/src/libfwsi/libfwsi/libfwsi_file_entry_extension_values.c

Source
/*
 * File entry extension values functions
 *
 * Copyright (C) 2010-2026, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwsi_debug.h"
#include "libfwsi_definitions.h"
#include "libfwsi_file_entry_extension_values.h"
#include "libfwsi_libcerror.h"
#include "libfwsi_libcnotify.h"
#include "libfwsi_libfdatetime.h"
#include "libfwsi_libuna.h"

/* Creates file entry extension values
 * Make sure the value file_entry_extension_values is referencing, is set to NULL
 * Returns 1 if successful or -1 on error
 */
int libfwsi_file_entry_extension_values_initialize(
     libfwsi_file_entry_extension_values_t **file_entry_extension_values,
     libcerror_error_t **error )
{
  static char *function = "libfwsi_file_entry_extension_values_initialize";

  if( file_entry_extension_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid file entry extension values.",
     function );

    return( -1 );
  }
  if( *file_entry_extension_values != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid file entry extension values value already set.",
     function );

    return( -1 );
  }
  *file_entry_extension_values = memory_allocate_structure(
                                  libfwsi_file_entry_extension_values_t );

  if( *file_entry_extension_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
     "%s: unable to create file entry extension values.",
     function );

    goto on_error;
  }
  if( memory_set(
       *file_entry_extension_values,
       0,
       sizeof( libfwsi_file_entry_extension_values_t ) ) == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
     "%s: unable to clear file entry extension values.",
     function );

    goto on_error;
  }
  return( 1 );

on_error:
  if( *file_entry_extension_values != NULL )
  {
    memory_free(
     *file_entry_extension_values );

    *file_entry_extension_values = NULL;
  }
  return( -1 );
}

/* Frees file entry extension values
 * Returns 1 if successful or -1 on error
 */
int libfwsi_file_entry_extension_values_free(
     libfwsi_file_entry_extension_values_t **file_entry_extension_values,
     libcerror_error_t **error )
{
  static char *function = "libfwsi_file_entry_extension_values_free";

  if( file_entry_extension_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid file entry extension values.",
     function );

    return( -1 );
  }
  if( *file_entry_extension_values != NULL )
  {
    if( ( *file_entry_extension_values )->long_name != NULL )
    {
      memory_free(
       ( *file_entry_extension_values )->long_name );
    }
    if( ( *file_entry_extension_values )->localized_name != NULL )
    {
      memory_free(
       ( *file_entry_extension_values )->localized_name );
    }
    memory_free(
     *file_entry_extension_values );

    *file_entry_extension_values = NULL;
  }
  return( 1 );
}

/* Reads the file entry extension values
 * Returns 1 if successful, 0 if not supported or -1 on error
 */
int libfwsi_file_entry_extension_values_read_data(
     libfwsi_file_entry_extension_values_t *file_entry_extension_values,
     const uint8_t *data,
     size_t data_size,
     int ascii_codepage,
     libcerror_error_t **error )
{
  static char *function          = "libfwsi_file_entry_extension_values_read_data";
  size_t data_offset             = 0;
  size_t string_size             = 0;
  uint32_t signature             = 0;
  uint16_t localized_name_offset = 0;
  uint16_t long_name_offset      = 0;
  uint16_t version               = 0;

#if defined( HAVE_DEBUG_OUTPUT )
  uint16_t value_16bit      = 0;
#endif

  if( file_entry_extension_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid file entry extension values.",
     function );

    return( -1 );
  }
  if( data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid data.",
     function );

    return( -1 );
  }
  if( data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: data size exceeds maximum.",
     function );

    return( -1 );
  }
  /* Do not try to parse unsupported data sizes
   */
  if( data_size < 20 )
  {
    return( 0 );
  }
  /* Do not try to parse unsupported extension block signatures
   */
  byte_stream_copy_to_uint32_little_endian(
   &( data[ 4 ] ),
   signature );

  if( signature != 0xbeef0004 )
  {
    return( 0 );
  }
  /* Do not try to parse unsupported version values
   */
  byte_stream_copy_to_uint32_little_endian(
   &( data[ 2 ] ),
   version );

