_Z8mem_openPKhm: 55| 3.41k|TSK_IMG_INFO *mem_open(const uint8_t *data, size_t size) { 56| 3.41k| IMG_MEM_INFO *inmemory_img = 57| 3.41k| reinterpret_cast(malloc(sizeof(IMG_MEM_INFO))); 58| 3.41k| TSK_IMG_INFO *img; 59| 3.41k| if (inmemory_img == nullptr) { ------------------ | Branch (59:7): [True: 0, False: 3.41k] ------------------ 60| 0| return nullptr; 61| 0| } 62| 3.41k| img = reinterpret_cast(inmemory_img); 63| 3.41k| img->itype = TSK_IMG_TYPE_RAW; 64| 3.41k| img->read = mem_read; 65| 3.41k| img->close = mem_close; 66| 3.41k| img->imgstat = mem_imgstat; 67| 3.41k| img->size = size; 68| 3.41k| img->sector_size = 512; 69| 3.41k| tsk_init_lock(&(img->cache_lock)); 70| 3.41k| inmemory_img->data = data; 71| 3.41k| inmemory_img->size = size; 72| 3.41k| return img; 73| 3.41k|} sleuthkit_fls_fuzzer.cc:_ZL8mem_readP12TSK_IMG_INFOlPcm: 30| 172| size_t len) { 31| 172| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 32| | // Bounds-checking exists in the real drivers. 33| 172| if (offset > mem_info->size) { ------------------ | Branch (33:7): [True: 0, False: 172] ------------------ 34| 0| return -1; 35| 0| } 36| 172| ssize_t read_len = len; 37| 172| if (offset + len > mem_info->size) { ------------------ | Branch (37:7): [True: 0, False: 172] ------------------ 38| 0| read_len = mem_info->size - offset; 39| 0| } 40| 172| if (memcpy(buf, mem_info->data + offset, read_len) == nullptr) { ------------------ | Branch (40:7): [True: 0, False: 172] ------------------ 41| 0| return -1; 42| 172| } else { 43| 172| return read_len; 44| 172| } 45| 172|} sleuthkit_fls_fuzzer.cc:_ZL9mem_closeP12TSK_IMG_INFO: 47| 3.41k|static void mem_close(TSK_IMG_INFO *img_info) { 48| 3.41k| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 49| 3.41k| tsk_deinit_lock(&(img_info->cache_lock)); 50| 3.41k| free(mem_info); 51| 3.41k|} _Z14hexDigitToCharc: 85| 256|{ 86| 256| if (ch > 47 && ch < 58) ------------------ | Branch (86:7): [True: 256, False: 0] | Branch (86:18): [True: 148, False: 108] ------------------ 87| 148| return ch - 48; 88| | 89| 108| if (ch > 96 && ch < 103) ------------------ | Branch (89:7): [True: 108, False: 0] | Branch (89:18): [True: 108, False: 0] ------------------ 90| 108| return ch - 87; 91| | 92| 0| if (ch > 64 && ch < 71) ------------------ | Branch (92:7): [True: 0, False: 0] | Branch (92:18): [True: 0, False: 0] ------------------ 93| 0| return ch - 55; 94| | 95| 0| return 0; 96| 0|} _Z13hexPairToCharcc: 100| 128|{ 101| 128| return hexDigitToChar(a) * 16 + hexDigitToChar(b); 102| 128|} _ZN7TSKGuidC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE: 106| 8|{ 107| 8| _bytes.clear(); 108| | 109| 8| char charOne, charTwo; 110| 8| bool lookingForFirstChar = true; 111| | 112| | // for (const char &ch : fromString) C++ 11 CODE CHANGED FOR TSK 113| 296| for (std::string::const_iterator it = fromString.begin(); it != fromString.end(); ++it) ------------------ | Branch (113:61): [True: 288, False: 8] ------------------ 114| 288| { 115| 288| char ch = *it; 116| 288| if (ch == '-') ------------------ | Branch (116:9): [True: 32, False: 256] ------------------ 117| 32| continue; 118| | 119| 256| if (lookingForFirstChar) ------------------ | Branch (119:9): [True: 128, False: 128] ------------------ 120| 128| { 121| 128| charOne = ch; 122| 128| lookingForFirstChar = false; 123| 128| } 124| 128| else 125| 128| { 126| 128| charTwo = ch; 127| 128| unsigned char byte = hexPairToChar(charOne, charTwo); 128| 128| _bytes.push_back(byte); 129| 128| lookingForFirstChar = true; 130| 128| } 131| 256| } 132| | 133| 8|} tsk_malloc: 29| 137k|{ 30| 137k| void *ptr; 31| | 32| 137k| if ((ptr = calloc(len, 1)) == 0) { ------------------ | Branch (32:9): [True: 0, False: 137k] ------------------ 33| 0| tsk_error_reset(); 34| 0| tsk_error_set_errno(TSK_ERR_AUX_MALLOC); ------------------ | | 307| 0|#define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0) | | ------------------ | | | | 298| 0|#define TSK_ERR_AUX 0x01000000 | | ------------------ ------------------ 35| 0| tsk_error_set_errstr("tsk_malloc: %s (%" PRIuSIZE" requested)", strerror(errno), len); 36| 0| } 37| | 38| 137k| return ptr; 39| 137k|} tsk_realloc: 44| 13.7k|{ 45| | // Use tmpPtr to prevent memory leak when realloc failed 46| 13.7k| void *tmpPtr = realloc(ptr, len); 47| 13.7k| if (tmpPtr == 0) { ------------------ | Branch (47:9): [True: 0, False: 13.7k] ------------------ 48| 0| tsk_error_reset(); 49| 0| tsk_error_set_errno(TSK_ERR_AUX_MALLOC); ------------------ | | 307| 0|#define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0) | | ------------------ | | | | 298| 0|#define TSK_ERR_AUX 0x01000000 | | ------------------ ------------------ 50| 0| tsk_error_set_errstr("tsk_realloc: %s (%" PRIuSIZE" requested)", strerror(errno), len); 51| 0| return (void *)0; 52| 0| } 53| 13.7k| else { 54| 13.7k| ptr = tmpPtr; 55| 13.7k| } 56| 13.7k| return ptr; 57| 13.7k|} tsk_guess_end_u16: 35| 3.37k|{ 36| | /* try little */ 37| 3.37k| if (tsk_getu16(TSK_LIT_ENDIAN, x) == val) { ------------------ | | 86| 3.37k|#define tsk_getu16(endian, x) \ | | 87| 3.37k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 3.37k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3.37k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (37:9): [True: 2.84k, False: 528] ------------------ 38| 2.84k| *flag = TSK_LIT_ENDIAN; 39| 2.84k| return 0; 40| 2.84k| } 41| | 42| | /* ok, big now */ 43| 528| if (tsk_getu16(TSK_BIG_ENDIAN, x) == val) { ------------------ | | 86| 528|#define tsk_getu16(endian, x) \ | | 87| 528|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 528| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 528| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (43:9): [True: 527, False: 1] ------------------ 44| 527| *flag = TSK_BIG_ENDIAN; 45| 527| return 0; 46| 527| } 47| | 48| | /* didn't find it */ 49| 1| return 1; 50| 528|} tsk_error_get_info: 148| 25.3k|{ 149| 25.3k| TSK_ERROR_INFO *ptr = NULL; 150| 25.3k| (void) pthread_once(&pt_tls_key_once, make_pt_tls_key); 151| 25.3k| if ((ptr = (TSK_ERROR_INFO *) pthread_getspecific(pt_tls_key)) == 0) { ------------------ | Branch (151:9): [True: 1, False: 25.3k] ------------------ 152| | // Under high memory pressure malloc will return NULL. 153| 1| ptr = (TSK_ERROR_INFO *) malloc(sizeof(TSK_ERROR_INFO)); 154| | 155| 1| if( ptr != NULL ) { ------------------ | Branch (155:13): [True: 1, False: 0] ------------------ 156| 1| ptr->t_errno = 0; 157| 1| ptr->errstr[0] = 0; 158| 1| ptr->errstr2[0] = 0; 159| 1| } 160| 1| (void) pthread_setspecific(pt_tls_key, ptr); 161| 1| } 162| 25.3k| return ptr; 163| 25.3k|} tsk_error_get_errno: 297| 587|{ 298| 587| return tsk_error_get_info()->t_errno; 299| 587|} tsk_error_set_errno: 308| 3.57k|{ 309| 3.57k| tsk_error_get_info()->t_errno = t_errno; 310| 3.57k|} tsk_error_set_errstr: 332| 3.51k|{ 333| 3.51k| va_list args; 334| 3.51k| va_start(args, format); 335| 3.51k| vsnprintf(tsk_error_get_info()->errstr, TSK_ERROR_STRING_MAX_LENGTH, ------------------ | | 67| 3.51k|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 336| 3.51k| format, args); 337| 3.51k| va_end(args); 338| 3.51k|} tsk_error_set_errstr2: 373| 3.46k|{ 374| 3.46k| va_list args; 375| 3.46k| va_start(args, format); 376| 3.46k| vsnprintf(tsk_error_get_info()->errstr2, TSK_ERROR_STRING_MAX_LENGTH, ------------------ | | 67| 3.46k|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 377| 3.46k| format, args); 378| 3.46k| va_end(args); 379| 3.46k|} tsk_error_errstr2_concat: 401| 2.84k|{ 402| 2.84k| char *errstr2 = tsk_error_get_info()->errstr2; 403| 2.84k| int current_length = (int) (strlen(errstr2) + 1); // +1 for a space 404| 2.84k| if (current_length > 0) { ------------------ | Branch (404:9): [True: 2.84k, False: 0] ------------------ 405| 2.84k| va_list args; 406| 2.84k| int remaining = TSK_ERROR_STRING_MAX_LENGTH - current_length; ------------------ | | 67| 2.84k|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 407| 2.84k| errstr2[current_length - 1] = ' '; 408| 2.84k| va_start(args, format); 409| 2.84k| vsnprintf(&errstr2[current_length], remaining, format, args); 410| 2.84k| va_end(args); 411| 2.84k| } 412| 2.84k|} tsk_error_reset: 444| 11.3k|{ 445| 11.3k| TSK_ERROR_INFO *info = tsk_error_get_info(); 446| | 447| 11.3k| if( info != NULL ) { ------------------ | Branch (447:9): [True: 11.3k, False: 0] ------------------ 448| 11.3k| info->t_errno = 0; 449| 11.3k| info->errstr[0] = 0; 450| 11.3k| info->errstr2[0] = 0; 451| 11.3k| info->errstr_print[0] = 0; 452| 11.3k| } 453| 11.3k|} tsk_error.c:make_pt_tls_key: 142| 1|{ 143| 1| (void) pthread_key_create(&pt_tls_key, free_error_info); 144| 1|} tsk_list_add: 47| 49|{ 48| 49| TSK_LIST *tmp; 49| | 50| | /* If the head is NULL, then create an entry */ 51| 49| if (*a_tsk_list_head == NULL) { ------------------ | Branch (51:9): [True: 14, False: 35] ------------------ 52| 14| TSK_LIST *ent; 53| | /* 54| | if (tsk_verbose) 55| | fprintf(stderr, "entry %" PRIu64 " is first on list\n", a_key); 56| | */ 57| 14| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (57:13): [True: 0, False: 14] ------------------ 58| 0| return 1; 59| | 60| 14| *a_tsk_list_head = ent; 61| 14| return 0; 62| 14| } 63| | 64| | /* If the new key is larger than the head, make it the head */ 65| 35| if (a_key > (*a_tsk_list_head)->key) { ------------------ | Branch (65:9): [True: 20, False: 15] ------------------ 66| | /* 67| | if (tsk_verbose) 68| | fprintf(stderr, 69| | "entry %" PRIu64 " added to head before %" PRIu64 "\n", 70| | a_key, (*a_tsk_list_head)->key); 71| | */ 72| | 73| | // If we can, update the length of the existing list entry 74| 20| if (a_key == (*a_tsk_list_head)->key + 1) { ------------------ | Branch (74:13): [True: 0, False: 20] ------------------ 75| 0| (*a_tsk_list_head)->key++; 76| 0| (*a_tsk_list_head)->len++; 77| 0| } 78| 20| else { 79| 20| TSK_LIST *ent; 80| 20| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (80:17): [True: 0, False: 20] ------------------ 81| 0| return 1; 82| 20| ent->next = *a_tsk_list_head; 83| 20| *a_tsk_list_head = ent; 84| 20| } 85| 20| return 0; 86| 20| } 87| | // get rid of duplicates 88| 15| else if (a_key == (*a_tsk_list_head)->key) { ------------------ | Branch (88:14): [True: 14, False: 1] ------------------ 89| 14| return 0; 90| 14| } 91| | 92| | /* At the start of this loop each time, we know that the key to add 93| | * is smaller than the entry being considered (tmp) */ 94| 1| tmp = *a_tsk_list_head; 95| 2| while (tmp != NULL) { ------------------ | Branch (95:12): [True: 2, False: 0] ------------------ 96| | 97| | /* First check if this is a duplicate and contained in tmp */ 98| 2| if (a_key > (tmp->key - tmp->len)) { ------------------ | Branch (98:13): [True: 0, False: 2] ------------------ 99| 0| return 0; 100| 0| } 101| | /* Can we append it to the end of tmp? */ 102| 2| else if (a_key == (tmp->key - tmp->len)) { ------------------ | Branch (102:18): [True: 0, False: 2] ------------------ 103| | // do a sanity check on the next entry 104| 0| if ((tmp->next) && (tmp->next->key == a_key)) { ------------------ | Branch (104:17): [True: 0, False: 0] | Branch (104:32): [True: 0, False: 0] ------------------ 105| | // @@@ We could fix this situation and remove the next entry... 106| 0| return 0; 107| 0| } 108| 0| tmp->len++; 109| 0| return 0; 110| 0| } 111| | 112| | /* The key is less than the current bucket and can't be added to it. 113| | * check if we are at the end of the list yet */ 114| 2| else if (tmp->next == NULL) { ------------------ | Branch (114:18): [True: 0, False: 2] ------------------ 115| 0| TSK_LIST *ent; 116| | 117| | /* 118| | if (tsk_verbose) 119| | fprintf(stderr, "entry %" PRIu64 " added to tail\n", 120| | a_key); 121| | */ 122| | 123| 0| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (123:17): [True: 0, False: 0] ------------------ 124| 0| return 1; 125| 0| tmp->next = ent; 126| | 127| 0| return 0; 128| 0| } 129| | // can we prepend it to the next bucket? 130| 2| else if (a_key == tmp->next->key + 1) { ------------------ | Branch (130:18): [True: 0, False: 2] ------------------ 131| 0| tmp->next->key++; 132| 0| tmp->next->len++; 133| 0| return 0; 134| 0| } 135| | // do we need a new bucket in between? 136| 2| else if (a_key > tmp->next->key) { ------------------ | Branch (136:18): [True: 0, False: 2] ------------------ 137| 0| TSK_LIST *ent; 138| | 139| | /* 140| | if (tsk_verbose) 141| | fprintf(stderr, 142| | "entry %" PRIu64 " added before %" PRIu64 "\n", 143| | a_key, tmp->next->key); 144| | */ 145| | 146| 0| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (146:17): [True: 0, False: 0] ------------------ 147| 0| return 1; 148| | 149| 0| ent->next = tmp->next; 150| 0| tmp->next = ent; 151| 0| return 0; 152| 0| } 153| 2| else if (a_key == tmp->next->key) { ------------------ | Branch (153:18): [True: 1, False: 1] ------------------ 154| 1| return 0; 155| 1| } 156| 1| tmp = tmp->next; 157| 1| } 158| 0| return 0; 159| 1|} tsk_list_find: 170| 15.9k|{ 171| 15.9k| TSK_LIST *tmp; 172| | 173| 15.9k| tmp = a_tsk_list_head; 174| 21.2k| while (tmp != NULL) { ------------------ | Branch (174:12): [True: 11.8k, False: 9.44k] ------------------ 175| | // check this bucket 176| | // use the key+1 and then subtract for unsigned cases when key-len == -1 177| 11.8k| if ((a_key <= tmp->key) && (a_key >= tmp->key + 1 - tmp->len)) ------------------ | Branch (177:13): [True: 5.39k, False: 6.45k] | Branch (177:36): [True: 30, False: 5.36k] ------------------ 178| 30| return 1; 179| | 180| | // Have we passed any potential buckets? 181| 11.8k| else if (a_key > tmp->key) ------------------ | Branch (181:18): [True: 6.45k, False: 5.36k] ------------------ 182| 6.45k| return 0; 183| | 184| 5.36k| tmp = tmp->next; 185| 5.36k| } 186| 9.44k| return 0; 187| 15.9k|} tsk_list_free: 196| 2.84k|{ 197| 2.84k| TSK_LIST *tmp; 198| | 199| 2.87k| while (a_tsk_list_head) { ------------------ | Branch (199:12): [True: 34, False: 2.84k] ------------------ 200| 34| tmp = a_tsk_list_head->next; 201| 34| free(a_tsk_list_head); 202| 34| a_tsk_list_head = tmp; 203| 34| } 204| 2.84k|} tsk_list.c:tsk_list_create: 25| 34|{ 26| 34| TSK_LIST *ent; 27| 34| if ((ent = (TSK_LIST *) tsk_malloc(sizeof(TSK_LIST))) == NULL) { ------------------ | Branch (27:9): [True: 0, False: 34] ------------------ 28| 0| return NULL; 29| 0| } 30| | 31| 34| ent->key = a_key; 32| 34| ent->next = NULL; 33| 34| ent->len = 1; 34| | 35| 34| return ent; 36| 34|} tsk_init_lock: 46| 13.6k|{ 47| 13.6k| pthread_mutexattr_t attr; 48| 13.6k| pthread_mutexattr_init(&attr); 49| | 50| | // Locks on Linux are not recursive (unlike on Windows), so things 51| | // will hang if the current thread tries to take the lock again. 52| | // While debugging, it's sometimes useful to call 53| | // 54| | // pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK_NP); 55| | // 56| | // which will provoke an immediate error rather than a hang. 57| | // 58| | // PTHREAD_MUTEX_ERRORCHECK is not defined by default on Linux, 59| | // but it is portable if you have the right_XOPEN_SOURCE settings. 60| | // However, that macro affects the availability of other features 61| | // like BSD-style u_int types used in afflib. 62| | // PTHREAD_MUTEX_ERRORCHECK -is- available by default on Mac. 63| | // 64| | // PTHREAD_MUTEX_ERRORCHECK_NP is the Linux/gcc non-portable 65| | // equivalent which does not require _XOPEN_SOURCE. 66| | // 67| | // Other interesting attributes are PTHREAD_MUTEX_RECURSIVE (and 68| | // PTHREAD_MUTEX_RECURSIVE_NP). We avoided those out of portability 69| | // concerns with the _XOPEN_SOURCE settings. 70| | 71| 13.6k| int e = pthread_mutex_init(&lock->mutex, &attr); 72| 13.6k| pthread_mutexattr_destroy(&attr); 73| 13.6k| if (e != 0) { ------------------ | Branch (73:9): [True: 0, False: 13.6k] ------------------ 74| 0| fprintf(stderr, "tsk_init_lock: thread_mutex_init failed %d\n", e); 75| 0| assert(0); 76| 0| } 77| 13.6k|} tsk_deinit_lock: 81| 13.6k|{ 82| 13.6k| pthread_mutex_destroy(&lock->mutex); 83| 13.6k|} tsk_take_lock: 87| 380k|{ 88| 380k| int e = pthread_mutex_lock(&lock->mutex); 89| 380k| if (e != 0) { ------------------ | Branch (89:9): [True: 0, False: 380k] ------------------ 90| 0| fprintf(stderr, "tsk_take_lock: thread_mutex_lock failed %d\n", e); 91| 0| assert(0); 92| 0| } 93| 380k|} tsk_release_lock: 97| 380k|{ 98| 380k| int e = pthread_mutex_unlock(&lock->mutex); 99| 380k| if (e != 0) { ------------------ | Branch (99:9): [True: 0, False: 380k] ------------------ 100| 0| fprintf(stderr, 101| 0| "tsk_release_lock: thread_mutex_unlock failed %d\n", e); 102| 0| assert(0); 103| 0| } 104| 380k|} tsk_stack_create: 24| 4.97k|{ 25| 4.97k| TSK_STACK *tsk_stack; 26| 4.97k| if ((tsk_stack = (TSK_STACK *) tsk_malloc(sizeof(TSK_STACK))) == NULL) { ------------------ | Branch (26:9): [True: 0, False: 4.97k] ------------------ 27| 0| return NULL; 28| 0| } 29| | 30| 4.97k| tsk_stack->len = 64; 31| 4.97k| tsk_stack->top = 0; 32| 4.97k| if ((tsk_stack->vals = ------------------ | Branch (32:9): [True: 0, False: 4.97k] ------------------ 33| 4.97k| (uint64_t *) tsk_malloc(tsk_stack->len * sizeof(uint64_t))) == 34| 4.97k| NULL) { 35| 0| free(tsk_stack); 36| 0| return NULL; 37| 0| } 38| 4.97k| return tsk_stack; 39| 4.97k|} tsk_stack_push: 50| 603|{ 51| 603| if (a_tsk_stack->top == a_tsk_stack->len) { ------------------ | Branch (51:9): [True: 0, False: 603] ------------------ 52| 0| a_tsk_stack->len += 64; 53| 0| if ((a_tsk_stack->vals = ------------------ | Branch (53:13): [True: 0, False: 0] ------------------ 54| 0| (uint64_t *) tsk_realloc((char *) a_tsk_stack->vals, 55| 0| a_tsk_stack->len * sizeof(uint64_t))) == NULL) { 56| 0| return 1; 57| 0| } 58| 0| } 59| 603| a_tsk_stack->vals[a_tsk_stack->top++] = a_val; 60| 603| return 0; 61| 603|} tsk_stack_pop: 70| 603|{ 71| 603| a_tsk_stack->top--; 72| 603|} tsk_stack_find: 83| 625|{ 84| 625| size_t i; 85| | 86| 657| for (i = 0; i < a_tsk_stack->top; i++) { ------------------ | Branch (86:17): [True: 54, False: 603] ------------------ 87| 54| if (a_tsk_stack->vals[i] == a_val) ------------------ | Branch (87:13): [True: 22, False: 32] ------------------ 88| 22| return 1; 89| 54| } 90| 603| return 0; 91| 625|} tsk_stack_free: 100| 4.97k|{ 101| 4.97k| free(a_tsk_stack->vals); 102| 4.97k| free(a_tsk_stack); 103| 4.97k|} ext2fs_inode_walk: 1095| 557|{ 1096| 557| char *myname = "extXfs_inode_walk"; 1097| 557| EXT2FS_INFO *ext2fs = (EXT2FS_INFO *) fs; 1098| 557| TSK_INUM_T inum; 1099| 557| TSK_INUM_T end_inum_tmp; 1100| 557| TSK_INUM_T ibase = 0; 1101| 557| TSK_FS_FILE *fs_file; 1102| 557| unsigned int myflags; 1103| 557| ext2fs_inode *dino_buf = NULL; 1104| 557| uint8_t *ea_buf = NULL; 1105| 557| size_t ea_buf_len = 0; 1106| 557| unsigned int size = 0; 1107| | 1108| | // clean up any error messages that are lying around 1109| 557| tsk_error_reset(); 1110| | 1111| | /* 1112| | * Sanity checks. 1113| | */ 1114| 557| if (start_inum < fs->first_inum || start_inum > fs->last_inum) { ------------------ | Branch (1114:9): [True: 0, False: 557] | Branch (1114:40): [True: 0, False: 557] ------------------ 1115| 0| tsk_error_reset(); 1116| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1117| 0| tsk_error_set_errstr("%s: start inode: %" PRIuINUM "", myname, 1118| 0| start_inum); 1119| 0| return 1; 1120| 0| } 1121| | 1122| 557| if (end_inum < fs->first_inum || end_inum > fs->last_inum ------------------ | Branch (1122:9): [True: 0, False: 557] | Branch (1122:38): [True: 0, False: 557] ------------------ 1123| 557| || end_inum < start_inum) { ------------------ | Branch (1123:12): [True: 0, False: 557] ------------------ 1124| 0| tsk_error_reset(); 1125| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1126| 0| tsk_error_set_errstr("%s: end inode: %" PRIuINUM "", myname, 1127| 0| end_inum); 1128| 0| return 1; 1129| 0| } 1130| | 1131| | /* If ORPHAN is wanted, then make sure that the flags are correct */ 1132| 557| if (flags & TSK_FS_META_FLAG_ORPHAN) { ------------------ | Branch (1132:9): [True: 0, False: 557] ------------------ 1133| 0| flags |= TSK_FS_META_FLAG_UNALLOC; 1134| 0| flags &= ~TSK_FS_META_FLAG_ALLOC; 1135| 0| flags |= TSK_FS_META_FLAG_USED; 1136| 0| flags &= ~TSK_FS_META_FLAG_UNUSED; 1137| 0| } 1138| 557| else { 1139| 557| if (((flags & TSK_FS_META_FLAG_ALLOC) == 0) && ------------------ | Branch (1139:13): [True: 557, False: 0] ------------------ 1140| 557| ((flags & TSK_FS_META_FLAG_UNALLOC) == 0)) { ------------------ | Branch (1140:13): [True: 0, False: 557] ------------------ 1141| 0| flags |= (TSK_FS_META_FLAG_ALLOC | TSK_FS_META_FLAG_UNALLOC); 1142| 0| } 1143| | 1144| | /* If neither of the USED or UNUSED flags are set, then set them 1145| | * both 1146| | */ 1147| 557| if (((flags & TSK_FS_META_FLAG_USED) == 0) && ------------------ | Branch (1147:13): [True: 0, False: 557] ------------------ 1148| 557| ((flags & TSK_FS_META_FLAG_UNUSED) == 0)) { ------------------ | Branch (1148:13): [True: 0, False: 0] ------------------ 1149| 0| flags |= (TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_UNUSED); 1150| 0| } 1151| 557| } 1152| | 1153| | 1154| | 1155| | /* If we are looking for orphan files and have not yet filled 1156| | * in the list of unalloc inodes that are pointed to, then fill 1157| | * in the list 1158| | */ 1159| 557| if ((flags & TSK_FS_META_FLAG_ORPHAN)) { ------------------ | Branch (1159:9): [True: 0, False: 557] ------------------ 1160| 0| if (tsk_fs_dir_load_inum_named(fs) != TSK_OK) { ------------------ | Branch (1160:13): [True: 0, False: 0] ------------------ 1161| 0| tsk_error_errstr2_concat 1162| 0| ("- ext2fs_inode_walk: identifying inodes allocated by file names"); 1163| 0| return 1; 1164| 0| } 1165| | 1166| 0| } 1167| | 1168| 557| fs_file = tsk_fs_file_alloc(fs); 1169| 557| if (fs_file == NULL) ------------------ | Branch (1169:9): [True: 0, False: 557] ------------------ 1170| 0| return 1; 1171| | 1172| 557| fs_file->meta = tsk_fs_meta_alloc(EXT2FS_FILE_CONTENT_LEN); ------------------ | | 97| 557|#define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 89| 557|#define EXT2FS_NDADDR 12 | | ------------------ | | #define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 90| 557|#define EXT2FS_NIADDR 3 | | ------------------ ------------------ 1173| 557| if (fs_file->meta == NULL) { ------------------ | Branch (1173:9): [True: 0, False: 557] ------------------ 1174| 0| free(fs_file); 1175| 0| return 1; 1176| 0| } 1177| | 1178| | // we need to handle fs->last_inum specially because it is for the 1179| | // virtual ORPHANS directory. Handle it outside of the loop. 1180| 557| if (end_inum == TSK_FS_ORPHANDIR_INUM(fs)) ------------------ | | 530| 557| (fs_info->last_inum) ------------------ | Branch (1180:9): [True: 557, False: 0] ------------------ 1181| 557| end_inum_tmp = end_inum - 1; 1182| 0| else 1183| 0| end_inum_tmp = end_inum; 1184| | 1185| | /* 1186| | * Iterate. 1187| | */ 1188| 557| size = 1189| 557| ext2fs->inode_size > ------------------ | Branch (1189:9): [True: 557, False: 0] ------------------ 1190| 557| sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode); 1191| | 1192| 557| dino_buf = (ext2fs_inode *) tsk_malloc(size); 1193| 557| if (dino_buf == NULL) { ------------------ | Branch (1193:9): [True: 0, False: 557] ------------------ 1194| 0| free(fs_file->meta); 1195| 0| free(fs_file); 1196| 0| return 1; 1197| 0| } 1198| | 1199| 118k| for (inum = start_inum; inum <= end_inum_tmp; inum++) { ------------------ | Branch (1199:29): [True: 118k, False: 0] ------------------ 1200| 118k| int retval; 1201| 118k| EXT2_GRPNUM_T grp_num; 1202| | 1203| | /* 1204| | * Be sure to use the proper group descriptor data. XXX Linux inodes 1205| | * start at 1, as in Fortran. 1206| | */ 1207| 118k| grp_num = 1208| 118k| (EXT2_GRPNUM_T) ((inum - 1) / tsk_getu32(fs->endian, ------------------ | | 119| 118k|#define tsk_getu32(endian, x) \ | | 120| 118k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 115k, False: 3.16k] | | ------------------ | | 121| 118k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 115k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 115k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 115k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 118k| : \ | | 126| 118k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 3.16k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 3.16k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 3.16k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1209| 118k| ext2fs->fs->s_inodes_per_group)); 1210| | 1211| | /* lock access to imap_buf */ 1212| 118k| tsk_take_lock(&ext2fs->lock); 1213| | 1214| 118k| if (ext2fs_imap_load(ext2fs, grp_num)) { ------------------ | Branch (1214:13): [True: 0, False: 118k] ------------------ 1215| 0| tsk_release_lock(&ext2fs->lock); 1216| 0| free(dino_buf); 1217| 0| tsk_fs_file_close(fs_file); 1218| 0| return 1; 1219| 0| } 1220| 118k| ibase = 1221| 118k| grp_num * tsk_getu32(fs->endian, ------------------ | | 119| 118k|#define tsk_getu32(endian, x) \ | | 120| 118k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 115k, False: 3.16k] | | ------------------ | | 121| 118k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 115k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 115k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 115k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 118k| : \ | | 126| 118k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 3.16k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 3.16k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 3.16k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1222| 118k| ext2fs->fs->s_inodes_per_group) + 1; 1223| | 1224| | /* 1225| | * Ensure that inum - ibase refers to a valid bit offset in imap_buf. 1226| | */ 1227| 118k| if ((ibase > inum) || (inum - ibase) >= (fs->block_size * 8)) { ------------------ | Branch (1227:13): [True: 0, False: 118k] | Branch (1227:31): [True: 0, False: 118k] ------------------ 1228| 0| tsk_release_lock(&ext2fs->lock); 1229| 0| free(dino_buf); 1230| 0| tsk_fs_file_close(fs_file); 1231| | 1232| 0| tsk_error_reset(); 1233| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1234| 0| tsk_error_set_errstr("%s: Invalid offset into imap_buf (inum %" PRIuINUM " - ibase %" PRIuINUM ")", 1235| 0| myname, inum, ibase); 1236| 0| return 1; 1237| 0| } 1238| | 1239| | /* 1240| | * Apply the allocated/unallocated restriction. 1241| | */ 1242| 118k| myflags = (isset(ext2fs->imap_buf, inum - ibase) ? 1243| 96.7k| TSK_FS_META_FLAG_ALLOC : TSK_FS_META_FLAG_UNALLOC); 1244| | 1245| 118k| tsk_release_lock(&ext2fs->lock); 1246| | 1247| 118k| if ((flags & myflags) != myflags) ------------------ | Branch (1247:13): [True: 21.5k, False: 96.7k] ------------------ 1248| 21.5k| continue; 1249| | 1250| 96.7k| if (ext2fs_dinode_load(ext2fs, inum, dino_buf, &ea_buf, &ea_buf_len)) { ------------------ | Branch (1250:13): [True: 541, False: 96.1k] ------------------ 1251| 541| free(dino_buf); 1252| 541| tsk_fs_file_close(fs_file); 1253| | 1254| 541| return 1; 1255| 541| } 1256| | 1257| | 1258| | /* 1259| | * Apply the used/unused restriction. 1260| | */ 1261| 96.1k| myflags |= (tsk_getu32(fs->endian, dino_buf->i_ctime) ? ------------------ | | 119| 96.1k|#define tsk_getu32(endian, x) \ | | ------------------ | | | Branch (119:31): [True: 9.29k, False: 86.8k] | | ------------------ | | 120| 96.1k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 93.5k, False: 2.63k] | | ------------------ | | 121| 96.1k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 93.5k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 93.5k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 93.5k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 96.1k| : \ | | 126| 96.1k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 2.63k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 2.63k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 2.63k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1262| 86.8k| TSK_FS_META_FLAG_USED : TSK_FS_META_FLAG_UNUSED); 1263| | 1264| 96.1k| if ((flags & myflags) != myflags) ------------------ | Branch (1264:13): [True: 86.8k, False: 9.29k] ------------------ 1265| 86.8k| continue; 1266| | 1267| | /* If we want only orphans, then check if this 1268| | * inode is in the seen list 1269| | */ 1270| 9.29k| if ((myflags & TSK_FS_META_FLAG_UNALLOC) && ------------------ | Branch (1270:13): [True: 9.29k, False: 0] ------------------ 1271| 9.29k| (flags & TSK_FS_META_FLAG_ORPHAN) && ------------------ | Branch (1271:13): [True: 0, False: 9.29k] ------------------ 1272| 9.29k| (tsk_fs_dir_find_inum_named(fs, inum))) { ------------------ | Branch (1272:13): [True: 0, False: 0] ------------------ 1273| 0| continue; 1274| 0| } 1275| | 1276| | 1277| | /* 1278| | * Fill in a file system-independent inode structure and pass control 1279| | * to the application. 1280| | */ 1281| 9.29k| if (ext2fs_dinode_copy(ext2fs, fs_file, inum, dino_buf, ea_buf, ea_buf_len)) { ------------------ | Branch (1281:13): [True: 0, False: 9.29k] ------------------ 1282| 0| free(dino_buf); 1283| 0| tsk_fs_file_close(fs_file); 1284| | 1285| 0| return 1; 1286| 0| } 1287| | 1288| 9.29k| retval = a_action(fs_file, a_ptr); 1289| 9.29k| if (retval == TSK_WALK_STOP) { ------------------ | Branch (1289:13): [True: 0, False: 9.29k] ------------------ 1290| 0| free(dino_buf); 1291| 0| tsk_fs_file_close(fs_file); 1292| | 1293| 0| return 0; 1294| 0| } 1295| 9.29k| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (1295:18): [True: 16, False: 9.28k] ------------------ 1296| 16| free(dino_buf); 1297| 16| tsk_fs_file_close(fs_file); 1298| | 1299| 16| return 1; 1300| 16| } 1301| 9.29k| } 1302| | 1303| | // handle the virtual orphans folder if they asked for it 1304| 0| if ((end_inum == TSK_FS_ORPHANDIR_INUM(fs)) ------------------ | | 530| 0| (fs_info->last_inum) ------------------ | Branch (1304:9): [True: 0, False: 0] ------------------ 1305| 0| && (flags & TSK_FS_META_FLAG_ALLOC) ------------------ | Branch (1305:12): [True: 0, False: 0] ------------------ 1306| 0| && (flags & TSK_FS_META_FLAG_USED)) { ------------------ | Branch (1306:12): [True: 0, False: 0] ------------------ 1307| 0| int retval; 1308| | 1309| 0| if (tsk_fs_dir_make_orphan_dir_meta(fs, fs_file->meta)) { ------------------ | Branch (1309:13): [True: 0, False: 0] ------------------ 1310| 0| free(dino_buf); 1311| 0| tsk_fs_file_close(fs_file); 1312| | 1313| 0| return 1; 1314| 0| } 1315| | /* call action */ 1316| 0| retval = a_action(fs_file, a_ptr); 1317| 0| if (retval == TSK_WALK_STOP) { ------------------ | Branch (1317:13): [True: 0, False: 0] ------------------ 1318| 0| tsk_fs_file_close(fs_file); 1319| 0| free(dino_buf); 1320| 0| tsk_fs_file_close(fs_file); 1321| | 1322| 0| return 0; 1323| 0| } 1324| 0| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (1324:18): [True: 0, False: 0] ------------------ 1325| 0| free(dino_buf); 1326| 0| tsk_fs_file_close(fs_file); 1327| | 1328| 0| return 1; 1329| 0| } 1330| 0| } 1331| | 1332| | /* 1333| | * Cleanup. 