: invalid record.",
297
0
     function );
298
299
0
    return( -1 );
300
0
  }
301
0
  internal_record = (libesedb_internal_record_t *) record;
302
303
0
  if( libcdata_array_get_number_of_entries(
304
0
       internal_record->values_array,
305
0
       number_of_values,
306
0
       error ) != 1 )
307
0
  {
308
0
    libcerror_error_set(
309
0
     error,
310
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
311
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
312
0
     "%s: unable to retrieve number of entries from values array.",
313
0
     function );
314
315
0
    return( -1 );
316
0
  }
317
0
  return( 1 );
318
0
}
319
320
/* Retrieves a specific column catalog definition
321
 * Returns 1 if successful or -1 on error
322
 */
323
int libesedb_record_get_column_catalog_definition(
324
     libesedb_internal_record_t *internal_record,
325
     int value_entry,
326
     libesedb_catalog_definition_t **column_catalog_definition,
327
     libcerror_error_t **error )
328
0
{
329
0
  static char *function                = "libesedb_record_get_column_identifier";
330
0
  int template_table_number_of_columns = 0;
331
332
0
  if( internal_record == NULL )
333
0
  {
334
0
    libcerror_error_set(
335
0
     error,
336
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
337
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
338
0
     "%s: invalid record.",
339
0
     function );
340
341
0
    return( -1 );
342
0
  }
343
0
  if( internal_record->table_definition == NULL )
344
0
  {
345
0
    libcerror_error_set(
346
0
     error,
347
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
348
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
349
0
     "%s: invalid record - missing table definition.",
350
0
     function );
351
352
0
    return( -1 );
353
0
  }
354
0
  if( internal_record->template_table_definition != NULL )
355
0
  {
356
0
    if( libesedb_table_definition_get_number_of_column_catalog_definitions(
357
0
         internal_record->template_table_definition,
358
0
         &template_table_number_of_columns,
359
0
         error ) != 1 )
360
0
    {
361
0
      libcerror_error_set(
362
0
       error,
363
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
364
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
365
0
       "%s: unable to retrieve number of columns from template table.",
366
0
       function );
367
368
0
      return( -1 );
369
0
    }
370
0
  }
371
0
  if( value_entry < template_table_number_of_columns )
372
0
  {
373
0
    if( libesedb_table_definition_get_column_catalog_definition_by_index(
374
0
         internal_record->template_table_definition,
375
0
         value_entry,
376
0
         column_catalog_definition,
377
0
         error ) != 1 )
378
0
    {
379
0
      libcerror_error_set(
380
0
       error,
381
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
382
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
383
0
       "%s: unable to retrieve column catalog definition from template table.",
384
0
       function );
385
386
0
      return( -1 );
387
0
    }
388
0
  }
389
0
  else
390
0
  {
391
0
    if( libesedb_table_definition_get_column_catalog_definition_by_index(
392
0
         internal_record->table_definition,
393
0
         value_entry - template_table_number_of_columns,
394
0
         column_catalog_definition,
395
0
         error ) != 1 )
396
0
    {
397
0
      libcerror_error_set(
398
0
       error,
399
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
400
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
401
0
       "%s: unable to retrieve column catalog definition from table.",
402
0
       function );
403
404
0
      return( -1 );
405
0
    }
406
0
  }
407
0
  return( 1 );
408
0
}
409
410
/* Retrieves the column identifier of the specific entry
411
 * Returns 1 if successful or -1 on error
412
 */
413
int libesedb_record_get_column_identifier(
414
     libesedb_record_t *record,
415
     int value_entry,
416
     uint32_t *column_identifier,
417
     libcerror_error_t **error )
418
0
{
419
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
420
0
  libesedb_internal_record_t *internal_record              = NULL;
421
0
  static char *function                                    = "libesedb_record_get_column_identifier";
422
423
0
  if( record == NULL )
424
0
  {
425
0
    libcerror_error_set(
426
0
     error,
427
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
428
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
429
0
     "%s: invalid record.",
430
0
     function );
431
432
0
    return( -1 );
433
0
  }
434
0
  internal_record = (libesedb_internal_record_t *) record;
435
436
0
  if( libesedb_record_get_column_catalog_definition(
437
0
       internal_record,
438
0
       value_entry,
439
0
       &column_catalog_definition,
440
0
       error ) != 1 )
441
0
  {
442
0
    libcerror_error_set(
443
0
     error,
444
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
445
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
446
0
     "%s: unable to retrieve column catalog definition.",
447
0
     function );
448
449
0
    return( -1 );
450
0
  }
451
0
  if( libesedb_catalog_definition_get_identifier(
452
0
       column_catalog_definition,
453
0
       column_identifier,
454
0
       error ) != 1 )
455
0
  {
456
0
    libcerror_error_set(
457
0
     error,
458
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
459
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
460
0
     "%s: unable to retrieve catalog definition identifier.",
461
0
     function );
462
463
0
    return( -1 );
464
0
  }
465
0
  return( 1 );
466
0
}
467
468
/* Retrieves the column type of the specific entry
469
 * Returns 1 if successful or -1 on error
470
 */
471
int libesedb_record_get_column_type(
472
     libesedb_record_t *record,
473
     int value_entry,
474
     uint32_t *column_type,
475
     libcerror_error_t **error )
476
0
{
477
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
478
0
  libesedb_internal_record_t *internal_record              = NULL;
479
0
  static char *function                                    = "libesedb_record_get_column_type";
480
481
0
  if( record == NULL )
482
0
  {
483
0
    libcerror_error_set(
484
0
     error,
485
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
486
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
487
0
     "%s: invalid record.",
488
0
     function );
489
490
0
    return( -1 );
491
0
  }
492
0
  internal_record = (libesedb_internal_record_t *) record;
493
494
0
  if( libesedb_record_get_column_catalog_definition(
495
0
       internal_record,
496
0
       value_entry,
497
0
       &column_catalog_definition,
498
0
       error ) != 1 )
499
0
  {
500
0
    libcerror_error_set(
501
0
     error,
502
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
503
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
504
0
     "%s: unable to retrieve column catalog definition.",
505
0
     function );
506
507
0
    return( -1 );
508
0
  }
509
0
  if( libesedb_catalog_definition_get_column_type(
510
0
       column_catalog_definition,
511
0
       column_type,
512
0
       error ) != 1 )
513
0
  {
514
0
    libcerror_error_set(
515
0
     error,
516
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
517
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
518
0
     "%s: unable to retrieve catalog definition column type.",
519
0
     function );
520
521
0
    return( -1 );
522
0
  }
523
0
  return( 1 );
524
0
}
525
526
/* Retrieves the size of the UTF-8 encoded string of the column name of the specific entry
527
 * The returned size includes the end of string character
528
 * Returns 1 if successful or -1 on error
529
 */
530
int libesedb_record_get_utf8_column_name_size(
531
     libesedb_record_t *record,
532
     int value_entry,
533
     size_t *utf8_string_size,
534
     libcerror_error_t **error )
535
0
{
536
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
537
0
  libesedb_internal_record_t *internal_record              = NULL;
538
0
  static char *function                                    = "libesedb_record_get_utf8_column_name_size";
539
540
0
  if( record == NULL )
541
0
  {
542
0
    libcerror_error_set(
543
0
     error,
544
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
545
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
546
0
     "%s: invalid record.",
547
0
     function );
548
549
0
    return( -1 );
550
0
  }
551
0
  internal_record = (libesedb_internal_record_t *) record;
552
553
0
  if( internal_record->io_handle == NULL )
554
0
  {
555
0
    libcerror_error_set(
556
0
     error,
557
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
558
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
559
0
     "%s: invalid record - missing IO handle.",
560
0
     function );
561
562
0
    return( -1 );
563
0
  }
564
0
  if( libesedb_record_get_column_catalog_definition(
565
0
       internal_record,
566
0
       value_entry,
567
0
       &column_catalog_definition,
568
0
       error ) != 1 )
569
0
  {
570
0
    libcerror_error_set(
571
0
     error,
572
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
573
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
574
0
     "%s: unable to retrieve column catalog definition.",
575
0
     function );
576
577
0
    return( -1 );
578
0
  }
579
0
  if( libesedb_catalog_definition_get_utf8_name_size(
580
0
       column_catalog_definition,
581
0
       utf8_string_size,
582
0
       internal_record->io_handle->ascii_codepage,
583
0
       error ) != 1 )
584
0
  {
585
0
    libcerror_error_set(
586
0
     error,
587
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
588
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
589
0
     "%s: unable to retrieve UTF-8 string size.",
590
0
     function );
591
592
0
    return( -1 );
593
0
  }
594
0
  return( 1 );
595
0
}
596
597
/* Retrieves the UTF-8 encoded string of the column name of the specific entry
598
 * The size should include the end of string character
599
 * Returns 1 if successful or -1 on error
600
 */
601
int libesedb_record_get_utf8_column_name(
602
     libesedb_record_t *record,
603
     int value_entry,
604
     uint8_t *utf8_string,
605
     size_t utf8_string_size,
606
     libcerror_error_t **error )
607
0
{
608
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
609
0
  libesedb_internal_record_t *internal_record              = NULL;
610
0
  static char *function                                    = "libesedb_record_get_utf8_column_name";
611
612
0
  if( record == NULL )
613
0
  {
614
0
    libcerror_error_set(
615
0
     error,
616
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
617
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
618
0
     "%s: invalid record.",
619
0
     function );
620
621
0
    return( -1 );
622
0
  }
623
0
  internal_record = (libesedb_internal_record_t *) record;
624
625
0
  if( internal_record->io_handle == NULL )
626
0
  {
627
0
    libcerror_error_set(
628
0
     error,
629
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
630
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
631
0
     "%s: invalid record - missing IO handle.",
632
0
     function );
633
634
0
    return( -1 );
635
0
  }
636
0
  if( libesedb_record_get_column_catalog_definition(
637
0
       internal_record,
638
0
       value_entry,
639
0
       &column_catalog_definition,
640
0
       error ) != 1 )
641
0
  {
642
0
    libcerror_error_set(
643
0
     error,
644
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
645
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
646
0
     "%s: unable to retrieve column catalog definition.",
647
0
     function );
648
649
0
    return( -1 );
650
0
  }
651
0
  if( libesedb_catalog_definition_get_utf8_name(
652
0
       column_catalog_definition,
653
0
       utf8_string,
654
0
       utf8_string_size,
655
0
       internal_record->io_handle->ascii_codepage,
656
0
       error ) != 1 )
657
0
  {
658
0
    libcerror_error_set(
659
0
     error,
660
0
     LIBCERROR_ERROR_DOMAIN_CONVERSION,
661
0
     LIBCERROR_CONVERSION_ERROR_GENERIC,
662
0
     "%s: unable to retrieve UTF-8 string.",
663
0
     function );
664
665
0
    return( -1 );
666
0
  }
667
0
  return( 1 );
668
0
}
669
670
/* Retrieves the size of the UTF-16 encoded string of the column name of the specific entry
671
 * The returned size includes the end of string character
672
 * Returns 1 if successful or -1 on error
673
 */
674
int libesedb_record_get_utf16_column_name_size(
675
     libesedb_record_t *record,
676
     int value_entry,
677
     size_t *utf16_string_size,
678
     libcerror_error_t **error )
679
0
{
680
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
681
0
  libesedb_internal_record_t *internal_record              = NULL;
682
0
  static char *function                                    = "libesedb_record_get_utf16_column_name_size";
683
684
0
  if( record == NULL )
685
0
  {
686
0
    libcerror_error_set(
687
0
     error,
688
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
689
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
690
0
     "%s: invalid record.",
691
0
     function );
692
693
0
    return( -1 );
694
0
  }
695
0
  internal_record = (libesedb_internal_record_t *) record;
696
697
0
  if( internal_record->io_handle == NULL )
698
0
  {
699
0
    libcerror_error_set(
700
0
     error,
701
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
702
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
703
0
     "%s: invalid record - missing IO handle.",
704
0
     function );
705
706
0
    return( -1 );
707
0
  }
708
0
  if( libesedb_record_get_column_catalog_definition(
709
0
       internal_record,
710
0
       value_entry,
711
0
       &column_catalog_definition,
712
0
       error ) != 1 )
713
0
  {
714
0
    libcerror_error_set(
715
0
     error,
716
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
717
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
718
0
     "%s: unable to retrieve column catalog definition.",
719
0
     function );
720
721
0
    return( -1 );
722
0
  }
723
0
  if( libesedb_catalog_definition_get_utf16_name_size(
724
0
       column_catalog_definition,
725
0
       utf16_string_size,
726
0
       internal_record->io_handle->ascii_codepage,
727
0
       error ) != 1 )
728
0
  {
729
0
    libcerror_error_set(
730
0
     error,
731
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
732
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
733
0
     "%s: unable to retrieve UTF-16 string size.",
734
0
     function );
735
736
0
    return( -1 );
737
0
  }
738
0
  return( 1 );
739
0
}
740
741
/* Retrieves the UTF-16 encoded string of the column name of the specific entry
742
 * The size should include the end of string character
743
 * Returns 1 if successful or -1 on error
744
 */
745
int libesedb_record_get_utf16_column_name(
746
     libesedb_record_t *record,