  if( ( version != 3 )
   && ( version != 7 )
   && ( version != 8 )
   && ( version != 9 ) )
  {
    return( 0 );
  }
  file_entry_extension_values->ascii_codepage = ascii_codepage;

  byte_stream_copy_to_uint32_little_endian(
   &( data[ 8 ] ),
   file_entry_extension_values->creation_time );

  byte_stream_copy_to_uint32_little_endian(
   &( data[ 12 ] ),
   file_entry_extension_values->access_time );

  byte_stream_copy_to_uint16_little_endian(
   &( data[ 16 ] ),
   long_name_offset );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    if( libfwsi_debug_print_fat_date_time_value(
         function,
         "creation time\t\t",
         &( data[ 8 ] ),
         4,
         LIBFDATETIME_ENDIAN_LITTLE,
         LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME,
         error ) != 1 )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
       "%s: unable to print FAT date time value.",
       function );

      goto on_error;
    }
    if( libfwsi_debug_print_fat_date_time_value(
         function,
         "access time\t\t",
         &( data[ 12 ] ),
         4,
         LIBFDATETIME_ENDIAN_LITTLE,
         LIBFDATETIME_STRING_FORMAT_TYPE_CTIME | LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME,
         error ) != 1 )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
       "%s: unable to print FAT date time value.",
       function );

      goto on_error;
    }
    libcnotify_printf(
     "%s: long name offset\t\t: 0x%04" PRIx16 "\n",
     function,
     long_name_offset );
  }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  data_offset = 18;

  if( version >= 7 )
  {
    /* Do not try to parse unsupported data sizes
     */
    if( data_offset >= ( data_size - 18 ) )
    {
      return( 0 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      byte_stream_copy_to_uint16_little_endian(
       &( data[ data_offset ] ),
       value_16bit );

      libcnotify_printf(
       "%s: unknown1\t\t\t: 0x%04" PRIx16 "\n",
       function,
       value_16bit );
    }
#endif
    data_offset += 2;

    byte_stream_copy_to_uint64_little_endian(
     &( data[ data_offset ] ),
     file_entry_extension_values->file_reference );

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      if( file_entry_extension_values->file_reference == 0 )
      {
        libcnotify_printf(
         "%s: file reference\t\t: %" PRIu64 "\n",
         function,
         file_entry_extension_values->file_reference );
      }
      else
      {
        libcnotify_printf(
         "%s: file reference\t\t: MFT entry: %" PRIu64 ", sequence: %" PRIu64 "\n",
         function,
         file_entry_extension_values->file_reference & 0xffffffffffffUL,
         file_entry_extension_values->file_reference >> 48 );
      }
    }
#endif
    data_offset += 8;

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: unknown2:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       8,
       0 );
    }
#endif
    data_offset += 8;
  }
  /* Do not try to parse unsupported data sizes
   */
  if( data_offset >= ( data_size - 2 ) )
  {
    return( 0 );
  }
  byte_stream_copy_to_uint16_little_endian(
   &( data[ data_offset ] ),
   localized_name_offset );

#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: localized name offset\t: 0x%04" PRIx16 "\n",
     function,
     localized_name_offset );
  }
#endif
  data_offset += 2;

  if( version >= 9 )
  {
    /* Do not try to parse unsupported data sizes
     */
    if( data_offset >= ( data_size - 4 ) )
    {
      return( 0 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: unknown4:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       4,
       0 );
    }
#endif
    data_offset += 4;
  }
  if( version >= 8 )
  {
    /* Do not try to parse unsupported data sizes
     */
    if( data_offset >= ( data_size - 4 ) )
    {
      return( 0 );
    }
#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: unknown5:\n",
       function );
      libcnotify_print_data(
       &( data[ data_offset ] ),
       4,
       0 );
    }
#endif
    data_offset += 4;
  }
  if( long_name_offset > 0 )
  {
    /* Do not try to parse unsupported data sizes
     */
    if( data_offset >= data_size )
    {
      return( 0 );
    }
    /* Determine the long name size
     */
    for( string_size = data_offset;
         ( string_size + 1 ) < data_size - 2;
         string_size += 2 )
    {
      if( ( data[ string_size ] == 0 )
       && ( data[ string_size + 1 ] == 0 ) )
      {
        string_size += 2;