1334| | */ 1335| 0| free(dino_buf); 1336| 0| tsk_fs_file_close(fs_file); 1337| | 1338| 0| return 0; 1339| 0|} ext2fs_open: 3477| 3.41k|{ 3478| 3.41k| EXT2FS_INFO *ext2fs; 3479| 3.41k| unsigned int len; 3480| 3.41k| TSK_FS_INFO *fs; 3481| 3.41k| ssize_t cnt; 3482| | 3483| | // clean up any error messages that are lying around 3484| 3.41k| tsk_error_reset(); 3485| | 3486| 3.41k| if (TSK_FS_TYPE_ISEXT(ftype) == 0) { ------------------ | | 857| 3.41k| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:6): [True: 3.41k, False: 0] | | ------------------ ------------------ | Branch (3486:9): [True: 0, False: 3.41k] ------------------ 3487| 0| tsk_error_reset(); 3488| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3489| 0| tsk_error_set_errstr("Invalid FS Type in ext2fs_open"); 3490| 0| return NULL; 3491| 0| } 3492| | 3493| 3.41k| if (img_info->sector_size == 0) { ------------------ | Branch (3493:9): [True: 0, False: 3.41k] ------------------ 3494| 0| tsk_error_reset(); 3495| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3496| 0| tsk_error_set_errstr("ext2fs_open: sector size is 0"); 3497| 0| return NULL; 3498| 0| } 3499| | 3500| 3.41k| if ((ext2fs = (EXT2FS_INFO *) tsk_fs_malloc(sizeof(*ext2fs))) == NULL) ------------------ | Branch (3500:9): [True: 0, False: 3.41k] ------------------ 3501| 0| return NULL; 3502| | 3503| 3.41k| fs = &(ext2fs->fs_info); 3504| | 3505| 3.41k| fs->ftype = ftype; 3506| 3.41k| fs->flags = 0; 3507| 3.41k| fs->img_info = img_info; 3508| 3.41k| fs->offset = offset; 3509| 3.41k| fs->tag = TSK_FS_INFO_TAG; ------------------ | | 933| 3.41k|#define TSK_FS_INFO_TAG 0x10101010 ------------------ 3510| | 3511| | /* 3512| | * Read the superblock. 3513| | */ 3514| 3.41k| len = sizeof(ext2fs_sb); 3515| 3.41k| if ((ext2fs->fs = (ext2fs_sb *) tsk_malloc(len)) == NULL) { ------------------ | Branch (3515:9): [True: 0, False: 3.41k] ------------------ 3516| 0| fs->tag = 0; 3517| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3518| 0| return NULL; 3519| 0| } 3520| | 3521| 3.41k| cnt = tsk_fs_read(fs, EXT2FS_SBOFF, (char *) ext2fs->fs, len); ------------------ | | 91| 3.41k|#define EXT2FS_SBOFF 1024 ------------------ 3522| 3.41k| if (cnt != len) { ------------------ | Branch (3522:9): [True: 38, False: 3.37k] ------------------ 3523| 38| if (cnt >= 0) { ------------------ | Branch (3523:13): [True: 27, False: 11] ------------------ 3524| 27| tsk_error_reset(); 3525| 27| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 27|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 27|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3526| 27| } 3527| 38| tsk_error_set_errstr2("ext2fs_open: superblock"); 3528| 38| fs->tag = 0; 3529| 38| free(ext2fs->fs); 3530| 38| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3531| 38| return NULL; 3532| 38| } 3533| | 3534| | /* 3535| | * Verify we are looking at an EXTxFS image 3536| | */ 3537| 3.37k| if (tsk_fs_guessu16(fs, ext2fs->fs->s_magic, EXT2FS_FS_MAGIC)) { ------------------ | | 296| 3.37k| tsk_guess_end_u16(&(fs->endian), (x), (mag)) | | ------------------ | | | Branch (296:6): [True: 1, False: 3.37k] | | ------------------ ------------------ 3538| 1| fs->tag = 0; 3539| 1| free(ext2fs->fs); 3540| 1| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3541| 1| tsk_error_reset(); 3542| 1| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 1|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 1|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3543| 1| tsk_error_set_errstr("not an EXTxFS file system (magic)"); 3544| 1| if (tsk_verbose) ------------------ | Branch (3544:13): [True: 0, False: 1] ------------------ 3545| 0| fprintf(stderr, "ext2fs_open: invalid magic\n"); 3546| 1| return NULL; 3547| 1| } 3548| | 3549| 3.37k| if (tsk_verbose) { ------------------ | Branch (3549:9): [True: 0, False: 3.37k] ------------------ 3550| 0| if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_ro_compat) & ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3550:13): [True: 0, False: 0] ------------------ 3551| 0| EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER) ------------------ | | 240| 0|#define EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER 0x0001 ------------------ 3552| 0| tsk_fprintf(stderr, "File system has sparse super blocks\n"); 3553| | 3554| 0| tsk_fprintf(stderr, "First data block is %" PRIu32 "\n", 3555| 0| tsk_getu32(fs->endian, ext2fs->fs->s_first_data_block)); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3556| 0| } 3557| | 3558| | /* If autodetect was given, look for the journal */ 3559| 3.37k| if (ftype == TSK_FS_TYPE_EXT_DETECT) { ------------------ | Branch (3559:9): [True: 3.37k, False: 0] ------------------ 3560| 3.37k| if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) & ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3560:13): [True: 0, False: 3.37k] ------------------ 3561| 3.37k| EXT2FS_FEATURE_INCOMPAT_EXTENTS) { ------------------ | | 228| 3.37k|#define EXT2FS_FEATURE_INCOMPAT_EXTENTS 0x0040 ------------------ 3562| 0| fs->ftype = TSK_FS_TYPE_EXT4; 3563| 0| fs->flags |= TSK_FS_INFO_FLAG_HAVE_NANOSEC; 3564| 0| } 3565| 3.37k| else if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_compat) & ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3565:18): [True: 527, False: 2.84k] ------------------ 3566| 3.37k| EXT2FS_FEATURE_COMPAT_HAS_JOURNAL) ------------------ | | 215| 3.37k|#define EXT2FS_FEATURE_COMPAT_HAS_JOURNAL 0x0004 ------------------ 3567| 527| fs->ftype = TSK_FS_TYPE_EXT3; 3568| 2.84k| else 3569| 2.84k| fs->ftype = TSK_FS_TYPE_EXT2; 3570| 3.37k| } 3571| 3.37k| fs->duname = "Fragment"; 3572| | 3573| | 3574| | /* we need to figure out if dentries are v1 or v2 */ 3575| 3.37k| if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) & ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3575:9): [True: 2.84k, False: 527] ------------------ 3576| 3.37k| EXT2FS_FEATURE_INCOMPAT_FILETYPE) ------------------ | | 224| 3.37k|#define EXT2FS_FEATURE_INCOMPAT_FILETYPE 0x0002 ------------------ 3577| 2.84k| ext2fs->deentry_type = EXT2_DE_V2; ------------------ | | 463| 2.84k|#define EXT2_DE_V2 2 ------------------ 3578| 527| else 3579| 527| ext2fs->deentry_type = EXT2_DE_V1; ------------------ | | 462| 527|#define EXT2_DE_V1 1 ------------------ 3580| | 3581| | 3582| | /* 3583| | * Calculate the meta data info 3584| | */ 3585| 3.37k| fs->inum_count = tsk_getu32(fs->endian, ext2fs->fs->s_inodes_count) + 1; // we are adding 1 in this calc to account for Orphans directory ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3586| 3.37k| fs->last_inum = fs->inum_count; 3587| 3.37k| fs->first_inum = EXT2FS_FIRSTINO; ------------------ | | 87| 3.37k|#define EXT2FS_FIRSTINO 1 /* inode 1 contains the bad blocks */ ------------------ 3588| 3.37k| fs->root_inum = EXT2FS_ROOTINO; ------------------ | | 88| 3.37k|#define EXT2FS_ROOTINO 2 /* location of root directory inode */ ------------------ 3589| | 3590| 3.37k| if (fs->inum_count < 10) { ------------------ | Branch (3590:9): [True: 0, False: 3.37k] ------------------ 3591| 0| fs->tag = 0; 3592| 0| free(ext2fs->fs); 3593| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3594| 0| tsk_error_reset(); 3595| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3596| 0| tsk_error_set_errstr("Not an EXTxFS file system (inum count)"); 3597| 0| if (tsk_verbose) ------------------ | Branch (3597:13): [True: 0, False: 0] ------------------ 3598| 0| fprintf(stderr, "ext2fs_open: two few inodes\n"); 3599| 0| return NULL; 3600| 0| } 3601| | 3602| | 3603| | /* Set the size of the inode, but default to our data structure 3604| | * size if it is larger */ 3605| 3.37k| ext2fs->inode_size = tsk_getu16(fs->endian, ext2fs->fs->s_inode_size); ------------------ | | 86| 3.37k|#define tsk_getu16(endian, x) \ | | 87| 3.37k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 2.84k, False: 527] | | ------------------ | | 88| 3.37k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3.37k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 3606| 3.37k| if (ext2fs->inode_size < sizeof(ext2fs_inode)) { ------------------ | Branch (3606:9): [True: 2, False: 3.36k] ------------------ 3607| 2| if (tsk_verbose) ------------------ | Branch (3607:13): [True: 0, False: 2] ------------------ 3608| 0| tsk_fprintf(stderr, "SB inode size is small"); 3609| 2| } 3610| | 3611| | 3612| | /* 3613| | * Calculate the block info 3614| | */ 3615| 3.37k| fs->dev_bsize = img_info->sector_size; 3616| 3.37k| if (tsk_getu32(fs->endian, ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3616:9): [True: 527, False: 2.84k] ------------------ 3617| 3.37k| ext2fs->fs-> 3618| 3.37k| s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT) { ------------------ | | 229| 3.37k|#define EXT2FS_FEATURE_INCOMPAT_64BIT 0x0080 ------------------ 3619| |// printf("DEBUG fs_open: 64bit file system\n"); 3620| 527| fs->block_count = 3621| 527| ext4_getu64(fs->endian, ext2fs->fs->s_blocks_count_hi, ------------------ | | 61| 527|#define ext4_getu64(endian, x, y) \ | | 62| 527|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 527] | | ------------------ | | 63| 527| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 527| : \ | | 73| 527| ((uint64_t) \ | | 74| 527| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 527| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 527| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 527| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 527| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 527| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 527| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 527| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ 3622| 527| ext2fs->fs->s_blocks_count); 3623| 527| } 3624| 2.84k| else { 3625| 2.84k| fs->block_count = 3626| 2.84k| tsk_getu32(fs->endian, ext2fs->fs->s_blocks_count); ------------------ | | 119| 2.84k|#define tsk_getu32(endian, x) \ | | 120| 2.84k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 0] | | ------------------ | | 121| 2.84k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 2.84k| : \ | | 126| 2.84k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3627| 2.84k| } 3628| 3.37k| fs->first_block = 0; 3629| 3.37k| fs->last_block_act = fs->last_block = fs->block_count - 1; 3630| 3.37k| ext2fs->first_data_block = 3631| 3.37k| tsk_getu32(fs->endian, ext2fs->fs->s_first_data_block); ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3632| | 3633| 3.37k| if (tsk_getu32(fs->endian, ext2fs->fs->s_log_block_size) != ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3633:9): [True: 0, False: 3.37k] ------------------ 3634| 3.37k| tsk_getu32(fs->endian, ext2fs->fs->s_log_frag_size)) { ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3635| 0| fs->tag = 0; 3636| 0| free(ext2fs->fs); 3637| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3638| 0| tsk_error_reset(); 3639| 0| tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC); ------------------ | | 347| 0|#define TSK_ERR_FS_UNSUPFUNC (TSK_ERR_FS | 2) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3640| 0| tsk_error_set_errstr 3641| 0| ("This file system has fragments that are a different size than blocks, which is not currently supported\nContact brian with details of the system that created this image"); 3642| 0| if (tsk_verbose) ------------------ | Branch (3642:13): [True: 0, False: 0] ------------------ 3643| 0| fprintf(stderr, 3644| 0| "ext2fs_open: fragment size not equal to block size\n"); 3645| 0| return NULL; 3646| 0| } 3647| | 3648| 3.37k| if (tsk_getu32(fs->endian, ext2fs->fs->s_log_block_size) >= sizeof(uint32_t) * 8) { ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3648:9): [True: 0, False: 3.37k] ------------------ 3649| 0| free(ext2fs->fs); 3650| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3651| 0| tsk_error_reset(); 3652| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3653| 0| tsk_error_set_errstr("Block size too large"); 3654| 0| if (tsk_verbose) ------------------ | Branch (3654:13): [True: 0, False: 0] ------------------ 3655| 0| fprintf(stderr, 3656| 0| "ext2fs_open: block size too large\n"); 3657| 0| return NULL; 3658| 0| } 3659| | 3660| 3.37k| fs->block_size = 3661| 3.37k| EXT2FS_MIN_BLOCK_SIZE << tsk_getu32(fs->endian, ------------------ | | 95| 3.37k|#define EXT2FS_MIN_BLOCK_SIZE 1024 ------------------ EXT2FS_MIN_BLOCK_SIZE << tsk_getu32(fs->endian, ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3662| 3.37k| ext2fs->fs->s_log_block_size); 3663| | 3664| | // sanity check 3665| 3.37k| if ((fs->block_size == 0) || (fs->block_size % 512)) { ------------------ | Branch (3665:9): [True: 0, False: 3.37k] | Branch (3665:34): [True: 0, False: 3.37k] ------------------ 3666| 0| fs->tag = 0; 3667| 0| free(ext2fs->fs); 3668| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3669| 0| tsk_error_reset(); 3670| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3671| 0| tsk_error_set_errstr("Not an EXTxFS file system (block size)"); 3672| 0| if (tsk_verbose) ------------------ | Branch (3672:13): [True: 0, False: 0] ------------------ 3673| 0| fprintf(stderr, "ext2fs_open: invalid block size\n"); 3674| 0| return NULL; 3675| 0| } 3676| | 3677| | // determine the last block we have in this image 3678| 3.37k| if ((TSK_DADDR_T) ((img_info->size - offset) / fs->block_size) < ------------------ | Branch (3678:9): [True: 3.35k, False: 14] ------------------ 3679| 3.37k| fs->block_count) 3680| 3.35k| fs->last_block_act = 3681| 3.35k| (img_info->size - offset) / fs->block_size - 1; 3682| | 3683| | 3684| | /* The group descriptors are located in the block following the 3685| | * super block */ 3686| 3.37k| ext2fs->groups_offset = 3687| 3.37k| roundup((EXT2FS_SBOFF + sizeof(ext2fs_sb)), fs->block_size); 3688| | 3689| | // sanity check to avoid divide by zero issues 3690| 3.37k| if (tsk_getu32(fs->endian, ext2fs->fs->s_blocks_per_group) == 0) { ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3690:9): [True: 0, False: 3.37k] ------------------ 3691| 0| fs->tag = 0; 3692| 0| free(ext2fs->fs); 3693| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3694| 0| tsk_error_reset(); 3695| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3696| 0| tsk_error_set_errstr("Not an EXTxFS file system (blocks per group)"); 3697| 0| if (tsk_verbose) ------------------ | Branch (3697:13): [True: 0, False: 0] ------------------ 3698| 0| fprintf(stderr, "ext2fs_open: blocks per group is 0\n"); 3699| 0| return NULL; 3700| 0| } 3701| 3.37k| if (tsk_getu32(fs->endian, ext2fs->fs->s_inodes_per_group) == 0) { ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3701:9): [True: 0, False: 3.37k] ------------------ 3702| 0| fs->tag = 0; 3703| 0| free(ext2fs->fs); 3704| 0| tsk_fs_free((TSK_FS_INFO *)ext2fs); 3705| 0| tsk_error_reset(); 3706| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 3707| 0| tsk_error_set_errstr("Not an EXTxFS file system (inodes per group)"); 3708| 0| if (tsk_verbose) ------------------ | Branch (3708:13): [True: 0, False: 0] ------------------ 3709| 0| fprintf(stderr, "ext2fs_open: inodes per group is 0\n"); 3710| 0| return NULL; 3711| 0| } 3712| | 3713| 3.37k| if (tsk_getu32(fs->endian, ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (3713:9): [True: 527, False: 2.84k] ------------------ 3714| 3.37k| ext2fs->fs-> 3715| 3.37k| s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT) { ------------------ | | 229| 3.37k|#define EXT2FS_FEATURE_INCOMPAT_64BIT 0x0080 ------------------ 3716| 527| ext2fs->groups_count = 3717| 527| (EXT2_GRPNUM_T) ((ext4_getu64(fs->endian, ------------------ | | 61| 527|#define ext4_getu64(endian, x, y) \ | | 62| 527|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 527] | | ------------------ | | 63| 527| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 527| : \ | | 73| 527| ((uint64_t) \ | | 74| 527| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 527| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 527| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 527| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 527| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 527| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 527| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 527| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ 3718| 527| ext2fs->fs->s_blocks_count_hi, 3719| 527| ext2fs->fs->s_blocks_count) 3720| 527| - ext2fs->first_data_block + tsk_getu32(fs->endian, ------------------ | | 119| 527|#define tsk_getu32(endian, x) \ | | 120| 527|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 527] | | ------------------ | | 121| 527| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 527| : \ | | 126| 527| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3721| 527| ext2fs->fs->s_blocks_per_group) - 1) 3722| 527| / tsk_getu32(fs->endian, ext2fs->fs->s_blocks_per_group)); ------------------ | | 119| 527|#define tsk_getu32(endian, x) \ | | 120| 527|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 527] | | ------------------ | | 121| 527| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 527| : \ | | 126| 527| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3723| 527| } 3724| 2.84k| else { 3725| 2.84k| ext2fs->groups_count = 3726| 2.84k| (EXT2_GRPNUM_T) ((tsk_getu32(fs->endian, ------------------ | | 119| 2.84k|#define tsk_getu32(endian, x) \ | | 120| 2.84k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 0] | | ------------------ | | 121| 2.84k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 2.84k| : \ | | 126| 2.84k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3727| 2.84k| ext2fs->fs->s_blocks_count) - 3728| 2.84k| ext2fs->first_data_block + tsk_getu32(fs->endian, ------------------ | | 119| 2.84k|#define tsk_getu32(endian, x) \ | | 120| 2.84k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 0] | | ------------------ | | 121| 2.84k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 2.84k| : \ | | 126| 2.84k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3729| 2.84k| ext2fs->fs->s_blocks_per_group) - 3730| 2.84k| 1) / tsk_getu32(fs->endian, ------------------ | | 119| 2.84k|#define tsk_getu32(endian, x) \ | | 120| 2.84k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 0] | | ------------------ | | 121| 2.84k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 2.84k| : \ | | 126| 2.84k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3731| 2.84k| ext2fs->fs->s_blocks_per_group)); 3732| 2.84k| } 3733| | 3734| | /* Volume ID */ 3735| 57.3k| for (fs->fs_id_used = 0; fs->fs_id_used < 16; fs->fs_id_used++) { ------------------ | Branch (3735:30): [True: 53.9k, False: 3.37k] ------------------ 3736| 53.9k| fs->fs_id[fs->fs_id_used] = ext2fs->fs->s_uuid[fs->fs_id_used]; 3737| 53.9k| } 3738| | 3739| | /* Set the generic function pointers */ 3740| 3.37k| fs->inode_walk = ext2fs_inode_walk; 3741| 3.37k| fs->block_walk = ext2fs_block_walk; 3742| 3.37k| fs->block_getflags = ext2fs_block_getflags; 3743| | 3744| 3.37k| fs->get_default_attr_type = tsk_fs_unix_get_default_attr_type; 3745| | //fs->load_attrs = tsk_fs_unix_make_data_run; 3746| 3.37k| fs->load_attrs = ext2fs_load_attrs; 3747| | 3748| 3.37k| fs->file_add_meta = ext2fs_inode_lookup; 3749| 3.37k| fs->dir_open_meta = ext2fs_dir_open_meta; 3750| 3.37k| fs->fsstat = ext2fs_fsstat; 3751| 3.37k| fs->fscheck = ext2fs_fscheck; 3752| 3.37k| fs->istat = ext2fs_istat; 3753| 3.37k| fs->name_cmp = tsk_fs_unix_name_cmp; 3754| 3.37k| fs->close = ext2fs_close; 3755| | 3756| | 3757| | /* Journal */ 3758| 3.37k| fs->journ_inum = tsk_getu32(fs->endian, ext2fs->fs->s_journal_inum); ------------------ | | 119| 3.37k|#define tsk_getu32(endian, x) \ | | 120| 3.37k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 2.84k, False: 527] | | ------------------ | | 121| 3.37k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 2.84k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 2.84k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 2.84k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 3.37k| : \ | | 126| 3.37k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 527| (((uint8_t *)(x))[2] << 8) + \ | | 128| 527| (((uint8_t *)(x))[1] << 16) + \ | | 129| 527| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3759| 3.37k| fs->jblk_walk = ext2fs_jblk_walk; 3760| 3.37k| fs->jentry_walk = ext2fs_jentry_walk; 3761| 3.37k| fs->jopen = ext2fs_jopen; 3762| | 3763| | /* initialize the caches */ 3764| | /* inode map */ 3765| 3.37k| ext2fs->imap_buf = NULL; 3766| 3.37k| ext2fs->imap_grp_num = 0xffffffff; 3767| | 3768| | /* block map */ 3769| 3.37k| ext2fs->bmap_buf = NULL; 3770| 3.37k| ext2fs->bmap_grp_num = 0xffffffff; 3771| | 3772| | /* group descriptor */ 3773| 3.37k| ext2fs->grp_buf = NULL; 3774| 3.37k| ext2fs->grp_num = 0xffffffff; 3775| | 3776| | 3777| | /* 3778| | * Print some stats. 3779| | */ 3780| 3.37k| if (tsk_verbose) ------------------ | Branch (3780:9): [True: 0, False: 3.37k] ------------------ 3781| 0| tsk_fprintf(stderr, 3782| 0| "inodes %" PRIu32 " root ino %" PRIuINUM " blocks %" PRIu32 3783| 0| " blocks/group %" PRIu32 "\n", tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3784| 0| ext2fs->fs->s_inodes_count), 3785| 0| fs->root_inum, tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3786| 0| ext2fs->fs->s_blocks_count), tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 3787| 0| ext2fs->fs->s_blocks_per_group)); 3788| | 3789| 3.37k| tsk_init_lock(&ext2fs->lock); 3790| | 3791| 3.37k| return fs; 3792| 3.37k|} ext2fs.c:ext2fs_imap_load: 387| 129k|{ 388| 129k| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ext2fs->fs_info; 389| 129k| ssize_t cnt; 390| 129k| TSK_DADDR_T addr; 391| | 392| | /* 393| | * Look up the group descriptor info. 394| | */ 395| 129k| if (ext2fs_group_load(ext2fs, grp_num)) { ------------------ | Branch (395:9): [True: 0, False: 129k] ------------------ 396| 0| return 1; 397| 0| } 398| | 399| | /* Allocate the cache buffer and exit if map is already loaded */ 400| 129k| if (ext2fs->imap_buf == NULL) { ------------------ | Branch (400:9): [True: 544, False: 129k] ------------------ 401| 544| if ((ext2fs->imap_buf = ------------------ | Branch (401:13): [True: 0, False: 544] ------------------ 402| 544| (uint8_t *) tsk_malloc(fs->block_size)) == NULL) { 403| 0| return 1; 404| 0| } 405| 544| } 406| 129k| else if (ext2fs->imap_grp_num == grp_num) { ------------------ | Branch (406:14): [True: 128k, False: 527] ------------------ 407| 128k| return 0; 408| 128k| } 409| | 410| | /* 411| | * Look up the inode allocation bitmap. 412| | */ 413| 1.07k| if (ext2fs->ext4_grp_buf != NULL) { ------------------ | Branch (413:9): [True: 0, False: 1.07k] ------------------ 414| 0| addr = ext4_getu64(fs->endian, ------------------ | | 61| 0|#define ext4_getu64(endian, x, y) \ | | 62| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 0] | | ------------------ | | 63| 0| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 0| : \ | | 73| 0| ((uint64_t) \ | | 74| 0| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 0| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 0| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 0| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ 415| 0| ext2fs->ext4_grp_buf->bg_inode_bitmap_hi, 416| 0| ext2fs->ext4_grp_buf->bg_inode_bitmap_lo); 417| 0| } 418| 1.07k| else { 419| 1.07k| addr = (TSK_DADDR_T) tsk_getu32(fs->endian, ext2fs->grp_buf->bg_inode_bitmap); ------------------ | | 119| 1.07k|#define tsk_getu32(endian, x) \ | | 120| 1.07k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 17, False: 1.05k] | | ------------------ | | 121| 1.07k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 17| (((uint8_t *)(x))[1] << 8) + \ | | 123| 17| (((uint8_t *)(x))[2] << 16) + \ | | 124| 17| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.07k| : \ | | 126| 1.07k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 1.05k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 1.05k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 1.05k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 420| 1.07k| } 421| | 422| 1.07k| if (addr > fs->last_block) { ------------------ | Branch (422:9): [True: 0, False: 1.07k] ------------------ 423| 0| tsk_error_reset(); 424| 0| tsk_error_set_errno(TSK_ERR_FS_BLK_NUM); ------------------ | | 352| 0|#define TSK_ERR_FS_BLK_NUM (TSK_ERR_FS | 7) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 425| 0| tsk_error_set_errstr 426| 0| ("ext2fs_imap_load: Block too large for image: %" PRIu64, addr); 427| 0| return 1; 428| 0| } 429| | 430| | // Ensure the bitmap buffer is initialized. 431| 1.07k| memset(ext2fs->imap_buf, 0, fs->block_size); 432| | 433| 1.07k| cnt = tsk_fs_read(fs, addr * fs->block_size, 434| 1.07k| (char *) ext2fs->imap_buf, ext2fs->fs_info.block_size); 435| | 436| 1.07k| if (cnt != ext2fs->fs_info.block_size) { ------------------ | Branch (436:9): [True: 0, False: 1.07k] ------------------ 437| 0| if (cnt >= 0) { ------------------ | Branch (437:13): [True: 0, False: 0] ------------------ 438| 0| tsk_error_reset(); 439| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 440| 0| } 441| 0| tsk_error_set_errstr2("ext2fs_imap_load: Inode bitmap %" 442| 0| PRI_EXT2GRP " at %" PRIu64, grp_num, addr); 443| 0| return 1; 444| 0| } 445| | 446| 1.07k| ext2fs->imap_grp_num = grp_num; 447| 1.07k| if (tsk_verbose > 1) ------------------ | Branch (447:9): [True: 0, False: 1.07k] ------------------ 448| 0| ext2fs_print_map(ext2fs->imap_buf, 449| 0| tsk_getu32(fs->endian, ext2fs->fs->s_inodes_per_group)); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 450| | 451| 1.07k| return 0; 452| 1.07k|} ext2fs.c:ext2fs_group_load: 128| 231k|{ 129| 231k| TSK_FS_INFO *fs = (TSK_FS_INFO *) ext2fs; 130| 231k| size_t gd_size = tsk_getu16(fs->endian, ext2fs->fs->s_desc_size); ------------------ | | 86| 231k|#define tsk_getu16(endian, x) \ | | 87| 231k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 218k, False: 13.1k] | | ------------------ | | 88| 231k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 231k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 131| | 132| | /* 133| | * Sanity check 134| | */ 135| 231k| if (grp_num >= ext2fs->groups_count) { ------------------ | Branch (135:9): [True: 30, False: 231k] ------------------ 136| 30| tsk_error_reset(); 137| 30| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 30|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 30|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 138| 30| tsk_error_set_errstr 139| 30| ("ext2fs_group_load: invalid cylinder group number: %" 140| 30| PRI_EXT2GRP "", grp_num); 141| 30| return 1; 142| 30| } 143| | // already loaded 144| 231k| else if (ext2fs->grp_num == grp_num) { ------------------ | Branch (144:14): [True: 227k, False: 3.89k] ------------------ 145| 227k| return 0; 146| 227k| } 147| | 148| | // 64-bit version. 149| 3.89k| if (((fs->ftype == TSK_FS_TYPE_EXT4)) && (EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs, ------------------ | | 221| 0| ((tsk_getu32(fs->endian,sb->s_feature_incompat) & mask) != 0) | | ------------------ | | | | 119| 0|#define tsk_getu32(endian, x) \ | | | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (120:13): [True: 0, False: 0] | | | | ------------------ | | | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | | | 125| 0| : \ | | | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) | | ------------------ | | | Branch (221:5): [True: 0, False: 0] | | ------------------ ------------------ | Branch (149:9): [True: 0, False: 3.89k] ------------------ 150| 0| EXT2FS_FEATURE_INCOMPAT_64BIT) 151| 0| && (tsk_getu16(fs->endian, ext2fs->fs->s_desc_size) >= 64))) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (151:12): [True: 0, False: 0] ------------------ 152| 0| TSK_OFF_T offs; 153| 0| ssize_t cnt; 154| | 155| 0| if (gd_size < (int)sizeof(ext4fs_gd)) ------------------ | Branch (155:17): [True: 0, False: 0] ------------------ 156| 0| gd_size = sizeof(ext4fs_gd); 157| | 158| 0| if (ext2fs->ext4_grp_buf == NULL) { ------------------ | Branch (158:17): [True: 0, False: 0] ------------------ 159| 0| if ((ext2fs->ext4_grp_buf = (ext4fs_gd *) tsk_malloc(gd_size)) == NULL) ------------------ | Branch (159:21): [True: 0, False: 0] ------------------ 160| 0| return 1; 161| 0| } 162| 0| offs = ext2fs->groups_offset + grp_num * gd_size; 163| | 164| 0| cnt = tsk_fs_read(&ext2fs->fs_info, offs, (char *) ext2fs->ext4_grp_buf, gd_size); 165| | 166| |#ifdef Ext4_DBG 167| | debug_print_buf((char *) ext2fs->ext4_grp_buf, gd_size); 168| |#endif 169| 0| if (cnt != (ssize_t) gd_size) { ------------------ | Branch (169:17): [True: 0, False: 0] ------------------ 170| 0| if (cnt >= 0) { ------------------ | Branch (170:21): [True: 0, False: 0] ------------------ 171| 0| tsk_error_reset(); 172| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 173| 0| } 174| 0| tsk_error_set_errstr2("ext2fs_group_load: Group descriptor %" 175| 0| PRI_EXT2GRP " at %" PRIdOFF, grp_num, offs); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 176| 0| return 1; 177| 0| } 178| | 179| | // sanity checks 180| 0| if ((ext4_getu64(fs->endian, ------------------ | | 61| 0|#define ext4_getu64(endian, x, y) \ | | 62| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 0] | | ------------------ | | 63| 0| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 0| : \ | | 73| 0| ((uint64_t) \ | | 74| 0| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 0| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 0| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 0| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ | Branch (180:17): [True: 0, False: 0] ------------------ 181| 0| ext2fs->ext4_grp_buf->bg_block_bitmap_hi, 182| 0| ext2fs->ext4_grp_buf->bg_block_bitmap_lo) > fs->last_block) || 183| 0| (ext4_getu64(fs->endian, ------------------ | | 61| 0|#define ext4_getu64(endian, x, y) \ | | 62| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 0] | | ------------------ | | 63| 0| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 0| : \ | | 73| 0| ((uint64_t) \ | | 74| 0| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 0| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 0| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 0| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ | Branch (183:17): [True: 0, False: 0] ------------------ 184| 0| ext2fs->ext4_grp_buf->bg_inode_bitmap_hi, 185| 0| ext2fs->ext4_grp_buf->bg_inode_bitmap_lo) > fs->last_block) || 186| 0| (ext4_getu64(fs->endian, ------------------ | | 61| 0|#define ext4_getu64(endian, x, y) \ | | 62| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 0] | | ------------------ | | 63| 0| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 0| : \ | | 73| 0| ((uint64_t) \ | | 74| 0| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 0| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 0| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 0| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ | Branch (186:17): [True: 0, False: 0] ------------------ 187| 0| ext2fs->ext4_grp_buf->bg_inode_table_hi, 188| 0| ext2fs->ext4_grp_buf->bg_inode_table_lo) > fs->last_block)) { 189| 0| tsk_error_reset(); 190| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 191| 0| tsk_error_set_errstr("extXfs_group_load: Ext4 Group %" PRI_EXT2GRP 192| 0| " descriptor block locations too large at byte offset %" 193| 0| PRIuDADDR, grp_num, offs); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 194| 0| return 1; 195| 0| } 196| 0| } 197| 3.89k| else { 198| 3.89k| TSK_OFF_T offs; 199| 3.89k| ssize_t cnt; 200| 3.89k| if (gd_size < (int)sizeof(ext2fs_gd)) ------------------ | Branch (200:13): [True: 3.89k, False: 1] ------------------ 201| 3.89k| gd_size = sizeof(ext2fs_gd); 202| | 203| 3.89k| if (ext2fs->grp_buf == NULL) { ------------------ | Branch (203:13): [True: 3.37k, False: 527] ------------------ 204| 3.37k| if ((ext2fs->grp_buf = (ext2fs_gd *) tsk_malloc(gd_size)) == NULL) ------------------ | Branch (204:17): [True: 0, False: 3.37k] ------------------ 205| 0| return 1; 206| 3.37k| } 207| 3.89k| offs = ext2fs->groups_offset + grp_num * gd_size; 208| | 209| 3.89k| cnt = tsk_fs_read(&ext2fs->fs_info, offs, (char *) ext2fs->grp_buf, gd_size); 210| | 211| 3.89k| if (cnt != (ssize_t) gd_size) { ------------------ | Branch (211:13): [True: 2.82k, False: 1.07k] ------------------ 212| 2.82k| if (cnt >= 0) { ------------------ | Branch (212:17): [True: 0, False: 2.82k] ------------------ 213| 0| tsk_error_reset(); 214| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 215| 0| } 216| 2.82k| tsk_error_set_errstr2("ext2fs_group_load: Group descriptor %" 217| 2.82k| PRI_EXT2GRP " at %" PRIdOFF, grp_num, offs); ------------------ | | 269| 2.82k|#define PRIdOFF PRId64 ------------------ 218| 2.82k| return 1; 219| 2.82k| } 220| | 221| | // sanity checks 222| 1.07k| if ((tsk_getu32(fs->endian, ------------------ | | 119| 1.07k|#define tsk_getu32(endian, x) \ | | 120| 1.07k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 17, False: 1.05k] | | ------------------ | | 121| 1.07k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 17| (((uint8_t *)(x))[1] << 8) + \ | | 123| 17| (((uint8_t *)(x))[2] << 16) + \ | | 124| 17| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.07k| : \ | | 126| 1.07k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 1.05k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 1.05k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 1.05k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (222:13): [True: 0, False: 1.07k] ------------------ 223| 1.07k| ext2fs->grp_buf->bg_block_bitmap) > fs->last_block) || 224| 1.07k| (tsk_getu32(fs->endian, ------------------ | | 119| 1.07k|#define tsk_getu32(endian, x) \ | | 120| 1.07k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 17, False: 1.05k] | | ------------------ | | 121| 1.07k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 17| (((uint8_t *)(x))[1] << 8) + \ | | 123| 17| (((uint8_t *)(x))[2] << 16) + \ | | 124| 17| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.07k| : \ | | 126| 1.07k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 1.05k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 1.05k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 1.05k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (224:13): [True: 0, False: 1.07k] ------------------ 225| 1.07k| ext2fs->grp_buf->bg_inode_bitmap) > fs->last_block) || 226| 1.07k| (tsk_getu32(fs->endian, ------------------ | | 119| 1.07k|#define tsk_getu32(endian, x) \ | | 120| 1.07k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 17, False: 1.05k] | | ------------------ | | 121| 1.07k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 17| (((uint8_t *)(x))[1] << 8) + \ | | 123| 17| (((uint8_t *)(x))[2] << 16) + \ | | 124| 17| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.07k| : \ | | 126| 1.07k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 1.05k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 1.05k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 1.05k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (226:13): [True: 0, False: 1.07k] ------------------ 227| 1.07k| ext2fs->grp_buf->bg_inode_table) > fs->last_block)) { 228| 0| tsk_error_reset(); 229| 0| tsk_error_set_errno(TSK_ERR_FS_CORRUPT); ------------------ | | 361| 0|#define TSK_ERR_FS_CORRUPT (TSK_ERR_FS | 16) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 230| 0| tsk_error_set_errstr("extXfs_group_load: Group %" PRI_EXT2GRP 231| 0| " descriptor block locations too large at byte offset %" 232| 0| PRIuDADDR, grp_num, offs); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 233| 0| return 1; 234| 0| } 235| | 236| 1.07k| if (tsk_verbose) { ------------------ | Branch (236:13): [True: 0, False: 1.07k] ------------------ 237| 0| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ext2fs->fs_info; 238| 0| tsk_fprintf(stderr, 239| 0| "\tgroup %" PRI_EXT2GRP ": %" PRIu16 "/%" PRIu16 240| 0| " free blocks/inodes\n", grp_num, tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 241| 0| ext2fs->grp_buf->bg_free_blocks_count), 242| 0| tsk_getu16(fs->endian, ext2fs->grp_buf->bg_free_inodes_count)); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 243| 0| } 244| 1.07k| } 245| 1.07k| ext2fs->grp_num = grp_num; 246| | 247| 1.07k| return 0; 248| 3.89k|} ext2fs.c:ext2fs_dinode_load: 466| 101k|{ 467| 101k| EXT2_GRPNUM_T grp_num; 468| 101k| TSK_OFF_T addr; 469| 101k| ssize_t cnt; 470| 101k| TSK_INUM_T rel_inum; 471| 101k| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ext2fs->fs_info; 472| | 473| | /* 474| | * Sanity check. 