747
     int value_entry,
748
     uint16_t *utf16_string,
749
     size_t utf16_string_size,
750
     libcerror_error_t **error )
751
0
{
752
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
753
0
  libesedb_internal_record_t *internal_record              = NULL;
754
0
  static char *function                                    = "libesedb_record_get_utf16_column_name";
755
756
0
  if( record == NULL )
757
0
  {
758
0
    libcerror_error_set(
759
0
     error,
760
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
761
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
762
0
     "%s: invalid record.",
763
0
     function );
764
765
0
    return( -1 );
766
0
  }
767
0
  internal_record = (libesedb_internal_record_t *) record;
768
769
0
  if( internal_record->io_handle == NULL )
770
0
  {
771
0
    libcerror_error_set(
772
0
     error,
773
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
774
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
775
0
     "%s: invalid record - missing IO handle.",
776
0
     function );
777
778
0
    return( -1 );
779
0
  }
780
0
  if( libesedb_record_get_column_catalog_definition(
781
0
       internal_record,
782
0
       value_entry,
783
0
       &column_catalog_definition,
784
0
       error ) != 1 )
785
0
  {
786
0
    libcerror_error_set(
787
0
     error,
788
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
789
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
790
0
     "%s: unable to retrieve column catalog definition.",
791
0
     function );
792
793
0
    return( -1 );
794
0
  }
795
0
  if( libesedb_catalog_definition_get_utf16_name(
796
0
       column_catalog_definition,
797
0
       utf16_string,
798
0
       utf16_string_size,
799
0
       internal_record->io_handle->ascii_codepage,
800
0
       error ) != 1 )
801
0
  {
802
0
    libcerror_error_set(
803
0
     error,
804
0
     LIBCERROR_ERROR_DOMAIN_CONVERSION,
805
0
     LIBCERROR_CONVERSION_ERROR_GENERIC,
806
0
     "%s: unable to retrieve UTF-16 string.",
807
0
     function );
808
809
0
    return( -1 );
810
0
  }
811
0
  return( 1 );
812
0
}
813
814
/* Retrieves the value of the specific entry
815
 * Returns 1 if successful or -1 on error
816
 */
817
int libesedb_record_get_value(
818
     libesedb_record_t *record,
819
     int value_entry,
820
     uint8_t **value_data,
821
     size_t *value_data_size,
822
     uint8_t *value_flags,
823
     libcerror_error_t **error )
824
0
{
825
0
  libesedb_internal_record_t *internal_record = NULL;
826
0
  libfvalue_value_t *record_value             = NULL;
827
0
  static char *function                       = "libesedb_record_get_value";
828
0
  uint32_t data_flags                         = 0;
829
0
  int encoding                                = 0;
830
831
0
  if( record == NULL )
832
0
  {
833
0
    libcerror_error_set(
834
0
     error,
835
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
836
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
837
0
     "%s: invalid record.",
838
0
     function );
839
840
0
    return( -1 );
841
0
  }
842
0
  internal_record = (libesedb_internal_record_t *) record;
843
844
0
  if( value_flags == NULL )
845
0
  {
846
0
    libcerror_error_set(
847
0
     error,
848
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
849
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
850
0
     "%s: invalid value flags.",
851
0
     function );
852
853
0
    return( -1 );
854
0
  }
855
0
  if( libcdata_array_get_entry_by_index(
856
0
       internal_record->values_array,
857
0
       value_entry,
858
0
       (intptr_t **) &record_value,
859
0
       error ) != 1 )
860
0
  {
861
0
    libcerror_error_set(
862
0
     error,
863
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
864
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
865
0
     "%s: unable to retrieve value: %d from values array.",
866
0
     function,
867
0
     value_entry );
868
869
0
    return( -1 );
870
0
  }
871
0
  if( libfvalue_value_get_data(
872
0
       record_value,
873
0
       value_data,
874
0
       value_data_size,
875
0
       &encoding,
876
0
       error ) != 1 )
877
0
  {
878
0
    libcerror_error_set(
879
0
     error,
880
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
881
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
882
0
     "%s: unable to retrieve value: %d data.",
883
0
     function,
884
0
     value_entry );
885
886
0
    return( -1 );
887
0
  }
888
0
  if( libfvalue_value_get_data_flags(
889
0
       record_value,
890
0
       &data_flags,
891
0
       error ) != 1 )
892
0
  {
893
0
    libcerror_error_set(
894
0
     error,
895
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
896
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
897
0
     "%s: unable to retrieve value: %d data flags.",
898
0
     function,
899
0
     value_entry );
900
901
0
    return( -1 );
902
0
  }
903
0
  *value_flags = (uint8_t) data_flags;
904
905
0
  return( 1 );
906
0
}
907
908
/* Retrieves the value data flags of the specific entry
909
 * Returns 1 if successful or -1 on error
910
 */
911
int libesedb_record_get_value_data_flags(
912
     libesedb_record_t *record,
913
     int value_entry,
914
     uint8_t *value_data_flags,
915
     libcerror_error_t **error )
916
0
{
917
0
  libesedb_internal_record_t *internal_record = NULL;
918
0
  libfvalue_value_t *record_value             = NULL;
919
0
  static char *function                       = "libesedb_record_get_value_data_flags";
920
0
  uint32_t data_flags                         = 0;
921
922
0
  if( record == NULL )
923
0
  {
924
0
    libcerror_error_set(
925
0
     error,
926
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
927
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
928
0
     "%s: invalid record.",
929
0
     function );
930
931
0
    return( -1 );
932
0
  }
933
0
  internal_record = (libesedb_internal_record_t *) record;
934
935
0
  if( value_data_flags == NULL )
936
0
  {
937
0
    libcerror_error_set(
938
0
     error,
939
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
940
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
941
0
     "%s: invalid value data flags.",
942
0
     function );
943
944
0
    return( -1 );
945
0
  }
946
0
  if( libcdata_array_get_entry_by_index(
947
0
       internal_record->values_array,
948
0
       value_entry,
949
0
       (intptr_t **) &record_value,
950
0
       error ) != 1 )
951
0
  {
952
0
    libcerror_error_set(
953
0
     error,
954
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
955
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
956
0
     "%s: unable to retrieve value: %d from values array.",
957
0
     function,
958
0
     value_entry );
959
960
0
    return( -1 );
961
0
  }
962
0
  if( libfvalue_value_get_data_flags(
963
0
       record_value,
964
0
       &data_flags,
965
0
       error ) != 1 )
966
0
  {
967
0
    libcerror_error_set(
968
0
     error,
969
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
970
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
971
0
     "%s: unable to retrieve value: %d data flags.",
972
0
     function,
973
0
     value_entry );
974
975
0
    return( -1 );
976
0
  }
977
0
  *value_data_flags = (uint8_t) data_flags;
978
979
0
  return( 1 );
980
0
}
981
982
/* Retrieves the value data size of the specific entry
983
 * Returns 1 if successful or -1 on error
984
 */
985
int libesedb_record_get_value_data_size(
986
     libesedb_record_t *record,
987
     int value_entry,
988
     size_t *value_data_size,
989
     libcerror_error_t **error )
990
0
{
991
0
  libesedb_internal_record_t *internal_record = NULL;
992
0
  libfvalue_value_t *record_value             = NULL;
993
0
  static char *function                       = "libesedb_record_get_value_data_size";
994
995
0
  if( record == NULL )
996
0
  {
997
0
    libcerror_error_set(
998
0
     error,
999
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1000
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1001
0
     "%s: invalid record.",
1002
0
     function );
1003
1004
0
    return( -1 );
1005
0
  }
1006
0
  internal_record = (libesedb_internal_record_t *) record;
1007
1008
0
  if( libcdata_array_get_entry_by_index(
1009
0
       internal_record->values_array,
1010
0
       value_entry,
1011
0
       (intptr_t **) &record_value,
1012
0
       error ) != 1 )
1013
0
  {
1014
0
    libcerror_error_set(
1015
0
     error,
1016
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1017
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1018
0
     "%s: unable to retrieve value: %d from values array.",
1019
0
     function,
1020
0
     value_entry );
1021
1022
0
    return( -1 );
1023
0
  }
1024
0
  if( libfvalue_value_get_data_size(
1025
0
       record_value,
1026
0
       value_data_size,
1027
0
       error ) != 1 )
1028
0
  {
1029
0
    libcerror_error_set(
1030
0
     error,
1031
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1032
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1033
0
     "%s: unable to retrieve value: %d data size.",
1034
0
     function,
1035
0
     value_entry );
1036
1037
0
    return( -1 );
1038
0
  }
1039
0
  return( 1 );
1040
0
}
1041
1042
/* Retrieves the value data of the specific entry
1043
 * Returns 1 if successful or -1 on error
1044
 */
1045
int libesedb_record_get_value_data(
1046
     libesedb_record_t *record,
1047
     int value_entry,
1048
     uint8_t *value_data,
1049
     size_t value_data_size,
1050
     libcerror_error_t **error )
1051
0
{
1052
0
  libesedb_internal_record_t *internal_record = NULL;
1053
0
  libfvalue_value_t *record_value             = NULL;
1054
0
  static char *function                       = "libesedb_record_get_value_data";
1055
1056
0
  if( record == NULL )
1057
0
  {
1058
0
    libcerror_error_set(
1059
0
     error,
1060
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1061
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1062
0
     "%s: invalid record.",
1063
0
     function );
1064
1065
0
    return( -1 );
1066
0
  }
1067
0
  internal_record = (libesedb_internal_record_t *) record;
1068
1069
0
  if( libcdata_array_get_entry_by_index(
1070
0
       internal_record->values_array,
1071
0
       value_entry,
1072
0
       (intptr_t **) &record_value,
1073
0
       error ) != 1 )
1074
0
  {
1075
0
    libcerror_error_set(
1076
0
     error,
1077
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1078
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1079
0
     "%s: unable to retrieve value: %d from values array.",
1080
0
     function,
1081
0
     value_entry );
1082
1083
0
    return( -1 );
1084
0
  }
1085
0
  if( libfvalue_value_copy_data(
1086
0
       record_value,
1087
0
       value_data,
1088
0
       value_data_size,
1089
0
       error ) != 1 )
1090
0
  {
1091
0
    libcerror_error_set(
1092
0
     error,
1093
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1094
0
     LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1095
0
     "%s: unable to copy value: %d data.",
1096
0
     function,
1097
0
     value_entry );
1098
1099
0
    return( -1 );
1100
0
  }
1101
0
  return( 1 );
1102
0
}
1103
1104
/* Retrieves the boolean value of a specific entry
1105
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1106
 */
1107
int libesedb_record_get_value_boolean(
1108
     libesedb_record_t *record,
1109
     int value_entry,
1110
     uint8_t *value_boolean,
1111
     libcerror_error_t **error )
1112
0
{
1113
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1114
0
  libesedb_internal_record_t *internal_record              = NULL;
1115
0
  libfvalue_value_t *record_value                          = NULL;
1116
0
  static char *function                                    = "libesedb_record_get_value_boolean";
1117
0
  uint32_t column_type                                     = 0;
1118
0
  int result                                               = 0;
1119
1120
0
  if( record == NULL )
1121
0
  {
1122
0
    libcerror_error_set(
1123
0
     error,
1124
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1125
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1126
0
     "%s: invalid record.",
1127
0
     function );
1128
1129
0
    return( -1 );
1130
0
  }
1131
0
  internal_record = (libesedb_internal_record_t *) record;
1132
1133
0
  if( libesedb_record_get_column_catalog_definition(
1134
0
       internal_record,
1135
0
       value_entry,
1136
0
       &column_catalog_definition,
1137
0
       error ) != 1 )
1138
0
  {
1139
0
    libcerror_error_set(
1140
0
     error,
1141
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1142
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1143
0
     "%s: unable to retrieve column catalog definition.",
1144
0
     function );
1145
1146
0
    return( -1 );
1147
0
  }
1148
0
  if( libesedb_catalog_definition_get_column_type(
1149
0
       column_catalog_definition,
1150
0
       &column_type,
1151
0
       error ) != 1 )
1152
0
  {
1153
0
    libcerror_error_set(
1154
0
     error,
1155
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1156
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1157
0
     "%s: unable to retrieve catalog definition column type.",
1158
0
     function );
1159
1160
0
    return( -1 );
1161
0
  }
1162
0
  if( column_type != LIBESEDB_COLUMN_TYPE_BOOLEAN )
1163
0
  {
1164
0
    libcerror_error_set(
1165
0
     error,
1166
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1167
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1168
0
     "%s: unsupported column type: %" PRIu32 ".",
1169
0
     function,
1170
0
     column_type );
1171
1172
0
    return( -1 );
1173
0
  }
1174
0
  if( libcdata_array_get_entry_by_index(
1175
0
       internal_record->values_array,
1176
0
       value_entry,
1177
0
       (intptr_t **) &record_value,
1178
0
       error ) != 1 )
1179
0
  {
1180
0
    libcerror_error_set(
1181
0
     error,
1182
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1183
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1184
0
     "%s: unable to retrieve value: %d from values array.",
1185
0
     function,
1186
0
     value_entry );
1187
1188
0
    return( -1 );
1189
0
  }
1190
0
  result = libfvalue_value_has_data(
1191
0
            record_value,
1192
0
            error );
1193
1194
0
  if( result == -1 )
1195
0
  {
1196
0
    libcerror_error_set(
1197
0
     error,
1198
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1199
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1200
0
     "%s: unable to determine if value: %d has data.",
1201
0
     function,
1202
0
     value_entry );
1203
1204
0
    return( -1 );
1205
0
  }
1206
0
  else if( result != 0 )
1207
0
  {
1208
0
    if( libfvalue_value_copy_to_boolean(
1209
0
         record_value,
1210
0
         0,
1211
0
         value_boolean,
1212
0
         error ) != 1 )
1213
0
    {
1214
0
      libcerror_error_set(
1215
0
       error,
1216