        break;
      }
    }
    string_size -= data_offset;

    if( ( string_size == 0 )
     || ( string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_RUNTIME,
       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
       "%s: invalid long name string size value out of bounds.",
       function );

      goto on_error;
    }
    file_entry_extension_values->long_name = (uint8_t *) memory_allocate(
                                                          sizeof( uint8_t ) * string_size );

    if( file_entry_extension_values->long_name == NULL )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_MEMORY,
       LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
       "%s: unable to create long name.",
       function );

      goto on_error;
    }
    if( memory_copy(
         file_entry_extension_values->long_name,
         &( data[ data_offset ] ),
         string_size ) == NULL )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_MEMORY,
       LIBCERROR_MEMORY_ERROR_COPY_FAILED,
       "%s: unable to copy long name.",
       function );

      goto on_error;
    }
    file_entry_extension_values->long_name_size = string_size;

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      if( libfwsi_debug_print_utf16_string_value(
           function,
           "long name\t\t",
           file_entry_extension_values->long_name,
           file_entry_extension_values->long_name_size,
           LIBUNA_ENDIAN_LITTLE,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
         "%s: unable to print UTF-16 string value.",
         function );

        goto on_error;
      }
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    data_offset += string_size;
  }
  if( localized_name_offset > 0 )
  {
    /* Do not try to parse unsupported data sizes
     */
    if( data_offset >= data_size )
    {
      return( 0 );
    }
    if( version >= 7 )
    {
      /* Determine the localized name size
       */
      for( string_size = data_offset;
           ( string_size + 1 ) < data_size - 2;
           string_size += 2 )
      {
        if( ( data[ string_size ] == 0 )
         && ( data[ string_size + 1 ] == 0 ) )
        {
          string_size += 2;

          break;
        }
      }
      string_size -= data_offset;

      if( ( string_size == 0 )
       || ( string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
         "%s: invalid localized name string size value out of bounds.",
         function );

        goto on_error;
      }
      file_entry_extension_values->localized_name = (uint8_t *) memory_allocate(
                                                                 sizeof( uint8_t ) * string_size );

      if( file_entry_extension_values->localized_name == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
         "%s: unable to create localized name.",
         function );

        goto on_error;
      }
      if( memory_copy(
           file_entry_extension_values->localized_name,
           &( data[ data_offset ] ),
           string_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy localized name.",
         function );

        goto on_error;
      }
      file_entry_extension_values->localized_name_size = string_size;

#if defined( HAVE_DEBUG_OUTPUT )
      if( libcnotify_verbose != 0 )
      {
        if( libfwsi_debug_print_utf16_string_value(
             function,
             "localized name\t\t",
             file_entry_extension_values->localized_name,
             file_entry_extension_values->localized_name_size,
             LIBUNA_ENDIAN_LITTLE,
             error ) != 1 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
           "%s: unable to print UTF-16 string value.",
           function );

          goto on_error;
        }
      }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */
    }
    else if( version >= 3 )
    {
      /* Determine the localized name size
       */
      for( string_size = data_offset;
           string_size < data_size - 2;
           string_size += 1 )
      {
        if( data[ string_size ] == 0 )
        {
          string_size += 1;

          break;
        }
      }
      string_size -= data_offset;

      if( ( string_size == 0 )
       || ( string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_RUNTIME,
         LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
         "%s: invalid localized name string size value out of bounds.",
         function );

        goto on_error;
      }
      file_entry_extension_values->localized_name = (uint8_t *) memory_allocate(
                                                                 sizeof( uint8_t ) * string_size );

      if( file_entry_extension_values->localized_name == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
         "%s: unable to create localized name.",
         function );

        goto on_error;
      }
      if( memory_copy(
           file_entry_extension_values->localized_name,
           &( data[ data_offset ] ),
           string_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy localized name.",
         function );

        goto on_error;
      }
      file_entry_extension_values->localized_name_size = string_size;