475| | * Use last_num-1 to account for virtual Orphan directory in last_inum. 476| | */ 477| 101k| if ((dino_inum < fs->first_inum) || (dino_inum > fs->last_inum - 1)) { ------------------ | Branch (477:9): [True: 0, False: 101k] | Branch (477:41): [True: 0, False: 101k] ------------------ 478| 0| tsk_error_reset(); 479| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_NUM); ------------------ | | 353| 0|#define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 8) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 480| 0| tsk_error_set_errstr("ext2fs_dinode_load: address: %" PRIuINUM, ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 481| 0| dino_inum); 482| 0| return 1; 483| 0| } 484| | 485| 101k| if (dino_buf == NULL) { ------------------ | Branch (485:9): [True: 0, False: 101k] ------------------ 486| 0| tsk_error_reset(); 487| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 488| 0| tsk_error_set_errstr("ext2fs_dinode_load: dino_buf is NULL"); 489| 0| return 1; 490| 0| } 491| | 492| | /* 493| | * Look up the group descriptor for this inode. 494| | */ 495| 101k| grp_num = (EXT2_GRPNUM_T) ((dino_inum - fs->first_inum) / 496| 101k| tsk_getu32(fs->endian, ext2fs->fs->s_inodes_per_group)); ------------------ | | 119| 101k|#define tsk_getu32(endian, x) \ | | 120| 101k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 96.6k, False: 5.27k] | | ------------------ | | 121| 101k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 96.6k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 96.6k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 96.6k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 101k| : \ | | 126| 101k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 5.27k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 5.27k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 5.27k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 497| | 498| | /* lock access to grp_buf */ 499| 101k| tsk_take_lock(&ext2fs->lock); 500| | 501| 101k| if (ext2fs_group_load(ext2fs, grp_num)) { ------------------ | Branch (501:9): [True: 2.85k, False: 99.1k] ------------------ 502| 2.85k| tsk_release_lock(&ext2fs->lock); 503| 2.85k| return 1; 504| 2.85k| } 505| | 506| | /* 507| | * Look up the inode table block for this inode. 508| | */ 509| 99.1k| rel_inum = 510| 99.1k| (dino_inum - 1) - tsk_getu32(fs->endian, ------------------ | | 119| 99.1k|#define tsk_getu32(endian, x) \ | | 120| 99.1k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 93.8k, False: 5.27k] | | ------------------ | | 121| 99.1k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 93.8k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 93.8k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 93.8k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 99.1k| : \ | | 126| 99.1k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 5.27k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 5.27k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 5.27k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 511| 99.1k| ext2fs->fs->s_inodes_per_group) * grp_num; 512| 99.1k| if (ext2fs->ext4_grp_buf != NULL) { ------------------ | Branch (512:9): [True: 0, False: 99.1k] ------------------ 513| |#ifdef Ext4_DBG 514| | printf("DEBUG: d_inode_load 64bit gd_size=%d\n", 515| | tsk_getu16(fs->endian, ext2fs->fs->s_desc_size)); 516| |#endif 517| | /* Test for possible overflow */ 518| 0| if (ext4_getu64(fs->endian, ext2fs->ext4_grp_buf->bg_inode_table_hi, ext2fs->ext4_grp_buf->bg_inode_table_lo) ------------------ | | 61| 0|#define ext4_getu64(endian, x, y) \ | | 62| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 0] | | ------------------ | | 63| 0| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 0| : \ | | 73| 0| ((uint64_t) \ | | 74| 0| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 0| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 0| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 0| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ | Branch (518:13): [True: 0, False: 0] ------------------ 519| 0| >= LLONG_MAX / fs->block_size) { 520| 0| tsk_release_lock(&ext2fs->lock); 521| | 522| 0| tsk_error_reset(); 523| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 524| 0| tsk_error_set_errstr 525| 0| ("ext2fs_dinode_load: Overflow when calculating address"); 526| 0| return 1; 527| 0| } 528| | 529| 0| addr = 530| 0| (TSK_OFF_T) ext4_getu64(fs->endian, ------------------ | | 61| 0|#define ext4_getu64(endian, x, y) \ | | 62| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (62:13): [True: 0, False: 0] | | ------------------ | | 63| 0| ((uint64_t) \ | | 64| 0| ((uint64_t)((uint8_t *)(y))[0] << 0) + \ | | 65| 0| ((uint64_t)((uint8_t *)(y))[1] << 8) + \ | | 66| 0| ((uint64_t)((uint8_t *)(y))[2] << 16) + \ | | 67| 0| ((uint64_t)((uint8_t *)(y))[3] << 24) + \ | | 68| 0| ((uint64_t)((uint8_t *)(x))[0] << 32) + \ | | 69| 0| ((uint64_t)((uint8_t *)(x))[1] << 40) + \ | | 70| 0| ((uint64_t)((uint8_t *)(x))[2] << 48) + \ | | 71| 0| ((uint64_t)((uint8_t *)(x))[3] << 56))\ | | 72| 0| : \ | | 73| 0| ((uint64_t) \ | | 74| 0| ((uint64_t)((uint8_t *)(y))[3] << 0) + \ | | 75| 0| ((uint64_t)((uint8_t *)(y))[2] << 8) + \ | | 76| 0| ((uint64_t)((uint8_t *)(y))[1] << 16) + \ | | 77| 0| ((uint64_t)((uint8_t *)(y))[0] << 24) + \ | | 78| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 79| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 80| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 81| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) )\ ------------------ 531| 0| ext2fs->ext4_grp_buf->bg_inode_table_hi, 532| 0| ext2fs->ext4_grp_buf->bg_inode_table_lo) 533| 0| * (TSK_OFF_T) fs->block_size + 534| 0| rel_inum * (TSK_OFF_T) ext2fs->inode_size; 535| 0| } 536| 99.1k| else { 537| 99.1k| addr = 538| 99.1k| (TSK_OFF_T) tsk_getu32(fs->endian, ------------------ | | 119| 99.1k|#define tsk_getu32(endian, x) \ | | 120| 99.1k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 93.8k, False: 5.27k] | | ------------------ | | 121| 99.1k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 93.8k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 93.8k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 93.8k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 99.1k| : \ | | 126| 99.1k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 5.27k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 5.27k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 5.27k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 539| 99.1k| ext2fs->grp_buf->bg_inode_table) * (TSK_OFF_T) fs->block_size + 540| 99.1k| rel_inum * (TSK_OFF_T) ext2fs->inode_size; 541| 99.1k| } 542| 99.1k| tsk_release_lock(&ext2fs->lock); 543| | 544| 99.1k| cnt = tsk_fs_read(fs, addr, (char *) dino_buf, ext2fs->inode_size); 545| | 546| 99.1k| if (cnt != ext2fs->inode_size) { ------------------ | Branch (546:9): [True: 571, False: 98.5k] ------------------ 547| 571| if (cnt >= 0) { ------------------ | Branch (547:13): [True: 14, False: 557] ------------------ 548| 14| tsk_error_reset(); 549| 14| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 14|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 14|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 550| 14| } 551| 571| tsk_error_set_errstr2("ext2fs_dinode_load: Inode %" PRIuINUM 552| 571| " from %" PRIdOFF, dino_inum, addr); ------------------ | | 269| 571|#define PRIdOFF PRId64 ------------------ 553| 571| return 1; 554| 571| } 555| |//DEBUG printf("Inode Size: %d, %d, %d, %d\n", sizeof(ext2fs_inode), *ext2fs->fs->s_inode_size, ext2fs->inode_size, *ext2fs->fs->s_want_extra_isize); 556| |//DEBUG debug_print_buf((char *)dino_buf, ext2fs->inode_size); 557| | 558| | // Check if we have an extended attribute in the inode 559| 98.5k| if (ext2fs->inode_size > EXT2_EA_INODE_OFFSET) { ------------------ | | 472| 98.5k|#define EXT2_EA_INODE_OFFSET 160 ------------------ | Branch (559:9): [True: 98.5k, False: 2] ------------------ 560| | // The extended attribute data immediatly follows the standard inode data 561| 98.5k| *ea_buf = (char*)dino_buf + EXT2_EA_INODE_OFFSET; ------------------ | | 472| 98.5k|#define EXT2_EA_INODE_OFFSET 160 ------------------ 562| 98.5k| *ea_buf_len = ext2fs->inode_size - EXT2_EA_INODE_OFFSET; ------------------ | | 472| 98.5k|#define EXT2_EA_INODE_OFFSET 160 ------------------ 563| 98.5k| } 564| 2| else { 565| 2| *ea_buf = NULL; 566| 2| } 567| | 568| 98.5k| if (tsk_verbose) { ------------------ | Branch (568:9): [True: 0, False: 98.5k] ------------------ 569| 0| tsk_fprintf(stderr, 570| 0| "%" PRIuINUM " m/l/s=%o/%d/%" PRIu32 571| 0| " u/g=%d/%d macd=%" PRIu32 "/%" PRIu32 "/%" PRIu32 "/%" PRIu32 572| 0| "\n", dino_inum, tsk_getu16(fs->endian, dino_buf->i_mode), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 573| 0| tsk_getu16(fs->endian, dino_buf->i_nlink), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 574| 0| (tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (574:14): [True: 0, False: 0] ------------------ 575| 0| dino_buf->i_size) + (tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 576| 0| dino_buf->i_mode) & EXT2_IN_REG) ? (uint64_t) ------------------ | | 374| 0|#define EXT2_IN_REG 0100000 ------------------ 577| 0| tsk_getu32(fs->endian, dino_buf->i_size_high) << 32 : 0), ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 578| 0| tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 579| 0| dino_buf->i_uid) + (tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 580| 0| dino_buf->i_uid_high) << 16), tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 581| 0| dino_buf->i_gid) + (tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 582| 0| dino_buf->i_gid_high) << 16), tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 583| 0| dino_buf->i_mtime), tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 584| 0| dino_buf->i_atime), tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 585| 0| dino_buf->i_ctime), tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 586| 0| dino_buf->i_dtime)); 587| 0| } 588| | 589| 98.5k| return 0; 590| 99.1k|} ext2fs.c:ext2fs_dinode_copy: 717| 11.6k|{ 718| 11.6k| int i; 719| 11.6k| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ext2fs->fs_info; 720| 11.6k| TSK_FS_META * fs_meta = fs_file->meta; 721| 11.6k| ext2fs_sb *sb = ext2fs->fs; 722| 11.6k| EXT2_GRPNUM_T grp_num; 723| 11.6k| TSK_INUM_T ibase = 0; 724| | 725| 11.6k| if (dino_buf == NULL) { ------------------ | Branch (725:9): [True: 0, False: 11.6k] ------------------ 726| 0| tsk_error_reset(); 727| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 728| 0| tsk_error_set_errstr("ext2fs_dinode_copy: dino_buf is NULL"); 729| 0| return 1; 730| 0| } 731| | 732| 11.6k| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 733| 11.6k| if (fs_meta->attr) { ------------------ | Branch (733:9): [True: 4.65k, False: 6.98k] ------------------ 734| 4.65k| tsk_fs_attrlist_markunused(fs_meta->attr); 735| 4.65k| } 736| | 737| | // set the type 738| 11.6k| switch (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_FMT) { ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ switch (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_FMT) { ------------------ | | 371| 11.6k|#define EXT2_IN_FMT 0170000 ------------------ 739| 50| case EXT2_IN_REG: ------------------ | | 374| 50|#define EXT2_IN_REG 0100000 ------------------ | Branch (739:5): [True: 50, False: 11.5k] ------------------ 740| 50| fs_meta->type = TSK_FS_META_TYPE_REG; 741| 50| break; 742| 2.27k| case EXT2_IN_DIR: ------------------ | | 376| 2.27k|#define EXT2_IN_DIR 0040000 ------------------ | Branch (742:5): [True: 2.27k, False: 9.35k] ------------------ 743| 2.27k| fs_meta->type = TSK_FS_META_TYPE_DIR; 744| 2.27k| break; 745| 8| case EXT2_IN_SOCK: ------------------ | | 372| 8|#define EXT2_IN_SOCK 0140000 ------------------ | Branch (745:5): [True: 8, False: 11.6k] ------------------ 746| 8| fs_meta->type = TSK_FS_META_TYPE_SOCK; 747| 8| break; 748| 1.27k| case EXT2_IN_LNK: ------------------ | | 373| 1.27k|#define EXT2_IN_LNK 0120000 ------------------ | Branch (748:5): [True: 1.27k, False: 10.3k] ------------------ 749| 1.27k| fs_meta->type = TSK_FS_META_TYPE_LNK; 750| 1.27k| break; 751| 222| case EXT2_IN_BLK: ------------------ | | 375| 222|#define EXT2_IN_BLK 0060000 ------------------ | Branch (751:5): [True: 222, False: 11.4k] ------------------ 752| 222| fs_meta->type = TSK_FS_META_TYPE_BLK; 753| 222| break; 754| 66| case EXT2_IN_CHR: ------------------ | | 377| 66|#define EXT2_IN_CHR 0020000 ------------------ | Branch (754:5): [True: 66, False: 11.5k] ------------------ 755| 66| fs_meta->type = TSK_FS_META_TYPE_CHR; 756| 66| break; 757| 90| case EXT2_IN_FIFO: ------------------ | | 378| 90|#define EXT2_IN_FIFO 0010000 ------------------ | Branch (757:5): [True: 90, False: 11.5k] ------------------ 758| 90| fs_meta->type = TSK_FS_META_TYPE_FIFO; 759| 90| break; 760| 7.64k| default: ------------------ | Branch (760:5): [True: 7.64k, False: 3.98k] ------------------ 761| 7.64k| fs_meta->type = TSK_FS_META_TYPE_UNDEF; 762| 7.64k| break; 763| 11.6k| } 764| | 765| | // set the mode 766| 11.6k| fs_meta->mode = 0; 767| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_ISUID) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_ISUID) ------------------ | | 380| 11.6k|#define EXT2_IN_ISUID 0004000 ------------------ | Branch (767:9): [True: 4.02k, False: 7.61k] ------------------ 768| 4.02k| fs_meta->mode |= TSK_FS_META_MODE_ISUID; 769| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_ISGID) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_ISGID) ------------------ | | 381| 11.6k|#define EXT2_IN_ISGID 0002000 ------------------ | Branch (769:9): [True: 3.68k, False: 7.95k] ------------------ 770| 3.68k| fs_meta->mode |= TSK_FS_META_MODE_ISGID; 771| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_ISVTX) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_ISVTX) ------------------ | | 382| 11.6k|#define EXT2_IN_ISVTX 0001000 ------------------ | Branch (771:9): [True: 4.17k, False: 7.46k] ------------------ 772| 4.17k| fs_meta->mode |= TSK_FS_META_MODE_ISVTX; 773| | 774| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IRUSR) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IRUSR) ------------------ | | 383| 11.6k|#define EXT2_IN_IRUSR 0000400 ------------------ | Branch (774:9): [True: 1.57k, False: 10.0k] ------------------ 775| 1.57k| fs_meta->mode |= TSK_FS_META_MODE_IRUSR; 776| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IWUSR) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IWUSR) ------------------ | | 384| 11.6k|#define EXT2_IN_IWUSR 0000200 ------------------ | Branch (776:9): [True: 2.70k, False: 8.92k] ------------------ 777| 2.70k| fs_meta->mode |= TSK_FS_META_MODE_IWUSR; 778| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IXUSR) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IXUSR) ------------------ | | 385| 11.6k|#define EXT2_IN_IXUSR 0000100 ------------------ | Branch (778:9): [True: 2.38k, False: 9.25k] ------------------ 779| 2.38k| fs_meta->mode |= TSK_FS_META_MODE_IXUSR; 780| | 781| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IRGRP) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IRGRP) ------------------ | | 386| 11.6k|#define EXT2_IN_IRGRP 0000040 ------------------ | Branch (781:9): [True: 2.67k, False: 8.95k] ------------------ 782| 2.67k| fs_meta->mode |= TSK_FS_META_MODE_IRGRP; 783| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IWGRP) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IWGRP) ------------------ | | 387| 11.6k|#define EXT2_IN_IWGRP 0000020 ------------------ | Branch (783:9): [True: 3.15k, False: 8.47k] ------------------ 784| 3.15k| fs_meta->mode |= TSK_FS_META_MODE_IWGRP; 785| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IXGRP) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IXGRP) ------------------ | | 388| 11.6k|#define EXT2_IN_IXGRP 0000010 ------------------ | Branch (785:9): [True: 3.45k, False: 8.17k] ------------------ 786| 3.45k| fs_meta->mode |= TSK_FS_META_MODE_IXGRP; 787| | 788| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IROTH) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IROTH) ------------------ | | 389| 11.6k|#define EXT2_IN_IROTH 0000004 ------------------ | Branch (788:9): [True: 2.16k, False: 9.47k] ------------------ 789| 2.16k| fs_meta->mode |= TSK_FS_META_MODE_IROTH; 790| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IWOTH) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IWOTH) ------------------ | | 390| 11.6k|#define EXT2_IN_IWOTH 0000002 ------------------ | Branch (790:9): [True: 2.05k, False: 9.57k] ------------------ 791| 2.05k| fs_meta->mode |= TSK_FS_META_MODE_IWOTH; 792| 11.6k| if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IXOTH) ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs->endian, dino_buf->i_mode) & EXT2_IN_IXOTH) ------------------ | | 391| 11.6k|#define EXT2_IN_IXOTH 0000001 ------------------ | Branch (792:9): [True: 1.94k, False: 9.69k] ------------------ 793| 1.94k| fs_meta->mode |= TSK_FS_META_MODE_IXOTH; 794| | 795| 11.6k| fs_meta->nlink = tsk_getu16(fs->endian, dino_buf->i_nlink); ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 796| | 797| 11.6k| fs_meta->size = tsk_getu32(fs->endian, dino_buf->i_size); ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 798| | 799| 11.6k| fs_meta->addr = inum; 800| | 801| | /* the general size value in the inode is only 32-bits, 802| | * but the i_dir_acl value is used for regular files to 803| | * hold the upper 32-bits 804| | * 805| | * The RO_COMPAT_LARGE_FILE flag in the super block will identify 806| | * if there are any large files in the file system 807| | */ 808| 11.6k| if ((fs_meta->type == TSK_FS_META_TYPE_REG) && ------------------ | Branch (808:9): [True: 50, False: 11.5k] ------------------ 809| 11.6k| (tsk_getu32(fs->endian, sb->s_feature_ro_compat) & ------------------ | | 119| 50|#define tsk_getu32(endian, x) \ | | 120| 50|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 50, False: 0] | | ------------------ | | 121| 50| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 50| (((uint8_t *)(x))[1] << 8) + \ | | 123| 50| (((uint8_t *)(x))[2] << 16) + \ | | 124| 50| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 50| : \ | | 126| 50| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (809:9): [True: 0, False: 50] ------------------ 810| 50| EXT2FS_FEATURE_RO_COMPAT_LARGE_FILE)) { ------------------ | | 241| 50|#define EXT2FS_FEATURE_RO_COMPAT_LARGE_FILE 0x0002 ------------------ 811| 0| fs_meta->size += 812| 0| ((uint64_t) tsk_getu32(fs->endian, ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 813| 0| dino_buf->i_size_high) << 32); 814| 0| } 815| | 816| 11.6k| fs_meta->uid = 817| 11.6k| tsk_getu16(fs->endian, dino_buf->i_uid) + ((TSK_UID_T)tsk_getu16(fs->endian, ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ tsk_getu16(fs->endian, dino_buf->i_uid) + ((TSK_UID_T)tsk_getu16(fs->endian, ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 818| 11.6k| dino_buf->i_uid_high) << 16); 819| 11.6k| fs_meta->gid = 820| 11.6k| tsk_getu16(fs->endian, dino_buf->i_gid) + ((TSK_GID_T)tsk_getu16(fs->endian, ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ tsk_getu16(fs->endian, dino_buf->i_gid) + ((TSK_GID_T)tsk_getu16(fs->endian, ------------------ | | 86| 11.6k|#define tsk_getu16(endian, x) \ | | 87| 11.6k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.89k, False: 4.74k] | | ------------------ | | 88| 11.6k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 11.6k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 821| 11.6k| dino_buf->i_gid_high) << 16); 822| 11.6k| fs_meta->mtime = tsk_getu32(fs->endian, dino_buf->i_mtime); ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 823| 11.6k| fs_meta->atime = tsk_getu32(fs->endian, dino_buf->i_atime); ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 824| 11.6k| fs_meta->ctime = tsk_getu32(fs->endian, dino_buf->i_ctime); ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 825| 11.6k| fs_meta->time2.ext2.dtime = tsk_getu32(fs->endian, dino_buf->i_dtime); ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 826| 11.6k| if (fs->ftype == TSK_FS_TYPE_EXT4) { ------------------ | Branch (826:9): [True: 0, False: 11.6k] ------------------ 827| 0| fs_meta->mtime_nano = 828| 0| tsk_getu32(fs->endian, dino_buf->i_mtime_extra) >> 2; ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 829| 0| fs_meta->atime_nano = 830| 0| tsk_getu32(fs->endian, dino_buf->i_atime_extra) >> 2; ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 831| 0| fs_meta->ctime_nano = 832| 0| tsk_getu32(fs->endian, dino_buf->i_ctime_extra) >> 2; ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 833| 0| fs_meta->crtime = tsk_getu32(fs->endian, dino_buf->i_crtime); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 834| 0| fs_meta->crtime_nano = 835| 0| tsk_getu32(fs->endian, dino_buf->i_crtime_extra) >> 2; ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 836| 0| } 837| 11.6k| else { 838| 11.6k| fs_meta->mtime_nano = fs_meta->atime_nano = fs_meta->ctime_nano = 0; 839| 11.6k| fs_meta->crtime = 0; 840| 11.6k| } 841| 11.6k| fs_meta->time2.ext2.dtime_nano = 0; 842| 11.6k| fs_meta->seq = 0; 843| | 844| 11.6k| if (fs_meta->link) { ------------------ | Branch (844:9): [True: 0, False: 11.6k] ------------------ 845| 0| free(fs_meta->link); 846| 0| fs_meta->link = NULL; 847| 0| } 848| | 849| 11.6k| if (fs_meta->content_len != EXT2FS_FILE_CONTENT_LEN) { ------------------ | | 97| 11.6k|#define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 89| 11.6k|#define EXT2FS_NDADDR 12 | | ------------------ | | #define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 90| 11.6k|#define EXT2FS_NIADDR 3 | | ------------------ ------------------ | Branch (849:9): [True: 0, False: 11.6k] ------------------ 850| 0| if ((fs_meta = ------------------ | Branch (850:13): [True: 0, False: 0] ------------------ 851| 0| tsk_fs_meta_realloc(fs_meta, 852| 0| EXT2FS_FILE_CONTENT_LEN)) == NULL) { ------------------ | | 97| 0|#define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 89| 0|#define EXT2FS_NDADDR 12 | | ------------------ | | #define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 90| 0|#define EXT2FS_NIADDR 3 | | ------------------ ------------------ 853| 0| return 1; 854| 0| } 855| 0| } 856| | 857| 11.6k| if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_EXTENTS) { ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_EXTENTS) { ------------------ | | 413| 11.6k|#define EXT2_IN_EXTENTS 0x00080000 /* Inode uses extents */ ------------------ | Branch (857:9): [True: 3.21k, False: 8.42k] ------------------ 858| 3.21k| uint32_t *addr_ptr; 859| 3.21k| fs_meta->content_type = TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS; 860| | /* NOTE TSK_DADDR_T != uint32_t, so lets make sure we use uint32_t */ 861| 3.21k| addr_ptr = (uint32_t *) fs_meta->content_ptr; 862| 51.4k| for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) { ------------------ | | 89| 51.4k|#define EXT2FS_NDADDR 12 ------------------ for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) { ------------------ | | 90| 51.4k|#define EXT2FS_NIADDR 3 ------------------ | Branch (862:21): [True: 48.1k, False: 3.21k] ------------------ 863| 48.1k| addr_ptr[i] = tsk_gets32(fs->endian, dino_buf->i_block[i]); ------------------ | | 137| 48.1k|#define tsk_gets32(endian, x) \ | | 138| 48.1k|((int32_t)tsk_getu32(endian, x)) | | ------------------ | | | | 119| 48.1k|#define tsk_getu32(endian, x) \ | | | | 120| 48.1k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (120:13): [True: 40.2k, False: 7.90k] | | | | ------------------ | | | | 121| 48.1k| ((((uint8_t *)(x))[0] << 0) + \ | | | | 122| 40.2k| (((uint8_t *)(x))[1] << 8) + \ | | | | 123| 40.2k| (((uint8_t *)(x))[2] << 16) + \ | | | | 124| 40.2k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | | | 125| 48.1k| : \ | | | | 126| 48.1k| ((((uint8_t *)(x))[3] << 0) + \ | | | | 127| 7.90k| (((uint8_t *)(x))[2] << 8) + \ | | | | 128| 7.90k| (((uint8_t *)(x))[1] << 16) + \ | | | | 129| 7.90k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) | | ------------------ ------------------ 864| 48.1k| } 865| 3.21k| } 866| 8.42k| else if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_INLINE_DATA) { ------------------ | | 119| 8.42k|#define tsk_getu32(endian, x) \ | | 120| 8.42k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 4.20k, False: 4.21k] | | ------------------ | | 121| 8.42k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 4.20k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 4.20k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 4.20k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 8.42k| : \ | | 126| 8.42k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.21k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.21k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.21k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ else if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_INLINE_DATA) { ------------------ | | 419| 8.42k|#define EXT2_INLINE_DATA 0x10000000 /* Inode has inline data */ ------------------ | Branch (866:14): [True: 4.31k, False: 4.10k] ------------------ 867| 4.31k| uint32_t *addr_ptr; 868| 4.31k| fs_meta->content_type = TSK_FS_META_CONTENT_TYPE_EXT4_INLINE; 869| 4.31k| addr_ptr = (uint32_t *)fs_meta->content_ptr; 870| 69.0k| for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) { ------------------ | | 89| 69.0k|#define EXT2FS_NDADDR 12 ------------------ for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) { ------------------ | | 90| 69.0k|#define EXT2FS_NIADDR 3 ------------------ | Branch (870:21): [True: 64.7k, False: 4.31k] ------------------ 871| 64.7k| addr_ptr[i] = tsk_gets32(fs->endian, dino_buf->i_block[i]); ------------------ | | 137| 64.7k|#define tsk_gets32(endian, x) \ | | 138| 64.7k|((int32_t)tsk_getu32(endian, x)) | | ------------------ | | | | 119| 64.7k|#define tsk_getu32(endian, x) \ | | | | 120| 64.7k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (120:13): [True: 9.39k, False: 55.3k] | | | | ------------------ | | | | 121| 64.7k| ((((uint8_t *)(x))[0] << 0) + \ | | | | 122| 9.39k| (((uint8_t *)(x))[1] << 8) + \ | | | | 123| 9.39k| (((uint8_t *)(x))[2] << 16) + \ | | | | 124| 9.39k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | | | 125| 64.7k| : \ | | | | 126| 64.7k| ((((uint8_t *)(x))[3] << 0) + \ | | | | 127| 55.3k| (((uint8_t *)(x))[2] << 8) + \ | | | | 128| 55.3k| (((uint8_t *)(x))[1] << 16) + \ | | | | 129| 55.3k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) | | ------------------ ------------------ 872| 64.7k| } 873| | 874| | // For inline data we create the default attribute now 875| 4.31k| ext4_load_attrs_inline(fs_file, ea_buf, ea_buf_len); 876| 4.31k| } 877| 4.10k| else { 878| 4.10k| TSK_DADDR_T *addr_ptr; 879| 4.10k| addr_ptr = (TSK_DADDR_T *) fs_meta->content_ptr; 880| 65.7k| for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) ------------------ | | 89| 65.7k|#define EXT2FS_NDADDR 12 ------------------ for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) ------------------ | | 90| 65.7k|#define EXT2FS_NIADDR 3 ------------------ | Branch (880:21): [True: 61.6k, False: 4.10k] ------------------ 881| 61.6k| addr_ptr[i] = tsk_gets32(fs->endian, dino_buf->i_block[i]); ------------------ | | 137| 61.6k|#define tsk_gets32(endian, x) \ | | 138| 61.6k|((int32_t)tsk_getu32(endian, x)) | | ------------------ | | | | 119| 61.6k|#define tsk_getu32(endian, x) \ | | | | 120| 61.