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1217
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1218
0
       "%s: unable to copy value to boolean value.",
1219
0
       function );
1220
1221
0
      return( -1 );
1222
0
    }
1223
0
  }
1224
0
  return( result );
1225
0
}
1226
1227
/* Retrieves the 8-bit value of a specific entry
1228
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1229
 */
1230
int libesedb_record_get_value_8bit(
1231
     libesedb_record_t *record,
1232
     int value_entry,
1233
     uint8_t *value_8bit,
1234
     libcerror_error_t **error )
1235
0
{
1236
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1237
0
  libesedb_internal_record_t *internal_record              = NULL;
1238
0
  libfvalue_value_t *record_value                          = NULL;
1239
0
  static char *function                                    = "libesedb_record_get_value_8bit";
1240
0
  uint32_t column_type                                     = 0;
1241
0
  int result                                               = 0;
1242
1243
0
  if( record == NULL )
1244
0
  {
1245
0
    libcerror_error_set(
1246
0
     error,
1247
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1248
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1249
0
     "%s: invalid record.",
1250
0
     function );
1251
1252
0
    return( -1 );
1253
0
  }
1254
0
  internal_record = (libesedb_internal_record_t *) record;
1255
1256
0
  if( libesedb_record_get_column_catalog_definition(
1257
0
       internal_record,
1258
0
       value_entry,
1259
0
       &column_catalog_definition,
1260
0
       error ) != 1 )
1261
0
  {
1262
0
    libcerror_error_set(
1263
0
     error,
1264
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1265
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1266
0
     "%s: unable to retrieve column catalog definition.",
1267
0
     function );
1268
1269
0
    return( -1 );
1270
0
  }
1271
0
  if( libesedb_catalog_definition_get_column_type(
1272
0
       column_catalog_definition,
1273
0
       &column_type,
1274
0
       error ) != 1 )
1275
0
  {
1276
0
    libcerror_error_set(
1277
0
     error,
1278
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1279
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1280
0
     "%s: unable to retrieve catalog definition column type.",
1281
0
     function );
1282
1283
0
    return( -1 );
1284
0
  }
1285
0
  if( column_type != LIBESEDB_COLUMN_TYPE_INTEGER_8BIT_UNSIGNED )
1286
0
  {
1287
0
    libcerror_error_set(
1288
0
     error,
1289
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1290
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1291
0
     "%s: unsupported column type: %" PRIu32 ".",
1292
0
     function,
1293
0
     column_type );
1294
1295
0
    return( -1 );
1296
0
  }
1297
0
  if( libcdata_array_get_entry_by_index(
1298
0
       internal_record->values_array,
1299
0
       value_entry,
1300
0
       (intptr_t **) &record_value,
1301
0
       error ) != 1 )
1302
0
  {
1303
0
    libcerror_error_set(
1304
0
     error,
1305
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1306
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1307
0
     "%s: unable to retrieve value: %d from values array.",
1308
0
     function,
1309
0
     value_entry );
1310
1311
0
    return( -1 );
1312
0
  }
1313
0
  result = libfvalue_value_has_data(
1314
0
            record_value,
1315
0
            error );
1316
1317
0
  if( result == -1 )
1318
0
  {
1319
0
    libcerror_error_set(
1320
0
     error,
1321
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1322
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1323
0
     "%s: unable to determine if value: %d has data.",
1324
0
     function,
1325
0
     value_entry );
1326
1327
0
    return( -1 );
1328
0
  }
1329
0
  else if( result != 0 )
1330
0
  {
1331
0
    if( libfvalue_value_copy_to_8bit(
1332
0
         record_value,
1333
0
         0,
1334
0
         value_8bit,
1335
0
         error ) != 1 )
1336
0
    {
1337
0
      libcerror_error_set(
1338
0
       error,
1339
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1340
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1341
0
       "%s: unable to copy value to 8-bit value.",
1342
0
       function );
1343
1344
0
      return( -1 );
1345
0
    }
1346
0
  }
1347
0
  return( result );
1348
0
}
1349
1350
/* Retrieves the 16-bit value of a specific entry
1351
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1352
 */
1353
int libesedb_record_get_value_16bit(
1354
     libesedb_record_t *record,
1355
     int value_entry,
1356
     uint16_t *value_16bit,
1357
     libcerror_error_t **error )
1358
0
{
1359
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1360
0
  libesedb_internal_record_t *internal_record              = NULL;
1361
0
  libfvalue_value_t *record_value                          = NULL;
1362
0
  static char *function                                    = "libesedb_record_get_value_16bit";
1363
0
  uint32_t column_type                                     = 0;
1364
0
  int result                                               = 0;
1365
1366
0
  if( record == NULL )
1367
0
  {
1368
0
    libcerror_error_set(
1369
0
     error,
1370
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1371
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1372
0
     "%s: invalid record.",
1373
0
     function );
1374
1375
0
    return( -1 );
1376
0
  }
1377
0
  internal_record = (libesedb_internal_record_t *) record;
1378
1379
0
  if( libesedb_record_get_column_catalog_definition(
1380
0
       internal_record,
1381
0
       value_entry,
1382
0
       &column_catalog_definition,
1383
0
       error ) != 1 )
1384
0
  {
1385
0
    libcerror_error_set(
1386
0
     error,
1387
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1388
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1389
0
     "%s: unable to retrieve column catalog definition.",
1390
0
     function );
1391
1392
0
    return( -1 );
1393
0
  }
1394
0
  if( libesedb_catalog_definition_get_column_type(
1395
0
       column_catalog_definition,
1396
0
       &column_type,
1397
0
       error ) != 1 )
1398
0
  {
1399
0
    libcerror_error_set(
1400
0
     error,
1401
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1402
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1403
0
     "%s: unable to retrieve catalog definition column type.",
1404
0
     function );
1405
1406
0
    return( -1 );
1407
0
  }
1408
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_INTEGER_16BIT_SIGNED )
1409
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_INTEGER_16BIT_UNSIGNED ) )
1410
0
  {
1411
0
    libcerror_error_set(
1412
0
     error,
1413
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1414
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1415
0
     "%s: unsupported column type: %" PRIu32 ".",
1416
0
     function,
1417
0
     column_type );
1418
1419
0
    return( -1 );
1420
0
  }
1421
0
  if( libcdata_array_get_entry_by_index(
1422
0
       internal_record->values_array,
1423
0
       value_entry,
1424
0
       (intptr_t **) &record_value,
1425
0
       error ) != 1 )
1426
0
  {
1427
0
    libcerror_error_set(
1428
0
     error,
1429
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1430
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1431
0
     "%s: unable to retrieve value: %d from values array.",
1432
0
     function,
1433
0
     value_entry );
1434
1435
0
    return( -1 );
1436
0
  }
1437
0
  result = libfvalue_value_has_data(
1438
0
            record_value,
1439
0
            error );
1440
1441
0
  if( result == -1 )
1442
0
  {
1443
0
    libcerror_error_set(
1444
0
     error,
1445
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1446
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1447
0
     "%s: unable to determine if value: %d has data.",
1448
0
     function,
1449
0
     value_entry );
1450
1451
0
    return( -1 );
1452
0
  }
1453
0
  else if( result != 0 )
1454
0
  {
1455
0
    if( libfvalue_value_copy_to_16bit(
1456
0
         record_value,
1457
0
         0,
1458
0
         value_16bit,
1459
0
         error ) != 1 )
1460
0
    {
1461
0
      libcerror_error_set(
1462
0
       error,
1463
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1464
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1465
0
       "%s: unable to copy value to 16-bit value.",
1466
0
       function );
1467
1468
0
      return( -1 );
1469
0
    }
1470
0
  }
1471
0
  return( result );
1472
0
}
1473
1474
/* Retrieves the 32-bit value of a specific entry
1475
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1476
 */
1477
int libesedb_record_get_value_32bit(
1478
     libesedb_record_t *record,
1479
     int value_entry,
1480
     uint32_t *value_32bit,
1481
     libcerror_error_t **error )
1482
0
{
1483
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1484
0
  libesedb_internal_record_t *internal_record              = NULL;
1485
0
  libfvalue_value_t *record_value                          = NULL;
1486
0
  static char *function                                    = "libesedb_record_get_value_32bit";
1487
0
  uint32_t column_type                                     = 0;
1488
0
  int result                                               = 0;
1489
1490
0
  if( record == NULL )
1491
0
  {
1492
0
    libcerror_error_set(
1493
0
     error,
1494
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1495
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1496
0
     "%s: invalid record.",
1497
0
     function );
1498
1499
0
    return( -1 );
1500
0
  }
1501
0
  internal_record = (libesedb_internal_record_t *) record;
1502
1503
0
  if( libesedb_record_get_column_catalog_definition(
1504
0
       internal_record,
1505
0
       value_entry,
1506
0
       &column_catalog_definition,
1507
0
       error ) != 1 )
1508
0
  {
1509
0
    libcerror_error_set(
1510
0
     error,
1511
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1512
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1513
0
     "%s: unable to retrieve column catalog definition.",
1514
0
     function );
1515
1516
0
    return( -1 );
1517
0
  }
1518
0
  if( libesedb_catalog_definition_get_column_type(
1519
0
       column_catalog_definition,
1520
0
       &column_type,
1521
0
       error ) != 1 )
1522
0
  {
1523
0
    libcerror_error_set(
1524
0
     error,
1525
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1526
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1527
0
     "%s: unable to retrieve catalog definition column type.",
1528
0
     function );
1529
1530
0
    return( -1 );
1531
0
  }
1532
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_INTEGER_32BIT_SIGNED )
1533
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_INTEGER_32BIT_UNSIGNED ) )
1534
0
  {
1535
0
    libcerror_error_set(
1536
0
     error,
1537
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1538
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1539
0
     "%s: unsupported column type: %" PRIu32 ".",
1540
0
     function,
1541
0
     column_type );
1542
1543
0
    return( -1 );
1544
0
  }
1545
0
  if( libcdata_array_get_entry_by_index(
1546
0
       internal_record->values_array,
1547
0
       value_entry,
1548
0
       (intptr_t **) &record_value,
1549
0
       error ) != 1 )
1550
0
  {
1551
0
    libcerror_error_set(
1552
0
     error,
1553
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1554
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1555
0
     "%s: unable to retrieve value: %d from values array.",
1556
0
     function,
1557
0
     value_entry );
1558
1559
0
    return( -1 );
1560
0
  }
1561
0
  result = libfvalue_value_has_data(
1562
0
            record_value,
1563
0
            error );
1564
1565
0
  if( result == -1 )
1566
0
  {
1567
0
    libcerror_error_set(
1568
0
     error,
1569
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1570
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1571
0
     "%s: unable to determine if value: %d has data.",
1572
0
     function,
1573
0
     value_entry );
1574
1575
0
    return( -1 );
1576
0
  }
1577
0
  else if( result != 0 )
1578
0
  {
1579
0
    if( libfvalue_value_copy_to_32bit(
1580
0
         record_value,
1581
0
         0,
1582
0
         value_32bit,
1583
0
         error ) != 1 )
1584
0
    {
1585
0
      libcerror_error_set(
1586
0
       error,
1587
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1588
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1589
0
       "%s: unable to copy value to 32-bit value.",
1590
0
       function );
1591
1592
0
      return( -1 );
1593
0
    }
1594
0
  }
1595
0
  return( result );
1596
0
}
1597
1598
/* Retrieves the 64-bit value of a specific entry
1599
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1600
 */
1601
int libesedb_record_get_value_64bit(
1602
     libesedb_record_t *record,
1603
     int value_entry,
1604
     uint64_t *value_64bit,
1605
     libcerror_error_t **error )
1606
0
{
1607
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1608
0
  libesedb_internal_record_t *internal_record              = NULL;
1609
0
  libfvalue_value_t *record_value                          = NULL;
1610
0
  static char *function                                    = "libesedb_record_get_value_64bit";
1611
0
  uint32_t column_type                                     = 0;
1612
0
  int result                                               = 0;
1613
1614
0
  if( record == NULL )
1615
0
  {
1616
0
    libcerror_error_set(
1617
0
     error,
1618
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1619
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1620
0
     "%s: invalid record.",
1621
0
     function );
1622
1623
0
    return( -1 );
1624
0
  }
1625
0
  internal_record = (libesedb_internal_record_t *) record;
1626
1627
0
  if( libesedb_record_get_column_catalog_definition(
1628
0
       internal_record,
1629
0
       value_entry,
1630
0
       &column_catalog_definition,
1631
0
       error ) != 1 )
1632
0
  {
1633
0
    libcerror_error_set(
1634
0
     error,
1635
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1636
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1637
0
     "%s: unable to retrieve column catalog definition.",
1638
0
     function );
1639
1640
0
    return( -1 );
1641
0
  }
1642
0
  if( libesedb_catalog_definition_get_column_type(
1643
0
       column_catalog_definition,
1644
0
       &column_type,
1645
0
       error ) != 1 )
1646
0
  {
1647
0
    libcerror_error_set(
1648
0
     error,
1649
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1650
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1651
0
     "%s: unable to retrieve catalog definition column type.",
1652
0
     function );
1653
1654
0
    return( -1 );
1655
0
  }
1656
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_CURRENCY )
1657
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_DATE_TIME )
1658