#if defined( HAVE_DEBUG_OUTPUT )
      if( libcnotify_verbose != 0 )
      {
        if( libfwsi_debug_print_string_value(
             function,
             "localized name\t\t",
             file_entry_extension_values->localized_name,
             file_entry_extension_values->localized_name_size,
             ascii_codepage,
             error ) != 1 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
           "%s: unable to print string value.",
           function );

          goto on_error;
        }
      }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */
    }
    data_offset += string_size;
  }
  return( 1 );

on_error:
  if( file_entry_extension_values->localized_name != NULL )
  {
    memory_free(
     file_entry_extension_values->localized_name );

    file_entry_extension_values->localized_name = NULL;
  }
  file_entry_extension_values->localized_name_size = 0;

  if( file_entry_extension_values->long_name != NULL )
  {
    memory_free(
     file_entry_extension_values->long_name );

    file_entry_extension_values->long_name = NULL;
  }
  file_entry_extension_values->long_name_size = 0;

  return( -1 );
}


Coverage Report

Created: 2026-05-24 07:09

Line	Count	Source
1		/*
2		* File entry extension values functions
3		*
4		* Copyright (C) 2010-2026, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwsi_debug.h"
28		#include "libfwsi_definitions.h"
29		#include "libfwsi_file_entry_extension_values.h"
30		#include "libfwsi_libcerror.h"
31		#include "libfwsi_libcnotify.h"
32		#include "libfwsi_libfdatetime.h"
33		#include "libfwsi_libuna.h"
34
35		/* Creates file entry extension values
36		* Make sure the value file_entry_extension_values is referencing, is set to NULL
37		* Returns 1 if successful or -1 on error
38		*/
39		int libfwsi_file_entry_extension_values_initialize(
40		libfwsi_file_entry_extension_values_t **file_entry_extension_values,
41		libcerror_error_t **error )
42	0	{
43	0	static char *function = "libfwsi_file_entry_extension_values_initialize";
44
45	0	if( file_entry_extension_values == NULL )
46	0	{
47	0	libcerror_error_set(
48	0	error,
49	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
50	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
51	0	"%s: invalid file entry extension values.",
52	0	function );
53
54	0	return( -1 );
55	0	}
56	0	if( *file_entry_extension_values != NULL )
57	0	{
58	0	libcerror_error_set(
59	0	error,
60	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
61	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
62	0	"%s: invalid file entry extension values value already set.",
63	0	function );
64
65	0	return( -1 );
66	0	}
67	0	*file_entry_extension_values = memory_allocate_structure(
68	0	libfwsi_file_entry_extension_values_t );
69
70	0	if( *file_entry_extension_values == NULL )
71	0	{
72	0	libcerror_error_set(
73	0	error,
74	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
75	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
76	0	"%s: unable to create file entry extension values.",
77	0	function );
78
79	0	goto on_error;
80	0	}
81	0	if( memory_set(
82	0	*file_entry_extension_values,
83	0	0,
84	0	sizeof( libfwsi_file_entry_extension_values_t ) ) == NULL )
85	0	{
86	0	libcerror_error_set(
87	0	error,
88	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
89	0	LIBCERROR_MEMORY_ERROR_SET_FAILED,
90	0	"%s: unable to clear file entry extension values.",
91	0	function );
92
93	0	goto on_error;
94	0	}
95	0	return( 1 );
96
97	0	on_error:
98	0	if( *file_entry_extension_values != NULL )
99	0	{
100	0	memory_free(
101	0	*file_entry_extension_values );
102
103	0	*file_entry_extension_values = NULL;
104	0	}
105	0	return( -1 );
106	0	}
107
108		/* Frees file entry extension values
109		* Returns 1 if successful or -1 on error
110		*/
111		int libfwsi_file_entry_extension_values_free(
112		libfwsi_file_entry_extension_values_t **file_entry_extension_values,
113		libcerror_error_t **error )