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (120:13): [True: 53.7k, False: 7.90k] | | | | ------------------ | | | | 121| 61.6k| ((((uint8_t *)(x))[0] << 0) + \ | | | | 122| 53.7k| (((uint8_t *)(x))[1] << 8) + \ | | | | 123| 53.7k| (((uint8_t *)(x))[2] << 16) + \ | | | | 124| 53.7k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | | | 125| 61.6k| : \ | | | | 126| 61.6k| ((((uint8_t *)(x))[3] << 0) + \ | | | | 127| 7.90k| (((uint8_t *)(x))[2] << 8) + \ | | | | 128| 7.90k| (((uint8_t *)(x))[1] << 16) + \ | | | | 129| 7.90k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) | | ------------------ ------------------ 882| | 883| | /* set the link string 884| | * the size check prevents us from trying to allocate a huge amount of 885| | * memory for a bad inode value 886| | */ 887| 4.10k| if ((fs_meta->type == TSK_FS_META_TYPE_LNK) ------------------ | Branch (887:13): [True: 50, False: 4.05k] ------------------ 888| 4.10k| && (fs_meta->size < EXT2FS_MAXPATHLEN) && (fs_meta->size >= 0)) { ------------------ | | 94| 50|#define EXT2FS_MAXPATHLEN 4096 ------------------ | Branch (888:16): [True: 0, False: 50] | Branch (888:55): [True: 0, False: 0] ------------------ 889| 0| int i; 890| | 891| 0| if ((fs_meta->link = ------------------ | Branch (891:17): [True: 0, False: 0] ------------------ 892| 0| tsk_malloc((size_t) (fs_meta->size + 1))) == NULL) 893| 0| return 1; 894| | 895| | /* it is located directly in the pointers */ 896| 0| if (fs_meta->size < 4 * (EXT2FS_NDADDR + EXT2FS_NIADDR)) { ------------------ | | 89| 0|#define EXT2FS_NDADDR 12 ------------------ if (fs_meta->size < 4 * (EXT2FS_NDADDR + EXT2FS_NIADDR)) { ------------------ | | 90| 0|#define EXT2FS_NIADDR 3 ------------------ | Branch (896:17): [True: 0, False: 0] ------------------ 897| 0| unsigned int j; 898| 0| unsigned int count = 0; 899| | 900| 0| for (i = 0; i < (EXT2FS_NDADDR + EXT2FS_NIADDR) && ------------------ | | 89| 0|#define EXT2FS_NDADDR 12 ------------------ for (i = 0; i < (EXT2FS_NDADDR + EXT2FS_NIADDR) && ------------------ | | 90| 0|#define EXT2FS_NIADDR 3 ------------------ | Branch (900:29): [True: 0, False: 0] ------------------ 901| 0| count < fs_meta->size; i++) { ------------------ | Branch (901:21): [True: 0, False: 0] ------------------ 902| 0| char *a_ptr = (char *) &dino_buf->i_block[i]; 903| 0| for (j = 0; j < 4 && count < fs_meta->size; j++) { ------------------ | Branch (903:33): [True: 0, False: 0] | Branch (903:42): [True: 0, False: 0] ------------------ 904| 0| fs_meta->link[count++] = a_ptr[j]; 905| 0| } 906| 0| } 907| 0| fs_meta->link[count] = '\0'; 908| | 909| | /* clear the content pointer data to avoid the prog from reading them */ 910| 0| memset(fs_meta->content_ptr, 0, fs_meta->content_len); 911| 0| } 912| | 913| | /* it is in blocks */ 914| 0| else { 915| 0| TSK_FS_INFO *fs = (TSK_FS_INFO *) & ext2fs->fs_info; 916| 0| char *data_buf = NULL; 917| 0| char *a_ptr = fs_meta->link; 918| 0| unsigned int total_read = 0; 919| 0| TSK_DADDR_T *addr_ptr = fs_meta->content_ptr;; 920| | 921| 0| if ((data_buf = tsk_malloc(fs->block_size)) == NULL) { ------------------ | Branch (921:21): [True: 0, False: 0] ------------------ 922| 0| return 1; 923| 0| } 924| | 925| | /* we only need to do the direct blocks due to the limit 926| | * on path length */ 927| 0| for (i = 0; i < EXT2FS_NDADDR && total_read < fs_meta->size; ------------------ | | 89| 0|#define EXT2FS_NDADDR 12 ------------------ | Branch (927:29): [True: 0, False: 0] | Branch (927:50): [True: 0, False: 0] ------------------ 928| 0| i++) { 929| 0| ssize_t cnt; 930| | 931| 0| cnt = tsk_fs_read_block(fs, 932| 0| addr_ptr[i], data_buf, fs->block_size); 933| | 934| 0| if (cnt != fs->block_size) { ------------------ | Branch (934:25): [True: 0, False: 0] ------------------ 935| 0| if (cnt >= 0) { ------------------ | Branch (935:29): [True: 0, False: 0] ------------------ 936| 0| tsk_error_reset(); 937| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 938| 0| } 939| 0| tsk_error_set_errstr2 940| 0| ("ext2fs_dinode_copy: symlink destination from %" 941| 0| PRIuDADDR, addr_ptr[i]); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 942| 0| free(data_buf); 943| 0| return 1; 944| 0| } 945| | 946| 0| int copy_len = 947| 0| (fs_meta->size - total_read < ------------------ | Branch (947:25): [True: 0, False: 0] ------------------ 948| 0| fs->block_size) ? (int) (fs_meta->size - 949| 0| total_read) : (int) (fs->block_size); 950| | 951| 0| memcpy(a_ptr, data_buf, copy_len); 952| 0| total_read += copy_len; 953| 0| a_ptr = (char *) ((uintptr_t) a_ptr + copy_len); 954| 0| } 955| | 956| | /* terminate the string */ 957| 0| *a_ptr = '\0'; 958| 0| free(data_buf); 959| 0| } 960| | 961| | /* Clean up name */ 962| 0| i = 0; 963| 0| while (fs_meta->link[i] != '\0') { ------------------ | Branch (963:20): [True: 0, False: 0] ------------------ 964| 0| if (TSK_IS_CNTRL(fs_meta->link[i])) ------------------ | | 203| 0|#define TSK_IS_CNTRL(x) \ | | 204| 0|(((x) < 0x20) && ((x) >= 0x00)) | | ------------------ | | | Branch (204:2): [True: 0, False: 0] | | | Branch (204:18): [True: 0, False: 0] | | ------------------ ------------------ 965| 0| fs_meta->link[i] = '^'; 966| 0| i++; 967| 0| } 968| 0| } 969| 4.10k| } 970| | 971| | /* Fill in the flags value */ 972| 11.6k| grp_num = (EXT2_GRPNUM_T) ((inum - fs->first_inum) / 973| 11.6k| tsk_getu32(fs->endian, ext2fs->fs->s_inodes_per_group)); ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 974| | 975| | 976| 11.6k| tsk_take_lock(&ext2fs->lock); 977| | 978| 11.6k| if (ext2fs_imap_load(ext2fs, grp_num)) { ------------------ | Branch (978:9): [True: 0, False: 11.6k] ------------------ 979| 0| tsk_release_lock(&ext2fs->lock); 980| 0| return 1; 981| 0| } 982| | 983| 11.6k| ibase = 984| 11.6k| grp_num * tsk_getu32(fs->endian, ------------------ | | 119| 11.6k|#define tsk_getu32(endian, x) \ | | 120| 11.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.89k, False: 4.74k] | | ------------------ | | 121| 11.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.89k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.89k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.89k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 11.6k| : \ | | 126| 11.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 4.74k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 4.74k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 4.74k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 985| 11.6k| ext2fs->fs->s_inodes_per_group) + fs->first_inum; 986| | 987| | 988| | /* 989| | * Ensure that inum - ibase refers to a valid bit offset in imap_buf. 990| | */ 991| 11.6k| if ((ibase > inum) || (inum - ibase) >= (fs->block_size * 8)) { ------------------ | Branch (991:9): [True: 0, False: 11.6k] | Branch (991:27): [True: 0, False: 11.6k] ------------------ 992| 0| tsk_release_lock(&ext2fs->lock); 993| 0| tsk_error_reset(); 994| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 995| 0| tsk_error_set_errstr("ext2fs_dinode_copy: Invalid offset into imap_buf (inum %" PRIuINUM " - ibase %" PRIuINUM ")", 996| 0| inum, ibase); 997| 0| return 1; 998| 0| } 999| | 1000| | 1001| | /* 1002| | * Apply the allocated/unallocated restriction. 1003| | */ 1004| 11.6k| fs_meta->flags = (isset(ext2fs->imap_buf, inum - ibase) ? 1005| 11.5k| TSK_FS_META_FLAG_ALLOC : TSK_FS_META_FLAG_UNALLOC); 1006| | 1007| 11.6k| tsk_release_lock(&ext2fs->lock); 1008| | 1009| | 1010| | /* 1011| | * Apply the used/unused restriction. 1012| | */ 1013| 11.6k| fs_meta->flags |= (fs_meta->ctime ? ------------------ | Branch (1013:24): [True: 11.5k, False: 44] ------------------ 1014| 11.5k| TSK_FS_META_FLAG_USED : TSK_FS_META_FLAG_UNUSED); 1015| | 1016| 11.6k| return 0; 1017| 11.6k|} ext2fs.c:ext4_load_attrs_inline: 602| 4.31k|{ 603| 4.31k| TSK_FS_META *fs_meta = fs_file->meta; 604| 4.31k| TSK_FS_ATTR *fs_attr; 605| | 606| | // see if we have already loaded the attr 607| 4.31k| if ((fs_meta->attr != NULL) ------------------ | Branch (607:9): [True: 869, False: 3.44k] ------------------ 608| 4.31k| && (fs_meta->attr_state == TSK_FS_META_ATTR_STUDIED)) { ------------------ | Branch (608:12): [True: 0, False: 869] ------------------ 609| 0| return 0; 610| 0| } 611| | 612| 4.31k| if (fs_meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (612:9): [True: 0, False: 4.31k] ------------------ 613| 0| return 1; 614| 0| } 615| | 616| | // First load the data from the extended attr (if present) 617| 4.31k| const char *ea_inline_data = NULL; 618| 4.31k| uint32_t ea_inline_data_len = 0; 619| 4.31k| if ((ea_buf != NULL) && (ea_buf_len > 4 + sizeof(ext2fs_ea_entry)) ------------------ | Branch (619:9): [True: 4.31k, False: 0] | Branch (619:29): [True: 4.31k, False: 0] ------------------ 620| 4.31k| && (tsk_getu32(fs_file->fs_info->endian, ea_buf) == EXT2_EA_MAGIC)) { ------------------ | | 119| 4.31k|#define tsk_getu32(endian, x) \ | | 120| 4.31k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 626, False: 3.68k] | | ------------------ | | 121| 4.31k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 626| (((uint8_t *)(x))[1] << 8) + \ | | 123| 626| (((uint8_t *)(x))[2] << 16) + \ | | 124| 626| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 4.31k| : \ | | 126| 4.31k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 3.68k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 3.68k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 3.68k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ && (tsk_getu32(fs_file->fs_info->endian, ea_buf) == EXT2_EA_MAGIC)) { ------------------ | | 471| 4.31k|#define EXT2_EA_MAGIC 0xEA020000 ------------------ | Branch (620:12): [True: 1.05k, False: 3.26k] ------------------ 621| | 622| | // First entry starts after the four byte header 623| 1.05k| size_t index = 4; 624| 1.05k| ext2fs_ea_entry *ea_entry = (ext2fs_ea_entry*) &(ea_buf[index]); 625| | 626| | // The end of the list of entries is marked by two null bytes 627| 1.05k| while ((ea_entry->nlen != 0) || (ea_entry->nidx != 0)) { ------------------ | Branch (627:16): [True: 1.05k, False: 0] | Branch (627:41): [True: 0, False: 0] ------------------ 628| | 629| | // It looks like the continuation of inline data is stored in system.data. 630| | // Make sure we have room to read the attr name 'data'. 631| 1.05k| if ((ea_entry->nidx == EXT2_EA_IDX_SYSTEM) ------------------ | | 490| 1.05k|#define EXT2_EA_IDX_SYSTEM 7 // Possibly only valid for inline data ------------------ | Branch (631:17): [True: 1.05k, False: 0] ------------------ 632| 1.05k| && (ea_entry->nlen == 4) ------------------ | Branch (632:20): [True: 1.05k, False: 0] ------------------ 633| 1.05k| && (index + sizeof(ext2fs_ea_entry) + strlen("data") < ea_buf_len) ------------------ | Branch (633:20): [True: 1.05k, False: 0] ------------------ 634| 1.05k| && (strncmp(&(ea_entry->name), "data", 4)) == 0) { ------------------ | Branch (634:20): [True: 1.05k, False: 0] ------------------ 635| | 636| | // This is the right attribute. Check that the length and offset are valid. 637| | // The offset is from the beginning of the entries, i.e., four bytes into the buffer. 638| 1.05k| uint16_t offset = tsk_getu16(fs_file->fs_info->endian, ea_entry->val_off); ------------------ | | 86| 1.05k|#define tsk_getu16(endian, x) \ | | 87| 1.05k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 1.05k] | | ------------------ | | 88| 1.05k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 1.05k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 639| 1.05k| uint32_t size = tsk_getu32(fs_file->fs_info->endian, ea_entry->val_size); ------------------ | | 119| 1.05k|#define tsk_getu32(endian, x) \ | | 120| 1.05k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 1.05k] | | ------------------ | | 121| 1.05k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.05k| : \ | | 126| 1.05k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 1.05k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 1.05k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 1.05k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 640| 1.05k| if ((ea_buf_len >= 4) && (offset < ea_buf_len - 4) && (size <= ea_buf_len - 4 - offset)) { ------------------ | Branch (640:21): [True: 1.05k, False: 0] | Branch (640:42): [True: 1.05k, False: 0] | Branch (640:71): [True: 1.05k, False: 0] ------------------ 641| 1.05k| ea_inline_data = &(ea_buf[4 + offset]); 642| 1.05k| ea_inline_data_len = size; 643| 1.05k| break; 644| 1.05k| } 645| 1.05k| } 646| | 647| | // Prepare to load the next entry. 648| | // The entry size is the size of the struct plus the length of the name, minus one 649| | // because the struct contains the first character of the name. 650| 0| index += sizeof(ext2fs_ea_entry) + ea_entry->nlen - 1; 651| | 652| | // Make sure there's room for the next entry plus the 'data' name we're looking for. 653| 0| if (index + sizeof(ext2fs_ea_entry) + strlen("data") > ea_buf_len) { ------------------ | Branch (653:17): [True: 0, False: 0] ------------------ 654| 0| break; 655| 0| } 656| 0| ea_entry = (ext2fs_ea_entry*) &(ea_buf[index]); 657| 0| } 658| 1.05k| } 659| | 660| | // Check if resident data size exceeds maximum inode size (1024) - ext4 inode resident data offset (156) 661| 4.31k| if ((fs_meta->size == 0) || (fs_meta->size > (1024 - 156))) { ------------------ | Branch (661:9): [True: 1.69k, False: 2.62k] | Branch (661:33): [True: 482, False: 2.14k] ------------------ 662| 2.17k| return 1; 663| 2.17k| } 664| | 665| | // Combine the two parts of the inline data for the resident attribute. For now, make a 666| | // buffer for the full file size - this may be different than the length of the data 667| | // from the inode if we have sparse data. 668| 2.14k| uint8_t *resident_data = (uint8_t*)tsk_malloc(fs_meta->size); 669| 2.14k| if (resident_data == NULL) { ------------------ | Branch (669:9): [True: 0, False: 2.14k] ------------------ 670| 0| return 1; 671| 0| } 672| 2.14k| memset(resident_data, 0, fs_meta->size); 673| | 674| | // Copy the data from the inode. 675| 2.14k| size_t inode_data_len = (fs_meta->size < EXT2_INLINE_MAX_DATA_LEN) ? fs_meta->size : EXT2_INLINE_MAX_DATA_LEN; ------------------ | | 425| 2.14k|#define EXT2_INLINE_MAX_DATA_LEN 60 /* Max length for inline data in inode (not counting extended attribute) */ ------------------ size_t inode_data_len = (fs_meta->size < EXT2_INLINE_MAX_DATA_LEN) ? fs_meta->size : EXT2_INLINE_MAX_DATA_LEN; ------------------ | | 425| 4.27k|#define EXT2_INLINE_MAX_DATA_LEN 60 /* Max length for inline data in inode (not counting extended attribute) */ ------------------ | Branch (675:29): [True: 10, False: 2.13k] ------------------ 676| 2.14k| memcpy(resident_data, fs_meta->content_ptr, inode_data_len); 677| | 678| | // If we need more data and found an extended attribute, append that data 679| 2.14k| if ((fs_meta->size > EXT2_INLINE_MAX_DATA_LEN) && (ea_inline_data_len > 0)) { ------------------ | | 425| 2.14k|#define EXT2_INLINE_MAX_DATA_LEN 60 /* Max length for inline data in inode (not counting extended attribute) */ ------------------ | Branch (679:9): [True: 2.13k, False: 10] | Branch (679:55): [True: 1.05k, False: 1.07k] ------------------ 680| | // Don't go beyond the size of the file 681| 1.05k| size_t ea_data_len = (ea_inline_data_len < (uint64_t)fs_meta->size - inode_data_len) ? ea_inline_data_len : fs_meta->size - inode_data_len; ------------------ | Branch (681:30): [True: 1.05k, False: 0] ------------------ 682| 1.05k| memcpy(resident_data + inode_data_len, ea_inline_data, ea_data_len); 683| 1.05k| } 684| | 685| 2.14k| if (fs_meta->attr == NULL) { ------------------ | Branch (685:9): [True: 1.59k, False: 543] ------------------ 686| 1.59k| fs_meta->attr = tsk_fs_attrlist_alloc(); 687| 1.59k| } 688| 2.14k| if ((fs_attr = ------------------ | Branch (688:9): [True: 0, False: 2.14k] ------------------ 689| 2.14k| tsk_fs_attrlist_getnew(fs_meta->attr, 690| 2.14k| TSK_FS_ATTR_RES)) == NULL) { 691| 0| free(resident_data); 692| 0| return 1; 693| 0| } 694| | 695| | // Set the details in the fs_attr structure 696| 2.14k| if (tsk_fs_attr_set_str(fs_file, fs_attr, "DATA", ------------------ | Branch (696:9): [True: 0, False: 2.14k] ------------------ 697| 2.14k| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 2.14k|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 698| 2.14k| (void*)resident_data, 699| 2.14k| fs_meta->size)) { 700| 0| free(resident_data); 701| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 702| 0| return 1; 703| 0| } 704| | 705| 2.14k| free(resident_data); 706| 2.14k| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 707| 2.14k| return 0; 708| 2.14k|} ext2fs.c:ext2fs_load_attrs: 2004| 81|{ 2005| | /* EXT4 extents-based storage is dealt with differently than 2006| | * the traditional pointer lists. */ 2007| 81| if (fs_file->meta->content_type == TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS) { ------------------ | Branch (2007:9): [True: 32, False: 49] ------------------ 2008| 32| return ext4_load_attrs_extents(fs_file); 2009| 32| } 2010| 49| else if (fs_file->meta->content_type == TSK_FS_META_CONTENT_TYPE_EXT4_INLINE) { ------------------ | Branch (2010:14): [True: 0, False: 49] ------------------ 2011| | // Inline attributes are loaded in dinode_copy 2012| 0| return 0; 2013| 0| } 2014| 49| else { 2015| 49| return tsk_fs_unix_make_data_run(fs_file); 2016| 49| } 2017| 81|} ext2fs.c:ext4_load_attrs_extents: 1845| 32|{ 1846| 32| TSK_FS_META *fs_meta = fs_file->meta; 1847| 32| TSK_FS_INFO *fs_info = fs_file->fs_info; 1848| 32| TSK_OFF_T length = 0; 1849| 32| TSK_FS_ATTR *fs_attr; 1850| 32| int i; 1851| 32| ext2fs_extent *extents = NULL; 1852| 32| ext2fs_extent_idx *indices = NULL; 1853| | 1854| 32| ext2fs_extent_header *header = (ext2fs_extent_header *) fs_meta->content_ptr; 1855| 32| uint16_t num_entries = tsk_getu16(fs_info->endian, header->eh_entries); ------------------ | | 86| 32|#define tsk_getu16(endian, x) \ | | 87| 32|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 32, False: 0] | | ------------------ | | 88| 32| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 32| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1856| 32| uint16_t depth = tsk_getu16(fs_info->endian, header->eh_depth); ------------------ | | 86| 32|#define tsk_getu16(endian, x) \ | | 87| 32|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 32, False: 0] | | ------------------ | | 88| 32| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 32| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1857| | 1858| 32| if (tsk_getu16(fs_info->endian, header->eh_magic) != 0xF30A) { ------------------ | | 86| 32|#define tsk_getu16(endian, x) \ | | 87| 32|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 32, False: 0] | | ------------------ | | 88| 32| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 32| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1858:9): [True: 2, False: 30] ------------------ 1859| 2| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 2|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 2|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1860| 2| tsk_error_set_errstr 1861| 2| ("ext2fs_load_attrs: extent header magic valid incorrect!"); 1862| 2| return 1; 1863| 2| } 1864| | 1865| 30| if ((fs_meta->attr != NULL) ------------------ | Branch (1865:9): [True: 0, False: 30] ------------------ 1866| 30| && (fs_meta->attr_state == TSK_FS_META_ATTR_STUDIED)) { ------------------ | Branch (1866:12): [True: 0, False: 0] ------------------ 1867| 0| return 0; 1868| 0| } 1869| 30| else if (fs_meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (1869:14): [True: 0, False: 30] ------------------ 1870| 0| return 1; 1871| 0| } 1872| | 1873| 30| if (fs_meta->attr != NULL) { ------------------ | Branch (1873:9): [True: 0, False: 30] ------------------ 1874| 0| tsk_fs_attrlist_markunused(fs_meta->attr); 1875| 0| } 1876| 30| else { 1877| 30| fs_meta->attr = tsk_fs_attrlist_alloc(); 1878| 30| } 1879| | 1880| 30| if (TSK_FS_TYPE_ISEXT(fs_info->ftype) == 0) { ------------------ | | 857| 30| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:6): [True: 30, False: 0] | | ------------------ ------------------ | Branch (1880:9): [True: 0, False: 30] ------------------ 1881| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1882| 0| tsk_error_set_errstr 1883| 0| ("ext2fs_load_attr: Called with non-ExtX file system: %x", 1884| 0| fs_info->ftype); 1885| 0| return 1; 1886| 0| } 1887| | 1888| 30| length = roundup(fs_meta->size, fs_info->block_size); 1889| | 1890| 30| if ((fs_attr = ------------------ | Branch (1890:9): [True: 0, False: 30] ------------------ 1891| 30| tsk_fs_attrlist_getnew(fs_meta->attr, 1892| 30| TSK_FS_ATTR_NONRES)) == NULL) { 1893| 0| return 1; 1894| 0| } 1895| | 1896| 30| if (tsk_fs_attr_set_run(fs_file, fs_attr, NULL, NULL, ------------------ | Branch (1896:9): [True: 0, False: 30] ------------------ 1897| 30| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 30|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 1898| 30| fs_meta->size, fs_meta->size, length, 0, 0)) { 1899| 0| return 1; 1900| 0| } 1901| | 1902| 30| if (num_entries == 0) { ------------------ | Branch (1902:9): [True: 0, False: 30] ------------------ 1903| 0| if (fs_meta->size == 0) { ------------------ | Branch (1903:13): [True: 0, False: 0] ------------------ 1904| | // Empty file 1905| 0| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 1906| 0| return 0; 1907| 0| } 1908| | 1909| | // The entire file is sparse 1910| 0| if (ext2fs_handle_implicit_sparse_data_run(fs_info, fs_attr)) { ------------------ | Branch (1910:13): [True: 0, False: 0] ------------------ 1911| 0| return 1; 1912| 0| } 1913| | 1914| 0| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 1915| 0| return 0; 1916| 0| } 1917| | 1918| 30| if (depth == 0) { /* leaf node */ ------------------ | Branch (1918:9): [True: 0, False: 30] ------------------ 1919| | // Ensure fs_meta->content_ptr is sufficiently large 1920| | // Otherwise extents[i] below can cause an OOB read 1921| 0| if ((fs_meta->content_len < sizeof(ext2fs_extent_header)) || (num_entries > (fs_meta->content_len - sizeof(ext2fs_extent_header)) / sizeof(ext2fs_extent))) { ------------------ | Branch (1921:13): [True: 0, False: 0] | Branch (1921:70): [True: 0, False: 0] ------------------ 1922| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1923| 0| tsk_error_set_errstr 1924| 0| ("ext2fs_load_attr: Inode reports too many extents"); 1925| 0| return 1; 1926| 0| } 1927| | 1928| 0| extents = (ext2fs_extent *) (header + 1); 1929| 0| for (i = 0; i < num_entries; i++) { ------------------ | Branch (1929:21): [True: 0, False: 0] ------------------ 1930| 0| ext2fs_extent extent = extents[i]; 1931| 0| if (ext2fs_make_data_run_extent(fs_info, fs_attr, &extent)) { ------------------ | Branch (1931:17): [True: 0, False: 0] ------------------ 1932| 0| return 1; 1933| 0| } 1934| 0| } 1935| 0| } 1936| 30| else { /* interior node */ 1937| 30| TSK_FS_ATTR *fs_attr_extent; 1938| 30| int32_t extent_index_size; 1939| 30| TSK_DADDR_T idx_offset; 1940| | 1941| | // Ensure fs_meta->content_ptr is sufficiently large 1942| | // Otherwise indices[i] below can cause an OOB read 1943| 30| if ((fs_meta->content_len < sizeof(ext2fs_extent_header)) || (num_entries > (fs_meta->content_len - sizeof(ext2fs_extent_header)) / sizeof(ext2fs_extent_idx))) { ------------------ | Branch (1943:13): [True: 0, False: 30] | Branch (1943:70): [True: 0, False: 30] ------------------ 1944| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1945| 0| tsk_error_set_errstr 1946| 0| ("ext2fs_load_attr: Inode reports too many extent indices"); 1947| 0| return 1; 1948| 0| } 1949| | 1950| 30| if ((fs_attr_extent = ------------------ | Branch (1950:13): [True: 0, False: 30] ------------------ 1951| 30| tsk_fs_attrlist_getnew(fs_meta->attr, 1952| 30| TSK_FS_ATTR_NONRES)) == NULL) { 1953| 0| return 1; 1954| 0| } 1955| | 1956| 30| extent_index_size = 1957| 30| ext2fs_extent_tree_index_count(fs_info, fs_meta, header, 0); 1958| 30| if (extent_index_size < 0) { ------------------ | Branch (1958:13): [True: 0, False: 30] ------------------ 1959| 0| return 1; 1960| 0| } 1961| | 1962| 30| if (tsk_fs_attr_set_run(fs_file, fs_attr_extent, NULL, NULL, ------------------ | Branch (1962:13): [True: 0, False: 30] ------------------ 1963| 30| TSK_FS_ATTR_TYPE_UNIX_EXTENT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 30|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 1964| 30| fs_info->block_size * extent_index_size, 1965| 30| fs_info->block_size * extent_index_size, 1966| 30| fs_info->block_size * extent_index_size, 0, 0)) { 1967| 0| return 1; 1968| 0| } 1969| | 1970| 30| indices = (ext2fs_extent_idx *) (header + 1); 1971| 30| idx_offset = 0; 1972| 60| for (i = 0; i < num_entries; i++) { ------------------ | Branch (1972:21): [True: 30, False: 30] ------------------ 1973| 30| ext2fs_extent_idx *index = &indices[i]; 1974| 30| TSK_DADDR_T child_block = 1975| 30| (((uint32_t) tsk_getu16(fs_info->endian, ------------------ | | 86| 30|#define tsk_getu16(endian, x) \ | | 87| 30|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 30, False: 0] | | ------------------ | | 88| 30| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 30| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1976| 30| index-> 1977| 30| ei_leaf_hi)) << 16) | tsk_getu32(fs_info-> ------------------ | | 119| 30|#define tsk_getu32(endian, x) \ | | 120| 30|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 30, False: 0] | | ------------------ | | 121| 30| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 30| (((uint8_t *)(x))[1] << 8) + \ | | 123| 30| (((uint8_t *)(x))[2] << 16) + \ | | 124| 30| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 30| : \ | | 126| 30| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1978| 30| endian, index->ei_leaf_lo); 1979| 30| if (ext2fs_make_data_run_extent_index(fs_info, fs_attr, ------------------ | Branch (1979:17): [True: 0, False: 30] ------------------ 1980| 30| fs_attr_extent, child_block, &idx_offset)) { 1981| 0| return 1; 1982| 0| } 1983| 30| } 1984| 30| } 1985| | 1986| | // There may be implicit sparse blocks at the end of the file 1987| 30| if (ext2fs_handle_implicit_sparse_data_run(fs_info, fs_attr)) { ------------------ | Branch (1987:9): [True: 0, False: 30] ------------------ 1988| 0| return 1; 1989| 0| } 1990| | 1991| 30| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 1992| | 1993| 30| return 0; 1994| 30|} ext2fs.c:ext2fs_handle_implicit_sparse_data_run: 1799| 30|ext2fs_handle_implicit_sparse_data_run(TSK_FS_INFO * fs_info, TSK_FS_ATTR * fs_attr) { 1800| 30| TSK_FS_FILE *fs_file = fs_attr->fs_file; 1801| | 1802| 30| if (fs_file == NULL) { ------------------ | Branch (1802:9): [True: 0, False: 30] ------------------ 1803| 0| return 1; 1804| 0| } 1805| | 1806| 30| TSK_DADDR_T end_of_runs; 1807| 30| TSK_DADDR_T total_file_blocks = roundup(fs_file->meta->size, fs_info->block_size) / fs_info->block_size; 1808| | 1809| 30| if (fs_attr->nrd.run_end) { ------------------ | Branch (1809:9): [True: 30, False: 0] ------------------ 1810| 30| end_of_runs = fs_attr->nrd.run_end->offset + fs_attr->nrd.run_end->len; 1811| 30| } 1812| 0| else { 1813| 0| end_of_runs = 0; 1814| 0| } 1815| | 1816| 30| if (end_of_runs < total_file_blocks) { ------------------ | Branch (1816:9): [True: 0, False: 30] ------------------ 1817| | // Make sparse run. 1818| 0| TSK_FS_ATTR_RUN *data_run; 1819| 0| data_run = tsk_fs_attr_run_alloc(); 1820| 0| if (data_run == NULL) { ------------------ | Branch (1820:13): [True: 0, False: 0] ------------------ 1821| 0| return 1; 1822| 0| } 1823| 0| data_run->offset = end_of_runs; 1824| 0| data_run->addr = 0; 1825| 0| data_run->len = total_file_blocks - end_of_runs; 1826| 0| data_run->flags = TSK_FS_ATTR_RUN_FLAG_SPARSE; 1827| | 1828| | // Save the run. 1829| 0| if (tsk_fs_attr_add_run(fs_info, fs_attr, data_run)) { ------------------ | Branch (1829:13): [True: 0, False: 0] ------------------ 1830| | 1831| 0| return 1; 1832| 0| } 1833| 0| } 1834| 30| return 0; 1835| 30|} ext2fs.c:ext2fs_make_data_run_extent: 1573| 270|{ 1574| 270| TSK_FS_ATTR_RUN *data_run; 1575| 270| data_run = tsk_fs_attr_run_alloc(); 1576| 270| if (data_run == NULL) { ------------------ | Branch (1576:9): [True: 0, False: 270] ------------------ 1577| 0| return 1; 1578| 0| } 1579| | 1580| 270| data_run->offset = tsk_getu32(fs_info->endian, extent->ee_block); ------------------ | | 119| 270|#define tsk_getu32(endian, x) \ | | 120| 270|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 270, False: 0] | | ------------------ | | 121| 270| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 270| (((uint8_t *)(x))[1] << 8) + \ | | 123| 270| (((uint8_t *)(x))[2] << 16) + \ | | 124| 270| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 270| : \ | | 126| 270| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1581| | 1582| | // Check if the extent is initialized or uninitialized 1583| 270| if (tsk_getu16(fs_info->endian, extent->ee_len) <= EXT2_MAX_INIT_EXTENT_LENGTH) { ------------------ | | 86| 270|#define tsk_getu16(endian, x) \ | | 87| 270|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 270, False: 0] | | ------------------ | | 88| 270| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 270| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ if (tsk_getu16(fs_info->endian, extent->ee_len) <= EXT2_MAX_INIT_EXTENT_LENGTH) { ------------------ | | 368| 270|#define EXT2_MAX_INIT_EXTENT_LENGTH 0x8000 /* Maximum length of an initialized extent */ ------------------ | Branch (1583:9): [True: 152, False: 118] ------------------ 1584| | // Extent is initalized - process normally 1585| 152| data_run->addr = 1586| 152| (((uint32_t)tsk_getu16(fs_info->endian, ------------------ | | 86| 152|#define tsk_getu16(endian, x) \ | | 87| 152|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 152, False: 0] | | ------------------ | | 88| 152| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 152| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1587| 152| extent->ee_start_hi)) << 16) | tsk_getu32(fs_info->endian, ------------------ | | 119| 152|#define tsk_getu32(endian, x) \ | | 120| 152|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 152, False: 0] | | ------------------ | | 121| 152| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 152| (((uint8_t *)(x))[1] << 8) + \ | | 123| 152| (((uint8_t *)(x))[2] << 16) + \ | | 124| 152| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 152| : \ | | 126| 152| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1588| 152| extent->ee_start_lo); 1589| 152| data_run->len = tsk_getu16(fs_info->endian, extent->ee_len); ------------------ | | 86| 152|#define tsk_getu16(endian, x) \ | | 87| 152|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 152, False: 0] | | ------------------ | | 88| 152| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 152| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1590| 152| } 1591| 118| else { 1592| | // Extent is uninitialized - make a sparse run 1593| 118| data_run->len = tsk_getu16(fs_info->endian, extent->ee_len) - EXT2_MAX_INIT_EXTENT_LENGTH; ------------------ | | 86| 118|#define tsk_getu16(endian, x) \ | | 87| 118|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 118, False: 0] | | ------------------ | | 88| 118| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 118| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ data_run->len = tsk_getu16(fs_info->endian, extent->ee_len) - EXT2_MAX_INIT_EXTENT_LENGTH; ------------------ | | 368| 118|#define EXT2_MAX_INIT_EXTENT_LENGTH 0x8000 /* Maximum length of an initialized extent */ ------------------ 1594| 118| data_run->addr = 0; 1595| 118| data_run->flags = TSK_FS_ATTR_RUN_FLAG_SPARSE; 1596| 118| } 1597| | 1598| | // save the run 1599| 270| if (tsk_fs_attr_add_run(fs_info, fs_attr, data_run)) { ------------------ | Branch (1599:9): [True: 0, False: 270] ------------------ 1600| 0| tsk_fs_attr_run_free(data_run); 1601| 0| return 1; 1602| 0| } 1603| | 1604| 270| return 0; 1605| 270|} ext2fs.c:ext2fs_extent_tree_index_count: 1726| 60|{ 1727| 60| int fs_blocksize = fs_info->block_size; 1728| 60| ext2fs_extent_idx *indices; 1729| 60| int count = 0; 1730| 60| uint8_t *buf; 1731| 60| int i; 1732| | 1733| | // 32 is an arbitrary chosen value. 