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_INTEGER_64BIT_SIGNED ) )
1659
0
  {
1660
0
    libcerror_error_set(
1661
0
     error,
1662
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1663
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1664
0
     "%s: unsupported column type: %" PRIu32 ".",
1665
0
     function,
1666
0
     column_type );
1667
1668
0
    return( -1 );
1669
0
  }
1670
0
  if( libcdata_array_get_entry_by_index(
1671
0
       internal_record->values_array,
1672
0
       value_entry,
1673
0
       (intptr_t **) &record_value,
1674
0
       error ) != 1 )
1675
0
  {
1676
0
    libcerror_error_set(
1677
0
     error,
1678
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1679
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1680
0
     "%s: unable to retrieve value: %d from values array.",
1681
0
     function,
1682
0
     value_entry );
1683
1684
0
    return( -1 );
1685
0
  }
1686
0
  result = libfvalue_value_has_data(
1687
0
            record_value,
1688
0
            error );
1689
1690
0
  if( result == -1 )
1691
0
  {
1692
0
    libcerror_error_set(
1693
0
     error,
1694
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1695
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1696
0
     "%s: unable to determine if value: %d has data.",
1697
0
     function,
1698
0
     value_entry );
1699
1700
0
    return( -1 );
1701
0
  }
1702
0
  else if( result != 0 )
1703
0
  {
1704
0
    if( libfvalue_value_copy_to_64bit(
1705
0
         record_value,
1706
0
         0,
1707
0
         value_64bit,
1708
0
         error ) != 1 )
1709
0
    {
1710
0
      libcerror_error_set(
1711
0
       error,
1712
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1713
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1714
0
       "%s: unable to copy value to 64-bit value.",
1715
0
       function );
1716
1717
0
      return( -1 );
1718
0
    }
1719
0
  }
1720
0
  return( result );
1721
0
}
1722
1723
/* Retrieves the 64-bit filetime value of a specific entry
1724
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1725
 */
1726
int libesedb_record_get_value_filetime(
1727
     libesedb_record_t *record,
1728
     int value_entry,
1729
     uint64_t *value_filetime,
1730
     libcerror_error_t **error )
1731
0
{
1732
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1733
0
  libesedb_internal_record_t *internal_record              = NULL;
1734
0
  libfvalue_value_t *record_value                          = NULL;
1735
0
  static char *function                                    = "libesedb_record_get_value_filetime";
1736
0
  uint32_t column_type                                     = 0;
1737
0
  int result                                               = 0;
1738
1739
0
  if( record == NULL )
1740
0
  {
1741
0
    libcerror_error_set(
1742
0
     error,
1743
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1744
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1745
0
     "%s: invalid record.",
1746
0
     function );
1747
1748
0
    return( -1 );
1749
0
  }
1750
0
  internal_record = (libesedb_internal_record_t *) record;
1751
1752
0
  if( libesedb_record_get_column_catalog_definition(
1753
0
       internal_record,
1754
0
       value_entry,
1755
0
       &column_catalog_definition,
1756
0
       error ) != 1 )
1757
0
  {
1758
0
    libcerror_error_set(
1759
0
     error,
1760
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1761
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1762
0
     "%s: unable to retrieve column catalog definition.",
1763
0
     function );
1764
1765
0
    return( -1 );
1766
0
  }
1767
0
  if( libesedb_catalog_definition_get_column_type(
1768
0
       column_catalog_definition,
1769
0
       &column_type,
1770
0
       error ) != 1 )
1771
0
  {
1772
0
    libcerror_error_set(
1773
0
     error,
1774
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1775
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1776
0
     "%s: unable to retrieve catalog definition column type.",
1777
0
     function );
1778
1779
0
    return( -1 );
1780
0
  }
1781
0
  if( column_type != LIBESEDB_COLUMN_TYPE_DATE_TIME )
1782
0
  {
1783
0
    libcerror_error_set(
1784
0
     error,
1785
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1786
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1787
0
     "%s: unsupported column type: %" PRIu32 ".",
1788
0
     function,
1789
0
     column_type );
1790
1791
0
    return( -1 );
1792
0
  }
1793
0
  if( libcdata_array_get_entry_by_index(
1794
0
       internal_record->values_array,
1795
0
       value_entry,
1796
0
       (intptr_t **) &record_value,
1797
0
       error ) != 1 )
1798
0
  {
1799
0
    libcerror_error_set(
1800
0
     error,
1801
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1802
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1803
0
     "%s: unable to retrieve value: %d from values array.",
1804
0
     function,
1805
0
     value_entry );
1806
1807
0
    return( -1 );
1808
0
  }
1809
0
  result = libfvalue_value_has_data(
1810
0
            record_value,
1811
0
            error );
1812
1813
0
  if( result == -1 )
1814
0
  {
1815
0
    libcerror_error_set(
1816
0
     error,
1817
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1818
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1819
0
     "%s: unable to determine if value: %d has data.",
1820
0
     function,
1821
0
     value_entry );
1822
1823
0
    return( -1 );
1824
0
  }
1825
0
  else if( result != 0 )
1826
0
  {
1827
    /* Copy the filetime to a 64-bit value
1828
     */
1829
0
    if( libfvalue_value_copy_to_64bit(
1830
0
         record_value,
1831
0
         0,
1832
0
         value_filetime,
1833
0
         error ) != 1 )
1834
0
    {
1835
0
      libcerror_error_set(
1836
0
       error,
1837
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1838
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1839
0
       "%s: unable to copy value to 64-bit value.",
1840
0
       function );
1841
1842
0
      return( -1 );
1843
0
    }
1844
0
  }
1845
0
  return( result );
1846
0
}
1847
1848
/* Retrieves the single precision floating point value of a specific entry
1849
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1850
 */
1851
int libesedb_record_get_value_floating_point_32bit(
1852
     libesedb_record_t *record,
1853
     int value_entry,
1854
     float *value_floating_point_32bit,
1855
     libcerror_error_t **error )
1856
0
{
1857
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1858
0
  libesedb_internal_record_t *internal_record              = NULL;
1859
0
  libfvalue_value_t *record_value                          = NULL;
1860
0
  static char *function                                    = "libesedb_record_get_value_floating_point_32bit";
1861
0
  uint32_t column_type                                     = 0;
1862
0
  int result                                               = 0;
1863
1864
0
  if( record == NULL )
1865
0
  {
1866
0
    libcerror_error_set(
1867
0
     error,
1868
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1869
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1870
0
     "%s: invalid record.",
1871
0
     function );
1872
1873
0
    return( -1 );
1874
0
  }
1875
0
  internal_record = (libesedb_internal_record_t *) record;
1876
1877
0
  if( libesedb_record_get_column_catalog_definition(
1878
0
       internal_record,
1879
0
       value_entry,
1880
0
       &column_catalog_definition,
1881
0
       error ) != 1 )
1882
0
  {
1883
0
    libcerror_error_set(
1884
0
     error,
1885
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1886
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1887
0
     "%s: unable to retrieve column catalog definition.",
1888
0
     function );
1889
1890
0
    return( -1 );
1891
0
  }
1892
0
  if( libesedb_catalog_definition_get_column_type(
1893
0
       column_catalog_definition,
1894
0
       &column_type,
1895
0
       error ) != 1 )
1896
0
  {
1897
0
    libcerror_error_set(
1898
0
     error,
1899
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1900
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1901
0
     "%s: unable to retrieve catalog definition column type.",
1902
0
     function );
1903
1904
0
    return( -1 );
1905
0
  }
1906
0
  if( column_type != LIBESEDB_COLUMN_TYPE_FLOAT_32BIT )
1907
0
  {
1908
0
    libcerror_error_set(
1909
0
     error,
1910
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1911
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
1912
0
     "%s: unsupported column type: %" PRIu32 ".",
1913
0
     function,
1914
0
     column_type );
1915
1916
0
    return( -1 );
1917
0
  }
1918
0
  if( libcdata_array_get_entry_by_index(
1919
0
       internal_record->values_array,
1920
0
       value_entry,
1921
0
       (intptr_t **) &record_value,
1922
0
       error ) != 1 )
1923
0
  {
1924
0
    libcerror_error_set(
1925
0
     error,
1926
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1927
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1928
0
     "%s: unable to retrieve value: %d from values array.",
1929
0
     function,
1930
0
     value_entry );
1931
1932
0
    return( -1 );
1933
0
  }
1934
0
  result = libfvalue_value_has_data(
1935
0
            record_value,
1936
0
            error );
1937
1938
0
  if( result == -1 )
1939
0
  {
1940
0
    libcerror_error_set(
1941
0
     error,
1942
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
1943
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
1944
0
     "%s: unable to determine if value: %d has data.",
1945
0
     function,
1946
0
     value_entry );
1947
1948
0
    return( -1 );
1949
0
  }
1950
0
  else if( result != 0 )
1951
0
  {
1952
0
    if( libfvalue_value_copy_to_float(
1953
0
         record_value,
1954
0
         0,
1955
0
         value_floating_point_32bit,
1956
0
         error ) != 1 )
1957
0
    {
1958
0
      libcerror_error_set(
1959
0
       error,
1960
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
1961
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
1962
0
       "%s: unable to copy value to single precision floating point value.",
1963
0
       function );
1964
1965
0
      return( -1 );
1966
0
    }
1967
0
  }
1968
0
  return( result );
1969
0
}
1970
1971
/* Retrieves the double precision floating point value of a specific entry
1972
 * Returns 1 if successful, 0 if value is NULL or -1 on error
1973
 */
1974
int libesedb_record_get_value_floating_point_64bit(
1975
     libesedb_record_t *record,
1976
     int value_entry,
1977
     double *value_floating_point_64bit,
1978
     libcerror_error_t **error )
1979
0
{
1980
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
1981
0
  libesedb_internal_record_t *internal_record              = NULL;
1982
0
  libfvalue_value_t *record_value                          = NULL;
1983
0
  static char *function                                    = "libesedb_record_get_value_floating_point_64bit";
1984
0
  uint32_t column_type                                     = 0;
1985
0
  int result                                               = 0;
1986
1987
0
  if( record == NULL )
1988
0
  {
1989
0
    libcerror_error_set(
1990
0
     error,
1991
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
1992
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
1993
0
     "%s: invalid record.",
1994
0
     function );
1995
1996
0
    return( -1 );
1997
0
  }
1998
0
  internal_record = (libesedb_internal_record_t *) record;
1999
2000
0
  if( libesedb_record_get_column_catalog_definition(
2001
0
       internal_record,
2002
0
       value_entry,
2003
0
       &column_catalog_definition,
2004
0
       error ) != 1 )
2005
0
  {
2006
0
    libcerror_error_set(
2007
0
     error,
2008
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2009
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2010
0
     "%s: unable to retrieve column catalog definition.",
2011
0
     function );
2012
2013
0
    return( -1 );
2014
0
  }
2015
0
  if( libesedb_catalog_definition_get_column_type(
2016
0
       column_catalog_definition,
2017
0
       &column_type,
2018
0
       error ) != 1 )
2019
0
  {
2020
0
    libcerror_error_set(
2021
0
     error,
2022
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2023
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2024
0
     "%s: unable to retrieve catalog definition column type.",
2025
0
     function );
2026
2027
0
    return( -1 );
2028
0
  }
2029
0
  if( column_type != LIBESEDB_COLUMN_TYPE_DOUBLE_64BIT )
2030
0
  {
2031
0
    libcerror_error_set(
2032
0
     error,
2033
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2034
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2035
0
     "%s: unsupported column type: %" PRIu32 ".",
2036
0
     function,
2037
0
     column_type );
2038
2039
0
    return( -1 );
2040
0
  }
2041
0
  if( libcdata_array_get_entry_by_index(
2042
0
       internal_record->values_array,
2043
0
       value_entry,
2044
0
       (intptr_t **) &record_value,
2045
0
       error ) != 1 )
2046
0
  {
2047
0
    libcerror_error_set(
2048
0
     error,
2049
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2050
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2051
0
     "%s: unable to retrieve value: %d from values array.",
2052
0
     function,
2053
0
     value_entry );
2054
2055
0
    return( -1 );
2056
0
  }
2057
0
  result = libfvalue_value_has_data(
2058
0
            record_value,
2059
0
            error );
2060
2061
0
  if( result == -1 )
2062
0
  {
2063
0
    libcerror_error_set(
2064
0
     error,
2065
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2066
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2067
0
     "%s: unable to determine if value: %d has data.",
2068
0
     function,
2069
0
     value_entry );
2070
2071
0
    return( -1 );
2072
0
  }
2073
0
  else if( result != 0 )
2074
0
  {
2075
0
    if( libfvalue_value_copy_to_double(
2076
0
         record_value,
2077
0
         0,
2078
0
         value_floating_point_64bit,
2079
0
         error ) != 1 )
2080
0
    {
2081
0
      libcerror_error_set(
2082
0
       error,
2083
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
2084
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
2085
0
       "%s: unable to copy value to double precision floating point value.",
2086
0
       function );
2087
2088
0
      return( -1 );
2089
0
    }
2090
0
  }
2091
0
  return( result );
2092
0
}
2093
2094
/* Retrieves the size of an UTF-8 string a specific entry
2095
 * The returned size includes the end of string character
2096
 * Returns 1 if successful, 0 if value is NULL or -1 on error
2097
 */
2098
int libesedb_record_get_value_utf8_string_size(
2099
     libesedb_record_t *record,
2100
     int value_entry,
2101
     size_t *utf8_string_size,
2102
     libcerror_error_t **error )
2103
0
{
2104
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
2105
0