114	0	{
115	0	static char *function = "libfwsi_file_entry_extension_values_free";
116
117	0	if( file_entry_extension_values == NULL )
118	0	{
119	0	libcerror_error_set(
120	0	error,
121	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
122	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
123	0	"%s: invalid file entry extension values.",
124	0	function );
125
126	0	return( -1 );
127	0	}
128	0	if( *file_entry_extension_values != NULL )
129	0	{
130	0	if( ( *file_entry_extension_values )->long_name != NULL )
131	0	{
132	0	memory_free(
133	0	( *file_entry_extension_values )->long_name );
134	0	}
135	0	if( ( *file_entry_extension_values )->localized_name != NULL )
136	0	{
137	0	memory_free(
138	0	( *file_entry_extension_values )->localized_name );
139	0	}
140	0	memory_free(
141	0	*file_entry_extension_values );
142
143	0	*file_entry_extension_values = NULL;
144	0	}
145	0	return( 1 );
146	0	}
147
148		/* Reads the file entry extension values
149		* Returns 1 if successful, 0 if not supported or -1 on error
150		*/
151		int libfwsi_file_entry_extension_values_read_data(
152		libfwsi_file_entry_extension_values_t *file_entry_extension_values,
153		const uint8_t *data,
154		size_t data_size,
155		int ascii_codepage,
156		libcerror_error_t **error )
157	0	{
158	0	static char *function = "libfwsi_file_entry_extension_values_read_data";
159	0	size_t data_offset = 0;
160	0	size_t string_size = 0;
161	0	uint32_t signature = 0;
162	0	uint16_t localized_name_offset = 0;
163	0	uint16_t long_name_offset = 0;
164	0	uint16_t version = 0;
165
166		#if defined( HAVE_DEBUG_OUTPUT )
167		uint16_t value_16bit = 0;
168		#endif
169
170	0	if( file_entry_extension_values == NULL )
171	0	{
172	0	libcerror_error_set(
173	0	error,
174	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
175	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
176	0	"%s: invalid file entry extension values.",
177	0	function );
178
179	0	return( -1 );
180	0	}
181	0	if( data == NULL )
182	0	{
183	0	libcerror_error_set(
184	0	error,
185	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
186	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
187	0	"%s: invalid data.",
188	0	function );
189
190	0	return( -1 );
191	0	}
192	0	if( data_size > (size_t) SSIZE_MAX )
193	0	{
194	0	libcerror_error_set(
195	0	error,
196	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
197	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
198	0	"%s: data size exceeds maximum.",
199	0	function );
200
201	0	return( -1 );
202	0	}
203		/* Do not try to parse unsupported data sizes
204		*/
205	0	if( data_size < 20 )
206	0	{
207	0	return( 0 );
208	0	}
209		/* Do not try to parse unsupported extension block signatures
210		*/
211	0	byte_stream_copy_to_uint32_little_endian(
212	0	&( data[ 4 ] ),
213	0	signature );
214
215	0	if( signature != 0xbeef0004 )
216	0	{
217	0	return( 0 );
218	0	}
219		/* Do not try to parse unsupported version values
220		*/
221	0	byte_stream_copy_to_uint32_little_endian(
222	0	&( data[ 2 ] ),
223	0	version );
224
225	0	if( ( version != 3 )
226	0	&& ( version != 7 )
227	0	&& ( version != 8 )
228	0	&& ( version != 9 ) )
229	0	{
230	0	return( 0 );
231	0	}
232	0	file_entry_extension_values->ascii_codepage = ascii_codepage;
233
234	0	byte_stream_copy_to_uint32_little_endian(
235	0	&( data[ 8 ] ),
236	0	file_entry_extension_values->creation_time );
237
238	0	byte_stream_copy_to_uint32_little_endian(
239	0	&( data[ 12 ] ),
240	0	file_entry_extension_values->access_time );
241
242	0	byte_stream_copy_to_uint16_little_endian(
243	0	&( data[ 16 ] ),
244	0	long_name_offset );
245
246		#if defined( HAVE_DEBUG_OUTPUT )
247		if( libcnotify_verbose != 0 )
248		{
249		if( libfwsi_debug_print_fat_date_time_value(
250		function,
251		"creation time\t\t",
252		&( data[ 8 ] ),
253		4,
254		LIBFDATETIME_ENDIAN_LITTLE,
255		LIBFDATETIME_STRING_FORMAT_TYPE_CTIME \| LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME,