1734| 60| if (recursion_depth > 32) { ------------------ | Branch (1734:9): [True: 0, False: 60] ------------------ 1735| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1736| 0| tsk_error_set_errstr 1737| 0| ("ext2fs_load_attrs: exceeded maximum recursion depth!"); 1738| 0| return -1; 1739| 0| } 1740| 60| if (tsk_getu16(fs_info->endian, header->eh_magic) != 0xF30A) { ------------------ | | 86| 60|#define tsk_getu16(endian, x) \ | | 87| 60|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 60, False: 0] | | ------------------ | | 88| 60| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 60| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1740:9): [True: 0, False: 60] ------------------ 1741| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1742| 0| tsk_error_set_errstr 1743| 0| ("ext2fs_load_attrs: extent header magic valid incorrect!"); 1744| 0| return -1; 1745| 0| } 1746| | 1747| 60| if (tsk_getu16(fs_info->endian, header->eh_depth) == 0) { ------------------ | | 86| 60|#define tsk_getu16(endian, x) \ | | 87| 60|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 60, False: 0] | | ------------------ | | 88| 60| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 60| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1747:9): [True: 30, False: 30] ------------------ 1748| 30| return 0; 1749| 30| } 1750| | 1751| 30| buf = (uint8_t *) tsk_malloc(fs_blocksize); 1752| 30| if (buf == NULL) { ------------------ | Branch (1752:9): [True: 0, False: 30] ------------------ 1753| 0| return -1; 1754| 0| } 1755| | 1756| 30| indices = (ext2fs_extent_idx *) (header + 1); 1757| 60| for (i = 0; i < tsk_getu16(fs_info->endian, header->eh_entries); i++) { ------------------ | | 86| 60|#define tsk_getu16(endian, x) \ | | 87| 60|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 60, False: 0] | | ------------------ | | 88| 60| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 60| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1757:17): [True: 30, False: 30] ------------------ 1758| 30| ext2fs_extent_idx *index = &indices[i]; 1759| 30| TSK_DADDR_T block = 1760| 30| (((uint32_t) tsk_getu16(fs_info->endian, ------------------ | | 86| 30|#define tsk_getu16(endian, x) \ | | 87| 30|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 30, False: 0] | | ------------------ | | 88| 30| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 30| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1761| 30| index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info-> ------------------ | | 119| 30|#define tsk_getu32(endian, x) \ | | 120| 30|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 30, False: 0] | | ------------------ | | 121| 30| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 30| (((uint8_t *)(x))[1] << 8) + \ | | 123| 30| (((uint8_t *)(x))[2] << 16) + \ | | 124| 30| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 30| : \ | | 126| 30| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1762| 30| endian, index->ei_leaf_lo); 1763| 30| ssize_t cnt = 1764| 30| tsk_fs_read_block(fs_info, block, (char *) buf, fs_blocksize); 1765| 30| int ret; 1766| | 1767| 30| if (cnt != fs_blocksize) { ------------------ | Branch (1767:13): [True: 0, False: 30] ------------------ 1768| 0| if (cnt >= 0) { ------------------ | Branch (1768:17): [True: 0, False: 0] ------------------ 1769| 0| tsk_error_reset(); 1770| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1771| 0| } 1772| 0| tsk_error_set_errstr2("ext2fs_extent_tree_index_count: Block %" 1773| 0| PRIuDADDR, block); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 1774| 0| free(buf); 1775| 0| return -1; 1776| 0| } 1777| | 1778| 30| if ((ret = ------------------ | Branch (1778:13): [True: 0, False: 30] ------------------ 1779| 30| ext2fs_extent_tree_index_count(fs_info, fs_meta, 1780| 30| (ext2fs_extent_header *) buf, recursion_depth + 1)) < 0) { 1781| 0| free(buf); 1782| 0| return -1; 1783| 0| } 1784| 30| count += ret; 1785| 30| count++; 1786| 30| } 1787| | 1788| 30| free(buf); 1789| 30| return count; 1790| 30|} ext2fs.c:ext2fs_make_data_run_extent_index: 1617| 30|{ 1618| 30| ext2fs_extent_header *header; 1619| 30| TSK_FS_ATTR_RUN *data_run; 1620| 30| uint8_t *buf; 1621| 30| ssize_t cnt; 1622| 30| unsigned int i; 1623| | 1624| | /* first, read the block specified by the parameter */ 1625| 30| int fs_blocksize = fs_info->block_size; 1626| 30| if ((buf = (uint8_t *) tsk_malloc(fs_blocksize)) == NULL) { ------------------ | Branch (1626:9): [True: 0, False: 30] ------------------ 1627| 0| return 1; 1628| 0| } 1629| | 1630| 30| cnt = 1631| 30| tsk_fs_read_block(fs_info, idx_block, (char *) buf, fs_blocksize); 1632| 30| if (cnt != fs_blocksize) { ------------------ | Branch (1632:9): [True: 0, False: 30] ------------------ 1633| 0| if (cnt >= 0) { ------------------ | Branch (1633:13): [True: 0, False: 0] ------------------ 1634| 0| tsk_error_reset(); 1635| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1636| 0| } 1637| 0| tsk_error_set_errstr("ext2fs_make_data_run_extent_index: Block %" 1638| 0| PRIuDADDR, idx_block); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 1639| 0| free(buf); 1640| 0| return 1; 1641| 0| } 1642| 30| header = (ext2fs_extent_header *) buf; 1643| | 1644| | /* add it to the extent attribute */ 1645| 30| if (tsk_getu16(fs_info->endian, header->eh_magic) != 0xF30A) { ------------------ | | 86| 30|#define tsk_getu16(endian, x) \ | | 87| 30|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 30, False: 0] | | ------------------ | | 88| 30| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 30| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1645:9): [True: 0, False: 30] ------------------ 1646| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1647| 0| tsk_error_set_errstr 1648| 0| ("ext2fs_make_data_run_extent_index: extent header magic valid incorrect!"); 1649| 0| free(buf); 1650| 0| return 1; 1651| 0| } 1652| | 1653| 30| data_run = tsk_fs_attr_run_alloc(); 1654| 30| if (data_run == NULL) { ------------------ | Branch (1654:9): [True: 0, False: 30] ------------------ 1655| 0| free(buf); 1656| 0| return 1; 1657| 0| } 1658| 30| data_run->offset = *idx_offset; 1659| 30| ++*idx_offset; 1660| 30| data_run->addr = idx_block; 1661| 30| data_run->len = 1; 1662| | 1663| 30| if (tsk_fs_attr_add_run(fs_info, fs_attr_extent, data_run)) { ------------------ | Branch (1663:9): [True: 0, False: 30] ------------------ 1664| 0| tsk_fs_attr_run_free(data_run); 1665| 0| free(buf); 1666| 0| return 1; 1667| 0| } 1668| | 1669| | /* process leaf nodes */ 1670| 30| if (tsk_getu16(fs_info->endian, header->eh_depth) == 0) { ------------------ | | 86| 30|#define tsk_getu16(endian, x) \ | | 87| 30|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 30, False: 0] | | ------------------ | | 88| 30| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 30| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (1670:9): [True: 30, False: 0] ------------------ 1671| 30| uint16_t num_entries = tsk_getu16(fs_info->endian, header->eh_entries); ------------------ | | 86| 30|#define tsk_getu16(endian, x) \ | | 87| 30|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 30, False: 0] | | ------------------ | | 88| 30| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 30| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1672| | 1673| | // Ensure buf is sufficiently large 1674| | // Otherwise extents[i] below can cause an OOB read 1675| 30| if (((unsigned long)fs_blocksize < sizeof(ext2fs_extent_header)) || (num_entries > (fs_blocksize - sizeof(ext2fs_extent_header)) / sizeof(ext2fs_extent))) { ------------------ | Branch (1675:13): [True: 0, False: 30] | Branch (1675:77): [True: 0, False: 30] ------------------ 1676| 0| free(buf); 1677| 0| return 1; 1678| 0| } 1679| 30| ext2fs_extent *extents = (ext2fs_extent *) (header + 1); 1680| 300| for (i = 0; i < num_entries; i++) { ------------------ | Branch (1680:21): [True: 270, False: 30] ------------------ 1681| 270| ext2fs_extent extent = extents[i]; 1682| 270| if (ext2fs_make_data_run_extent(fs_info, fs_attr, &extent)) { ------------------ | Branch (1682:17): [True: 0, False: 270] ------------------ 1683| 0| free(buf); 1684| 0| return 1; 1685| 0| } 1686| 270| } 1687| 30| } 1688| | /* recurse on interior nodes */ 1689| 0| else { 1690| 0| uint16_t num_entries = tsk_getu16(fs_info->endian, header->eh_entries); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1691| | 1692| | // Ensure buf is sufficiently large 1693| | // Otherwise indices[i] below can cause an OOB read 1694| 0| if (((unsigned long)fs_blocksize < sizeof(ext2fs_extent_header)) || (num_entries > (fs_blocksize - sizeof(ext2fs_extent_header)) / sizeof(ext2fs_extent_idx))) { ------------------ | Branch (1694:13): [True: 0, False: 0] | Branch (1694:77): [True: 0, False: 0] ------------------ 1695| 0| free(buf); 1696| 0| return 1; 1697| 0| } 1698| 0| ext2fs_extent_idx *indices = (ext2fs_extent_idx *) (header + 1); 1699| 0| for (i = 0; i < num_entries; i++) { ------------------ | Branch (1699:21): [True: 0, False: 0] ------------------ 1700| 0| ext2fs_extent_idx *index = &indices[i]; 1701| 0| TSK_DADDR_T child_block = 1702| 0| (((uint32_t) tsk_getu16(fs_info->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 1703| 0| index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info-> ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 1704| 0| endian, index->ei_leaf_lo); 1705| 0| if (ext2fs_make_data_run_extent_index(fs_info, fs_attr, ------------------ | Branch (1705:17): [True: 0, False: 0] ------------------ 1706| 0| fs_attr_extent, child_block, idx_offset)) { 1707| 0| free(buf); 1708| 0| return 1; 1709| 0| } 1710| 0| } 1711| 0| } 1712| | 1713| 30| free(buf); 1714| 30| return 0; 1715| 30|} ext2fs.c:ext2fs_inode_lookup: 1030| 6.30k|{ 1031| 6.30k| EXT2FS_INFO *ext2fs = (EXT2FS_INFO *) fs; 1032| 6.30k| ext2fs_inode *dino_buf = NULL; 1033| 6.30k| uint8_t *ea_buf = NULL; 1034| 6.30k| size_t ea_buf_len = 0; 1035| 6.30k| unsigned int size = 0; 1036| | 1037| 6.30k| if (a_fs_file == NULL) { ------------------ | Branch (1037:9): [True: 0, False: 6.30k] ------------------ 1038| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1039| 0| tsk_error_set_errstr("ext2fs_inode_lookup: fs_file is NULL"); 1040| 0| return 1; 1041| 0| } 1042| | 1043| 6.30k| if (a_fs_file->meta == NULL) { ------------------ | Branch (1043:9): [True: 6.30k, False: 0] ------------------ 1044| 6.30k| if ((a_fs_file->meta = ------------------ | Branch (1044:13): [True: 0, False: 6.30k] ------------------ 1045| 6.30k| tsk_fs_meta_alloc(EXT2FS_FILE_CONTENT_LEN)) == NULL) ------------------ | | 97| 6.30k|#define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 89| 6.30k|#define EXT2FS_NDADDR 12 | | ------------------ | | #define EXT2FS_FILE_CONTENT_LEN ((EXT2FS_NDADDR + EXT2FS_NIADDR) * sizeof(TSK_DADDR_T)) | | ------------------ | | | | 90| 6.30k|#define EXT2FS_NIADDR 3 | | ------------------ ------------------ 1046| 0| return 1; 1047| 6.30k| } 1048| 0| else { 1049| 0| tsk_fs_meta_reset(a_fs_file->meta); 1050| 0| } 1051| | 1052| | // see if they are looking for the special "orphans" directory 1053| 6.30k| if (inum == TSK_FS_ORPHANDIR_INUM(fs)) { ------------------ | | 530| 6.30k| (fs_info->last_inum) ------------------ | Branch (1053:9): [True: 1.08k, False: 5.22k] ------------------ 1054| 1.08k| if (tsk_fs_dir_make_orphan_dir_meta(fs, a_fs_file->meta)) ------------------ | Branch (1054:13): [True: 0, False: 1.08k] ------------------ 1055| 0| return 1; 1056| 1.08k| else 1057| 1.08k| return 0; 1058| 1.08k| } 1059| | 1060| 5.22k| size = 1061| 5.22k| ext2fs->inode_size > ------------------ | Branch (1061:9): [True: 5.22k, False: 2] ------------------ 1062| 5.22k| sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode); 1063| 5.22k| if ((dino_buf = (ext2fs_inode *) tsk_malloc(size)) == NULL) { ------------------ | Branch (1063:9): [True: 0, False: 5.22k] ------------------ 1064| 0| return 1; 1065| 0| } 1066| | 1067| 5.22k| if (ext2fs_dinode_load(ext2fs, inum, dino_buf, &ea_buf, &ea_buf_len)) { ------------------ | Branch (1067:9): [True: 2.88k, False: 2.33k] ------------------ 1068| 2.88k| free(dino_buf); 1069| 2.88k| return 1; 1070| 2.88k| } 1071| | 1072| 2.33k| if (ext2fs_dinode_copy(ext2fs, a_fs_file, inum, dino_buf, ea_buf, ea_buf_len)) { ------------------ | Branch (1072:9): [True: 0, False: 2.33k] ------------------ 1073| 0| free(dino_buf); 1074| 0| return 1; 1075| 0| } 1076| | 1077| 2.33k| free(dino_buf); 1078| 2.33k| return 0; 1079| 2.33k|} ext2fs.c:ext2fs_close: 3449| 3.37k|{ 3450| 3.37k| EXT2FS_INFO *ext2fs = (EXT2FS_INFO *) fs; 3451| | 3452| 3.37k| fs->tag = 0; 3453| 3.37k| free(ext2fs->fs); 3454| 3.37k| free(ext2fs->grp_buf); 3455| 3.37k| free(ext2fs->ext4_grp_buf); 3456| 3.37k| free(ext2fs->bmap_buf); 3457| 3.37k| free(ext2fs->imap_buf); 3458| | 3459| 3.37k| tsk_deinit_lock(&ext2fs->lock); 3460| | 3461| 3.37k| tsk_fs_free(fs); 3462| 3.37k|} ext2fs_dir_open_meta: 242| 5.57k|{ 243| 5.57k| EXT2FS_INFO *ext2fs = (EXT2FS_INFO *) a_fs; 244| 5.57k| char *dirbuf; 245| 5.57k| TSK_FS_DIR *fs_dir; 246| 5.57k| TSK_LIST *list_seen = NULL; 247| | 248| | /* If we get corruption in one of the blocks, then continue processing. 249| | * retval_final will change when corruption is detected. Errors are 250| | * returned immediately. */ 251| 5.57k| TSK_RETVAL_ENUM retval_tmp; 252| 5.57k| TSK_RETVAL_ENUM retval_final = TSK_OK; 253| | 254| 5.57k| if (a_addr < a_fs->first_inum || a_addr > a_fs->last_inum) { ------------------ | Branch (254:9): [True: 0, False: 5.57k] | Branch (254:38): [True: 0, False: 5.57k] ------------------ 255| 0| tsk_error_reset(); 256| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 257| 0| tsk_error_set_errstr("ext2fs_dir_open_meta: inode value: %" 258| 0| PRIuINUM "\n", a_addr); 259| 0| return TSK_ERR; 260| 0| } 261| 5.57k| else if (a_fs_dir == NULL) { ------------------ | Branch (261:14): [True: 0, False: 5.57k] ------------------ 262| 0| tsk_error_reset(); 263| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 264| 0| tsk_error_set_errstr 265| 0| ("ext2fs_dir_open_meta: NULL fs_attr argument given"); 266| 0| return TSK_ERR; 267| 0| } 268| | 269| 5.57k| if (tsk_verbose) { ------------------ | Branch (269:9): [True: 0, False: 5.57k] ------------------ 270| 0| tsk_fprintf(stderr, 271| 0| "ext2fs_dir_open_meta: Processing directory %" PRIuINUM 272| 0| "\n", a_addr); 273| |#ifdef Ext4_DBG 274| | tsk_fprintf(stderr, 275| | "ext2fs_dir_open_meta: $OrphanFiles Inum %" PRIuINUM 276| | " == %" PRIuINUM ": %d\n", TSK_FS_ORPHANDIR_INUM(a_fs), a_addr, 277| | a_addr == TSK_FS_ORPHANDIR_INUM(a_fs)); 278| |#endif 279| 0| } 280| | 281| 5.57k| fs_dir = *a_fs_dir; 282| 5.57k| if (fs_dir) { ------------------ | Branch (282:9): [True: 0, False: 5.57k] ------------------ 283| 0| tsk_fs_dir_reset(fs_dir); 284| 0| fs_dir->addr = a_addr; 285| 0| } 286| 5.57k| else { 287| 5.57k| if ((*a_fs_dir = fs_dir = ------------------ | Branch (287:13): [True: 0, False: 5.57k] ------------------ 288| 5.57k| tsk_fs_dir_alloc(a_fs, a_addr, 128)) == NULL) { 289| 0| return TSK_ERR; 290| 0| } 291| 5.57k| } 292| | 293| | // handle the orphan directory if its contents were requested 294| 5.57k| if (a_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 5.57k| (fs_info->last_inum) ------------------ | Branch (294:9): [True: 557, False: 5.01k] ------------------ 295| |#ifdef Ext4_DBG 296| | tsk_fprintf(stderr, "DEBUG: Getting ready to process ORPHANS\n"); 297| |#endif 298| 557| return tsk_fs_dir_find_orphans(a_fs, fs_dir); 299| 557| } 300| 5.01k| else { 301| |#ifdef Ext4_DBG 302| | tsk_fprintf(stderr, 303| | "DEBUG: not orphan %" PRIuINUM "!=%" PRIuINUM "\n", a_addr, 304| | TSK_FS_ORPHANDIR_INUM(a_fs)); 305| |#endif 306| 5.01k| } 307| | 308| 5.01k| if ((fs_dir->fs_file = ------------------ | Branch (308:9): [True: 2.82k, False: 2.19k] ------------------ 309| 5.01k| tsk_fs_file_open_meta(a_fs, NULL, a_addr)) == NULL) { 310| 2.82k| tsk_error_reset(); 311| 2.82k| tsk_error_errstr2_concat("- ext2fs_dir_open_meta"); 312| 2.82k| return TSK_COR; 313| 2.82k| } 314| | 315| | // We only read in and process a single block at a time 316| 2.19k| if ((dirbuf = tsk_malloc((size_t)a_fs->block_size)) == NULL) { ------------------ | Branch (316:9): [True: 0, False: 2.19k] ------------------ 317| 0| return TSK_ERR; 318| 0| } 319| 2.19k| TSK_OFF_T size = 0; 320| | 321| 2.19k| if (fs_dir->fs_file->meta->content_type == TSK_FS_META_CONTENT_TYPE_EXT4_INLINE) { ------------------ | Branch (321:9): [True: 2.10k, False: 83] ------------------ 322| | // For inline dirs, don't try to read past the end of the data 323| 2.10k| size = fs_dir->fs_file->meta->size; 324| 2.10k| } 325| 83| else { 326| 83| if (fs_dir->fs_file->meta->size <= 0 || a_fs->block_size <= 0 ------------------ | Branch (326:13): [True: 2, False: 81] | Branch (326:49): [True: 0, False: 81] ------------------ 327| 83| || (INT64_MAX - (a_fs->block_size - 1) < fs_dir->fs_file->meta->size)) { ------------------ | Branch (327:20): [True: 0, False: 81] ------------------ 328| 2| tsk_error_set_errstr("ext2fs_dir_open_meta: invalid data size value out of bounds.\n"); 329| 2| free(dirbuf); 330| 2| return TSK_ERR; 331| 2| } 332| 81| size = roundup(fs_dir->fs_file->meta->size, a_fs->block_size); 333| 81| } 334| 2.18k| TSK_OFF_T offset = 0; 335| | 336| 31.8k| while (size > 0) { ------------------ | Branch (336:12): [True: 29.7k, False: 2.14k] ------------------ 337| 29.7k| ssize_t len = (a_fs->block_size < size) ? a_fs->block_size : size; ------------------ | Branch (337:23): [True: 28.6k, False: 1.08k] ------------------ 338| 29.7k| ssize_t cnt = tsk_fs_file_read(fs_dir->fs_file, offset, dirbuf, len, (TSK_FS_FILE_READ_FLAG_ENUM)0); 339| 29.7k| if (cnt != len) { ------------------ | Branch (339:13): [True: 47, False: 29.6k] ------------------ 340| 47| tsk_error_reset(); 341| 47| tsk_error_set_errno(TSK_ERR_FS_FWALK); ------------------ | | 356| 47|#define TSK_ERR_FS_FWALK (TSK_ERR_FS | 11) | | ------------------ | | | | 301| 47|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 342| 47| tsk_error_set_errstr 343| 47| ("ext2fs_dir_open_meta: Error reading directory contents: %" 344| 47| PRIuINUM "\n", a_addr); 345| 47| free(dirbuf); 346| 47| return TSK_COR; 347| 47| } 348| | 349| 29.6k| retval_tmp = 350| 29.6k| ext2fs_dent_parse_block(ext2fs, fs_dir, 351| 29.6k| (fs_dir->fs_file->meta-> ------------------ | Branch (351:13): [True: 1.09k, False: 28.5k] ------------------ 352| 29.6k| flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0, &list_seen, 353| 29.6k| dirbuf, len); 354| | 355| 29.6k| if (retval_tmp == TSK_ERR) { ------------------ | Branch (355:13): [True: 0, False: 29.6k] ------------------ 356| 0| retval_final = TSK_ERR; 357| 0| break; 358| 0| } 359| 29.6k| else if (retval_tmp == TSK_COR) { ------------------ | Branch (359:18): [True: 0, False: 29.6k] ------------------ 360| 0| retval_final = TSK_COR; 361| 0| } 362| | 363| 29.6k| size -= len; 364| 29.6k| offset += len; 365| 29.6k| } 366| 2.14k| free(dirbuf); 367| | 368| | // if we are listing the root directory, add the Orphan directory entry 369| 2.14k| if (a_addr == a_fs->root_inum) { ------------------ | Branch (369:9): [True: 1.08k, False: 1.05k] ------------------ 370| 1.08k| TSK_FS_NAME *fs_name = tsk_fs_name_alloc(256, 0); 371| 1.08k| if (fs_name == NULL) ------------------ | Branch (371:13): [True: 0, False: 1.08k] ------------------ 372| 0| return TSK_ERR; 373| | 374| 1.08k| if (tsk_fs_dir_make_orphan_dir_name(a_fs, fs_name)) { ------------------ | Branch (374:13): [True: 0, False: 1.08k] ------------------ 375| 0| tsk_fs_name_free(fs_name); 376| 0| return TSK_ERR; 377| 0| } 378| | 379| 1.08k| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (379:13): [True: 0, False: 1.08k] ------------------ 380| 0| tsk_fs_name_free(fs_name); 381| 0| return TSK_ERR; 382| 0| } 383| 1.08k| tsk_fs_name_free(fs_name); 384| 1.08k| } 385| | 386| 2.14k| return retval_final; 387| 2.14k|} ext2fs_dent.c:ext2fs_dent_parse_block: 122| 29.6k|{ 123| 29.6k| TSK_FS_INFO *fs = &(ext2fs->fs_info); 124| | 125| 29.6k| int dellen = 0; 126| 29.6k| int idx; 127| 29.6k| uint16_t reclen; 128| 29.6k| uint32_t inode; 129| 29.6k| char *dirPtr; 130| 29.6k| TSK_FS_NAME *fs_name; 131| 29.6k| int minreclen = 4; 132| | 133| 29.6k| if ((fs_name = tsk_fs_name_alloc(EXT2FS_MAXNAMLEN + 1, 0)) == NULL) ------------------ | | 93| 29.6k|#define EXT2FS_MAXNAMLEN 255 ------------------ | Branch (133:9): [True: 0, False: 29.6k] ------------------ 134| 0| return TSK_ERR; 135| | 136| | /* update each time by the actual length instead of the 137| | ** recorded length so we can view the deleted entries 138| | */ 139| 7.46M| for (idx = 0; idx <= len - EXT2FS_DIRSIZ_lcl(1); idx += minreclen) { ------------------ | | 447| 7.46M| ((len + 8 + 3) & ~(3)) ------------------ | Branch (139:19): [True: 7.43M, False: 29.6k] ------------------ 140| | 141| 7.43M| unsigned int namelen; 142| 7.43M| dirPtr = &buf[idx]; 143| | 144| 7.43M| if (ext2fs->deentry_type == EXT2_DE_V1) { ------------------ | | 462| 7.43M|#define EXT2_DE_V1 1 ------------------ | Branch (144:13): [True: 205k, False: 7.23M] ------------------ 145| 205k| ext2fs_dentry1 *dir = (ext2fs_dentry1 *) dirPtr; 146| 205k| inode = tsk_getu32(fs->endian, dir->inode); ------------------ | | 119| 205k|#define tsk_getu32(endian, x) \ | | 120| 205k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 205k] | | ------------------ | | 121| 205k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 205k| : \ | | 126| 205k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 205k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 205k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 205k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 147| 205k| namelen = tsk_getu16(fs->endian, dir->name_len); ------------------ | | 86| 205k|#define tsk_getu16(endian, x) \ | | 87| 205k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 205k] | | ------------------ | | 88| 205k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 205k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 148| 205k| reclen = tsk_getu16(fs->endian, dir->rec_len); ------------------ | | 86| 205k|#define tsk_getu16(endian, x) \ | | 87| 205k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 205k] | | ------------------ | | 88| 205k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 205k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 149| 205k| } 150| 7.23M| else { 151| 7.23M| ext2fs_dentry2 *dir = (ext2fs_dentry2 *) dirPtr; 152| 7.23M| inode = tsk_getu32(fs->endian, dir->inode); ------------------ | | 119| 7.23M|#define tsk_getu32(endian, x) \ | | 120| 7.23M|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 7.23M, False: 0] | | ------------------ | | 121| 7.23M| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 7.23M| (((uint8_t *)(x))[1] << 8) + \ | | 123| 7.23M| (((uint8_t *)(x))[2] << 16) + \ | | 124| 7.23M| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 7.23M| : \ | | 126| 7.23M| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 153| 7.23M| namelen = dir->name_len; 154| 7.23M| reclen = tsk_getu16(fs->endian, dir->rec_len); ------------------ | | 86| 7.23M|#define tsk_getu16(endian, x) \ | | 87| 7.23M|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 7.23M, False: 0] | | ------------------ | | 88| 7.23M| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 7.23M| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 155| 7.23M| } 156| | 157| 7.43M| minreclen = EXT2FS_DIRSIZ_lcl(namelen); ------------------ | | 447| 7.43M| ((len + 8 + 3) & ~(3)) ------------------ 158| | 159| | /* 160| | ** Check if we may have a valid directory entry. If we don't, 161| | ** then increment to the next word and try again. 162| | */ 163| 7.43M| if ((inode > fs->last_inum) || // inode is unsigned ------------------ | Branch (163:13): [True: 40.9k, False: 7.39M] ------------------ 164| 7.43M| (namelen > EXT2FS_MAXNAMLEN) || (namelen == 0) || // namelen is unsigned ------------------ | | 93| 7.39M|#define EXT2FS_MAXNAMLEN 255 ------------------ | Branch (164:13): [True: 6.85k, False: 7.38M] | Branch (164:45): [True: 7.08M, False: 302k] ------------------ 165| 7.43M| (reclen < minreclen) || (reclen % 4) || (idx + reclen > len)) { ------------------ | Branch (165:13): [True: 61.7k, False: 240k] | Branch (165:37): [True: 97.8k, False: 142k] | Branch (165:53): [True: 136k, False: 5.94k] ------------------ 166| | 167| 7.43M| minreclen = 4; 168| 7.43M| if (dellen > 0) ------------------ | Branch (168:17): [True: 102k, False: 7.32M] ------------------ 169| 102k| dellen -= 4; 170| 7.43M| continue; 171| 7.43M| } 172| | 173| | /* Before we process an entry in unallocated space, make 174| | * sure that it also ends in the unalloc space */ 175| 5.94k| if ((dellen) && (dellen < minreclen)) { ------------------ | Branch (175:13): [True: 1.82k, False: 4.11k] | Branch (175:25): [True: 196, False: 1.63k] ------------------ 176| 196| minreclen = 4; 177| 196| dellen -= 4; 178| 196| continue; 179| 196| } 180| | 181| 5.74k| if (ext2fs_dent_copy(ext2fs, dirPtr, fs_name)) { ------------------ | Branch (181:13): [True: 0, False: 5.74k] ------------------ 182| 0| tsk_fs_name_free(fs_name); 183| 0| return TSK_ERR; 184| 0| } 185| | 186| | /* Do we have a deleted entry? */ 187| 5.74k| if ((dellen > 0) || (inode == 0) || (a_is_del)) { ------------------ | Branch (187:13): [True: 1.63k, False: 4.11k] | Branch (187:29): [True: 682, False: 3.43k] | Branch (187:45): [True: 2, False: 3.43k] ------------------ 188| 2.31k| fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 189| 2.31k| if (dellen > 0) ------------------ | Branch (189:17): [True: 1.63k, False: 684] ------------------ 190| 1.63k| dellen -= minreclen; 191| 2.31k| } 192| | /* We have a non-deleted entry */ 193| 3.43k| else { 194| 3.43k| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 195| 3.43k| } 196| 5.74k| if (tsk_fs_dir_add(a_fs_dir, fs_name)) { ------------------ | Branch (196:13): [True: 0, False: 5.74k] ------------------ 197| 0| tsk_fs_name_free(fs_name); 198| 0| return TSK_ERR; 199| 0| } 200| | 201| | /* If the actual length is shorter then the 202| | ** recorded length, then the next entry(ies) have been 203| | ** deleted. Set dellen to the length of data that 204| | ** has been deleted 205| | ** 206| | ** Because we aren't guaranteed with Ext2FS that the next 207| | ** entry begins right after this one, we will check to 208| | ** see if the difference is less than a possible entry 209| | ** before we waste time searching it 210| | */ 211| 5.74k| if (dellen <= 0) { ------------------ | Branch (211:13): [True: 4.14k, False: 1.60k] ------------------ 212| 4.14k| if (reclen - minreclen >= EXT2FS_DIRSIZ_lcl(1)) ------------------ | | 447| 4.14k| ((len + 8 + 3) & ~(3)) ------------------ | Branch (212:17): [True: 2.18k, False: 1.95k] ------------------ 213| 2.18k| dellen = reclen - minreclen; 214| 1.95k| else 215| 1.95k| minreclen = reclen; 216| 4.14k| } 217| 5.74k| } 218| | 219| 29.6k| tsk_fs_name_free(fs_name); 220| 29.6k| return TSK_OK; 221| 29.6k|} ext2fs_dent.c:ext2fs_dent_copy: 36| 5.74k|{ 37| 5.74k| TSK_FS_INFO *fs = &(ext2fs->fs_info); 38| | 39| 5.74k| if (ext2fs->deentry_type == EXT2_DE_V1) { ------------------ | | 462| 5.74k|#define EXT2_DE_V1 1 ------------------ | Branch (39:9): [True: 0, False: 5.74k] ------------------ 40| 0| ext2fs_dentry1 *dir = (ext2fs_dentry1 *) ext2_dent; 41| | 42| 0| fs_name->meta_addr = tsk_getu32(fs->endian, dir->inode); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 43| | 44| | /* ext2 does not null terminate */ 45| 0| if (tsk_getu16(fs->endian, dir->name_len) >= fs_name->name_size) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (45:13): [True: 0, False: 0] ------------------ 46| 0| tsk_error_reset(); 47| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 48| 0| tsk_error_set_errstr 49| 0| ("ext2fs_dent_copy: Name Space too Small %d %" PRIuSIZE "", 50| 0| tsk_getu16(fs->endian, dir->name_len), fs_name->name_size); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 51| 0| return 1; 52| 0| } 53| | 54| | /* Copy and Null Terminate */ 55| 0| strncpy(fs_name->name, dir->name, tsk_getu16(fs->endian, ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 56| 0| dir->name_len)); 57| 0| fs_name->name[tsk_getu16(fs->endian, dir->name_len)] = '\0'; ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 58| | 59| 0| fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 60| 0| } 61| 5.74k| else { 62| 5.74k| ext2fs_dentry2 *dir = (ext2fs_dentry2 *) ext2_dent; 63| | 64| 5.74k| fs_name->meta_addr = tsk_getu32(fs->endian, dir->inode); ------------------ | | 119| 5.74k|#define tsk_getu32(endian, x) \ | | 120| 5.74k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 5.74k, False: 0] | | ------------------ | | 121| 5.74k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 5.74k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 5.74k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 5.74k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 5.74k| : \ | | 126| 5.74k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 65| | 66| | /* ext2 does not null terminate */ 67| 5.74k| if (dir->name_len >= fs_name->name_size) { ------------------ | Branch (67:13): [True: 0, False: 5.74k] ------------------ 68| 0| tsk_error_reset(); 69| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 70| 0| tsk_error_set_errstr 71| 0| ("ext2_dent_copy: Name Space too Small %d %" PRIuSIZE "", 72| 0| dir->name_len, fs_name->name_size); 73| 0| return 1; 74| 0| } 75| | 76| | /* Copy and Null Terminate */ 77| 5.74k| strncpy(fs_name->name, dir->name, dir->name_len); 78| 5.74k| fs_name->name[dir->name_len] = '\0'; 79| | 80| 5.74k| switch (dir->type) { 81| 366| case EXT2_DE_REG: ------------------ | | 452| 366|#define EXT2_DE_REG 1 ------------------ | Branch (81:9): [True: 366, False: 5.38k] ------------------ 82| 366| fs_name->type = TSK_FS_NAME_TYPE_REG; 83| 366| break; 84| 2.16k| case EXT2_DE_DIR: ------------------ | | 453| 2.16k|#define EXT2_DE_DIR 2 ------------------ | Branch (84:9): [True: 2.16k, False: 3.58k] ------------------ 85| 2.16k| fs_name->type = TSK_FS_NAME_TYPE_DIR; 86| 2.16k| break; 87| 30| case EXT2_DE_CHR: ------------------ | | 454| 30|#define EXT2_DE_CHR 3 ------------------ | Branch (87:9): [True: 30, False: 5.71k] ------------------ 88| 30| fs_name->type = TSK_FS_NAME_TYPE_CHR; 89| 30| break; 90| 6| case EXT2_DE_BLK: ------------------ | | 455| 6|#define EXT2_DE_BLK 4 ------------------ | Branch (90:9): [True: 6, False: 5.74k] ------------------ 91| 6| fs_name->type = TSK_FS_NAME_TYPE_BLK; 92| 6| break; 93| 0| case EXT2_DE_FIFO: ------------------ | | 456| 0|#define EXT2_DE_FIFO 5 ------------------ | Branch (93:9): [True: 0, False: 5.74k] ------------------ 94| 0| fs_name->type = TSK_FS_NAME_TYPE_FIFO; 95| 0| break; 96| 10| case EXT2_DE_SOCK: ------------------ | | 457| 10|#define EXT2_DE_SOCK 6 ------------------ | Branch (96:9): [True: 10, False: 5.73k] ------------------ 97| 10| fs_name->type = TSK_FS_NAME_TYPE_SOCK; 98| 10| break; 99| 24| case EXT2_DE_LNK: ------------------ | | 458| 24|#define EXT2_DE_LNK 7 ------------------ | Branch (99:9): [True: 24, False: 5.72k] ------------------ 100| 24| fs_name->type = TSK_FS_NAME_TYPE_LNK; 101| 24| break; 102| 1.40k| case EXT2_DE_UNKNOWN: ------------------ | | 451| 1.40k|#define EXT2_DE_UNKNOWN 0 ------------------ | Branch (102:9): [True: 1.40k, False: 4.34k] ------------------ 103| 3.14k| default: ------------------ | Branch (103:9): [True: 1.74k, False: 3.99k] ------------------ 104| 3.14k| fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 105| 3.14k| break; 106| 5.74k| } 107| 5.74k| } 108| | 109| 5.74k| fs_name->flags = 0; 110| | 111| 5.74k| return 0; 112| 5.74k|} tsk_fs_fls: 212| 3.37k|{ 213| 3.37k| FLS_DATA data; 214| | 215| 3.37k| data.flags = lclflags; 216| 3.37k| data.sec_skew = skew; 217| | 218| |#ifdef TSK_WIN32 219| | { 220| | UTF8 *ptr8; 221| | UTF16 *ptr16; 222| | int retval; 223| | 224| | if ((tpre != NULL) && (TSTRLEN(tpre) > 0)) { 225| | size_t clen = TSTRLEN(tpre) * 4; 226| | data.macpre = (char *) tsk_malloc(clen); 227| | if (data.macpre == NULL) { 228| | return 1; 229| | } 230| | ptr8 = (UTF8 *) data.macpre; 231| | ptr16 = (UTF16 *) tpre; 232| | 233| | retval = 234| | tsk_UTF16toUTF8_lclorder((const UTF16 **) &ptr16, (UTF16 *) 235| | & ptr16[TSTRLEN(tpre) + 1], &ptr8, 236| | (UTF8 *) ((uintptr_t) ptr8 + clen), TSKlenientConversion); 237| | if (retval != TSKconversionOK) { 238| | tsk_error_reset(); 239| | tsk_error_set_errno(TSK_ERR_FS_UNICODE); 240| | tsk_error_set_errstr 241| | ("Error converting fls mactime pre-text to UTF-8 %d\n", 242| | retval); 243| | return 1; 244| | } 245| | } 246| | else { 247| | data.macpre = (char *) tsk_malloc(1); 248| | if (data.macpre == NULL) { 249| | return 1; 250| | } 251| | data.macpre[0] = '\0'; 252| | } 253| | 254| | retval = tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data); 255| | 256| | free(data.macpre); 257| | data.macpre = NULL; 258| | return retval; 259| | } 260| |#else 261| 3.37k| data.macpre = tpre; 262| 3.37k| return tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data); 263| 3.37k|#endif 264| 3.37k|} fls_lib.c:print_dent_act: 115| 767|{ 116| 767| FLS_DATA *fls_data = (FLS_DATA *) ptr; 117| | 118| | /* only print dirs if TSK_FS_FLS_DIR is set and only print everything 119| | ** else if TSK_FS_FLS_FILE is set (or we aren't sure what it is) 120| | */ 121| 767| if (((fls_data->flags & TSK_FS_FLS_DIR) && ------------------ | Branch (121:10): [True: 0, False: 767] ------------------ 122| 767| ((fs_file->meta) && ------------------ | Branch (122:14): [True: 0, False: 0] ------------------ 123| 0| (TSK_FS_IS_DIR_META(fs_file->meta->type)))) ------------------ | | 414| 0|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 0] | | | Branch (414:63): [True: 0, False: 0] | | ------------------ ------------------ 124| 767| || ((fls_data->flags & TSK_FS_FLS_FILE) && (((fs_file->meta) ------------------ | Branch (124:13): [True: 0, False: 767] | Branch (124:54): [True: 0, False: 0] ------------------ 125| 0| && ( ! TSK_FS_IS_DIR_META(fs_file->meta->type))) ------------------ | | 414| 0|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 0] | | | Branch (414:63): [True: 0, False: 0] | | ------------------ ------------------ 126| 0| || (!fs_file->meta)))) { ------------------ | Branch (126:20): [True: 0, False: 0] ------------------ 127| | 128| | 129| | /* Make a special case for NTFS so we can identify all of the 130| | * alternate data streams! 