  libesedb_internal_record_t *internal_record              = NULL;
2106
0
  libfvalue_value_t *record_value                          = NULL;
2107
0
  static char *function                                    = "libesedb_record_get_value_utf8_string_size";
2108
0
  uint32_t column_type                                     = 0;
2109
0
  int result                                               = 0;
2110
2111
0
  if( record == NULL )
2112
0
  {
2113
0
    libcerror_error_set(
2114
0
     error,
2115
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2116
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2117
0
     "%s: invalid record.",
2118
0
     function );
2119
2120
0
    return( -1 );
2121
0
  }
2122
0
  internal_record = (libesedb_internal_record_t *) record;
2123
2124
0
  if( libesedb_record_get_column_catalog_definition(
2125
0
       internal_record,
2126
0
       value_entry,
2127
0
       &column_catalog_definition,
2128
0
       error ) != 1 )
2129
0
  {
2130
0
    libcerror_error_set(
2131
0
     error,
2132
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2133
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2134
0
     "%s: unable to retrieve column catalog definition.",
2135
0
     function );
2136
2137
0
    return( -1 );
2138
0
  }
2139
0
  if( libesedb_catalog_definition_get_column_type(
2140
0
       column_catalog_definition,
2141
0
       &column_type,
2142
0
       error ) != 1 )
2143
0
  {
2144
0
    libcerror_error_set(
2145
0
     error,
2146
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2147
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2148
0
     "%s: unable to retrieve catalog definition column type.",
2149
0
     function );
2150
2151
0
    return( -1 );
2152
0
  }
2153
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT )
2154
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) )
2155
0
  {
2156
0
    libcerror_error_set(
2157
0
     error,
2158
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2159
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2160
0
     "%s: unsupported column type: %" PRIu32 ".",
2161
0
     function,
2162
0
     column_type );
2163
2164
0
    return( -1 );
2165
0
  }
2166
0
  if( libcdata_array_get_entry_by_index(
2167
0
       internal_record->values_array,
2168
0
       value_entry,
2169
0
       (intptr_t **) &record_value,
2170
0
       error ) != 1 )
2171
0
  {
2172
0
    libcerror_error_set(
2173
0
     error,
2174
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2175
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2176
0
     "%s: unable to retrieve value: %d from values array.",
2177
0
     function,
2178
0
     value_entry );
2179
2180
0
    return( -1 );
2181
0
  }
2182
0
  result = libesedb_record_value_get_utf8_string_size(
2183
0
            record_value,
2184
0
            utf8_string_size,
2185
0
            error );
2186
2187
0
  if( result == -1 )
2188
0
  {
2189
0
    libcerror_error_set(
2190
0
     error,
2191
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2192
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2193
0
     "%s: unable to retrieve UTF-8 string size from value: %d.",
2194
0
     function,
2195
0
     value_entry );
2196
2197
0
    return( -1 );
2198
0
  }
2199
0
  return( result );
2200
0
}
2201
2202
/* Retrieves the UTF-8 encoded string of a specific entry
2203
 * The function uses the codepage in the column definition if necessary
2204
 * The size should include the end of string character
2205
 * Returns 1 if successful, 0 if value is NULL or -1 on error
2206
 */
2207
int libesedb_record_get_value_utf8_string(
2208
     libesedb_record_t *record,
2209
     int value_entry,
2210
     uint8_t *utf8_string,
2211
     size_t utf8_string_size,
2212
     libcerror_error_t **error )
2213
0
{
2214
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
2215
0
  libesedb_internal_record_t *internal_record              = NULL;
2216
0
  libfvalue_value_t *record_value                          = NULL;
2217
0
  static char *function                                    = "libesedb_record_get_value_utf8_string";
2218
0
  uint32_t column_type                                     = 0;
2219
0
  int result                                               = 0;
2220
2221
0
  if( record == NULL )
2222
0
  {
2223
0
    libcerror_error_set(
2224
0
     error,
2225
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2226
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2227
0
     "%s: invalid record.",
2228
0
     function );
2229
2230
0
    return( -1 );
2231
0
  }
2232
0
  internal_record = (libesedb_internal_record_t *) record;
2233
2234
0
  if( libesedb_record_get_column_catalog_definition(
2235
0
       internal_record,
2236
0
       value_entry,
2237
0
       &column_catalog_definition,
2238
0
       error ) != 1 )
2239
0
  {
2240
0
    libcerror_error_set(
2241
0
     error,
2242
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2243
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2244
0
     "%s: unable to retrieve column catalog definition.",
2245
0
     function );
2246
2247
0
    return( -1 );
2248
0
  }
2249
0
  if( libesedb_catalog_definition_get_column_type(
2250
0
       column_catalog_definition,
2251
0
       &column_type,
2252
0
       error ) != 1 )
2253
0
  {
2254
0
    libcerror_error_set(
2255
0
     error,
2256
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2257
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2258
0
     "%s: unable to retrieve catalog definition column type.",
2259
0
     function );
2260
2261
0
    return( -1 );
2262
0
  }
2263
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT )
2264
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) )
2265
0
  {
2266
0
    libcerror_error_set(
2267
0
     error,
2268
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2269
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2270
0
     "%s: unsupported column type: %" PRIu32 ".",
2271
0
     function,
2272
0
     column_type );
2273
2274
0
    return( -1 );
2275
0
  }
2276
0
  if( libcdata_array_get_entry_by_index(
2277
0
       internal_record->values_array,
2278
0
       value_entry,
2279
0
       (intptr_t **) &record_value,
2280
0
       error ) != 1 )
2281
0
  {
2282
0
    libcerror_error_set(
2283
0
     error,
2284
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2285
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2286
0
     "%s: unable to retrieve value: %d from values array.",
2287
0
     function,
2288
0
     value_entry );
2289
2290
0
    return( -1 );
2291
0
  }
2292
0
  result = libesedb_record_value_get_utf8_string(
2293
0
            record_value,
2294
0
            utf8_string,
2295
0
            utf8_string_size,
2296
0
            error );
2297
2298
0
  if( result == -1 )
2299
0
  {
2300
0
    libcerror_error_set(
2301
0
     error,
2302
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2303
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2304
0
     "%s: unable to retrieve UTF-8 string from value: %d.",
2305
0
     function,
2306
0
     value_entry );
2307
2308
0
    return( -1 );
2309
0
  }
2310
0
  return( result );
2311
0
}
2312
2313
/* Retrieves the size of an UTF-16 string a specific entry
2314
 * The returned size includes the end of string character
2315
 * Returns 1 if successful, 0 if value is NULL or -1 on error
2316
 */
2317
int libesedb_record_get_value_utf16_string_size(
2318
     libesedb_record_t *record,
2319
     int value_entry,
2320
     size_t *utf16_string_size,
2321
     libcerror_error_t **error )
2322
0
{
2323
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
2324
0
  libesedb_internal_record_t *internal_record              = NULL;
2325
0
  libfvalue_value_t *record_value                          = NULL;
2326
0
  static char *function                                    = "libesedb_record_get_value_utf16_string_size";
2327
0
  uint32_t column_type                                     = 0;
2328
0
  int result                                               = 0;
2329
2330
0
  if( record == NULL )
2331
0
  {
2332
0
    libcerror_error_set(
2333
0
     error,
2334
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2335
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2336
0
     "%s: invalid record.",
2337
0
     function );
2338
2339
0
    return( -1 );
2340
0
  }
2341
0
  internal_record = (libesedb_internal_record_t *) record;
2342
2343
0
  if( libesedb_record_get_column_catalog_definition(
2344
0
       internal_record,
2345
0
       value_entry,
2346
0
       &column_catalog_definition,
2347
0
       error ) != 1 )
2348
0
  {
2349
0
    libcerror_error_set(
2350
0
     error,
2351
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2352
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2353
0
     "%s: unable to retrieve column catalog definition.",
2354
0
     function );
2355
2356
0
    return( -1 );
2357
0
  }
2358
0
  if( libesedb_catalog_definition_get_column_type(
2359
0
       column_catalog_definition,
2360
0
       &column_type,
2361
0
       error ) != 1 )
2362
0
  {
2363
0
    libcerror_error_set(
2364
0
     error,
2365
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2366
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2367
0
     "%s: unable to retrieve catalog definition column type.",
2368
0
     function );
2369
2370
0
    return( -1 );
2371
0
  }
2372
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT )
2373
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) )
2374
0
  {
2375
0
    libcerror_error_set(
2376
0
     error,
2377
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2378
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2379
0
     "%s: unsupported column type: %" PRIu32 ".",
2380
0
     function,
2381
0
     column_type );
2382
2383
0
    return( -1 );
2384
0
  }
2385
0
  if( libcdata_array_get_entry_by_index(
2386
0
       internal_record->values_array,
2387
0
       value_entry,
2388
0
       (intptr_t **) &record_value,
2389
0
       error ) != 1 )
2390
0
  {
2391
0
    libcerror_error_set(
2392
0
     error,
2393
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2394
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2395
0
     "%s: unable to retrieve value: %d from values array.",
2396
0
     function,
2397
0
     value_entry );
2398
2399
0
    return( -1 );
2400
0
  }
2401
0
  result = libesedb_record_value_get_utf16_string_size(
2402
0
            record_value,
2403
0
            utf16_string_size,
2404
0
            error );
2405
2406
0
  if( result == -1 )
2407
0
  {
2408
0
    libcerror_error_set(
2409
0
     error,
2410
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2411
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2412
0
     "%s: unable to retrieve UTF-16 string size from value: %d.",
2413
0
     function,
2414
0
     value_entry );
2415
2416
0
    return( -1 );
2417
0
  }
2418
0
  return( result );
2419
0
}
2420
2421
/* Retrieves the UTF-16 encoded string value of a specific entry
2422
 * The function uses the codepage in the column definition if necessary
2423
 * The size should include the end of string character
2424
 * Returns 1 if successful, 0 if value is NULL or -1 on error
2425
 */
2426
int libesedb_record_get_value_utf16_string(
2427
     libesedb_record_t *record,
2428
     int value_entry,
2429
     uint16_t *utf16_string,
2430
     size_t utf16_string_size,
2431
     libcerror_error_t **error )
2432
0
{
2433
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
2434
0
  libesedb_internal_record_t *internal_record              = NULL;
2435
0
  libfvalue_value_t *record_value                          = NULL;
2436
0
  static char *function                                    = "libesedb_record_get_value_utf16_string";
2437
0
  uint32_t column_type                                     = 0;
2438
0
  int result                                               = 0;
2439
2440
0
  if( record == NULL )
2441
0
  {
2442
0
    libcerror_error_set(
2443
0
     error,
2444
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2445
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2446
0
     "%s: invalid record.",
2447
0
     function );
2448
2449
0
    return( -1 );
2450
0
  }
2451
0
  internal_record = (libesedb_internal_record_t *) record;
2452
2453
0
  if( libesedb_record_get_column_catalog_definition(
2454
0
       internal_record,
2455
0
       value_entry,
2456
0
       &column_catalog_definition,
2457
0
       error ) != 1 )
2458
0
  {
2459
0
    libcerror_error_set(
2460
0
     error,
2461
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2462
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2463
0
     "%s: unable to retrieve column catalog definition.",
2464
0
     function );
2465
2466
0
    return( -1 );
2467
0
  }
2468
0
  if( libesedb_catalog_definition_get_column_type(
2469
0
       column_catalog_definition,
2470
0
       &column_type,
2471
0
       error ) != 1 )
2472
0
  {
2473
0
    libcerror_error_set(
2474
0
     error,
2475
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2476
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2477
0
     "%s: unable to retrieve catalog definition column type.",
2478
0
     function );
2479
2480
0
    return( -1 );
2481
0
  }
2482
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_TEXT )
2483
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_TEXT ) )
2484
0
  {
2485
0
    libcerror_error_set(
2486
0
     error,
2487
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2488
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2489
0
     "%s: unsupported column type: %" PRIu32 ".",
2490
0
     function,
2491
0
     column_type );
2492
2493
0
    return( -1 );
2494
0
  }
2495
0
  if( libcdata_array_get_entry_by_index(
2496
0
       internal_record->values_array,
2497
0
       value_entry,
2498
0
       (intptr_t **) &record_value,
2499
0
       error ) != 1 )
2500
0
  {
2501
0
    libcerror_error_set(
2502
0
     error,
2503
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2504
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2505
0
     "%s: unable to retrieve value: %d from values array.",
2506
0
     function,
2507
0
     value_entry );
2508
2509
0
    return( -1 );
2510
0
  }
2511
0
  result = libesedb_record_value_get_utf16_string(
2512
0
            record_value,
2513
0
            utf16_string,
2514
0
            utf16_string_size,
2515
0
            error );
2516
2517
0
  if( result == -1 )
2518
0
  {
2519
0
    libcerror_error_set(
2520
0
     error,
2521
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2522
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2523
0
     "%s: unable to retrieve UTF-16 string from value: %d.",
2524
0
     function,
2525
0
     value_entry );
2526
2527
0
    return( -1 );
2528
0
  }
2529
0
  return( result );
2530
0
}
2531
2532
/* Retrieves the binary data size of a specific entry
2533
 * Returns 1 if successful, 0 if value is NULL or -1 on error