256		error ) != 1 )
257		{
258		libcerror_error_set(
259		error,
260		LIBCERROR_ERROR_DOMAIN_RUNTIME,
261		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
262		"%s: unable to print FAT date time value.",
263		function );
264
265		goto on_error;
266		}
267		if( libfwsi_debug_print_fat_date_time_value(
268		function,
269		"access time\t\t",
270		&( data[ 12 ] ),
271		4,
272		LIBFDATETIME_ENDIAN_LITTLE,
273		LIBFDATETIME_STRING_FORMAT_TYPE_CTIME \| LIBFDATETIME_STRING_FORMAT_FLAG_DATE_TIME,
274		error ) != 1 )
275		{
276		libcerror_error_set(
277		error,
278		LIBCERROR_ERROR_DOMAIN_RUNTIME,
279		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
280		"%s: unable to print FAT date time value.",
281		function );
282
283		goto on_error;
284		}
285		libcnotify_printf(
286		"%s: long name offset\t\t: 0x%04" PRIx16 "\n",
287		function,
288		long_name_offset );
289		}
290		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
291
292	0	data_offset = 18;
293
294	0	if( version >= 7 )
295	0	{
296		/* Do not try to parse unsupported data sizes
297		*/
298	0	if( data_offset >= ( data_size - 18 ) )
299	0	{
300	0	return( 0 );
301	0	}
302		#if defined( HAVE_DEBUG_OUTPUT )
303		if( libcnotify_verbose != 0 )
304		{
305		byte_stream_copy_to_uint16_little_endian(
306		&( data[ data_offset ] ),
307		value_16bit );
308
309		libcnotify_printf(
310		"%s: unknown1\t\t\t: 0x%04" PRIx16 "\n",
311		function,
312		value_16bit );
313		}
314		#endif
315	0	data_offset += 2;
316
317	0	byte_stream_copy_to_uint64_little_endian(
318	0	&( data[ data_offset ] ),
319	0	file_entry_extension_values->file_reference );
320
321		#if defined( HAVE_DEBUG_OUTPUT )
322		if( libcnotify_verbose != 0 )
323		{
324		if( file_entry_extension_values->file_reference == 0 )
325		{
326		libcnotify_printf(
327		"%s: file reference\t\t: %" PRIu64 "\n",
328		function,
329		file_entry_extension_values->file_reference );
330		}
331		else
332		{
333		libcnotify_printf(
334		"%s: file reference\t\t: MFT entry: %" PRIu64 ", sequence: %" PRIu64 "\n",
335		function,
336		file_entry_extension_values->file_reference & 0xffffffffffffUL,
337		file_entry_extension_values->file_reference >> 48 );
338		}
339		}
340		#endif
341	0	data_offset += 8;
342
343		#if defined( HAVE_DEBUG_OUTPUT )
344		if( libcnotify_verbose != 0 )
345		{
346		libcnotify_printf(
347		"%s: unknown2:\n",
348		function );
349		libcnotify_print_data(
350		&( data[ data_offset ] ),
351		8,
352		0 );
353		}
354		#endif
355	0	data_offset += 8;
356	0	}
357		/* Do not try to parse unsupported data sizes
358		*/
359	0	if( data_offset >= ( data_size - 2 ) )
360	0	{
361	0	return( 0 );
362	0	}
363	0	byte_stream_copy_to_uint16_little_endian(
364	0	&( data[ data_offset ] ),
365	0	localized_name_offset );
366
367		#if defined( HAVE_DEBUG_OUTPUT )
368		if( libcnotify_verbose != 0 )
369		{
370		libcnotify_printf(
371		"%s: localized name offset\t: 0x%04" PRIx16 "\n",
372		function,
373		localized_name_offset );
374		}
375		#endif
376	0	data_offset += 2;
377
378	0	if( version >= 9 )
379	0	{
380		/* Do not try to parse unsupported data sizes
381		*/
382	0	if( data_offset >= ( data_size - 4 ) )
383	0	{
384	0	return( 0 );
385	0	}
386		#if defined( HAVE_DEBUG_OUTPUT )
387		if( libcnotify_verbose != 0 )
388		{
389		libcnotify_printf(
390		"%s: unknown4:\n",
391		function );
392		libcnotify_print_data(
393		&( data[ data_offset ] ),
394		4,
395		0 );
396		}
397		#endif
398	0	data_offset += 4;
399	0	}
400	0	if( version >= 8 )
401	0	{
402		/* Do not try to parse unsupported data sizes
403		*/
404	0	if( data_offset >= ( data_size - 4 ) )
405	0	{
406	0	return( 0 );
407	0	}
408		#if defined( HAVE_DEBUG_OUTPUT )
409		if( libcnotify_verbose != 0 )
410		{
411		libcnotify_printf(
412		"%s: unknown5:\n",
413		function );
414		libcnotify_print_data(
415		&( data[ data_offset ] ),
416		4,
417		0 );
418		}
419		#endif
420	0	data_offset += 4;
421	0	}