131| | */ 132| 0| if ((TSK_FS_TYPE_ISNTFS(fs_file->fs_info->ftype)) ------------------ | | 836| 0| (((ftype) & TSK_FS_TYPE_NTFS_DETECT)?1:0) | | ------------------ | | | Branch (836:6): [True: 0, False: 0] | | ------------------ ------------------ | Branch (132:13): [True: 0, False: 0] ------------------ 133| 0| && (fs_file->meta)) { ------------------ | Branch (133:16): [True: 0, False: 0] ------------------ 134| 0| uint8_t printed = 0; 135| 0| int i, cnt; 136| | 137| | // cycle through the attributes 138| 0| cnt = tsk_fs_file_attr_getsize(fs_file); 139| 0| for (i = 0; i < cnt; i++) { ------------------ | Branch (139:25): [True: 0, False: 0] ------------------ 140| 0| const TSK_FS_ATTR *fs_attr = 141| 0| tsk_fs_file_attr_get_idx(fs_file, i); 142| 0| if (!fs_attr) ------------------ | Branch (142:21): [True: 0, False: 0] ------------------ 143| 0| continue; 144| | 145| 0| if (fs_attr->type == TSK_FS_ATTR_TYPE_NTFS_DATA) { ------------------ | Branch (145:21): [True: 0, False: 0] ------------------ 146| 0| printed = 1; 147| | 148| 0| if (fs_file->meta->type == TSK_FS_META_TYPE_DIR) { ------------------ | Branch (148:25): [True: 0, False: 0] ------------------ 149| | 150| | /* we don't want to print the ..:blah stream if 151| | * the -a flag was not given 152| | */ 153| 0| if ((fs_file->name->name[0] == '.') ------------------ | Branch (153:29): [True: 0, False: 0] ------------------ 154| 0| && (fs_file->name->name[1]) ------------------ | Branch (154:32): [True: 0, False: 0] ------------------ 155| 0| && (fs_file->name->name[2] == '\0') ------------------ | Branch (155:32): [True: 0, False: 0] ------------------ 156| 0| && ((fls_data->flags & TSK_FS_FLS_DOT) == 0)) { ------------------ | Branch (156:32): [True: 0, False: 0] ------------------ 157| 0| continue; 158| 0| } 159| 0| } 160| | 161| 0| printit(fs_file, a_path, fs_attr, fls_data); 162| 0| } 163| 0| else if (fs_attr->type == TSK_FS_ATTR_TYPE_NTFS_IDXROOT) { ------------------ | Branch (163:26): [True: 0, False: 0] ------------------ 164| 0| printed = 1; 165| | 166| | /* If it is . or .. only print it if the flags say so, 167| | * we continue with other streams though in case the 168| | * directory has a data stream 169| | */ 170| 0| if (!((TSK_FS_ISDOT(fs_file->name->name)) && ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (170:27): [True: 0, False: 0] ------------------ 171| 0| ((fls_data->flags & TSK_FS_FLS_DOT) == 0))) ------------------ | Branch (171:29): [True: 0, False: 0] ------------------ 172| 0| printit(fs_file, a_path, fs_attr, fls_data); 173| 0| } 174| | /* Print the FILE_NAME times if this is the same attribute 175| | * that we collected the times from. */ 176| 0| else if ((fs_attr->type == TSK_FS_ATTR_TYPE_NTFS_FNAME) && ------------------ | Branch (176:26): [True: 0, False: 0] ------------------ 177| 0| (fs_attr->id == fs_file->meta->time2.ntfs.fn_id) && ------------------ | Branch (177:21): [True: 0, False: 0] ------------------ 178| 0| (fls_data->flags & TSK_FS_FLS_MAC)) { ------------------ | Branch (178:21): [True: 0, False: 0] ------------------ 179| | /* If it is . or .. only print it if the flags say so, 180| | * we continue with other streams though in case the 181| | * directory has a data stream 182| | */ 183| 0| if (!((TSK_FS_ISDOT(fs_file->name->name)) && ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (183:27): [True: 0, False: 0] ------------------ 184| 0| ((fls_data->flags & TSK_FS_FLS_DOT) == 0))) ------------------ | Branch (184:29): [True: 0, False: 0] ------------------ 185| 0| printit(fs_file, a_path, fs_attr, fls_data); 186| 0| } 187| 0| } 188| | 189| | /* A user reported that an allocated file had the standard 190| | * attributes, but no $Data. We should print something */ 191| 0| if (printed == 0) { ------------------ | Branch (191:17): [True: 0, False: 0] ------------------ 192| 0| printit(fs_file, a_path, NULL, fls_data); 193| 0| } 194| | 195| 0| } 196| 0| else { 197| | /* skip it if it is . or .. and we don't want them */ 198| 0| if (!((TSK_FS_ISDOT(fs_file->name->name)) ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (198:19): [True: 0, False: 0] ------------------ 199| 0| && ((fls_data->flags & TSK_FS_FLS_DOT) == 0))) ------------------ | Branch (199:24): [True: 0, False: 0] ------------------ 200| 0| printit(fs_file, a_path, NULL, fls_data); 201| 0| } 202| 0| } 203| 767| return TSK_WALK_CONT; 204| 767|} tsk_fs_attr_run_alloc: 47| 897|{ 48| 897| TSK_FS_ATTR_RUN *fs_attr_run = 49| 897| (TSK_FS_ATTR_RUN *) tsk_malloc(sizeof(TSK_FS_ATTR_RUN)); 50| 897| if (fs_attr_run == NULL) ------------------ | Branch (50:9): [True: 0, False: 897] ------------------ 51| 0| return NULL; 52| | 53| 897| return fs_attr_run; 54| 897|} tsk_fs_attr_run_free: 64| 109|{ 65| 1.00k| while (fs_attr_run) { ------------------ | Branch (65:12): [True: 897, False: 109] ------------------ 66| 897| TSK_FS_ATTR_RUN *fs_attr_run_prev = fs_attr_run; 67| 897| fs_attr_run = fs_attr_run->next; 68| 897| fs_attr_run_prev->next = NULL; 69| 897| free(fs_attr_run_prev); 70| 897| } 71| 109|} tsk_fs_attr_alloc: 85| 1.72k|{ 86| 1.72k| TSK_FS_ATTR *fs_attr = (TSK_FS_ATTR *) tsk_malloc(sizeof(TSK_FS_ATTR)); 87| 1.72k| if (fs_attr == NULL) { ------------------ | Branch (87:9): [True: 0, False: 1.72k] ------------------ 88| 0| return NULL; 89| 0| } 90| | 91| 1.72k| fs_attr->name_size = 128; 92| 1.72k| if ((fs_attr->name = (char *) tsk_malloc(fs_attr->name_size)) == NULL) { ------------------ | Branch (92:9): [True: 0, False: 1.72k] ------------------ 93| 0| free(fs_attr); 94| 0| return NULL; 95| 0| } 96| | 97| 1.72k| if (type == TSK_FS_ATTR_NONRES) { ------------------ | Branch (97:9): [True: 123, False: 1.59k] ------------------ 98| 123| fs_attr->flags = (TSK_FS_ATTR_NONRES | TSK_FS_ATTR_INUSE); 99| 123| } 100| 1.59k| else if (type == TSK_FS_ATTR_RES) { ------------------ | Branch (100:14): [True: 1.59k, False: 0] ------------------ 101| 1.59k| fs_attr->rd.buf_size = 1024; 102| 1.59k| fs_attr->rd.buf = (uint8_t *) tsk_malloc(fs_attr->rd.buf_size); 103| 1.59k| if (fs_attr->rd.buf == NULL) { ------------------ | Branch (103:13): [True: 0, False: 1.59k] ------------------ 104| 0| free(fs_attr->name); 105| 0| return NULL; 106| 0| } 107| 1.59k| fs_attr->flags = (TSK_FS_ATTR_RES | TSK_FS_ATTR_INUSE); 108| 1.59k| } 109| 0| else { 110| 0| tsk_error_reset(); 111| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 112| 0| tsk_error_set_errstr("tsk_fs_attr_alloc: Invalid Type: %d\n", 113| 0| type); 114| 0| return NULL; 115| 0| } 116| | 117| 1.72k| return fs_attr; 118| 1.72k|} tsk_fs_attr_free: 129| 1.72k|{ 130| 1.72k| if (a_fs_attr == NULL) ------------------ | Branch (130:9): [True: 0, False: 1.72k] ------------------ 131| 0| return; 132| | 133| 1.72k| if (a_fs_attr->nrd.run) ------------------ | Branch (133:9): [True: 109, False: 1.61k] ------------------ 134| 109| tsk_fs_attr_run_free(a_fs_attr->nrd.run); 135| 1.72k| a_fs_attr->nrd.run = NULL; 136| | 137| 1.72k| free(a_fs_attr->rd.buf); 138| 1.72k| a_fs_attr->rd.buf = NULL; 139| | 140| 1.72k| free(a_fs_attr->name); 141| 1.72k| a_fs_attr->name = NULL; 142| | 143| 1.72k| free(a_fs_attr); 144| 1.72k|} tsk_fs_attr_clear: 155| 4.65k|{ 156| 4.65k| a_fs_attr->size = a_fs_attr->type = 157| 4.65k| a_fs_attr->id = a_fs_attr->flags = 0; 158| 4.65k| if (a_fs_attr->nrd.run) { ------------------ | Branch (158:9): [True: 0, False: 4.65k] ------------------ 159| 0| tsk_fs_attr_run_free(a_fs_attr->nrd.run); 160| 0| a_fs_attr->nrd.run = NULL; 161| 0| a_fs_attr->nrd.run_end = NULL; 162| 0| a_fs_attr->nrd.allocsize = 0; 163| 0| a_fs_attr->nrd.initsize = 0; 164| 0| } 165| 4.65k|} tsk_fs_attr_set_str: 218| 2.14k|{ 219| 2.14k| if (a_fs_attr == NULL) { ------------------ | Branch (219:9): [True: 0, False: 2.14k] ------------------ 220| 0| tsk_error_reset(); 221| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 222| 0| tsk_error_set_errstr("Null fs_attr in tsk_fs_attr_set_str"); 223| 0| return 1; 224| 0| } 225| | 226| 2.14k| a_fs_attr->fs_file = a_fs_file; 227| 2.14k| a_fs_attr->flags = (TSK_FS_ATTR_INUSE | TSK_FS_ATTR_RES); 228| 2.14k| a_fs_attr->type = type; 229| 2.14k| a_fs_attr->id = id; 230| 2.14k| a_fs_attr->nrd.compsize = 0; 231| | 232| 2.14k| if (fs_attr_put_name(a_fs_attr, name)) { ------------------ | Branch (232:9): [True: 0, False: 2.14k] ------------------ 233| 0| return 1; 234| 0| } 235| | 236| 2.14k| if (a_fs_attr->rd.buf_size < len) { ------------------ | Branch (236:9): [True: 0, False: 2.14k] ------------------ 237| 0| a_fs_attr->rd.buf = 238| 0| (uint8_t *) tsk_realloc((char *) a_fs_attr->rd.buf, len); 239| 0| if (a_fs_attr->rd.buf == NULL) ------------------ | Branch (239:13): [True: 0, False: 0] ------------------ 240| 0| return 1; 241| 0| a_fs_attr->rd.buf_size = len; 242| 0| } 243| | 244| 2.14k| memset(a_fs_attr->rd.buf, 0, a_fs_attr->rd.buf_size); 245| 2.14k| memcpy(a_fs_attr->rd.buf, res_data, len); 246| 2.14k| a_fs_attr->size = len; 247| | 248| 2.14k| return 0; 249| 2.14k|} tsk_fs_attr_set_run: 279| 123|{ 280| 123| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)) { ------------------ | Branch (280:9): [True: 0, False: 123] | Branch (280:32): [True: 0, False: 123] ------------------ 281| 0| tsk_error_reset(); 282| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 283| 0| tsk_error_set_errstr("Null fs_file in tsk_fs_attr_set_run"); 284| 0| return 1; 285| 0| } 286| 123| if (a_fs_attr == NULL) { ------------------ | Branch (286:9): [True: 0, False: 123] ------------------ 287| 0| tsk_error_reset(); 288| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 289| 0| tsk_error_set_errstr("Null fs_attr in tsk_fs_attr_set_run"); 290| 0| return 1; 291| 0| } 292| | 293| 123| if (alloc_size < size) { ------------------ | Branch (293:9): [True: 0, False: 123] ------------------ 294| 0| tsk_error_reset(); 295| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 296| 0| tsk_error_set_errstr("tsk_fs_attr_set_run: alloc_size (%" PRIdOFF 297| 0| ") is less than size (%" PRIdOFF ")", alloc_size, size); 298| 0| return 1; 299| 0| } 300| | 301| 123| a_fs_attr->fs_file = a_fs_file; 302| 123| a_fs_attr->flags = (TSK_FS_ATTR_INUSE | TSK_FS_ATTR_NONRES | flags); 303| 123| a_fs_attr->type = type; 304| 123| a_fs_attr->id = id; 305| 123| a_fs_attr->size = size; 306| 123| a_fs_attr->nrd.allocsize = alloc_size; 307| 123| a_fs_attr->nrd.initsize = init_size; 308| 123| a_fs_attr->nrd.compsize = compsize; 309| | 310| 123| if (fs_attr_put_name(a_fs_attr, name)) { ------------------ | Branch (310:9): [True: 0, False: 123] ------------------ 311| 0| return 1; 312| 0| } 313| | 314| | /* Add the a_data_run_new to the attribute. */ 315| | 316| | /* We support the ODD case where the run is NULL. In this case, 317| | * we set the attribute size info, but set everything else to NULL. 318| | */ 319| 123| if (a_data_run_new == NULL) { ------------------ | Branch (319:9): [True: 123, False: 0] ------------------ 320| 123| a_fs_attr->nrd.run = NULL; 321| 123| a_fs_attr->nrd.run_end = NULL; 322| 123| return 0; 323| 123| } 324| | 325| | /* 326| | * If this is not in the beginning, then we need to make a filler 327| | * to account for the cluster numbers we haven't seen yet 328| | * 329| | * This commonly happens when we process an MFT entry that 330| | * is not a base entry and it is referenced in an $ATTR_LIST 331| | * 332| | * The $DATA attribute in the non-base have a non-zero 333| | * a_data_run_new->offset. 334| | */ 335| 0| if (a_data_run_new->offset != 0) { ------------------ | Branch (335:9): [True: 0, False: 0] ------------------ 336| 0| TSK_FS_ATTR_RUN *fill_run = tsk_fs_attr_run_alloc(); 337| 0| fill_run->flags = TSK_FS_ATTR_RUN_FLAG_FILLER; 338| 0| fill_run->offset = 0; 339| 0| fill_run->addr = 0; 340| 0| fill_run->len = a_data_run_new->offset; 341| 0| fill_run->next = a_data_run_new; 342| 0| a_data_run_new = fill_run; 343| 0| } 344| | 345| 0| a_fs_attr->nrd.run = a_data_run_new; 346| | 347| | // update the pointer to the end of the list 348| 0| a_fs_attr->nrd.run_end = a_data_run_new; 349| 0| while (a_fs_attr->nrd.run_end->next) { ------------------ | Branch (349:12): [True: 0, False: 0] ------------------ 350| 0| a_fs_attr->nrd.run_end = a_fs_attr->nrd.run_end->next; 351| 0| } 352| | 353| 0| return 0; 354| 123|} tsk_fs_attr_add_run: 479| 300|{ 480| 300| TSK_FS_ATTR_RUN *data_run_cur, *data_run_prev; 481| 300| TSK_DADDR_T run_len; 482| | 483| 300| tsk_error_reset(); 484| | 485| 300| if (a_fs_attr == NULL) { ------------------ | Branch (485:9): [True: 0, False: 300] ------------------ 486| 0| tsk_error_reset(); 487| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 488| 0| tsk_error_set_errstr 489| 0| ("tsk_fs_attr_add_run: Error, a_fs_attr is NULL"); 490| 0| return 1; 491| 0| } 492| | 493| | // we only support the case of a null run if it is the only run... 494| 300| if (a_data_run_new == NULL) { ------------------ | Branch (494:9): [True: 0, False: 300] ------------------ 495| 0| tsk_error_reset(); 496| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 497| 0| tsk_error_set_errstr 498| 0| ("tsk_fs_attr_add_run: Error, a_data_run_new is NULL (%" 499| 0| PRIuINUM ")", a_fs_attr->fs_file->meta->addr); 500| 0| return 1; 501| 0| } 502| | 503| 300| run_len = 0; 504| 300| data_run_cur = a_data_run_new; 505| 600| while (data_run_cur) { ------------------ | Branch (505:12): [True: 300, False: 300] ------------------ 506| 300| run_len += data_run_cur->len; 507| 300| data_run_cur = data_run_cur->next; 508| 300| } 509| | 510| | /* First thing, is to check if we can just add it to the end */ 511| 300| if ((a_fs_attr->nrd.run_end) ------------------ | Branch (511:9): [True: 240, False: 60] ------------------ 512| 300| && (a_fs_attr->nrd.run_end->offset + a_fs_attr->nrd.run_end->len == ------------------ | Branch (512:12): [True: 0, False: 240] ------------------ 513| 240| a_data_run_new->offset)) { 514| | 515| 0| a_fs_attr->nrd.run_end->next = a_data_run_new; 516| | // update the pointer to the end of the list 517| 0| while (a_fs_attr->nrd.run_end->next) ------------------ | Branch (517:16): [True: 0, False: 0] ------------------ 518| 0| a_fs_attr->nrd.run_end = a_fs_attr->nrd.run_end->next; 519| | 520| | /* return head of a_fs_attr list */ 521| 0| return 0; 522| 0| } 523| | 524| | // cycle through existing runs and see if we can add this into a filler spot 525| 300| data_run_cur = a_fs_attr->nrd.run; 526| 300| data_run_prev = NULL; 527| 1.23k| while (data_run_cur) { ------------------ | Branch (527:12): [True: 1.14k, False: 90] ------------------ 528| | 529| 1.14k| if (tsk_verbose) ------------------ | Branch (529:13): [True: 0, False: 1.14k] ------------------ 530| 0| tsk_fprintf(stderr, 531| 0| "tsk_fs_attr_add: %" PRIuDADDR "@%" PRIuDADDR 532| 0| " (Filler: %s)\n", data_run_cur->offset, data_run_cur->len, 533| 0| (data_run_cur->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) ? "Yes" ------------------ | Branch (533:17): [True: 0, False: 0] ------------------ 534| 0| : "No"); 535| | 536| | /* Do we replace this filler spot? */ 537| 1.14k| if (data_run_cur->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) { ------------------ | Branch (537:13): [True: 630, False: 510] ------------------ 538| | 539| | /* This should never happen because we always add 540| | * the filler to start from VCN 0 */ 541| 630| if (data_run_cur->offset > a_data_run_new->offset) { ------------------ | Branch (541:17): [True: 0, False: 630] ------------------ 542| 0| tsk_error_reset(); 543| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 544| 0| tsk_error_set_errstr 545| 0| ("tsk_fs_attr_add_run: could not add data_run b.c. offset (%" 546| 0| PRIuDADDR ") is larger than FILLER (%" PRIuDADDR ") (%" 547| 0| PRIuINUM ")", a_data_run_new->offset, 548| 0| data_run_cur->offset, a_fs_attr->fs_file->meta->addr); 549| 0| if (tsk_verbose) ------------------ | Branch (549:21): [True: 0, False: 0] ------------------ 550| 0| dump_attr(a_fs_attr); 551| 0| return 1; 552| 0| } 553| | 554| | /* Check if the new run starts inside of this filler. */ 555| 630| if (data_run_cur->offset + data_run_cur->len > ------------------ | Branch (555:17): [True: 210, False: 420] ------------------ 556| 630| a_data_run_new->offset) { 557| 210| TSK_FS_ATTR_RUN *endrun; 558| | 559| | /* if the new starts at the same as the filler, 560| | * replace the pointer */ 561| 210| if (data_run_cur->offset == a_data_run_new->offset) { ------------------ | Branch (561:21): [True: 30, False: 180] ------------------ 562| 30| if (data_run_prev) ------------------ | Branch (562:25): [True: 0, False: 30] ------------------ 563| 0| data_run_prev->next = a_data_run_new; 564| 30| else 565| 30| a_fs_attr->nrd.run = a_data_run_new; 566| 30| } 567| | 568| | /* The new run does not start at the beginning of 569| | * the filler, so make a new start filler 570| | */ 571| 180| else { 572| 180| TSK_FS_ATTR_RUN *newfill = tsk_fs_attr_run_alloc(); 573| 180| if (newfill == NULL) ------------------ | Branch (573:25): [True: 0, False: 180] ------------------ 574| 0| return 1; 575| | 576| 180| if (data_run_prev) ------------------ | Branch (576:25): [True: 120, False: 60] ------------------ 577| 120| data_run_prev->next = newfill; 578| 60| else 579| 60| a_fs_attr->nrd.run = newfill; 580| | 581| 180| newfill->next = a_data_run_new; 582| 180| newfill->len = 583| 180| a_data_run_new->offset - data_run_cur->offset; 584| 180| newfill->offset = data_run_cur->offset; 585| 180| newfill->flags = TSK_FS_ATTR_RUN_FLAG_FILLER; 586| | 587| 180| data_run_cur->len -= newfill->len; 588| 180| } 589| | 590| | /* get to the end of the run that we are trying to add */ 591| 210| endrun = a_data_run_new; 592| 210| while (endrun->next) ------------------ | Branch (592:24): [True: 0, False: 210] ------------------ 593| 0| endrun = endrun->next; 594| | 595| | /* if the filler is the same size as the 596| | * new one, replace it 597| | */ 598| 210| if (run_len == data_run_cur->len) { ------------------ | Branch (598:21): [True: 0, False: 210] ------------------ 599| 0| endrun->next = data_run_cur->next; 600| | 601| | // update the pointer to the end of the list (if we are the end) 602| 0| if (endrun->next == NULL) ------------------ | Branch (602:25): [True: 0, False: 0] ------------------ 603| 0| a_fs_attr->nrd.run_end = endrun; 604| | 605| 0| free(data_run_cur); 606| 0| } 607| | /* else adjust the last filler entry */ 608| 210| else { 609| 210| endrun->next = data_run_cur; 610| 210| data_run_cur->len -= run_len; 611| 210| data_run_cur->offset = 612| 210| a_data_run_new->offset + a_data_run_new->len; 613| 210| } 614| | 615| 210| return 0; 616| 210| } 617| 630| } 618| | 619| 930| data_run_prev = data_run_cur; 620| 930| data_run_cur = data_run_cur->next; 621| 930| } 622| | 623| | 624| | /* 625| | * There is no filler holding the location of this run, so 626| | * we will add it to the end of the list 627| | * 628| | * we got here because it did not fit in the current list or 629| | * because the current list is NULL 630| | * 631| | * At this point data_run_prev is the end of the existing list or 632| | * 0 if there is no list 633| | */ 634| | /* This is an error condition. 635| | * It means that we cycled through the existing runs, 636| | * ended at a VCN that is larger than what we are adding, 637| | * and never found a filler entry to insert it into... 638| | */ 639| 90| if ((data_run_prev) ------------------ | Branch (639:9): [True: 30, False: 60] ------------------ 640| 90| && (data_run_prev->offset + data_run_prev->len > ------------------ | Branch (640:12): [True: 0, False: 30] ------------------ 641| 30| a_data_run_new->offset)) { 642| | 643| | /* MAYBE this is because of a duplicate entry .. */ 644| 0| if ((data_run_prev->addr == a_data_run_new->addr) && ------------------ | Branch (644:13): [True: 0, False: 0] ------------------ 645| 0| (data_run_prev->len == a_data_run_new->len)) { ------------------ | Branch (645:13): [True: 0, False: 0] ------------------ 646| | // @@@ Sould be we freeing this....? What if the caller tries to write to it? 647| 0| tsk_fs_attr_run_free(a_data_run_new); 648| 0| return 0; 649| 0| } 650| | 651| 0| tsk_error_reset(); 652| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 653| 0| tsk_error_set_errstr 654| 0| ("fs_attr_add_run: error adding additional run (%" PRIuINUM 655| 0| "): No filler entry for %" PRIuDADDR ". Final: %" PRIuDADDR, ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 656| 0| a_fs_attr->fs_file->meta->addr, a_data_run_new->offset, 657| 0| data_run_prev->offset + data_run_prev->len); 658| 0| if (tsk_verbose) ------------------ | Branch (658:13): [True: 0, False: 0] ------------------ 659| 0| dump_attr(a_fs_attr); 660| 0| return 1; 661| 0| } 662| | 663| | /* we should add it right here */ 664| 90| else if (((data_run_prev) ------------------ | Branch (664:15): [True: 30, False: 60] ------------------ 665| 90| && (data_run_prev->offset + data_run_prev->len == ------------------ | Branch (665:16): [True: 0, False: 30] ------------------ 666| 30| a_data_run_new->offset)) 667| 90| || (a_data_run_new->offset == 0)) { ------------------ | Branch (667:12): [True: 30, False: 60] ------------------ 668| 30| if (data_run_prev) ------------------ | Branch (668:13): [True: 0, False: 30] ------------------ 669| 0| data_run_prev->next = a_data_run_new; 670| 30| else 671| 30| a_fs_attr->nrd.run = a_data_run_new; 672| 30| } 673| | /* we need to make a filler before it */ 674| 60| else { 675| 60| TSK_FS_ATTR_RUN *tmprun = tsk_fs_attr_run_alloc(); 676| 60| if (tmprun == NULL) ------------------ | Branch (676:13): [True: 0, False: 60] ------------------ 677| 0| return 1; 678| | 679| 60| if (data_run_prev) { ------------------ | Branch (679:13): [True: 30, False: 30] ------------------ 680| 30| data_run_prev->next = tmprun; 681| 30| tmprun->offset = data_run_prev->offset + data_run_prev->len; 682| 30| } 683| 30| else { 684| 30| a_fs_attr->nrd.run = tmprun; 685| 30| } 686| | 687| 60| tmprun->len = a_data_run_new->offset - tmprun->offset; 688| 60| tmprun->flags = TSK_FS_ATTR_RUN_FLAG_FILLER; 689| 60| tmprun->next = a_data_run_new; 690| 60| } 691| | 692| | // update the pointer to the end of the list 693| 90| a_fs_attr->nrd.run_end = a_data_run_new; 694| 90| while (a_fs_attr->nrd.run_end->next) ------------------ | Branch (694:12): [True: 0, False: 90] ------------------ 695| 0| a_fs_attr->nrd.run_end = a_fs_attr->nrd.run_end->next; 696| | 697| 90| return 0; 698| 90|} tsk_fs_attr_append_run: 712| 357|{ 713| 357| TSK_FS_ATTR_RUN *data_run_cur; 714| | 715| 357| if ((a_fs_attr == NULL) || (a_data_run == NULL)) { ------------------ | Branch (715:9): [True: 0, False: 357] | Branch (715:32): [True: 0, False: 357] ------------------ 716| 0| return; 717| 0| } 718| | 719| 357| if (a_fs_attr->nrd.run == NULL) { ------------------ | Branch (719:9): [True: 49, False: 308] ------------------ 720| 49| a_fs_attr->nrd.run = a_data_run; 721| 49| a_data_run->offset = 0; 722| 49| } 723| 308| else { 724| | // just in case this was not updated 725| 308| if ((a_fs_attr->nrd.run_end == NULL) ------------------ | Branch (725:13): [True: 49, False: 259] ------------------ 726| 308| || (a_fs_attr->nrd.run_end->next != NULL)) { ------------------ | Branch (726:16): [True: 259, False: 0] ------------------ 727| 308| data_run_cur = a_fs_attr->nrd.run; 728| 1.34k| while (data_run_cur->next) { ------------------ | Branch (728:20): [True: 1.03k, False: 308] ------------------ 729| 1.03k| data_run_cur = data_run_cur->next; 730| 1.03k| } 731| 308| a_fs_attr->nrd.run_end = data_run_cur; 732| 308| } 733| 308| a_fs_attr->nrd.run_end->next = a_data_run; 734| 308| a_data_run->offset = 735| 308| a_fs_attr->nrd.run_end->offset + a_fs_attr->nrd.run_end->len; 736| 308| } 737| | 738| | // update the rest of the offsets in the run (if any exist) 739| 357| data_run_cur = a_data_run; 740| 357| while (data_run_cur->next) { ------------------ | Branch (740:12): [True: 0, False: 357] ------------------ 741| 0| data_run_cur->next->offset = 742| 0| data_run_cur->offset + data_run_cur->len; 743| 0| a_fs_attr->nrd.run_end = data_run_cur->next; 744| 0| data_run_cur = data_run_cur->next; 745| 0| } 746| 357|} tsk_fs_attr_read: 1105| 29.7k|{ 1106| 29.7k| TSK_FS_INFO *fs; 1107| | 1108| 29.7k| if ((a_fs_attr == NULL) || (a_fs_attr->fs_file == NULL) ------------------ | Branch (1108:9): [True: 0, False: 29.7k] | Branch (1108:32): [True: 0, False: 29.7k] ------------------ 1109| 29.7k| || (a_fs_attr->fs_file->fs_info == NULL) || (a_buf == NULL)) { ------------------ | Branch (1109:12): [True: 0, False: 29.7k] | Branch (1109:53): [True: 0, False: 29.7k] ------------------ 1110| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1111| 0| tsk_error_set_errstr 1112| 0| ("tsk_fs_attr_read: Attribute has null pointers."); 1113| 0| return -1; 1114| 0| } 1115| 29.7k| fs = a_fs_attr->fs_file->fs_info; 1116| | 1117| | // Handle logical directories separately 1118| 29.7k| if (fs->ftype == TSK_FS_TYPE_LOGICAL) { ------------------ | Branch (1118:6): [True: 0, False: 29.7k] ------------------ 1119| 0| return logicalfs_read(fs, a_fs_attr->fs_file, a_offset, a_len, a_buf); 1120| 0| } 1121| | 1122| | /* for compressed data, call the specialized function */ 1123| 29.7k| if (a_fs_attr->flags & TSK_FS_ATTR_COMP) { ------------------ | Branch (1123:9): [True: 0, False: 29.7k] ------------------ 1124| 0| if (a_fs_attr->r == NULL) { ------------------ | Branch (1124:13): [True: 0, False: 0] ------------------ 1125| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1126| 0| tsk_error_set_errstr 1127| 0| ("tsk_fs_attr_read: Attribute has compressed type set, but no compressed read function defined"); 1128| 0| return -1; 1129| 0| } 1130| 0| return a_fs_attr->r(a_fs_attr, a_offset, a_buf, a_len); 1131| 0| } 1132| | 1133| | /* For resident data, copy data from the local buffer */ 1134| 29.7k| else if (a_fs_attr->flags & TSK_FS_ATTR_RES) { ------------------ | Branch (1134:14): [True: 1.05k, False: 28.6k] ------------------ 1135| 1.05k| size_t len_toread; 1136| | 1137| 1.05k| if (a_offset >= a_fs_attr->size) { ------------------ | Branch (1137:13): [True: 0, False: 1.05k] ------------------ 1138| 0| tsk_error_reset(); 1139| 0| tsk_error_set_errno(TSK_ERR_FS_READ_OFF); ------------------ | | 350| 0|#define TSK_ERR_FS_READ_OFF (TSK_ERR_FS | 5) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1140| 0| tsk_error_set_errstr("tsk_fs_attr_read - %" PRIdOFF, a_offset); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 1141| 0| return -1; 1142| 0| } 1143| | 1144| 1.05k| len_toread = a_len; 1145| 1.05k| if (a_offset + (TSK_OFF_T)a_len > a_fs_attr->size) { ------------------ | Branch (1145:13): [True: 0, False: 1.05k] ------------------ 1146| 0| len_toread = (size_t) (a_fs_attr->size - a_offset); 1147| 0| memset(&a_buf[len_toread], 0, a_len - len_toread); 1148| 0| } 1149| | 1150| 1.05k| memcpy(a_buf, &a_fs_attr->rd.buf[a_offset], len_toread); 1151| | 1152| 1.05k| return (ssize_t) len_toread; 1153| 1.05k| } 1154| | 1155| | /* For non-resident data, load the needed block and copy the data */ 1156| 28.6k| else if (a_fs_attr->flags & TSK_FS_ATTR_NONRES) { ------------------ | Branch (1156:14): [True: 28.6k, False: 0] ------------------ 1157| 28.6k| TSK_FS_ATTR_RUN *data_run_cur; 1158| 28.6k| TSK_DADDR_T blkoffset_toread; // block offset of where we want to start reading from 1159| 28.6k| size_t byteoffset_toread; // byte offset in blkoffset_toread of where we want to start reading from 1160| 28.6k| ssize_t len_remain; // length remaining to copy 1161| 28.6k| size_t len_toread; // length total to copy 1162| | 1163| 28.6k| if (((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) ------------------ | Branch (1163:14): [True: 0, False: 28.6k] ------------------ 1164| 28.6k| && (a_offset >= a_fs_attr->nrd.allocsize)) ------------------ | Branch (1164:20): [True: 0, False: 0] ------------------ 1165| 28.6k| || (!