2534
 */
2535
int libesedb_record_get_value_binary_data_size(
2536
     libesedb_record_t *record,
2537
     int value_entry,
2538
     size_t *binary_data_size,
2539
     libcerror_error_t **error )
2540
0
{
2541
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
2542
0
  libesedb_internal_record_t *internal_record              = NULL;
2543
0
  libfvalue_value_t *record_value                          = NULL;
2544
0
  uint8_t *entry_data                                      = NULL;
2545
0
  uint8_t *value_data                                      = NULL;
2546
0
  static char *function                                    = "libesedb_record_get_value_binary_data_size";
2547
0
  size_t entry_data_size                                   = 0;
2548
0
  uint32_t column_type                                     = 0;
2549
0
  uint32_t data_flags                                      = 0;
2550
0
  int encoding                                             = 0;
2551
0
  int result                                               = 0;
2552
2553
0
  if( record == NULL )
2554
0
  {
2555
0
    libcerror_error_set(
2556
0
     error,
2557
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2558
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2559
0
     "%s: invalid record.",
2560
0
     function );
2561
2562
0
    return( -1 );
2563
0
  }
2564
0
  internal_record = (libesedb_internal_record_t *) record;
2565
2566
0
  if( libesedb_record_get_column_catalog_definition(
2567
0
       internal_record,
2568
0
       value_entry,
2569
0
       &column_catalog_definition,
2570
0
       error ) != 1 )
2571
0
  {
2572
0
    libcerror_error_set(
2573
0
     error,
2574
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2575
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2576
0
     "%s: unable to retrieve column catalog definition.",
2577
0
     function );
2578
2579
0
    return( -1 );
2580
0
  }
2581
0
  if( libesedb_catalog_definition_get_column_type(
2582
0
       column_catalog_definition,
2583
0
       &column_type,
2584
0
       error ) != 1 )
2585
0
  {
2586
0
    libcerror_error_set(
2587
0
     error,
2588
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2589
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2590
0
     "%s: unable to retrieve catalog definition column type.",
2591
0
     function );
2592
2593
0
    return( -1 );
2594
0
  }
2595
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_BINARY_DATA )
2596
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_BINARY_DATA ) )
2597
0
  {
2598
0
    libcerror_error_set(
2599
0
     error,
2600
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2601
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2602
0
     "%s: unsupported column type: %" PRIu32 ".",
2603
0
     function,
2604
0
     column_type );
2605
2606
0
    return( -1 );
2607
0
  }
2608
0
  if( libcdata_array_get_entry_by_index(
2609
0
       internal_record->values_array,
2610
0
       value_entry,
2611
0
       (intptr_t **) &record_value,
2612
0
       error ) != 1 )
2613
0
  {
2614
0
    libcerror_error_set(
2615
0
     error,
2616
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2617
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2618
0
     "%s: unable to retrieve value: %d from values array.",
2619
0
     function,
2620
0
     value_entry );
2621
2622
0
    return( -1 );
2623
0
  }
2624
0
  result = libfvalue_value_has_data(
2625
0
            record_value,
2626
0
            error );
2627
2628
0
  if( result == -1 )
2629
0
  {
2630
0
    libcerror_error_set(
2631
0
     error,
2632
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2633
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2634
0
     "%s: unable to determine if value: %d has data.",
2635
0
     function,
2636
0
     value_entry );
2637
2638
0
    return( -1 );
2639
0
  }
2640
0
  else if( result != 0 )
2641
0
  {
2642
0
    if( libfvalue_value_get_data_flags(
2643
0
         record_value,
2644
0
         &data_flags,
2645
0
         error ) != 1 )
2646
0
    {
2647
0
      libcerror_error_set(
2648
0
       error,
2649
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
2650
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2651
0
       "%s: unable to retrieve value: %d data flags.",
2652
0
       function,
2653
0
       value_entry );
2654
2655
0
      return( -1 );
2656
0
    }
2657
0
    if( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 )
2658
0
    {
2659
0
      if( libfvalue_value_get_entry_data(
2660
0
           record_value,
2661
0
           0,
2662
0
           &entry_data,
2663
0
           &entry_data_size,
2664
0
           &encoding,
2665
0
           error ) != 1 )
2666
0
      {
2667
0
        libcerror_error_set(
2668
0
         error,
2669
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
2670
0
         LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2671
0
         "%s: unable to retrieve record value entry data.",
2672
0
         function );
2673
2674
0
        return( -1 );
2675
0
      }
2676
0
      result = libesedb_compression_decompress_get_size(
2677
0
                entry_data,
2678
0
                entry_data_size,
2679
0
                binary_data_size,
2680
0
                error );
2681
0
    }
2682
0
    else
2683
0
    {
2684
0
       result = libfvalue_value_get_data(
2685
0
                 record_value,
2686
0
                 &value_data,
2687
0
                 binary_data_size,
2688
0
                 &encoding,
2689
0
                 error );
2690
0
    }
2691
0
    if( result != 1 )
2692
0
    {
2693
0
      libcerror_error_set(
2694
0
       error,
2695
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
2696
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2697
0
       "%s: unable retrieve value data.",
2698
0
       function );
2699
2700
0
      return( -1 );
2701
0
    }
2702
0
  }
2703
0
  return( result );
2704
0
}
2705
2706
/* Retrieves the binary data value of a specific entry
2707
 * Returns 1 if successful, 0 if value is NULL or -1 on error
2708
 */
2709
int libesedb_record_get_value_binary_data(
2710
     libesedb_record_t *record,
2711
     int value_entry,
2712
     uint8_t *binary_data,
2713
     size_t binary_data_size,
2714
     libcerror_error_t **error )
2715
0
{
2716
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
2717
0
  libesedb_internal_record_t *internal_record              = NULL;
2718
0
  libfvalue_value_t *record_value                          = NULL;
2719
0
  uint8_t *entry_data                                      = NULL;
2720
0
  static char *function                                    = "libesedb_record_get_value_binary_data";
2721
0
  size_t entry_data_size                                   = 0;
2722
0
  uint32_t column_type                                     = 0;
2723
0
  uint32_t data_flags                                      = 0;
2724
0
  int encoding                                             = 0;
2725
0
  int result                                               = 0;
2726
2727
0
  if( record == NULL )
2728
0
  {
2729
0
    libcerror_error_set(
2730
0
     error,
2731
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2732
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2733
0
     "%s: invalid record.",
2734
0
     function );
2735
2736
0
    return( -1 );
2737
0
  }
2738
0
  internal_record = (libesedb_internal_record_t *) record;
2739
2740
0
  if( libesedb_record_get_column_catalog_definition(
2741
0
       internal_record,
2742
0
       value_entry,
2743
0
       &column_catalog_definition,
2744
0
       error ) != 1 )
2745
0
  {
2746
0
    libcerror_error_set(
2747
0
     error,
2748
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2749
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2750
0
     "%s: unable to retrieve column catalog definition.",
2751
0
     function );
2752
2753
0
    return( -1 );
2754
0
  }
2755
0
  if( libesedb_catalog_definition_get_column_type(
2756
0
       column_catalog_definition,
2757
0
       &column_type,
2758
0
       error ) != 1 )
2759
0
  {
2760
0
    libcerror_error_set(
2761
0
     error,
2762
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2763
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2764
0
     "%s: unable to retrieve catalog definition column type.",
2765
0
     function );
2766
2767
0
    return( -1 );
2768
0
  }
2769
0
  if( ( column_type != LIBESEDB_COLUMN_TYPE_BINARY_DATA )
2770
0
   && ( column_type != LIBESEDB_COLUMN_TYPE_LARGE_BINARY_DATA ) )
2771
0
  {
2772
0
    libcerror_error_set(
2773
0
     error,
2774
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2775
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
2776
0
     "%s: unsupported column type: %" PRIu32 ".",
2777
0
     function,
2778
0
     column_type );
2779
2780
0
    return( -1 );
2781
0
  }
2782
0
  if( libcdata_array_get_entry_by_index(
2783
0
       internal_record->values_array,
2784
0
       value_entry,
2785
0
       (intptr_t **) &record_value,
2786
0
       error ) != 1 )
2787
0
  {
2788
0
    libcerror_error_set(
2789
0
     error,
2790
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2791
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2792
0
     "%s: unable to retrieve value: %d from values array.",
2793
0
     function,
2794
0
     value_entry );
2795
2796
0
    return( -1 );
2797
0
  }
2798
0
  result = libfvalue_value_has_data(
2799
0
            record_value,
2800
0
            error );
2801
2802
0
  if( result == -1 )
2803
0
  {
2804
0
    libcerror_error_set(
2805
0
     error,
2806
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2807
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2808
0
     "%s: unable to determine if value: %d has data.",
2809
0
     function,
2810
0
     value_entry );
2811
2812
0
    return( -1 );
2813
0
  }
2814
0
  else if( result != 0 )
2815
0
  {
2816
0
    if( libfvalue_value_get_data_flags(
2817
0
         record_value,
2818
0
         &data_flags,
2819
0
         error ) != 1 )
2820
0
    {
2821
0
      libcerror_error_set(
2822
0
       error,
2823
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
2824
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2825
0
       "%s: unable to retrieve value: %d data flags.",
2826
0
       function,
2827
0
       value_entry );
2828
2829
0
      return( -1 );
2830
0
    }
2831
0
    if( ( data_flags & LIBESEDB_VALUE_FLAG_COMPRESSED ) != 0 )
2832
0
    {
2833
0
      if( libfvalue_value_get_entry_data(
2834
0
           record_value,
2835
0
           0,
2836
0
           &entry_data,
2837
0
           &entry_data_size,
2838
0
           &encoding,
2839
0
           error ) != 1 )
2840
0
      {
2841
0
        libcerror_error_set(
2842
0
         error,
2843
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
2844
0
         LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2845
0
         "%s: unable to retrieve record value entry data.",
2846
0
         function );
2847
2848
0
        return( -1 );
2849
0
      }
2850
0
      result = libesedb_compression_decompress(
2851
0
                entry_data,
2852
0
                entry_data_size,
2853
0
                binary_data,
2854
0
                binary_data_size,
2855
0
                error );
2856
0
    }
2857
0
    else
2858
0
    {
2859
0
      result = libfvalue_value_copy_data(
2860
0
                record_value,
2861
0
                binary_data,
2862
0
                binary_data_size,
2863
0
                error );
2864
0
    }
2865
0
    if( result != 1 )
2866
0
    {
2867
0
      libcerror_error_set(
2868
0
       error,
2869
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
2870
0
       LIBCERROR_RUNTIME_ERROR_COPY_FAILED,
2871
0
       "%s: unable copy value data.",
2872
0
       function );
2873
2874
0
      return( -1 );
2875
0
    }
2876
0
  }
2877
0
  return( result );
2878
0
}
2879
2880
/* Determines if a specific entry is a long value
2881
 * Returns 1 if true, 0 if not or -1 on error
2882
 */
2883
int libesedb_record_is_long_value(
2884
     libesedb_record_t *record,
2885
     int value_entry,
2886
     libcerror_error_t **error )
2887
0
{
2888
0
  libesedb_internal_record_t *internal_record = NULL;
2889
0
  static char *function                       = "libesedb_record_is_long_value";
2890
0
  libfvalue_value_t *record_value             = NULL;
2891
0
  uint32_t data_flags                         = 0;
2892
2893
0
  if( record == NULL )
2894
0
  {
2895
0
    libcerror_error_set(
2896
0
     error,
2897
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2898
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2899
0
     "%s: invalid record.",
2900
0
     function );
2901
2902
0
    return( -1 );
2903
0
  }
2904
0
  internal_record = (libesedb_internal_record_t *) record;
2905
2906
0
  if( libcdata_array_get_entry_by_index(
2907
0
       internal_record->values_array,
2908
0
       value_entry,
2909
0
       (intptr_t **) &record_value,
2910
0
       error ) != 1 )
2911
0
  {
2912
0
    libcerror_error_set(
2913
0
     error,
2914
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2915
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2916
0
     "%s: unable to retrieve value: %d from values array.",
2917
0
     function,
2918
0
     value_entry );
2919
2920
0
    return( -1 );
2921
0
  }
2922
0
  if( libfvalue_value_get_data_flags(
2923
0
       record_value,
2924
0
       &data_flags,
2925
0
       error ) != 1 )
2926
0
  {
2927
0
    libcerror_error_set(
2928
0
     error,
2929
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2930
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2931
0
     "%s: unable to retrieve value: %d data flags.",
2932
0
     function,
2933
0
     value_entry );
2934
2935
0
    return( -1 );
2936
0
  }
2937
0
  return( ( data_flags & LIBESEDB_VALUE_FLAG_LONG_VALUE ) != 0 );
2938
0
}
2939
2940
/* Determines if a specific entry is a multi value
2941
 * Returns 1 if true, 0 if not or -1 on error
2942
 */
2943
int libesedb_record_is_multi_value(
2944
     libesedb_record_t *record,
2945
     int value_entry,
2946
     libcerror_error_t **error )
2947
0
{
2948
0
  libesedb_internal_record_t *internal_record = NULL;
2949
0
  static char *function                       = "libesedb_record_is_multi_value";
2950
0
  libfvalue_value_t *record_value             = NULL;
2951
0
  uint32_t data_flags                         = 0;
2952
2953
0
  if( record == NULL )
2954
0
  {
2955
0
    libcerror_error_set(
2956
0
     error,
2957
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
2958
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
2959
0
     "%s: invalid record.",
2960
0
     function );
2961
2962
0
    return( -1 );
2963
0
  }
2964
0
  internal_record = (libesedb_internal_record_t *) record;
2965
2966
0
  if( libcdata_array_get_entry_by_index(
2967
0
       internal_record->values_array,
2968
0
       value_entry,