422	0	if( long_name_offset > 0 )
423	0	{
424		/* Do not try to parse unsupported data sizes
425		*/
426	0	if( data_offset >= data_size )
427	0	{
428	0	return( 0 );
429	0	}
430		/* Determine the long name size
431		*/
432	0	for( string_size = data_offset;
433	0	( string_size + 1 ) < data_size - 2;
434	0	string_size += 2 )
435	0	{
436	0	if( ( data[ string_size ] == 0 )
437	0	&& ( data[ string_size + 1 ] == 0 ) )
438	0	{
439	0	string_size += 2;
440
441	0	break;
442	0	}
443	0	}
444	0	string_size -= data_offset;
445
446	0	if( ( string_size == 0 )
447	0	\|\| ( string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
448	0	{
449	0	libcerror_error_set(
450	0	error,
451	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
452	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
453	0	"%s: invalid long name string size value out of bounds.",
454	0	function );
455
456	0	goto on_error;
457	0	}
458	0	file_entry_extension_values->long_name = (uint8_t *) memory_allocate(
459	0	sizeof( uint8_t ) * string_size );
460
461	0	if( file_entry_extension_values->long_name == NULL )
462	0	{
463	0	libcerror_error_set(
464	0	error,
465	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
466	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
467	0	"%s: unable to create long name.",
468	0	function );
469
470	0	goto on_error;
471	0	}
472	0	if( memory_copy(
473	0	file_entry_extension_values->long_name,
474	0	&( data[ data_offset ] ),
475	0	string_size ) == NULL )
476	0	{
477	0	libcerror_error_set(
478	0	error,
479	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
480	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
481	0	"%s: unable to copy long name.",
482	0	function );
483
484	0	goto on_error;
485	0	}
486	0	file_entry_extension_values->long_name_size = string_size;
487
488		#if defined( HAVE_DEBUG_OUTPUT )
489		if( libcnotify_verbose != 0 )
490		{
491		if( libfwsi_debug_print_utf16_string_value(
492		function,
493		"long name\t\t",
494		file_entry_extension_values->long_name,
495		file_entry_extension_values->long_name_size,
496		LIBUNA_ENDIAN_LITTLE,
497		error ) != 1 )
498		{
499		libcerror_error_set(
500		error,
501		LIBCERROR_ERROR_DOMAIN_RUNTIME,
502		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
503		"%s: unable to print UTF-16 string value.",
504		function );
505
506		goto on_error;
507		}
508		}
509		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
510
511	0	data_offset += string_size;
512	0	}
513	0	if( localized_name_offset > 0 )
514	0	{
515		/* Do not try to parse unsupported data sizes
516		*/
517	0	if( data_offset >= data_size )
518	0	{
519	0	return( 0 );
520	0	}
521	0	if( version >= 7 )
522	0	{
523		/* Determine the localized name size
524		*/
525	0	for( string_size = data_offset;
526	0	( string_size + 1 ) < data_size - 2;
527	0	string_size += 2 )
528	0	{
529	0	if( ( data[ string_size ] == 0 )
530	0	&& ( data[ string_size + 1 ] == 0 ) )
531	0	{
532	0	string_size += 2;
533
534	0	break;
535	0	}
536	0	}
537	0	string_size -= data_offset;
538
539	0	if( ( string_size == 0 )
540	0	\|\| ( string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
541	0	{
542	0	libcerror_error_set(
543	0	error,
544	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
545	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
546	0	"%s: invalid localized name string size value out of bounds.",
547	0	function );
548
549	0	goto on_error;
550	0	}
551	0	file_entry_extension_values->localized_name = (uint8_t *) memory_allocate(
552	0	sizeof( uint8_t ) * string_size );
553
554	0	if( file_entry_extension_values->localized_name == NULL )
555	0	{
556	0	libcerror_error_set(
557	0	error,
558	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
559	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
560	0	"%s: unable to create localized name.",
561	0	function );
562
563	0	goto on_error;
564	0	}
565	0	if( memory_copy(
566	0	file_entry_extension_values->localized_name,