(a_flags & TSK_FS_FILE_READ_FLAG_SLACK) ------------------ | Branch (1165:17): [True: 28.6k, False: 0] ------------------ 1166| 28.6k| && (a_offset >= a_fs_attr->size))) { ------------------ | Branch (1166:20): [True: 0, False: 28.6k] ------------------ 1167| 0| tsk_error_reset(); 1168| 0| tsk_error_set_errno(TSK_ERR_FS_READ_OFF); ------------------ | | 350| 0|#define TSK_ERR_FS_READ_OFF (TSK_ERR_FS | 5) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1169| 0| tsk_error_set_errstr("tsk_fs_attr_read - %" PRIdOFF, a_offset); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 1170| 0| return -1; 1171| 0| } 1172| | 1173| 28.6k| blkoffset_toread = a_offset / fs->block_size; 1174| 28.6k| byteoffset_toread = (size_t) (a_offset % fs->block_size); 1175| | 1176| | // determine how many bytes we can copy 1177| 28.6k| len_toread = a_len; 1178| 28.6k| if (a_flags & TSK_FS_FILE_READ_FLAG_SLACK) { ------------------ | Branch (1178:13): [True: 0, False: 28.6k] ------------------ 1179| 0| if (a_offset + (TSK_OFF_T)a_len > a_fs_attr->nrd.allocsize) ------------------ | Branch (1179:17): [True: 0, False: 0] ------------------ 1180| 0| len_toread = 1181| 0| (size_t) (a_fs_attr->nrd.allocsize - a_offset); 1182| 0| } 1183| 28.6k| else { 1184| 28.6k| if (a_offset + (TSK_OFF_T)a_len > a_fs_attr->size) ------------------ | Branch (1184:17): [True: 1, False: 28.6k] ------------------ 1185| 1| len_toread = (size_t) (a_fs_attr->size - a_offset); 1186| 28.6k| } 1187| | 1188| | 1189| | // wipe the buffer we won't read into 1190| 28.6k| if (len_toread < a_len) ------------------ | Branch (1190:13): [True: 1, False: 28.6k] ------------------ 1191| 1| memset(&a_buf[len_toread], 0, a_len - len_toread); 1192| | 1193| 28.6k| len_remain = len_toread; 1194| | 1195| | // cycle through the runs until we find the one where our offset starts 1196| 57.6k| for (data_run_cur = a_fs_attr->nrd.run; data_run_cur && len_remain > 0; ------------------ | Branch (1196:49): [True: 57.6k, False: 0] | Branch (1196:65): [True: 29.0k, False: 28.6k] ------------------ 1197| 29.0k| data_run_cur = data_run_cur->next) { 1198| | 1199| 29.0k| TSK_DADDR_T blkoffset_inrun; 1200| 29.0k| size_t len_inrun; 1201| | 1202| | // See if this run contains the starting offset they requested 1203| 29.0k| if (data_run_cur->offset + data_run_cur->len <= ------------------ | Branch (1203:17): [True: 368, False: 28.6k] ------------------ 1204| 29.0k| blkoffset_toread) 1205| 368| continue; 1206| | 1207| | // We want this run, so find out the offset that we want 1208| | // we'll start at 0 if we already read data in the last run. 1209| 28.6k| if (data_run_cur->offset < blkoffset_toread) ------------------ | Branch (1209:17): [True: 28.4k, False: 150] ------------------ 1210| 28.4k| blkoffset_inrun = blkoffset_toread - data_run_cur->offset; 1211| 150| else 1212| 150| blkoffset_inrun = 0; 1213| | 1214| | // see if we need to read the rest of this run and into the next or if it is all here 1215| 28.6k| len_inrun = len_remain; 1216| 28.6k| if ((data_run_cur->len - blkoffset_inrun) * fs->block_size - ------------------ | Branch (1216:17): [True: 0, False: 28.6k] ------------------ 1217| 28.6k| byteoffset_toread < (size_t)len_remain) { 1218| 0| len_inrun = 1219| 0| (size_t) ((data_run_cur->len - 1220| 0| blkoffset_inrun) * fs->block_size - 1221| 0| byteoffset_toread); 1222| 0| } 1223| | 1224| | /* sparse files/runs just get 0s */ 1225| 28.6k| if (data_run_cur->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) { ------------------ | Branch (1225:17): [True: 231, False: 28.4k] ------------------ 1226| 231| memset(&a_buf[len_toread - len_remain], 0, len_inrun); 1227| 231| } 1228| | 1229| | /* FILLER entries exist when the source file system can store run 1230| | * info out of order and we did not get all of the run info. We 1231| | * return 0s if data is read from this type of run. */ 1232| 28.4k| else if (data_run_cur->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) { ------------------ | Branch (1232:22): [True: 0, False: 28.4k] ------------------ 1233| 0| if (a_buf == NULL) { ------------------ | Branch (1233:21): [True: 0, False: 0] ------------------ 1234| 0| tsk_error_reset(); 1235| 0| tsk_error_set_errno(TSK_ERR_FS_READ_OFF); ------------------ | | 350| 0|#define TSK_ERR_FS_READ_OFF (TSK_ERR_FS | 5) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1236| 0| tsk_error_set_errstr("tsk_fs_attr_read - missing a_buf"); 1237| 0| return -1; 1238| 0| } 1239| 0| memset(&a_buf[len_toread - len_remain], 0, len_inrun); 1240| 0| if (tsk_verbose) ------------------ | Branch (1240:21): [True: 0, False: 0] ------------------ 1241| 0| fprintf(stderr, 1242| 0| "tsk_fs_attr_read_type: File %" PRIuINUM 1243| 0| " has FILLER entry, using 0s\n", 1244| 0| (a_fs_attr->fs_file->meta) ? a_fs_attr-> ------------------ | Branch (1244:25): [True: 0, False: 0] ------------------ 1245| 0| fs_file->meta->addr : 0); 1246| 0| } 1247| | 1248| | // we return 0s for reads past the initsize (unless they want slack space) 1249| 28.4k| else if (((TSK_OFF_T) ((data_run_cur->offset + ------------------ | Branch (1249:22): [True: 0, False: 28.4k] ------------------ 1250| 28.4k| blkoffset_inrun) * fs->block_size + 1251| 28.4k| byteoffset_toread) >= a_fs_attr->nrd.initsize) 1252| 28.4k| && ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) { ------------------ | Branch (1252:20): [True: 0, False: 0] ------------------ 1253| 0| memset(&a_buf[len_toread - len_remain], 0, len_inrun); 1254| 0| if (tsk_verbose) ------------------ | Branch (1254:21): [True: 0, False: 0] ------------------ 1255| 0| fprintf(stderr, 1256| 0| "tsk_fs_attr_read: Returning 0s for read past end of initsize (%" 1257| 0| PRIuINUM ")\n", ((a_fs_attr->fs_file) ------------------ | Branch (1257:42): [True: 0, False: 0] ------------------ 1258| 0| && (a_fs_attr->fs_file-> ------------------ | Branch (1258:32): [True: 0, False: 0] ------------------ 1259| 0| meta)) ? a_fs_attr->fs_file->meta-> 1260| 0| addr : 0); 1261| 0| } 1262| | 1263| | // we are going to read some data 1264| 28.4k| else { 1265| 28.4k| TSK_OFF_T fs_offset_b; 1266| 28.4k| ssize_t cnt; 1267| | 1268| | // calculate the byte offset in the file system that we want to read from 1269| 28.4k| fs_offset_b = 1270| 28.4k| (data_run_cur->addr + 1271| 28.4k| blkoffset_inrun) * fs->block_size; 1272| | 1273| | // add the byte offset in the block 1274| 28.4k| fs_offset_b += byteoffset_toread; 1275| 28.4k| cnt = 1276| 28.4k| tsk_fs_read_decrypt(fs, fs_offset_b, 1277| 28.4k| &a_buf[len_toread - len_remain], len_inrun, 1278| 28.4k| data_run_cur->crypto_id + blkoffset_inrun); 1279| | 1280| 28.4k| if (cnt != (ssize_t)len_inrun) { ------------------ | Branch (1280:21): [True: 31, False: 28.3k] ------------------ 1281| 31| if (cnt >= 0) { ------------------ | Branch (1281:25): [True: 10, False: 21] ------------------ 1282| 10| tsk_error_reset(); 1283| 10| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 10|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 10|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1284| 10| } 1285| 31| tsk_error_set_errstr2 1286| 31| ("tsk_fs_attr_read_type: offset: %" PRIdOFF 1287| 31| " Len: %" PRIuSIZE "", fs_offset_b, len_inrun); 1288| 31| return cnt; 1289| 31| } 1290| | 1291| | // see if part of the data is in the non-initialized space 1292| 28.3k| if (((TSK_OFF_T) ((data_run_cur->offset + ------------------ | Branch (1292:21): [True: 0, False: 28.3k] ------------------ 1293| 28.3k| blkoffset_inrun) * fs->block_size + 1294| 28.3k| byteoffset_toread + len_inrun) > 1295| 28.3k| a_fs_attr->nrd.initsize) 1296| 28.3k| && ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) { ------------------ | Branch (1296:24): [True: 0, False: 0] ------------------ 1297| | 1298| 0| size_t uninit_off = (size_t) (a_fs_attr->nrd.initsize - 1299| 0| ((data_run_cur->offset + 1300| 0| blkoffset_inrun) * fs->block_size + 1301| 0| byteoffset_toread)); 1302| | 1303| 0| memset(&a_buf[len_toread - len_remain + uninit_off], 0, 1304| 0| len_inrun - uninit_off); 1305| 0| } 1306| | 1307| 28.3k| } 1308| | 1309| 28.6k| len_remain -= len_inrun; 1310| | 1311| | // reset this in case we need to also read from the next run 1312| 28.6k| byteoffset_toread = 0; 1313| 28.6k| } 1314| 28.6k| return (ssize_t) (len_toread - len_remain); 1315| 28.6k| } 1316| | 1317| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1318| 0| tsk_error_set_errstr("tsk_fs_attr_read: Unknown attribute type: %x", 1319| 0| a_fs_attr->flags); 1320| 0| return -1; 1321| 29.7k|} fs_attr.c:fs_attr_put_name: 181| 2.26k|{ 182| 2.26k| if ((name == NULL) || (strlen(name) == 0)) { ------------------ | Branch (182:9): [True: 123, False: 2.14k] | Branch (182:27): [True: 0, False: 2.14k] ------------------ 183| 123| if (fs_attr->name_size > 0) { ------------------ | Branch (183:13): [True: 123, False: 0] ------------------ 184| 123| free(fs_attr->name); 185| 123| fs_attr->name_size = 0; 186| 123| } 187| 123| fs_attr->name = NULL; 188| 123| return 0; 189| 123| } 190| | 191| 2.14k| if (fs_attr->name_size < (strlen(name) + 1)) { ------------------ | Branch (191:9): [True: 0, False: 2.14k] ------------------ 192| 0| fs_attr->name = tsk_realloc(fs_attr->name, strlen(name) + 1); 193| 0| if (fs_attr->name == NULL) ------------------ | Branch (193:13): [True: 0, False: 0] ------------------ 194| 0| return 1; 195| 0| fs_attr->name_size = strlen(name) + 1; 196| 0| } 197| 2.14k| strncpy(fs_attr->name, name, fs_attr->name_size); 198| 2.14k| return 0; 199| 2.14k|} tsk_fs_attrlist_alloc: 26| 1.67k|{ 27| 1.67k| TSK_FS_ATTRLIST *fs_attrlist; 28| | 29| 1.67k| if ((fs_attrlist = ------------------ | Branch (29:9): [True: 0, False: 1.67k] ------------------ 30| 1.67k| (TSK_FS_ATTRLIST *) tsk_malloc(sizeof(TSK_FS_ATTRLIST))) == 31| 1.67k| NULL) 32| 0| return NULL; 33| 1.67k| return fs_attrlist; 34| 1.67k|} tsk_fs_attrlist_free: 41| 1.67k|{ 42| 1.67k| TSK_FS_ATTR *fs_attr_cur, *fs_attr_tmp; 43| 1.67k| if (a_fs_attrlist == NULL) ------------------ | Branch (43:9): [True: 0, False: 1.67k] ------------------ 44| 0| return; 45| | 46| 1.67k| fs_attr_cur = a_fs_attrlist->head; 47| 3.40k| while (fs_attr_cur) { ------------------ | Branch (47:12): [True: 1.72k, False: 1.67k] ------------------ 48| 1.72k| fs_attr_tmp = fs_attr_cur->next; 49| 1.72k| tsk_fs_attr_free(fs_attr_cur); 50| 1.72k| fs_attr_cur = fs_attr_tmp; 51| 1.72k| } 52| 1.67k| free(a_fs_attrlist); 53| 1.67k|} tsk_fs_attrlist_add: 65| 1.72k|{ 66| 1.72k| if (a_fs_attrlist == NULL) { ------------------ | Branch (66:9): [True: 0, False: 1.72k] ------------------ 67| 0| tsk_error_reset(); 68| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 69| 0| tsk_error_set_errstr("Null list in tsk_fs_attrlist_add"); 70| 0| return 1; 71| 0| } 72| | 73| | // verify INUSE is set 74| 1.72k| a_fs_attr->flags |= TSK_FS_ATTR_INUSE; 75| | 76| 1.72k| if (a_fs_attrlist->head == NULL) { ------------------ | Branch (76:9): [True: 1.67k, False: 44] ------------------ 77| 1.67k| a_fs_attrlist->head = a_fs_attr; 78| 1.67k| } 79| 44| else { 80| 44| TSK_FS_ATTR *fs_attr_cur; 81| 44| fs_attr_cur = a_fs_attrlist->head; 82| 44| while (fs_attr_cur) { ------------------ | Branch (82:16): [True: 44, False: 0] ------------------ 83| | // check if it already exists 84| 44| if ((fs_attr_cur->type == a_fs_attr->type) ------------------ | Branch (84:17): [True: 0, False: 44] ------------------ 85| 44| && (fs_attr_cur->id == a_fs_attr->id)) { ------------------ | Branch (85:20): [True: 0, False: 0] ------------------ 86| 0| tsk_error_reset(); 87| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 88| 0| tsk_error_set_errstr 89| 0| ("datalist_add: Type %d and Id %d already in list", 90| 0| a_fs_attr->type, a_fs_attr->id); 91| 0| return 1; 92| 0| } 93| 44| if (fs_attr_cur->next == NULL) { ------------------ | Branch (93:17): [True: 44, False: 0] ------------------ 94| 44| fs_attr_cur->next = a_fs_attr; 95| 44| break; 96| 44| } 97| 0| fs_attr_cur = fs_attr_cur->next; 98| 0| } 99| 44| } 100| 1.72k| return 0; 101| 1.72k|} tsk_fs_attrlist_getnew: 120| 2.26k|{ 121| 2.26k| TSK_FS_ATTR *fs_attr_cur; 122| 2.26k| TSK_FS_ATTR *fs_attr_ok = NULL; 123| | 124| 2.26k| if (a_fs_attrlist == NULL) { ------------------ | Branch (124:9): [True: 0, False: 2.26k] ------------------ 125| 0| tsk_error_reset(); 126| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 127| 0| tsk_error_set_errstr("Null list in tsk_fs_attrlist_getnew()"); 128| 0| return NULL; 129| 0| } 130| | 131| 2.26k| if ((a_atype != TSK_FS_ATTR_NONRES) && (a_atype != TSK_FS_ATTR_RES)) { ------------------ | Branch (131:9): [True: 2.14k, False: 123] | Branch (131:44): [True: 0, False: 2.14k] ------------------ 132| 0| tsk_error_reset(); 133| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 134| 0| tsk_error_set_errstr("Invalid Type in tsk_fs_attrlist_getnew()"); 135| 0| return NULL; 136| 0| } 137| | 138| 2.30k| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (138:45): [True: 587, False: 1.72k] ------------------ 139| 2.26k| fs_attr_cur = fs_attr_cur->next) { 140| 587| if (fs_attr_cur->flags == 0) { ------------------ | Branch (140:13): [True: 543, False: 44] ------------------ 141| 543| if (a_atype == TSK_FS_ATTR_NONRES) { ------------------ | Branch (141:17): [True: 0, False: 543] ------------------ 142| 0| if (fs_attr_cur->nrd.run) ------------------ | Branch (142:21): [True: 0, False: 0] ------------------ 143| 0| break; 144| 0| else if (!fs_attr_ok) ------------------ | Branch (144:26): [True: 0, False: 0] ------------------ 145| 0| fs_attr_ok = fs_attr_cur; 146| 0| } 147| | /* we want one with an allocated buf */ 148| 543| else { 149| 543| if (fs_attr_cur->rd.buf_size) ------------------ | Branch (149:21): [True: 543, False: 0] ------------------ 150| 543| break; 151| 0| else if (!fs_attr_ok) ------------------ | Branch (151:26): [True: 0, False: 0] ------------------ 152| 0| fs_attr_ok = fs_attr_cur; 153| 543| } 154| 543| } 155| 587| } 156| | 157| | /* if we fell out then check fs_attr_tmp */ 158| 2.26k| if (!fs_attr_cur) { ------------------ | Branch (158:9): [True: 1.72k, False: 543] ------------------ 159| 1.72k| if (fs_attr_ok) ------------------ | Branch (159:13): [True: 0, False: 1.72k] ------------------ 160| 0| fs_attr_cur = fs_attr_ok; 161| 1.72k| else { 162| | /* make a new one */ 163| 1.72k| if ((fs_attr_cur = tsk_fs_attr_alloc(a_atype)) == NULL) ------------------ | Branch (163:17): [True: 0, False: 1.72k] ------------------ 164| 0| return NULL; 165| | 166| | // add it to the list 167| 1.72k| if (tsk_fs_attrlist_add(a_fs_attrlist, fs_attr_cur)) { ------------------ | Branch (167:17): [True: 0, False: 1.72k] ------------------ 168| 0| tsk_fs_attr_free(fs_attr_cur); 169| 0| return NULL; 170| 0| } 171| 1.72k| } 172| 1.72k| } 173| | 174| 2.26k| fs_attr_cur->flags = (TSK_FS_ATTR_INUSE | a_atype); 175| 2.26k| return fs_attr_cur; 176| 2.26k|} tsk_fs_attrlist_markunused: 185| 4.65k|{ 186| 4.65k| TSK_FS_ATTR *fs_attr_cur; 187| 4.65k| if (a_fs_attrlist == NULL) ------------------ | Branch (187:9): [True: 0, False: 4.65k] ------------------ 188| 0| return; 189| | 190| 4.65k| fs_attr_cur = a_fs_attrlist->head; 191| 9.30k| while (fs_attr_cur) { ------------------ | Branch (191:12): [True: 4.65k, False: 4.65k] ------------------ 192| 4.65k| tsk_fs_attr_clear(fs_attr_cur); 193| 4.65k| fs_attr_cur = fs_attr_cur->next; 194| 4.65k| } 195| 4.65k|} tsk_fs_attrlist_get: 212| 29.7k|{ 213| 29.7k| TSK_FS_ATTR *fs_attr_cur; 214| 29.7k| TSK_FS_ATTR *fs_attr_ok = NULL; 215| | 216| 29.7k| if (!a_fs_attrlist) { ------------------ | Branch (216:9): [True: 0, False: 29.7k] ------------------ 217| 0| tsk_error_reset(); 218| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 219| 0| tsk_error_set_errstr("tsk_fs_attrlist_get: Null list pointer"); 220| 0| return NULL; 221| 0| } 222| | 223| 87.7k| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (223:45): [True: 58.0k, False: 29.7k] ------------------ 224| 58.0k| fs_attr_cur = fs_attr_cur->next) { 225| 58.0k| if ((fs_attr_cur->flags & TSK_FS_ATTR_INUSE) ------------------ | Branch (225:13): [True: 58.0k, False: 0] ------------------ 226| 58.0k| && (fs_attr_cur->type == a_type)) { ------------------ | Branch (226:16): [True: 29.7k, False: 28.3k] ------------------ 227| | 228| | /* If we are looking for NTFS $Data, 229| | * then return default when we see it */ 230| 29.7k| if ((fs_attr_cur->type == TSK_FS_ATTR_TYPE_NTFS_DATA) && ------------------ | Branch (230:17): [True: 0, False: 29.7k] ------------------ 231| 29.7k| (fs_attr_cur->name == NULL)) { ------------------ | Branch (231:17): [True: 0, False: 0] ------------------ 232| 0| return fs_attr_cur; 233| 0| } 234| | 235| | // make sure we return the lowest if multiple exist 236| 29.7k| if ((fs_attr_ok == NULL) || (fs_attr_ok->id > fs_attr_cur->id)) ------------------ | Branch (236:17): [True: 29.7k, False: 0] | Branch (236:41): [True: 0, False: 0] ------------------ 237| 29.7k| fs_attr_ok = fs_attr_cur; 238| 29.7k| } 239| 58.0k| } 240| | 241| 29.7k| if (!fs_attr_ok) { ------------------ | Branch (241:9): [True: 0, False: 29.7k] ------------------ 242| 0| tsk_error_set_errno(TSK_ERR_FS_ATTR_NOTFOUND); ------------------ | | 362| 0|#define TSK_ERR_FS_ATTR_NOTFOUND (TSK_ERR_FS | 17) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| tsk_error_set_errstr("tsk_fs_attrlist_get: Attribute %d not found", 244| 0| a_type); 245| 0| return NULL; 246| 0| } 247| 29.7k| else { 248| 29.7k| return fs_attr_ok; 249| 29.7k| } 250| 29.7k|} tsk_fs_dir_alloc: 29| 5.57k|{ 30| 5.57k| TSK_FS_DIR *fs_dir; 31| 5.57k| size_t i; 32| | 33| | // allocate and initialize the structure 34| 5.57k| if ((fs_dir = (TSK_FS_DIR *) tsk_malloc(sizeof(TSK_FS_DIR))) == NULL) { ------------------ | Branch (34:9): [True: 0, False: 5.57k] ------------------ 35| 0| return NULL; 36| 0| } 37| | 38| 5.57k| fs_dir->names_alloc = a_cnt; 39| 5.57k| fs_dir->names_used = 0; 40| 5.57k| if ((fs_dir->names = ------------------ | Branch (40:9): [True: 0, False: 5.57k] ------------------ 41| 5.57k| (TSK_FS_NAME *) tsk_malloc(sizeof(TSK_FS_NAME) * 42| 5.57k| fs_dir->names_alloc)) == NULL) { 43| 0| free(fs_dir); 44| 0| return NULL; 45| 0| } 46| 5.57k| fs_dir->fs_info = a_fs; 47| 5.57k| fs_dir->addr = a_addr; 48| 5.57k| fs_dir->tag = TSK_FS_DIR_TAG; ------------------ | | 633| 5.57k|#define TSK_FS_DIR_TAG 0x57531246 ------------------ 49| 719k| for (i = 0; i < a_cnt; i++) { ------------------ | Branch (49:17): [True: 713k, False: 5.57k] ------------------ 50| 713k| fs_dir->names[i].tag = TSK_FS_NAME_TAG; ------------------ | | 594| 713k|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 51| 713k| } 52| | 53| 5.57k| return fs_dir; 54| 5.57k|} tsk_fs_dir_realloc: 66| 20|{ 67| 20| size_t prev_cnt, i; 68| 20| if ((a_fs_dir == NULL) || (a_fs_dir->tag != TSK_FS_DIR_TAG)) ------------------ | | 633| 20|#define TSK_FS_DIR_TAG 0x57531246 ------------------ | Branch (68:9): [True: 0, False: 20] | Branch (68:31): [True: 0, False: 20] ------------------ 69| 0| return 1; 70| | 71| 20| if (a_fs_dir->names_alloc >= a_cnt) ------------------ | Branch (71:9): [True: 0, False: 20] ------------------ 72| 0| return 0; 73| 20| prev_cnt = a_fs_dir->names_alloc; 74| | 75| 20| a_fs_dir->names_alloc = a_cnt; 76| | 77| 20| if ((a_fs_dir->names = ------------------ | Branch (77:9): [True: 0, False: 20] ------------------ 78| 20| (TSK_FS_NAME *)tsk_realloc((void *)a_fs_dir->names, 79| 20| sizeof(TSK_FS_NAME) * a_fs_dir->names_alloc)) == NULL) { 80| 0| a_fs_dir->names_alloc = 0; 81| 0| a_fs_dir->names_used = 0; 82| 0| return 1; 83| 0| } 84| | 85| 20| memset(&a_fs_dir->names[prev_cnt], 0, 86| 20| (a_cnt - prev_cnt) * sizeof(TSK_FS_NAME)); 87| 10.2k| for (i = prev_cnt; i < a_cnt; i++) { ------------------ | Branch (87:24): [True: 10.2k, False: 20] ------------------ 88| 10.2k| a_fs_dir->names[i].tag = TSK_FS_NAME_TAG; ------------------ | | 594| 10.2k|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 89| 10.2k| } 90| 20| return 0; 91| 20|} tsk_fs_dir_add: 210| 16.0k|{ 211| 16.0k| TSK_FS_NAME *fs_name_dest = NULL; 212| 16.0k| size_t i; 213| | 214| | /* see if we already have it in the buffer / queue 215| | * We skip this check for FAT because it will always fail because two entries 216| | * never have the same meta address. */ 217| | // @@@ We could do something more efficient here too with orphan files because we do not 218| | // need to check the contents of that directory either and this takes a lot of time on those 219| | // large images. 220| 16.0k| if (TSK_FS_TYPE_ISFAT(a_fs_dir->fs_info->ftype) == 0) { ------------------ | | 843| 16.0k| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:6): [True: 0, False: 16.0k] | | ------------------ ------------------ | Branch (220:9): [True: 16.0k, False: 0] ------------------ 221| 1.39M| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (221:21): [True: 1.38M, False: 13.6k] ------------------ 222| 1.38M| if ((a_fs_name->meta_addr == a_fs_dir->names[i].meta_addr) && ------------------ | Branch (222:17): [True: 10.5k, False: 1.37M] ------------------ 223| 1.38M| (strcmp(a_fs_name->name, a_fs_dir->names[i].name) == 0)) { ------------------ | Branch (223:17): [True: 2.47k, False: 8.08k] ------------------ 224| | 225| 2.47k| if (tsk_verbose) ------------------ | Branch (225:21): [True: 0, False: 2.47k] ------------------ 226| 0| tsk_fprintf(stderr, 227| 0| "tsk_fs_dir_add: removing duplicate entry: %s (%" 228| 0| PRIuINUM ")\n", a_fs_name->name, 229| 0| a_fs_name->meta_addr); 230| | 231| | /* We do not check type because then we cannot detect NTFS orphan file 232| | * duplicates that are added as "-/r" while a similar entry exists as "r/r" 233| | (a_fs_name->type == a_fs_dir->names[i].type)) { */ 234| | 235| | // if the one in the list is unalloc and we have an alloc, replace it 236| 2.47k| if ((a_fs_dir->names[i].flags & TSK_FS_NAME_FLAG_UNALLOC) ------------------ | Branch (236:21): [True: 866, False: 1.60k] ------------------ 237| 2.47k| && (a_fs_name->flags & TSK_FS_NAME_FLAG_ALLOC)) { ------------------ | Branch (237:24): [True: 104, False: 762] ------------------ 238| 104| fs_name_dest = &a_fs_dir->names[i]; 239| | 240| | // free the memory - not the most efficient, but prevents 241| | // duplicate code. 242| 104| tsk_fs_dir_free_name_internal(fs_name_dest); 243| 104| break; 244| 104| } 245| 2.36k| else { 246| 2.36k| return 0; 247| 2.36k| } 248| 2.47k| } 249| 1.38M| } 250| 16.0k| } 251| | 252| 13.7k| if (fs_name_dest == NULL) { ------------------ | Branch (252:9): [True: 13.6k, False: 104] ------------------ 253| | // make sure we got the room 254| 13.6k| if (a_fs_dir->names_used >= a_fs_dir->names_alloc) { ------------------ | Branch (254:13): [True: 20, False: 13.6k] ------------------ 255| | 256| | // Protect against trying to process very large directories 257| 20| if (a_fs_dir->names_used >= MAX_DIR_SIZE_TO_PROCESS) { ------------------ | | 75| 20|#define MAX_DIR_SIZE_TO_PROCESS 1000000 ------------------ | Branch (257:8): [True: 0, False: 20] ------------------ 258| 0| tsk_error_reset(); 259| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 260| 0| tsk_error_set_errstr("tsk_fs_dir_add: Directory too large to process (addr: %" PRIuSIZE")", a_fs_dir->addr); 261| 0| return 1; 262| 0| } 263| | 264| 20| if (tsk_fs_dir_realloc(a_fs_dir, a_fs_dir->names_used + 512)) ------------------ | Branch (264:17): [True: 0, False: 20] ------------------ 265| 0| return 1; 266| 20| } 267| | 268| 13.6k| fs_name_dest = &a_fs_dir->names[a_fs_dir->names_used++]; 269| 13.6k| } 270| | 271| 13.7k| if (tsk_fs_name_copy(fs_name_dest, a_fs_name)) ------------------ | Branch (271:9): [True: 0, False: 13.7k] ------------------ 272| 0| return 1; 273| | 274| | // add the parent address 275| 13.7k| if (a_fs_dir->addr) { ------------------ | Branch (275:9): [True: 13.7k, False: 0] ------------------ 276| 13.7k| fs_name_dest->par_addr = a_fs_dir->addr; 277| 13.7k| fs_name_dest->par_seq = a_fs_dir->seq; 278| 13.7k| } 279| | 280| 13.7k| return 0; 281| 13.7k|} tsk_fs_dir_close: 387| 5.57k|{ 388| 5.57k| size_t i; 389| 5.57k| if ((a_fs_dir == NULL) || (a_fs_dir->tag != TSK_FS_DIR_TAG)) { ------------------ | | 633| 5.57k|#define TSK_FS_DIR_TAG 0x57531246 ------------------ | Branch (389:9): [True: 0, False: 5.57k] | Branch (389:31): [True: 0, False: 5.57k] ------------------ 390| 0| return; 391| 0| } 392| | 393| 5.57k| if (a_fs_dir->names != NULL) { ------------------ | Branch (393:9): [True: 5.57k, False: 0] ------------------ 394| 19.2k| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (394:21): [True: 13.6k, False: 5.57k] ------------------ 395| 13.6k| tsk_fs_dir_free_name_internal(&a_fs_dir->names[i]); 396| 13.6k| } 397| 5.57k| free(a_fs_dir->names); 398| 5.57k| } 399| | 400| 5.57k| if (a_fs_dir->fs_file) { ------------------ | Branch (400:9): [True: 2.19k, False: 3.38k] ------------------ 401| 2.19k| tsk_fs_file_close(a_fs_dir->fs_file); 402| 2.19k| a_fs_dir->fs_file = NULL; 403| 2.19k| } 404| | 405| 5.57k| a_fs_dir->tag = 0; 406| 5.57k| free(a_fs_dir); 407| 5.57k|} tsk_fs_dir_walk_internal: 958| 4.97k|{ 959| 4.97k| DENT_DINFO dinfo; 960| 4.97k| TSK_WALK_RET_ENUM retval; 961| | 962| 4.97k| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) { ------------------ | | 933| 4.97k|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (962:9): [True: 0, False: 4.97k] | Branch (962:27): [True: 0, False: 4.97k] ------------------ 963| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 964| 0| tsk_error_set_errstr 965| 0| ("tsk_fs_dir_walk_internal: called with NULL or unallocated structures"); 966| 0| return 1; 967| 0| } 968| | 969| | // 128 is a somewhat arbitrary value. 970| | // https://github.com/sleuthkit/sleuthkit/issues/1859 identified 971| | // an overflow with 240 levels of recursion with FAT 972| 4.97k| if (macro_recursion_depth > 128) { ------------------ | Branch (972:9): [True: 0, False: 4.97k] ------------------ 973| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 974| 0| tsk_error_set_errstr 975| 0| ("tsk_fs_dir_walk_internal: recursion depth exceeds maximum (%d)", macro_recursion_depth); 976| 0| return 1; 977| 0| } 978| | 979| 4.97k| memset(&dinfo, 0, sizeof(DENT_DINFO)); 980| 4.97k| if ((dinfo.stack_seen = tsk_stack_create()) == NULL) ------------------ | Branch (980:9): [True: 0, False: 4.97k] ------------------ 981| 0| return 1; 982| | 983| | /* Sanity check on flags -- make sure at least one ALLOC is set */ 984| 4.97k| if (((a_flags & TSK_FS_DIR_WALK_FLAG_ALLOC) == 0) && ------------------ | Branch (984:9): [True: 4.97k, False: 0] ------------------ 985| 4.97k| ((a_flags & TSK_FS_DIR_WALK_FLAG_UNALLOC) == 0)) { ------------------ | Branch (985:9): [True: 3.37k, False: 1.60k] ------------------ 986| 3.37k| a_flags |= 987| 3.37k| (TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC); 988| 3.37k| } 989| | 990| | /* if the flags are right, we can collect info that may be needed 991| | * for an orphan walk. If the walk fails or stops, the code that 992| | * calls the action will clear this stuff. 993| | */ 994| 4.97k| tsk_take_lock(&a_fs->list_inum_named_lock); 995| 4.97k| if ((a_fs->list_inum_named == NULL) && (a_addr == a_fs->root_inum) ------------------ | Branch (995:9): [True: 4.95k, False: 20] | Branch (995:44): [True: 3.89k, False: 1.05k] ------------------ 996| 4.97k| && (a_flags & TSK_FS_DIR_WALK_FLAG_RECURSE)) { ------------------ | Branch (996:12): [True: 3.89k, False: 0] ------------------ 997| 3.89k| dinfo.save_inum_named = 1; 998| 3.89k| } 999| 4.97k| tsk_release_lock(&a_fs->list_inum_named_lock); 1000| | 1001| 4.97k| retval = tsk_fs_dir_walk_recursive(a_fs, &dinfo, a_addr, a_flags, 1002| 4.97k| a_action, a_ptr, macro_recursion_depth); 1003| | 1004| | // if we were saving the list of named files in the temp list, 1005| | // then now save them to FS_INFO 1006| 4.97k| if (dinfo.save_inum_named == 1) { ------------------ | Branch (1006:9): [True: 2.83k, False: 2.14k] ------------------ 1007| 2.83k| if (retval != TSK_WALK_CONT) { ------------------ | Branch (1007:13): [True: 2.83k, False: 0] ------------------ 1008| | /* There was an error and we stopped early, so we should get 1009| | * rid of the partial list we were making. 1010| | */ 1011| 2.83k| tsk_list_free(dinfo.list_inum_named); 1012| 2.83k| dinfo.list_inum_named = NULL; 1013| 2.83k| } 1014| 0| else { 1015| 0| save_inum_named(a_fs, &dinfo); 1016| 0| } 1017| 2.83k| } 1018| | 1019| 4.97k| tsk_stack_free(dinfo.stack_seen); 1020| | 1021| 4.97k| if (retval == TSK_WALK_ERROR) ------------------ | Branch (1021:9): [True: 2.84k, False: 2.12k] ------------------ 1022| 2.84k| return 1; 1023| 2.12k| else 1024| 2.12k| return 0; 1025| 4.97k|} tsk_fs_dir_walk: 1042| 3.37k|{ 1043| 3.37k| return tsk_fs_dir_walk_internal(a_fs, a_addr, a_flags, a_action, a_ptr, 0); 1044| 3.37k|} tsk_fs_dir_make_orphan_dir_name: 1055| 1.08k|{ 1056| 1.08k| snprintf(a_fs_name->name, a_fs_name->name_size, "$OrphanFiles"); 1057| 1.08k| if (a_fs_name->shrt_name_size > 0) ------------------ | Branch (1057:9): [True: 0, False: 1.08k] ------------------ 1058| 0| a_fs_name->shrt_name[0] = '\0'; 1059| 1.08k| a_fs_name->meta_addr = TSK_FS_ORPHANDIR_INUM(a_fs); ------------------ | | 530| 1.08k| (fs_info->last_inum) ------------------ 1060| 1.08k| a_fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 1061| 1.08k| a_fs_name->type = TSK_FS_NAME_TYPE_VIRT_DIR; 1062| 1.08k| return 0; 1063| 1.08k|} tsk_fs_dir_make_orphan_dir_meta: 1074| 1.08k|{ 1075| 1.08k| a_fs_meta->type = TSK_FS_META_TYPE_VIRT_DIR; 1076| 1.08k| a_fs_meta->mode = 0; 1077| 1.08k| a_fs_meta->nlink = 1; 1078| | 1079| 1.08k| a_fs_meta->flags = (TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_ALLOC); 1080| 1.08k| a_fs_meta->uid = a_fs_meta->gid = 0; 1081| 1.08k| a_fs_meta->mtime = a_fs_meta->atime = a_fs_meta->ctime = 1082| 1.08k| a_fs_meta->crtime = 0; 1083| 1.08k| a_fs_meta->mtime_nano = a_fs_meta->atime_nano = a_fs_meta->ctime_nano = 1084| 1.08k| a_fs_meta->crtime_nano = 0; 1085| | 1086| 1.08k| if (a_fs_meta->name2 == NULL) { ------------------ | Branch (1086:9): [True: 1.08k, False: 0] ------------------ 1087| 1.08k| if ((a_fs_meta->name2 = (TSK_FS_META_NAME_LIST *) ------------------ | Branch (1087:13): [True: 0, False: 1.08k] ------------------ 1088| 1.08k| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST))) == NULL) 1089| 0| return 1; 1090| 1.08k| a_fs_meta->name2->next = NULL; 1091| 1.08k| } 1092| | 1093| 1.08k| a_fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 1094| 1.08k| if (a_fs_meta->attr) { ------------------ | Branch (1094:9): [True: 0, False: 1.08k] ------------------ 1095| 0| tsk_fs_attrlist_markunused(a_fs_meta->attr); 1096| 0| } 1097| | 1098| 1.08k| a_fs_meta->addr = TSK_FS_ORPHANDIR_INUM(a_fs); ------------------ | | 530| 1.08k| (fs_info->last_inum) ------------------ 1099| 1.08k| strncpy(a_fs_meta->name2->name, "$OrphanFiles", 1100| 1.08k| TSK_FS_META_NAME_LIST_NSIZE); ------------------ | | 348| 1.08k|#define TSK_FS_META_NAME_LIST_NSIZE 512 ------------------ 1101| 1.08k| if (a_fs_meta->content_len) { ------------------ | Branch (1101:9): [True: 1.08k, False: 0] ------------------ 1102| 1.08k| TSK_DADDR_T *addr_ptr = (TSK_DADDR_T *) a_fs_meta->content_ptr; 1103| 1.08k| addr_ptr[0] = 0; 1104| 1.08k| } 1105| 1.08k| a_fs_meta->size = 0; 1106| 1.08k| return 0; 1107| 1.08k|} tsk_fs_dir_load_inum_named: 1147| 557|{ 1148| 557| tsk_take_lock(&a_fs->list_inum_named_lock); 1149| 557| if (a_fs->list_inum_named != NULL) { ------------------ | Branch (1149:9): [True: 30, False: 527] ------------------ 1150| 30| tsk_release_lock(&a_fs->list_inum_named_lock); 1151| 30| if (tsk_verbose) ------------------ | Branch (1151:13): [True: 0, False: 30] ------------------ 1152| 0| fprintf(stderr, 1153| 0| "tsk_fs_dir_load_inum_named: List already populated. Skipping walk.