2969
0
       (intptr_t **) &record_value,
2970
0
       error ) != 1 )
2971
0
  {
2972
0
    libcerror_error_set(
2973
0
     error,
2974
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2975
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2976
0
     "%s: unable to retrieve value: %d from values array.",
2977
0
     function,
2978
0
     value_entry );
2979
2980
0
    return( -1 );
2981
0
  }
2982
0
  if( libfvalue_value_get_data_flags(
2983
0
       record_value,
2984
0
       &data_flags,
2985
0
       error ) != 1 )
2986
0
  {
2987
0
    libcerror_error_set(
2988
0
     error,
2989
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
2990
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
2991
0
     "%s: unable to retrieve value: %d data flags.",
2992
0
     function,
2993
0
     value_entry );
2994
2995
0
    return( -1 );
2996
0
  }
2997
0
  return( ( data_flags & LIBESEDB_VALUE_FLAG_MULTI_VALUE ) != 0 );
2998
0
}
2999
3000
/* Retrieves the long value data segments list of a specific entry
3001
 * Creates a new data segments list
3002
 * Returns 1 if successful, 0 if the item does not contain such value or -1 on error
3003
 */
3004
int libesedb_record_get_long_value_data_segments_list(
3005
     libesedb_internal_record_t *internal_record,
3006
     const uint8_t *long_value_key,
3007
     size_t long_value_key_size,
3008
     libfdata_list_t **data_segments_list,
3009
     libcerror_error_t **error )
3010
0
{
3011
0
  uint8_t long_value_segment_key[ 8 ];
3012
3013
0
  libesedb_data_definition_t *data_definition = NULL;
3014
0
  libesedb_page_tree_key_t *key               = NULL;
3015
0
  static char *function                       = "libesedb_record_get_long_value_data_segments_list";
3016
0
  uint32_t long_value_segment_offset          = 0;
3017
0
  int result                                  = 0;
3018
3019
0
  if( internal_record == NULL )
3020
0
  {
3021
0
    libcerror_error_set(
3022
0
     error,
3023
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3024
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3025
0
     "%s: invalid record.",
3026
0
     function );
3027
3028
0
    return( -1 );
3029
0
  }
3030
0
  if( long_value_key == NULL )
3031
0
  {
3032
0
    libcerror_error_set(
3033
0
     error,
3034
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3035
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3036
0
     "%s: invalid long value key.",
3037
0
     function );
3038
3039
0
    return( -1 );
3040
0
  }
3041
0
  if( long_value_key_size != 4 )
3042
0
  {
3043
0
    libcerror_error_set(
3044
0
     error,
3045
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3046
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
3047
0
     "%s: unsupport long value key size: %" PRIzd ".",
3048
0
     function,
3049
0
     long_value_key_size );
3050
3051
0
    return( -1 );
3052
0
  }
3053
0
  if( data_segments_list == NULL )
3054
0
  {
3055
0
    libcerror_error_set(
3056
0
     error,
3057
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3058
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3059
0
     "%s: invalid data segments list.",
3060
0
     function );
3061
3062
0
    return( -1 );
3063
0
  }
3064
0
  if( libesedb_page_tree_key_initialize(
3065
0
       &key,
3066
0
       error ) != 1 )
3067
0
  {
3068
0
    libcerror_error_set(
3069
0
     error,
3070
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3071
0
     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
3072
0
     "%s: unable to create key.",
3073
0
     function );
3074
3075
0
    goto on_error;
3076
0
  }
3077
0
  if( libesedb_page_tree_key_set_data(
3078
0
       key,
3079
0
       long_value_key,
3080
0
       long_value_key_size,
3081
0
       error ) != 1 )
3082
0
  {
3083
0
    libcerror_error_set(
3084
0
     error,
3085
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3086
0
     LIBCERROR_RUNTIME_ERROR_SET_FAILED,
3087
0
     "%s: unable to set long value key data in key.",
3088
0
     function );
3089
3090
0
    goto on_error;
3091
0
  }
3092
0
  key->type = LIBESEDB_KEY_TYPE_LONG_VALUE;
3093
3094
0
  result = libesedb_page_tree_get_leaf_value_by_key(
3095
0
            internal_record->long_values_page_tree,
3096
0
            internal_record->file_io_handle,
3097
0
            key,
3098
0
            &data_definition,
3099
0
            error );
3100
3101
0
  if( result == -1 )
3102
0
  {
3103
0
    libcerror_error_set(
3104
0
     error,
3105
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3106
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3107
0
     "%s: unable to retrieve leaf value by key.",
3108
0
     function );
3109
3110
0
    goto on_error;
3111
0
  }
3112
0
  if( libesedb_page_tree_key_free(
3113
0
       &key,
3114
0
       error ) != 1 )
3115
0
  {
3116
0
    libcerror_error_set(
3117
0
     error,
3118
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3119
0
     LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
3120
0
     "%s: unable to free key.",
3121
0
     function );
3122
3123
0
    goto on_error;
3124
0
  }
3125
0
  if( result == 0 )
3126
0
  {
3127
0
    return( 0 );
3128
0
  }
3129
0
  if( libfdata_list_initialize(
3130
0
       data_segments_list,
3131
0
       NULL,
3132
0
       NULL,
3133
0
       NULL,
3134
0
       (int (*)(intptr_t *, intptr_t *, libfdata_list_element_t *, libfdata_cache_t *, int, off64_t, size64_t, uint32_t, uint8_t, libcerror_error_t **)) &libesedb_data_segment_read_element_data,
3135
0
       NULL,
3136
0
       0,
3137
0
       error ) != 1 )
3138
0
  {
3139
0
    libcerror_error_set(
3140
0
     error,
3141
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3142
0
     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
3143
0
     "%s: unable to create data segments list.",
3144
0
     function );
3145
3146
0
    goto on_error;
3147
0
  }
3148
0
  if( libesedb_data_definition_read_long_value(
3149
0
       data_definition,
3150
0
       internal_record->file_io_handle,
3151
0
       internal_record->long_values_pages_vector,
3152
0
       internal_record->long_values_pages_cache,
3153
0
       error ) != 1 )
3154
0
  {
3155
0
    libcerror_error_set(
3156
0
     error,
3157
0
     LIBCERROR_ERROR_DOMAIN_IO,
3158
0
     LIBCERROR_IO_ERROR_READ_FAILED,
3159
0
     "%s: unable to read data definition long value.",
3160
0
     function );
3161
3162
0
    goto on_error;
3163
0
  }
3164
0
  if( libesedb_data_definition_free(
3165
0
       &data_definition,
3166
0
       error ) != 1 )
3167
0
  {
3168
0
    libcerror_error_set(
3169
0
     error,
3170
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3171
0
     LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
3172
0
     "%s: unable to free data definition.",
3173
0
     function );
3174
3175
0
    goto on_error;
3176
0
  }
3177
  /* Reverse the reversed long value key
3178
   */
3179
0
  long_value_segment_key[ 0 ] = long_value_key[ 3 ];
3180
0
  long_value_segment_key[ 1 ] = long_value_key[ 2 ];
3181
0
  long_value_segment_key[ 2 ] = long_value_key[ 1 ];
3182
0
  long_value_segment_key[ 3 ] = long_value_key[ 0 ];
3183
3184
0
  do
3185
0
  {
3186
0
    byte_stream_copy_from_uint32_big_endian(
3187
0
     &( long_value_segment_key[ 4 ] ),
3188
0
     long_value_segment_offset );
3189
3190
0
    if( libesedb_page_tree_key_initialize(
3191
0
         &key,
3192
0
         error ) != 1 )
3193
0
    {
3194
0
      libcerror_error_set(
3195
0
       error,
3196
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3197
0
       LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
3198
0
       "%s: unable to create key.",
3199
0
       function );
3200
3201
0
      goto on_error;
3202
0
    }
3203
0
    if( libesedb_page_tree_key_set_data(
3204
0
         key,
3205
0
         long_value_segment_key,
3206
0
         8,
3207
0
         error ) != 1 )
3208
0
    {
3209
0
      libcerror_error_set(
3210
0
       error,
3211
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3212
0
       LIBCERROR_RUNTIME_ERROR_SET_FAILED,
3213
0
       "%s: unable to set long value segment key data in key.",
3214
0
       function );
3215
3216
0
      goto on_error;
3217
0
    }
3218
0
    key->type = LIBESEDB_KEY_TYPE_LONG_VALUE_SEGMENT;
3219
3220
0
    result = libesedb_page_tree_get_leaf_value_by_key(
3221
0
              internal_record->long_values_page_tree,
3222
0
              internal_record->file_io_handle,
3223
0
              key,
3224
0
              &data_definition,
3225
0
              error );
3226
3227
0
    if( result == -1 )
3228
0
    {
3229
0
      libcerror_error_set(
3230
0
       error,
3231
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3232
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3233
0
       "%s: unable to retrieve leaf value by key.",
3234
0
       function );
3235
3236
0
      goto on_error;
3237
0
    }
3238
0
    else if( result != 0 )
3239
0
    {
3240
0
      if( libesedb_data_definition_read_long_value_segment(
3241
0
           data_definition,
3242
0
           internal_record->file_io_handle,
3243
0
           internal_record->io_handle,
3244
0
           internal_record->long_values_pages_vector,
3245
0
           internal_record->long_values_pages_cache,
3246
0
           long_value_segment_offset,
3247
0
           *data_segments_list,
3248
0
           error ) != 1 )
3249
0
      {
3250
0
        libcerror_error_set(
3251
0
         error,
3252
0
         LIBCERROR_ERROR_DOMAIN_IO,
3253
0
         LIBCERROR_IO_ERROR_READ_FAILED,
3254
0
         "%s: unable to read data definition long value segment.",
3255
0
         function );
3256
3257
0
        goto on_error;
3258
0
      }
3259
0
      long_value_segment_offset += data_definition->data_size;
3260
3261
0
      if( libesedb_data_definition_free(
3262
0
           &data_definition,
3263
0
           error ) != 1 )
3264
0
      {
3265
0
        libcerror_error_set(
3266
0
         error,
3267
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
3268
0
         LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
3269
0
         "%s: unable to free data definition.",
3270
0
         function );
3271
3272
0
        goto on_error;
3273
0
      }
3274
0
    }
3275
0
    if( libesedb_page_tree_key_free(
3276
0
         &key,
3277
0
         error ) != 1 )
3278
0
    {
3279
0
      libcerror_error_set(
3280
0
       error,
3281
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3282
0
       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,
3283
0
       "%s: unable to free key.",
3284
0
       function );
3285
3286
0
      goto on_error;
3287
0
    }
3288
0
  }
3289
0
  while( result == 1 );
3290
3291
0
  return( 1 );
3292
3293
0
on_error:
3294
0
  if( *data_segments_list != NULL )
3295
0
  {
3296
0
    libfdata_list_free(
3297
0
     data_segments_list,
3298
0
     NULL );
3299
0
  }
3300
0
  if( data_definition != NULL )
3301
0
  {
3302
0
    libesedb_data_definition_free(
3303
0
     &data_definition,
3304
0
     NULL );
3305
0
  }
3306
0
  if( key != NULL )
3307
0
  {
3308
0
    libesedb_page_tree_key_free(
3309
0
     &key,
3310
0
     NULL );
3311
0
  }
3312
0
  return( -1 );
3313
0
}
3314
3315
/* Retrieves the long value of a specific entry
3316
 * Creates a new long value
3317
 * Returns 1 if successful, 0 if the item does not contain such value or -1 on error
3318
 */
3319
int libesedb_record_get_long_value(
3320
     libesedb_record_t *record,
3321
     int value_entry,
3322
     libesedb_long_value_t **long_value,
3323
     libcerror_error_t **error )
3324
0
{
3325
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
3326
0
  libesedb_internal_record_t *internal_record              = NULL;
3327
0
  libfdata_list_t *data_segments_list                      = NULL;
3328
0
  libfvalue_value_t *record_value                          = NULL;
3329
0
  uint8_t* value_data                                      = NULL;
3330
0
  static char *function                                    = "libesedb_record_get_long_value";
3331
0
  size_t value_data_size                                   = 0;
3332
0
  uint32_t data_flags                                      = 0;
3333
0
  int encoding                                             = 0;
3334
0
  int result                                               = 0;
3335
3336
0
  if( record == NULL )
3337
0
  {
3338
0
    libcerror_error_set(
3339
0
     error,
3340
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3341
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3342
0
     "%s: invalid record.",
3343
0
     function );
3344
3345
0
    return( -1 );
3346
0
  }
3347
0
  internal_record = (libesedb_internal_record_t *) record;
3348
3349
0
  if( long_value == NULL )
3350
0
  {
3351
0
    libcerror_error_set(
3352
0
     error,
3353
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3354
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3355
0
     "%s: invalid long value.",
3356
0
     function );
3357
3358
0
    return( -1 );
3359
0
  }
3360
0
  if( *long_value != NULL )
3361
0
  {
3362
0
    libcerror_error_set(
3363
0
     error,
3364
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3365
0
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
3366
0
     "%s: long value already set.",
3367
0
     function );
3368
3369
0
    return( -1 );
3370
0
  }
3371
0
  if( libesedb_record_get_column_catalog_definition(
3372
0
       internal_record,
3373
0
       value_entry,
3374
0
       &column_catalog_definition,
3375
0
       error ) != 1 )
3376
0
  {
3377
0
    libcerror_error_set(
3378
0
     error,
3379
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3380
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3381
0
     "%s: unable to retrieve column catalog definition.",
3382
0
     function );
3383
3384
0
    goto on_error;
3385
0
  }
3386
0
  if( libcdata_array_get_entry_by_index(
3387
0
       internal_record->values_array,
3388
0
       value_entry,
3389
0
       (intptr_t **) &record_value,
3390
0
       error ) != 1 )
3391
0
  {
3392
0
    libcerror_error_set(
3393
0
     error,
3394
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3395
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3396
0
     "%s: unable to retrieve value: %d from values array.",
3397
0
     function,
3398
0
     value_entry );
3399
3400
0
    goto on_error;
3401
0
  }
3402
0
  if( libfvalue_value_get_data_flags(
3403
0
       record_value,
3404
0
       &data_flags,
3405
0
       error ) != 1 )
3406
0
  {
3407
0
    libcerror_error_set(
3408
0
     error,
3409
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3410
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3411
0
     "%s: unable to retrieve value: %d data flags.",
3412
0
     function,
3413
0
     value_entry );
3414
3415
0
    goto on_error;
3416
0
  }
3417
0
  if( ( data_flags & LIBESEDB_VALUE_FLAG_LONG_VALUE ) == 0 )
3418
0
  {
3419
0
    libcerror_error_set(
3420
0
     error,