567	0	&( data[ data_offset ] ),
568	0	string_size ) == NULL )
569	0	{
570	0	libcerror_error_set(
571	0	error,
572	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
573	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
574	0	"%s: unable to copy localized name.",
575	0	function );
576
577	0	goto on_error;
578	0	}
579	0	file_entry_extension_values->localized_name_size = string_size;
580
581		#if defined( HAVE_DEBUG_OUTPUT )
582		if( libcnotify_verbose != 0 )
583		{
584		if( libfwsi_debug_print_utf16_string_value(
585		function,
586		"localized name\t\t",
587		file_entry_extension_values->localized_name,
588		file_entry_extension_values->localized_name_size,
589		LIBUNA_ENDIAN_LITTLE,
590		error ) != 1 )
591		{
592		libcerror_error_set(
593		error,
594		LIBCERROR_ERROR_DOMAIN_RUNTIME,
595		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
596		"%s: unable to print UTF-16 string value.",
597		function );
598
599		goto on_error;
600		}
601		}
602		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
603	0	}
604	0	else if( version >= 3 )
605	0	{
606		/* Determine the localized name size
607		*/
608	0	for( string_size = data_offset;
609	0	string_size < data_size - 2;
610	0	string_size += 1 )
611	0	{
612	0	if( data[ string_size ] == 0 )
613	0	{
614	0	string_size += 1;
615
616	0	break;
617	0	}
618	0	}
619	0	string_size -= data_offset;
620
621	0	if( ( string_size == 0 )
622	0	\|\| ( string_size > (size_t) MEMORY_MAXIMUM_ALLOCATION_SIZE ) )
623	0	{
624	0	libcerror_error_set(
625	0	error,
626	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
627	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
628	0	"%s: invalid localized name string size value out of bounds.",
629	0	function );
630
631	0	goto on_error;
632	0	}
633	0	file_entry_extension_values->localized_name = (uint8_t *) memory_allocate(
634	0	sizeof( uint8_t ) * string_size );
635
636	0	if( file_entry_extension_values->localized_name == NULL )
637	0	{
638	0	libcerror_error_set(
639	0	error,
640	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
641	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
642	0	"%s: unable to create localized name.",
643	0	function );
644
645	0	goto on_error;
646	0	}
647	0	if( memory_copy(
648	0	file_entry_extension_values->localized_name,
649	0	&( data[ data_offset ] ),
650	0	string_size ) == NULL )
651	0	{
652	0	libcerror_error_set(
653	0	error,
654	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
655	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
656	0	"%s: unable to copy localized name.",
657	0	function );
658
659	0	goto on_error;
660	0	}
661	0	file_entry_extension_values->localized_name_size = string_size;
662
663		#if defined( HAVE_DEBUG_OUTPUT )
664		if( libcnotify_verbose != 0 )
665		{
666		if( libfwsi_debug_print_string_value(
667		function,
668		"localized name\t\t",
669		file_entry_extension_values->localized_name,
670		file_entry_extension_values->localized_name_size,
671		ascii_codepage,
672		error ) != 1 )
673		{
674		libcerror_error_set(
675		error,
676		LIBCERROR_ERROR_DOMAIN_RUNTIME,
677		LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
678		"%s: unable to print string value.",
679		function );
680
681		goto on_error;
682		}
683		}
684		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
685	0	}
686	0	data_offset += string_size;
687	0	}
688	0	return( 1 );
689
690	0	on_error:
691	0	if( file_entry_extension_values->localized_name != NULL )
692	0	{
693	0	memory_free(
694	0	file_entry_extension_values->localized_name );
695
696	0	file_entry_extension_values->localized_name = NULL;
697	0	}
698	0	file_entry_extension_values->localized_name_size = 0;
699
700	0	if( file_entry_extension_values->long_name != NULL )
701	0	{
702	0	memory_free(
703	0	file_entry_extension_values->long_name );
704
705	0	file_entry_extension_values->long_name = NULL;
706	0	}
707	0	file_entry_extension_values->long_name_size = 0;
708
709	0	return( -1 );
710	0	}
711