3421
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3422
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
3423
0
     "%s: unsupported data flags: 0x%02" PRIx32 ".",
3424
0
     function,
3425
0
     data_flags );
3426
3427
0
    goto on_error;
3428
0
  }
3429
0
  if( ( data_flags & LIBESEDB_VALUE_FLAG_MULTI_VALUE ) != 0 )
3430
0
  {
3431
0
    libcerror_error_set(
3432
0
     error,
3433
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3434
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
3435
0
     "%s: unsupported data flags: 0x%02" PRIx32 ".",
3436
0
     function,
3437
0
     data_flags );
3438
3439
0
    goto on_error;
3440
0
  }
3441
0
  result = libfvalue_value_has_data(
3442
0
            record_value,
3443
0
            error );
3444
3445
0
  if( result == -1 )
3446
0
  {
3447
0
    libcerror_error_set(
3448
0
     error,
3449
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3450
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3451
0
     "%s: unable to determine if value: %d has data.",
3452
0
     function,
3453
0
     value_entry );
3454
3455
0
    goto on_error;
3456
0
  }
3457
0
  else if( result == 0 )
3458
0
  {
3459
0
    return( 0 );
3460
0
  }
3461
0
  if( libfvalue_value_get_data(
3462
0
       record_value,
3463
0
       &value_data,
3464
0
       &value_data_size,
3465
0
       &encoding,
3466
0
       error ) != 1 )
3467
0
  {
3468
0
    libcerror_error_set(
3469
0
     error,
3470
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3471
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3472
0
     "%s: unable retrieve value data.",
3473
0
     function );
3474
3475
0
    goto on_error;
3476
0
  }
3477
0
  result = libesedb_record_get_long_value_data_segments_list(
3478
0
      internal_record,
3479
0
      value_data,
3480
0
      value_data_size,
3481
0
      &data_segments_list,
3482
0
      error );
3483
3484
0
  if( result == -1 )
3485
0
  {
3486
0
    libcerror_error_set(
3487
0
     error,
3488
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3489
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3490
0
     "%s: unable retrieve value data.",
3491
0
     function );
3492
3493
0
    goto on_error;
3494
0
  }
3495
0
  else if( result == 0 )
3496
0
  {
3497
0
    return( 0 );
3498
0
  }
3499
0
  if( libesedb_long_value_initialize(
3500
0
       long_value,
3501
0
       internal_record->file_io_handle,
3502
0
       internal_record->io_handle,
3503
0
       column_catalog_definition,
3504
0
       data_segments_list,
3505
0
       error ) != 1 )
3506
0
  {
3507
0
    libcerror_error_set(
3508
0
     error,
3509
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3510
0
     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
3511
0
     "%s: unable to create long value.",
3512
0
     function );
3513
3514
0
    goto on_error;
3515
0
  }
3516
0
  return( 1 );
3517
3518
0
on_error:
3519
0
  if( data_segments_list != NULL )
3520
0
  {
3521
0
    libfdata_list_free(
3522
0
     &data_segments_list,
3523
0
     NULL );
3524
0
  }
3525
0
  return( -1 );
3526
0
}
3527
3528
/* Retrieves the multi value of a specific entry
3529
 * Creates a new multi value
3530
 * Returns 1 if successful, 0 if the item does not contain such value or -1 on error
3531
 */
3532
int libesedb_record_get_multi_value(
3533
     libesedb_record_t *record,
3534
     int value_entry,
3535
     libesedb_multi_value_t **multi_value,
3536
     libcerror_error_t **error )
3537
0
{
3538
0
  libesedb_catalog_definition_t *column_catalog_definition = NULL;
3539
0
  libesedb_internal_record_t *internal_record              = NULL;
3540
0
  libfvalue_value_t *record_value                          = NULL;
3541
0
  uint8_t *value_data                                      = NULL;
3542
0
  static char *function                                    = "libesedb_record_get_multi_value";
3543
0
  size_t value_data_offset                                 = 0;
3544
0
  size_t value_data_size                                   = 0;
3545
0
  uint32_t data_flags                                      = 0;
3546
0
  uint16_t number_of_value_entries                         = 0;
3547
0
  uint16_t value_16bit                                     = 0;
3548
0
  uint16_t value_entry_offset                              = 0;
3549
0
  uint16_t value_entry_offset_index                        = 0;
3550
0
  uint16_t value_entry_size                                = 0;
3551
0
  int encoding                                             = 0;
3552
0
  int result                                               = 0;
3553
0
  int value_entry_index                                    = 0;
3554
3555
0
  if( record == NULL )
3556
0
  {
3557
0
    libcerror_error_set(
3558
0
     error,
3559
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3560
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3561
0
     "%s: invalid record.",
3562
0
     function );
3563
3564
0
    return( -1 );
3565
0
  }
3566
0
  internal_record = (libesedb_internal_record_t *) record;
3567
3568
0
  if( multi_value == NULL )
3569
0
  {
3570
0
    libcerror_error_set(
3571
0
     error,
3572
0
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
3573
0
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
3574
0
     "%s: invalid multi value.",
3575
0
     function );
3576
3577
0
    return( -1 );
3578
0
  }
3579
0
  if( *multi_value != NULL )
3580
0
  {
3581
0
    libcerror_error_set(
3582
0
     error,
3583
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3584
0
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
3585
0
     "%s: multi value already set.",
3586
0
     function );
3587
3588
0
    return( -1 );
3589
0
  }
3590
0
  if( libesedb_record_get_column_catalog_definition(
3591
0
       internal_record,
3592
0
       value_entry,
3593
0
       &column_catalog_definition,
3594
0
       error ) != 1 )
3595
0
  {
3596
0
    libcerror_error_set(
3597
0
     error,
3598
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3599
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3600
0
     "%s: unable to retrieve column catalog definition.",
3601
0
     function );
3602
3603
0
    return( -1 );
3604
0
  }
3605
0
  if( column_catalog_definition == NULL )
3606
0
  {
3607
0
    libcerror_error_set(
3608
0
     error,
3609
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3610
0
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
3611
0
     "%s: missing column catalog definition.",
3612
0
     function );
3613
3614
0
    return( -1 );
3615
0
  }
3616
0
  if( libcdata_array_get_entry_by_index(
3617
0
       internal_record->values_array,
3618
0
       value_entry,
3619
0
       (intptr_t **) &record_value,
3620
0
       error ) != 1 )
3621
0
  {
3622
0
    libcerror_error_set(
3623
0
     error,
3624
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3625
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3626
0
     "%s: unable to retrieve value: %d from values array.",
3627
0
     function,
3628
0
     value_entry );
3629
3630
0
    return( -1 );
3631
0
  }
3632
0
  if( libfvalue_value_get_data_flags(
3633
0
       record_value,
3634
0
       &data_flags,
3635
0
       error ) != 1 )
3636
0
  {
3637
0
    libcerror_error_set(
3638
0
     error,
3639
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3640
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3641
0
     "%s: unable to retrieve value: %d data flags.",
3642
0
     function,
3643
0
     value_entry );
3644
3645
0
    return( -1 );
3646
0
  }
3647
0
  if( ( data_flags & LIBESEDB_VALUE_FLAG_MULTI_VALUE ) == 0 )
3648
0
  {
3649
0
    libcerror_error_set(
3650
0
     error,
3651
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3652
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
3653
0
     "%s: unsupported data flags: 0x%02" PRIx32 ".",
3654
0
     function,
3655
0
     data_flags );
3656
3657
0
    return( -1 );
3658
0
  }
3659
0
  if( ( ( data_flags & LIBESEDB_VALUE_FLAG_LONG_VALUE ) != 0 )
3660
0
   || ( ( data_flags & 0x10 ) != 0 ) )
3661
0
  {
3662
0
    libcerror_error_set(
3663
0
     error,
3664
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3665
0
     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,
3666
0
     "%s: unsupported data flags: 0x%02" PRIx32 ".",
3667
0
     function,
3668
0
     data_flags );
3669
3670
0
    return( -1 );
3671
0
  }
3672
0
  result = libfvalue_value_has_data(
3673
0
            record_value,
3674
0
            error );
3675
3676
0
  if( result == -1 )
3677
0
  {
3678
0
    libcerror_error_set(
3679
0
     error,
3680
0
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
3681
0
     LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3682
0
     "%s: unable to determine if value: %d has data.",
3683
0
     function,
3684
0
     value_entry );
3685
3686
0
    return( -1 );
3687
0
  }
3688
0
  else if( result != 0 )
3689
0
  {
3690
0
    if( libfvalue_value_get_data(
3691
0
         record_value,
3692
0
         &value_data,
3693
0
         &value_data_size,
3694
0
         &encoding,
3695
0
         error ) != 1 )
3696
0
    {
3697
0
      libcerror_error_set(
3698
0
       error,
3699
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3700
0
       LIBCERROR_RUNTIME_ERROR_GET_FAILED,
3701
0
       "%s: unable retrieve value data.",
3702
0
       function );
3703
3704
0
      return( -1 );
3705
0
    }
3706
0
    if( value_data == NULL )
3707
0
    {
3708
0
      libcerror_error_set(
3709
0
       error,
3710
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3711
0
       LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
3712
0
       "%s: missing value data.",
3713
0
       function );
3714
3715
0
      return( -1 );
3716
0
    }
3717
0
    if( value_data_size > (size_t) UINT16_MAX )
3718
0
    {
3719
0
      libcerror_error_set(
3720
0
       error,
3721
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3722
0
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
3723
0
       "%s: invalid value data size value out of bounds.",
3724
0
       function );
3725
3726
0
      return( -1 );
3727
0
    }
3728
#if defined( HAVE_DEBUG_OUTPUT )
3729
    if( libcnotify_verbose != 0 )
3730
    {
3731
      libcnotify_printf(
3732
       "%s: multi value data:\n",
3733
       function );
3734
      libcnotify_print_data(
3735
       value_data,
3736
       value_data_size,
3737
       0 );
3738
    }
3739
#endif
3740
    /* The first 2 bytes contain the offset to the first value
3741
     * there is an offset for every value
3742
     * therefore first offset / 2 = the number of value entries
3743
     */
3744
0
    byte_stream_copy_to_uint16_little_endian(
3745
0
     value_data,
3746
0
     value_16bit );
3747
3748
0
    value_data_offset += 2;
3749
3750
#if defined( HAVE_DEBUG_OUTPUT )
3751
    if( libcnotify_verbose != 0 )
3752
    {
3753
      libcnotify_printf(
3754
       "%s: multi value offset: %03" PRIu16 "\t\t: 0x%04" PRIx16 " (%" PRIu16 ")\n",
3755
       function,
3756
       value_entry_offset_index,
3757
       value_16bit,
3758
       value_16bit & 0x7fff );
3759
    }
3760
#endif
3761
0
    value_entry_offset = value_16bit & 0x7fff;
3762
3763
0
    number_of_value_entries = value_entry_offset / 2;
3764
3765
0
    if( number_of_value_entries == 0 )
3766
0
    {
3767
0
      libcerror_error_set(
3768
0
       error,
3769
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3770
0
       LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
3771
0
       "%s: missing value entries.",
3772
0
       function );
3773
3774
0
      return( -1 );
3775
0
    }
3776
0
    for( value_entry_offset_index = 1;
3777
0
         value_entry_offset_index < number_of_value_entries;
3778
0
         value_entry_offset_index++ )
3779
0
    {
3780
0
      byte_stream_copy_to_uint16_little_endian(
3781
0
       &( value_data[ value_data_offset ] ),
3782
0
       value_16bit );
3783
3784
0
      value_data_offset += 2;
3785
3786
#if defined( HAVE_DEBUG_OUTPUT )
3787
      if( libcnotify_verbose != 0 )
3788
      {
3789
        libcnotify_printf(
3790
         "%s: multi value offset: %03" PRIu16 "\t\t: 0x%04" PRIx16 " (%" PRIu16 ")\n",
3791
         function,
3792
         value_entry_offset_index,
3793
         value_16bit,
3794
         value_16bit & 0x7fff );
3795
      }
3796
#endif
3797
0
      value_16bit &= 0x7fff;
3798
3799
0
      if( value_16bit < value_entry_offset )
3800
0
      {
3801
0
        libcerror_error_set(
3802
0
         error,
3803
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
3804
0
         LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
3805
0
         "%s: invalid value offset: %" PRIu16 " value is smaller than previous.",
3806
0
         function,
3807
0
         value_entry_offset_index );
3808
3809
0
        return( -1 );
3810
0
      }
3811
0
      value_entry_size = value_16bit - value_entry_offset;
3812
3813
0
      if( libfvalue_value_append_entry(
3814
0
           record_value,
3815
0
           &value_entry_index,
3816
0
           (size_t) value_entry_offset,
3817
0
           (size_t) value_entry_size,
3818
0
           error ) != 1 )
3819
0
      {
3820
0
        libcerror_error_set(
3821
0
         error,
3822
0
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
3823
0
         LIBCERROR_RUNTIME_ERROR_SET_FAILED,
3824
0
         "%s: unable set value entry: %" PRIu16 ".",
3825
0
         function,
3826
0
         value_entry_offset_index - 1 );
3827
3828
0
        return( -1 );
3829
0
      }
3830
0
      value_entry_offset = value_16bit;
3831
0
    }
3832
0
    value_entry_size = (uint16_t) value_data_size - value_entry_offset;
3833
3834
0
    if( libfvalue_value_append_entry(
3835
0
         record_value,
3836
0
         &value_entry_index,
3837
0
         (size_t) value_entry_offset,
3838
0
         (size_t) value_entry_size,
3839
0
         error ) != 1 )
3840
0
    {
3841
0
      libcerror_error_set(
3842
0
       error,
3843
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3844
0
       LIBCERROR_RUNTIME_ERROR_SET_FAILED,
3845
0
       "%s: unable set value entry: %" PRIu16 ".",
3846
0
       function,
3847
0
       value_entry_offset_index - 1 );
3848
3849
0
      return( -1 );
3850
0
    }
3851
#if defined( HAVE_DEBUG_OUTPUT )
3852
    if( libcnotify_verbose != 0 )
3853
    {
3854
      libcnotify_printf(
3855
       "\n" );
3856
    }
3857
#endif
3858
0
    if( libesedb_multi_value_initialize(
3859
0
         multi_value,
3860
0
         column_catalog_definition,
3861
0
         record_value,
3862
0
         error ) != 1 )
3863
0
    {
3864
0
      libcerror_error_set(
3865
0
       error,
3866
0
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
3867
0
       LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,
3868
0
       "%s: unable to create multi value.",
3869
0
       function );
3870
3871
0
      return( -1 );
3872
0
    }
3873
0
  }
3874
0
  return( result );
3875
0
}
3876