\n"); 1154| 30| return TSK_OK; 1155| 30| } 1156| 527| tsk_release_lock(&a_fs->list_inum_named_lock); 1157| | 1158| 527| if (tsk_verbose) ------------------ | Branch (1158:9): [True: 0, False: 527] ------------------ 1159| 0| fprintf(stderr, 1160| 0| "tsk_fs_dir_load_inum_named: Performing dir walk to find named files\n"); 1161| | 1162| | /* Do a dir_walk. There is internal caching code that will populate 1163| | * the structure. The callback is really a dummy call. This could 1164| | * be made more efficient in the future (not do callbacks...). We 1165| | * specify UNALLOC only as a flag on the assumption that there will 1166| | * be fewer callbacks for UNALLOC than ALLOC. 1167| | */ 1168| 527| if (tsk_fs_dir_walk_internal(a_fs, a_fs->root_inum, ------------------ | Branch (1168:9): [True: 0, False: 527] ------------------ 1169| 527| TSK_FS_NAME_FLAG_UNALLOC | TSK_FS_DIR_WALK_FLAG_RECURSE | 1170| 527| TSK_FS_DIR_WALK_FLAG_NOORPHAN, load_named_dir_walk_cb, NULL, 0)) { 1171| 0| tsk_error_errstr2_concat 1172| 0| ("- tsk_fs_dir_load_inum_named: identifying inodes allocated by file names"); 1173| 0| return TSK_ERR; 1174| 0| } 1175| | 1176| 527| return TSK_OK; 1177| 527|} tsk_fs_dir_find_orphans: 1356| 557|{ 1357| 557| FIND_ORPHAN_DATA data; 1358| 557| size_t i; 1359| | 1360| 557| tsk_take_lock(&a_fs->orphan_dir_lock); 1361| | 1362| 557| if (a_fs->orphan_dir != NULL) { ------------------ | Branch (1362:9): [True: 0, False: 557] ------------------ 1363| 0| if (tsk_fs_dir_copy(a_fs->orphan_dir, a_fs_dir)) { ------------------ | Branch (1363:13): [True: 0, False: 0] ------------------ 1364| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1365| 0| return TSK_ERR; 1366| 0| } 1367| | 1368| 0| if (tsk_fs_dir_add_orphan_dir_meta(a_fs, a_fs_dir)) { ------------------ | Branch (1368:13): [True: 0, False: 0] ------------------ 1369| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1370| 0| return TSK_ERR; 1371| 0| } 1372| | 1373| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1374| 0| return TSK_OK; 1375| 0| } 1376| | 1377| 557| if (tsk_verbose) ------------------ | Branch (1377:9): [True: 0, False: 557] ------------------ 1378| 0| fprintf(stderr, 1379| 0| "tsk_fs_dir_find_orphans: Searching for orphan files\n"); 1380| | 1381| 557| memset(&data, 0, sizeof(FIND_ORPHAN_DATA)); 1382| | 1383| | /* We first need to determine which of the unallocated meta structures 1384| | * have a name pointing to them. We cache this data, so see if it is 1385| | * already known. */ 1386| 557| if (tsk_fs_dir_load_inum_named(a_fs) != TSK_OK) { ------------------ | Branch (1386:9): [True: 0, False: 557] ------------------ 1387| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1388| 0| return TSK_ERR; 1389| 0| } 1390| | // note that list_inum_named could still be NULL if there are no deleted names. 1391| | 1392| | /* Now we walk the unallocated metadata structures and find ones that are 1393| | * not named. The callback will add the names to the FS_DIR structure. 1394| | */ 1395| 557| data.fs_dir = a_fs_dir; 1396| | 1397| | // allocate a name once so that we will reuse for each name we add to FS_DIR 1398| 557| if ((data.fs_name = tsk_fs_name_alloc(256, 0)) == NULL) { ------------------ | Branch (1398:9): [True: 0, False: 557] ------------------ 1399| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1400| 0| return TSK_ERR; 1401| 0| } 1402| | 1403| 557| if (tsk_verbose) ------------------ | Branch (1403:9): [True: 0, False: 557] ------------------ 1404| 0| fprintf(stderr, 1405| 0| "tsk_fs_dir_find_orphans: Performing inode_walk to find unnamed metadata structures\n"); 1406| | 1407| 557| if (tsk_fs_meta_walk(a_fs, a_fs->first_inum, a_fs->last_inum, ------------------ | Branch (1407:9): [True: 557, False: 0] ------------------ 1408| 557| TSK_FS_META_FLAG_UNALLOC | TSK_FS_META_FLAG_USED, 1409| 557| find_orphan_meta_walk_cb, &data)) { 1410| 557| tsk_fs_name_free(data.fs_name); 1411| 557| if (data.orphan_subdir_list) { ------------------ | Branch (1411:13): [True: 0, False: 557] ------------------ 1412| 0| tsk_list_free(data.orphan_subdir_list); 1413| 0| data.orphan_subdir_list = NULL; 1414| 0| } 1415| 557| tsk_release_lock(&a_fs->orphan_dir_lock); 1416| 557| return TSK_ERR; 1417| 557| } 1418| | 1419| 0| tsk_fs_name_free(data.fs_name); 1420| 0| data.fs_name = NULL; 1421| | 1422| | 1423| 0| if (tsk_verbose) ------------------ | Branch (1423:9): [True: 0, False: 0] ------------------ 1424| 0| fprintf(stderr, 1425| 0| "tsk_fs_dir_find_orphans: De-duping orphan files and directories\n"); 1426| | 1427| | /* do some cleanup on the final list. This cleanup will compare the 1428| | * entries in the root orphan directory with files that can be accessed 1429| | * from subdirectories of the orphan directory. These entries will exist if 1430| | * they were added before their parent directory was added to the orphan directory. */ 1431| 0| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (1431:17): [True: 0, False: 0] ------------------ 1432| 0| if (tsk_list_find(data.orphan_subdir_list, ------------------ | Branch (1432:13): [True: 0, False: 0] ------------------ 1433| 0| a_fs_dir->names[i].meta_addr)) { 1434| | 1435| | // Unclear what should happen in this situation, but it can happen, 1436| | // So skipping over this situation for now. 1437| 0| if (a_fs_dir->names_used == i + 1) { ------------------ | Branch (1437:17): [True: 0, False: 0] ------------------ 1438| 0| continue; 1439| 0| } 1440| 0| if (a_fs_dir->names_used > 1) { ------------------ | Branch (1440:17): [True: 0, False: 0] ------------------ 1441| 0| tsk_fs_name_copy(&a_fs_dir->names[i], 1442| 0| &a_fs_dir->names[a_fs_dir->names_used - 1]); 1443| 0| } 1444| 0| tsk_fs_dir_free_name_internal(&a_fs_dir->names[a_fs_dir->names_used-1]); 1445| 0| a_fs_dir->names_used--; 1446| 0| } 1447| 0| } 1448| | 1449| 0| if (data.orphan_subdir_list) { ------------------ | Branch (1449:9): [True: 0, False: 0] ------------------ 1450| 0| tsk_list_free(data.orphan_subdir_list); 1451| 0| data.orphan_subdir_list = NULL; 1452| 0| } 1453| | 1454| | 1455| | // make copy of this so that we don't need to do it again. 1456| 0| if ((a_fs->orphan_dir = ------------------ | Branch (1456:9): [True: 0, False: 0] ------------------ 1457| 0| tsk_fs_dir_alloc(a_fs, a_fs_dir->addr, 1458| 0| a_fs_dir->names_used)) == NULL) { 1459| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1460| 0| return TSK_ERR; 1461| 0| } 1462| | 1463| 0| if (tsk_fs_dir_copy(a_fs_dir, a_fs->orphan_dir)) { ------------------ | Branch (1463:9): [True: 0, False: 0] ------------------ 1464| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1465| 0| return TSK_ERR; 1466| 0| } 1467| | 1468| | // populate the fake FS_FILE structure in the struct to be returned for the "Orphan Directory" 1469| 0| if (tsk_fs_dir_add_orphan_dir_meta(a_fs, a_fs_dir)) { ------------------ | Branch (1469:9): [True: 0, False: 0] ------------------ 1470| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1471| 0| return TSK_ERR; 1472| 0| } 1473| | 1474| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1475| 0| return TSK_OK; 1476| 0|} fs_dir.c:tsk_fs_dir_free_name_internal: 182| 13.7k|{ 183| 13.7k| if (fs_name == NULL) { ------------------ | Branch (183:9): [True: 0, False: 13.7k] ------------------ 184| 0| return; 185| 0| } 186| | 187| 13.7k| if (fs_name->name) { ------------------ | Branch (187:9): [True: 13.7k, False: 0] ------------------ 188| 13.7k| free(fs_name->name); 189| 13.7k| fs_name->name = NULL; 190| 13.7k| fs_name->name_size = 0; 191| 13.7k| } 192| 13.7k| if (fs_name->shrt_name) { ------------------ | Branch (192:9): [True: 0, False: 13.7k] ------------------ 193| 0| free(fs_name->shrt_name); 194| 0| fs_name->shrt_name = NULL; 195| 0| fs_name->shrt_name_size = 0; 196| 0| } 197| 13.7k|} fs_dir.c:tsk_fs_dir_open_meta_internal: 296| 5.57k|{ 297| 5.57k| TSK_FS_DIR *fs_dir = NULL; 298| 5.57k| TSK_RETVAL_ENUM retval; 299| | 300| 5.57k| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG) ------------------ | | 933| 5.57k|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (300:9): [True: 0, False: 5.57k] | Branch (300:27): [True: 0, False: 5.57k] ------------------ 301| 5.57k| || (a_fs->dir_open_meta == NULL)) { ------------------ | Branch (301:12): [True: 0, False: 5.57k] ------------------ 302| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 303| 0| tsk_error_set_errstr 304| 0| ("tsk_fs_dir_open_meta_internal: called with NULL or unallocated structures"); 305| 0| return NULL; 306| 0| } 307| | 308| 5.57k| retval = a_fs->dir_open_meta(a_fs, &fs_dir, a_addr, macro_recursion_depth); 309| 5.57k| if (retval != TSK_OK) { ------------------ | Branch (309:9): [True: 3.43k, False: 2.14k] ------------------ 310| 3.43k| tsk_fs_dir_close(fs_dir); 311| 3.43k| return NULL; 312| 3.43k| } 313| | 314| 2.14k| return fs_dir; 315| 5.57k|} fs_dir.c:tsk_fs_dir_walk_recursive: 654| 5.57k|{ 655| 5.57k| TSK_FS_DIR *fs_dir; 656| 5.57k| TSK_FS_FILE *fs_file; 657| 5.57k| size_t i; 658| 5.57k| int* indexToOrderedIndex = NULL; 659| | 660| | // get the list of entries in the directory 661| 5.57k| if ((fs_dir = tsk_fs_dir_open_meta_internal(a_fs, a_addr, macro_recursion_depth + 1)) == NULL) { ------------------ | Branch (661:9): [True: 3.43k, False: 2.14k] ------------------ 662| 3.43k| return TSK_WALK_ERROR; 663| 3.43k| } 664| | 665| | // If we're in the root folder, sort the files/folders to prioritize user content 666| 2.14k| if (a_addr == a_fs->root_inum) { ------------------ | Branch (666:9): [True: 1.08k, False: 1.05k] ------------------ 667| 1.08k| indexToOrderedIndex = (int *)tsk_malloc(fs_dir->names_used * sizeof(int)); 668| 1.08k| if (indexToOrderedIndex == NULL) { ------------------ | Branch (668:13): [True: 0, False: 1.08k] ------------------ 669| 0| tsk_fs_dir_close(fs_dir); 670| 0| return TSK_WALK_ERROR; 671| 0| } 672| 1.08k| if (TSK_OK != prioritizeDirNames(fs_dir->names, fs_dir->names_used, indexToOrderedIndex)) { ------------------ | Branch (672:13): [True: 0, False: 1.08k] ------------------ 673| 0| tsk_fs_dir_close(fs_dir); 674| 0| return TSK_WALK_ERROR; 675| 0| } 676| 1.08k| } 677| | 678| | /* Allocate a file structure for the callbacks. We 679| | * will allocate fs_meta structures as needed and 680| | * point into the fs_dir structure for the names. */ 681| 2.14k| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) { ------------------ | Branch (681:9): [True: 0, False: 2.14k] ------------------ 682| 0| tsk_fs_dir_close(fs_dir); 683| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (683:13): [True: 0, False: 0] ------------------ 684| 0| free(indexToOrderedIndex); 685| 0| } 686| 0| return TSK_WALK_ERROR; 687| 0| } 688| | 689| 3.43k| for (i = 0; i < fs_dir->names_used; i++) { ------------------ | Branch (689:17): [True: 1.29k, False: 2.14k] ------------------ 690| 1.29k| TSK_WALK_RET_ENUM retval; 691| | 692| | /* Point name to the buffer of names. We need to be 693| | * careful about resetting this before we free fs_file */ 694| 1.29k| if (indexToOrderedIndex != NULL) { ------------------ | Branch (694:13): [True: 1.29k, False: 0] ------------------ 695| | // If we have a priortized list, use it 696| 1.29k| fs_file->name = (TSK_FS_NAME *)& fs_dir->names[indexToOrderedIndex[i]]; 697| 1.29k| } 698| 0| else { 699| 0| fs_file->name = (TSK_FS_NAME *)& fs_dir->names[i]; 700| 0| } 701| | 702| | /* load the fs_meta structure if possible. 703| | * Must have non-zero inode addr or have allocated name (if inode is 0) */ 704| 1.29k| if (((fs_file->name->meta_addr) ------------------ | Branch (704:14): [True: 1.29k, False: 4] ------------------ 705| 1.29k| || (fs_file->name->flags & TSK_FS_NAME_FLAG_ALLOC))) { ------------------ | Branch (705:20): [True: 0, False: 4] ------------------ 706| | 707| | /* Note that the NTFS code behind here has a slight hack to use the 708| | * correct sequence number based on the data in fs_file->name */ 709| 1.29k| if (a_fs->file_add_meta(a_fs, fs_file, ------------------ | Branch (709:17): [True: 60, False: 1.23k] ------------------ 710| 1.29k| fs_file->name->meta_addr)) { 711| 60| if (tsk_verbose) ------------------ | Branch (711:21): [True: 0, False: 60] ------------------ 712| 0| tsk_error_print(stderr); 713| 60| tsk_error_reset(); 714| 60| } 715| 1.29k| } 716| | 717| | // call the action if we have the right flags. 718| 1.29k| if ((fs_file->name->flags & a_flags) == fs_file->name->flags) { ------------------ | Branch (718:13): [True: 767, False: 527] ------------------ 719| | 720| 767| retval = a_action(fs_file, a_dinfo->dirs, a_ptr); 721| 767| if (retval == TSK_WALK_STOP) { ------------------ | Branch (721:17): [True: 0, False: 767] ------------------ 722| 0| tsk_fs_dir_close(fs_dir); 723| 0| fs_file->name = NULL; 724| 0| tsk_fs_file_close(fs_file); 725| | 726| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (726:21): [True: 0, False: 0] ------------------ 727| 0| free(indexToOrderedIndex); 728| 0| } 729| | 730| | /* free the list -- fs_dir_walk has no way 731| | * of knowing that we stopped early w/out error. 732| | */ 733| 0| if (a_dinfo->save_inum_named) { ------------------ | Branch (733:21): [True: 0, False: 0] ------------------ 734| 0| tsk_list_free(a_dinfo->list_inum_named); 735| 0| a_dinfo->list_inum_named = NULL; 736| 0| a_dinfo->save_inum_named = 0; 737| 0| } 738| 0| return TSK_WALK_STOP; 739| 0| } 740| 767| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (740:22): [True: 0, False: 767] ------------------ 741| 0| tsk_fs_dir_close(fs_dir); 742| 0| fs_file->name = NULL; 743| 0| tsk_fs_file_close(fs_file); 744| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (744:21): [True: 0, False: 0] ------------------ 745| 0| free(indexToOrderedIndex); 746| 0| } 747| 0| return TSK_WALK_ERROR; 748| 0| } 749| 767| } 750| | 751| | // save the inode info for orphan finding - if requested 752| 1.29k| if ((a_dinfo->save_inum_named) && (fs_file->meta) ------------------ | Branch (752:13): [True: 1.19k, False: 104] | Branch (752:43): [True: 1.18k, False: 1] ------------------ 753| 1.29k| && (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)) { ------------------ | Branch (753:16): [True: 49, False: 1.14k] ------------------ 754| | 755| 49| if (tsk_list_add(&a_dinfo->list_inum_named, ------------------ | Branch (755:17): [True: 0, False: 49] ------------------ 756| 49| fs_file->meta->addr)) { 757| | 758| | // if there is an error, then clear the list 759| 0| tsk_list_free(a_dinfo->list_inum_named); 760| 0| a_dinfo->list_inum_named = NULL; 761| 0| a_dinfo->save_inum_named = 0; 762| 0| } 763| 49| } 764| | 765| | 766| | /* Optimization. If we are about to recurse into the 767| | * orphan directory and we are the last item in the 768| | * directory and the flag has been set to save inum_named, 769| | * then save inum_named now to FS_INFO so that we can use 770| | * it for the orphan folder. Otherwise, we do a full 771| | * inode walk again for nothing. */ 772| 1.29k| if ((fs_file->name->meta_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) && ------------------ | | 530| 1.29k| (fs_info->last_inum) ------------------ | Branch (772:13): [True: 1.08k, False: 210] ------------------ 773| 1.29k| (i == fs_dir->names_used-1) && ------------------ | Branch (773:13): [True: 1.08k, False: 0] ------------------ 774| 1.29k| (a_dinfo->save_inum_named == 1)) { ------------------ | Branch (774:13): [True: 1.06k, False: 16] ------------------ 775| 1.06k| save_inum_named(a_fs, a_dinfo); 776| 1.06k| a_dinfo->save_inum_named = 0; 777| 1.06k| } 778| | 779| | /* Recurse into a directory if: 780| | * - Both dir entry and inode have DIR type (or name is undefined) 781| | * - Recurse flag is set 782| | * - dir entry is allocated OR both are unallocated 783| | * - not one of the '.' or '..' entries 784| | * - A Non-Orphan Dir or the Orphan Dir with the NOORPHAN flag not set. 785| | */ 786| 1.29k| if ((TSK_FS_IS_DIR_NAME(fs_file->name->type) ------------------ | | 592| 2.58k| ((x == TSK_FS_NAME_TYPE_DIR) || (x == TSK_FS_NAME_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (592:6): [True: 68, False: 1.22k] | | | Branch (592:37): [True: 1.08k, False: 142] | | ------------------ ------------------ 787| 1.29k| || (fs_file->name->type == TSK_FS_NAME_TYPE_UNDEF)) ------------------ | Branch (787:20): [True: 142, False: 0] ------------------ 788| 1.29k| && (fs_file->meta) ------------------ | Branch (788:16): [True: 1.29k, False: 4] ------------------ 789| 1.29k| && (TSK_FS_IS_DIR_META(fs_file->meta->type)) ------------------ | | 414| 1.29k|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 68, False: 1.22k] | | | Branch (414:63): [True: 1.08k, False: 138] | | ------------------ ------------------ 790| 1.29k| && (a_flags & TSK_FS_DIR_WALK_FLAG_RECURSE) ------------------ | Branch (790:16): [True: 1.15k, False: 0] ------------------ 791| 1.29k| && ((fs_file->name->flags & TSK_FS_NAME_FLAG_ALLOC) ------------------ | Branch (791:17): [True: 1.15k, False: 0] ------------------ 792| 1.15k| || ((fs_file->name->flags & TSK_FS_NAME_FLAG_UNALLOC) ------------------ | Branch (792:21): [True: 0, False: 0] ------------------ 793| 0| && (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)) ------------------ | Branch (793:24): [True: 0, False: 0] ------------------ 794| 1.15k| ) 795| 1.29k| && (!TSK_FS_ISDOT(fs_file->name->name)) ------------------ | | 1179| 1.15k|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 1.15k] | | ------------------ | | 1180| 1.15k| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (795:16): [True: 1.15k, False: 0] ------------------ 796| 1.29k| && ((fs_file->name->meta_addr != TSK_FS_ORPHANDIR_INUM(a_fs)) ------------------ | | 530| 1.15k| (fs_info->last_inum) ------------------ | Branch (796:17): [True: 68, False: 1.08k] ------------------ 797| 1.15k| || ((a_flags & TSK_FS_DIR_WALK_FLAG_NOORPHAN) == 0)) ------------------ | Branch (797:20): [True: 557, False: 527] ------------------ 798| 1.29k| ) { 799| | 800| | /* Make sure we do not get into an infinite loop */ 801| 625| if (0 == tsk_stack_find(a_dinfo->stack_seen, ------------------ | Branch (801:17): [True: 603, False: 22] ------------------ 802| 625| fs_file->name->meta_addr)) { 803| 603| int depth_added = 0; 804| 603| uint8_t save_bak = 0; 805| | 806| 603| if (tsk_stack_push(a_dinfo->stack_seen, ------------------ | Branch (806:21): [True: 0, False: 603] ------------------ 807| 603| fs_file->name->meta_addr)) { 808| 0| tsk_fs_dir_close(fs_dir); 809| 0| fs_file->name = NULL; 810| 0| tsk_fs_file_close(fs_file); 811| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (811:25): [True: 0, False: 0] ------------------ 812| 0| free(indexToOrderedIndex); 813| 0| } 814| 0| return TSK_WALK_ERROR; 815| 0| } 816| | 817| | /* If we've exceeded the max depth or max length, don't 818| | * recurse any further into this directory 819| | * NOTE: We have two concepts of recursion detection in 820| | * here. This one is based on within a top-level call 821| | * to dir_walk. The macro_recursion_depth value allows 822| | * us to detect when file systems need to call dir_walk 823| | * to resolve things and they get into an infinite loop. 824| | * Perhaps they can be unified some day. 825| | */ 826| 603| if ((a_dinfo->depth >= MAX_DEPTH) || ------------------ | | 521| 603|#define MAX_DEPTH 128 ------------------ | Branch (826:21): [True: 0, False: 603] ------------------ 827| 603| (DIR_STRSZ <= ------------------ | | 522| 603|#define DIR_STRSZ 4096 ------------------ | Branch (827:21): [True: 0, False: 603] ------------------ 828| 603| strlen(a_dinfo->dirs) + 829| 603| strlen(fs_file->name->name))) { 830| 0| if (tsk_verbose) { ------------------ | Branch (830:25): [True: 0, False: 0] ------------------ 831| 0| tsk_fprintf(stdout, 832| 0| "tsk_fs_dir_walk_recursive: directory : %" 833| 0| PRIuINUM " exceeded max length / depth\n", fs_file->name->meta_addr); 834| 0| } 835| | 836| 0| tsk_fs_dir_close(fs_dir); 837| 0| fs_file->name = NULL; 838| 0| tsk_fs_file_close(fs_file); 839| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (839:25): [True: 0, False: 0] ------------------ 840| 0| free(indexToOrderedIndex); 841| 0| } 842| 0| return TSK_WALK_ERROR; 843| 0| } 844| | 845| 603| a_dinfo->didx[a_dinfo->depth] = 846| 603| &a_dinfo->dirs[strlen(a_dinfo->dirs)]; 847| 603| strncpy(a_dinfo->didx[a_dinfo->depth], 848| 603| fs_file->name->name, 849| 603| DIR_STRSZ - strlen(a_dinfo->dirs)); ------------------ | | 522| 603|#define DIR_STRSZ 4096 ------------------ 850| 603| strncat(a_dinfo->dirs, "/", DIR_STRSZ - strlen(a_dinfo->dirs) - 1); ------------------ | | 522| 603|#define DIR_STRSZ 4096 ------------------ 851| 603| depth_added = 1; 852| 603| a_dinfo->depth++; 853| | 854| | /* We do not want to save info about named unalloc files 855| | * when we go into the Orphan directory (because then we have 856| | * no orphans). So, disable it for this recursion. 857| | */ 858| 603| if (fs_file->name->meta_addr == ------------------ | Branch (858:21): [True: 557, False: 46] ------------------ 859| 603| TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 603| (fs_info->last_inum) ------------------ 860| 557| save_bak = a_dinfo->save_inum_named; 861| 557| a_dinfo->save_inum_named = 0; 862| 557| } 863| 603| retval = tsk_fs_dir_walk_recursive(a_fs, 864| 603| a_dinfo, fs_file->name->meta_addr, a_flags, 865| 603| a_action, a_ptr, macro_recursion_depth + 1); 866| 603| if (retval == TSK_WALK_ERROR) { ------------------ | Branch (866:21): [True: 587, False: 16] ------------------ 867| | /* In most cases we want to continue if a directory 868| | * did not load, but if we ran out 869| | * of memory we should stop */ 870| 587| if (tsk_error_get_errno() & TSK_ERR_AUX) { ------------------ | | 298| 587|#define TSK_ERR_AUX 0x01000000 ------------------ | Branch (870:25): [True: 0, False: 587] ------------------ 871| 0| tsk_fs_dir_close(fs_dir); 872| 0| fs_file->name = NULL; 873| 0| tsk_fs_file_close(fs_file); 874| | 875| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (875:29): [True: 0, False: 0] ------------------ 876| 0| free(indexToOrderedIndex); 877| 0| } 878| 0| return TSK_WALK_ERROR; 879| 0| } 880| | 881| 587| if (tsk_verbose) { ------------------ | Branch (881:25): [True: 0, False: 587] ------------------ 882| 0| tsk_fprintf(stderr, 883| 0| "tsk_fs_dir_walk_recursive: error reading directory: %" 884| 0| PRIuINUM "\n", fs_file->name->meta_addr); 885| 0| tsk_error_print(stderr); 886| 0| } 887| | 888| 587| tsk_error_reset(); 889| 587| } 890| 16| else if (retval == TSK_WALK_STOP) { ------------------ | Branch (890:26): [True: 0, False: 16] ------------------ 891| 0| tsk_fs_dir_close(fs_dir); 892| 0| fs_file->name = NULL; 893| 0| tsk_fs_file_close(fs_file); 894| | 895| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (895:25): [True: 0, False: 0] ------------------ 896| 0| free(indexToOrderedIndex); 897| 0| } 898| 0| return TSK_WALK_STOP; 899| 0| } 900| | 901| | // reset the save status 902| 603| if (fs_file->name->meta_addr == ------------------ | Branch (902:21): [True: 557, False: 46] ------------------ 903| 603| TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 603| (fs_info->last_inum) ------------------ 904| 557| a_dinfo->save_inum_named = save_bak; 905| 557| } 906| | 907| 603| tsk_stack_pop(a_dinfo->stack_seen); 908| 603| a_dinfo->depth--; 909| 603| if (depth_added) ------------------ | Branch (909:21): [True: 603, False: 0] ------------------ 910| 603| *a_dinfo->didx[a_dinfo->depth] = '\0'; 911| 603| } 912| 22| else { 913| 22| if (tsk_verbose) ------------------ | Branch (913:21): [True: 0, False: 22] ------------------ 914| 0| fprintf(stderr, 915| 0| "tsk_fs_dir_walk_recursive: Loop detected with address %" 916| 0| PRIuINUM, fs_file->name->meta_addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 917| 22| } 918| 625| } 919| | 920| | // remove the pointer to name buffer 921| 1.29k| fs_file->name = NULL; 922| | 923| | // free the metadata if we allocated it 924| 1.29k| if (fs_file->meta) { ------------------ | Branch (924:13): [True: 1.29k, False: 4] ------------------ 925| 1.29k| tsk_fs_meta_close(fs_file->meta); 926| 1.29k| fs_file->meta = NULL; 927| 1.29k| } 928| 1.29k| } 929| | 930| 2.14k| tsk_fs_dir_close(fs_dir); 931| 2.14k| fs_file->name = NULL; 932| 2.14k| tsk_fs_file_close(fs_file); 933| | 934| 2.14k| if (indexToOrderedIndex != NULL) { ------------------ | Branch (934:9): [True: 1.08k, False: 1.05k] ------------------ 935| 1.08k| free(indexToOrderedIndex); 936| 1.08k| } 937| 2.14k| return TSK_WALK_CONT; 938| 2.14k|} fs_dir.c:prioritizeDirNames: 583| 1.08k|prioritizeDirNames(TSK_FS_NAME * names, size_t count, int * indexToOrderedIndex) { 584| 1.08k| const int HIGH = 0; 585| 1.08k| const int MED = 1; 586| 1.08k| const int LOW = 2; 587| 1.08k| const int LAST = 3; 588| 1.08k| int * scores; 589| 1.08k| int currentScore; 590| 1.08k| size_t i; 591| | 592| 1.08k| scores = (int *)tsk_malloc(count * sizeof(int)); 593| 1.08k| if (scores == NULL) { ------------------ | Branch (593:9): [True: 0, False: 1.08k] ------------------ 594| 0| return TSK_ERR; 595| 0| } 596| | 597| | // Default level is medium for any files/folders that do not match one of the patterns below. 598| | // This includes the Program Files and Applications folders. 599| 2.37k| for (i = 0; i < count; i++) { ------------------ | Branch (599:17): [True: 1.29k, False: 1.08k] ------------------ 600| 1.29k| scores[i] = MED; 601| 1.29k| } 602| | 603| | // Get the score for each name. Currnetly all patterns match the beginning of the name. 604| 2.37k| for (i = 0; i < count; i++) { ------------------ | Branch (604:17): [True: 1.29k, False: 1.08k] ------------------ 605| 1.29k| TSK_FS_NAME* name = &(names[i]); 606| 1.29k| if (name->name != NULL) { ------------------ | Branch (606:13): [True: 1.29k, False: 0] ------------------ 607| 1.29k| if (0 == strncasecmp(name->name, "Users", strlen("Users"))) { ------------------ | Branch (607:17): [True: 0, False: 1.29k] ------------------ 608| 0| scores[i] = HIGH; 609| 0| } 610| 1.29k| else if (0 == strncasecmp(name->name, "Documents and Settings", strlen("Documents and Settings"))) { ------------------ | Branch (610:22): [True: 0, False: 1.29k] ------------------ 611| 0| scores[i] = HIGH; 612| 0| } 613| 1.29k| else if (0 == strncasecmp(name->name, "home", strlen("home"))) { ------------------ | Branch (613:22): [True: 30, False: 1.26k] ------------------ 614| 30| scores[i] = HIGH; 615| 30| } 616| 1.26k| else if (0 == strncasecmp(name->name, "ProgramData", strlen("ProgramData"))) { ------------------ | Branch (616:22): [True: 0, False: 1.26k] ------------------ 617| 0| scores[i] = HIGH; 618| 0| } 619| 1.26k| else if (0 == strncasecmp(name->name, "Windows", strlen("Windows"))) { ------------------ | Branch (619:22): [True: 0, False: 1.26k] ------------------ 620| 0| scores[i] = LOW; 621| 0| } 622| 1.26k| else if (0 == strncasecmp(name->name, "$Orphan", strlen("$Orphan"))) { ------------------ | Branch (622:22): [True: 1.08k, False: 180] ------------------ 623| 1.08k| scores[i] = LOW; 624| 1.08k| } 625| 180| else if (0 == strncasecmp(name->name, "pagefile", strlen("pagefile"))) { ------------------ | Branch (625:22): [True: 0, False: 180] ------------------ 626| 0| scores[i] = LAST; 627| 0| } 628| 180| else if (0 == strncasecmp(name->name, "hiberfil", strlen("hiberfil"))) { ------------------ | Branch (628:22): [True: 0, False: 180] ------------------ 629| 0| scores[i] = LAST; 630| 0| } 631| 1.29k| } 632| 1.29k| } 633| | 634| | // Order the name entries based on the scores 635| 1.08k| int orderedIndex = 0; 636| 5.42k| for (currentScore = HIGH; currentScore <= LAST; currentScore++) { ------------------ | Branch (636:31): [True: 4.33k, False: 1.08k] ------------------ 637| 9.51k| for (i = 0; i < count; i++) { ------------------ | Branch (637:21): [True: 5.17k, False: 4.33k] ------------------ 638| 5.17k| if (scores[i] == currentScore) { ------------------ | Branch (638:17): [True: 1.29k, False: 3.88k] ------------------ 639| 1.29k| indexToOrderedIndex[orderedIndex] = i; 640| 1.29k| orderedIndex++; 641| 1.29k| } 642| 5.17k| } 643| 4.33k| } 644| 1.08k| free(scores); 645| 1.08k| return TSK_OK; 646| 1.08k|} fs_dir.c:save_inum_named: 561| 1.06k|save_inum_named(TSK_FS_INFO *a_fs, DENT_DINFO *dinfo) { 562| | 563| | /* We finished the dir walk successfully, so reassign 564| | * ownership of the dinfo's list_inum_named to the shared 565| | * list_inum_named in TSK_FS_INFO, under a lock, if 566| | * another thread hasn't already done so. 567| | */ 568| 1.06k| tsk_take_lock(&a_fs->list_inum_named_lock); 569| 1.06k| if (a_fs->list_inum_named == NULL) { ------------------ | Branch (569:9): [True: 1.06k, False: 0] ------------------ 570| 1.06k| a_fs->list_inum_named = dinfo->list_inum_named; 571| 1.06k| } 572| 0| else { 573| 0| tsk_list_free(dinfo->list_inum_named); 574| 0| } 575| 1.06k| dinfo->list_inum_named = NULL; 576| 1.06k| tsk_release_lock(&a_fs->list_inum_named_lock); 577| 1.06k|} fs_dir.c:find_orphan_meta_walk_cb: 1251| 9.29k|{ 1252| 9.29k| FIND_ORPHAN_DATA *data = (FIND_ORPHAN_DATA *) a_ptr; 1253| 9.29k| TSK_FS_INFO *fs = a_fs_file->fs_info; 1254| | 1255| | /* We want only orphans, then check if this 1256| | * inode is in the seen list 1257| | */ 1258| 9.29k| tsk_take_lock(&fs->list_inum_named_lock); 1259| 9.29k| if ((fs->list_inum_named) ------------------ | Branch (1259:9): [True: 6.66k, False: 2.63k] ------------------ 1260| 9.29k| && (tsk_list_find(fs->list_inum_named, a_fs_file->meta->addr))) { ------------------ | Branch (1260:12): [True: 30, False: 6.63k] ------------------ 1261| 30| tsk_release_lock(&fs->list_inum_named_lock); 1262| 30| return TSK_WALK_CONT; 1263| 30| } 1264| 9.26k| tsk_release_lock(&fs->list_inum_named_lock); 1265| | 1266| | // check if we have already added it as an orphan (in a subdirectory) 1267| 9.26k| if (tsk_list_find(data->orphan_subdir_list, a_fs_file->meta->addr)) { ------------------ | Branch (1267:9): [True: 0, False: 9.26k] ------------------ 1268| 0| return TSK_WALK_CONT; 1269| 0| } 1270| | 1271| | // use their name if they have one 1272| 9.26k| if (a_fs_file->meta->name2 != NULL && ------------------ | Branch (1272:9): [True: 0, False: 9.26k] ------------------ 1273| 9.26k| strlen(a_fs_file->meta->name2->name) > 0) { ------------------ | Branch (1273:9): [True: 0, False: 0] ------------------ 1274| 0| strncpy(data->fs_name->name, a_fs_file->meta->name2->name, 1275| 0| data->fs_name->name_size); 1276| 0| } 1277| 9.26k| else { 1278| 9.26k| snprintf(data->fs_name->name, data->fs_name->name_size, 1279| 9.26k| "OrphanFile-%" PRIuINUM, a_fs_file->meta->addr); ------------------ | | 252| 9.26k|#define PRIuINUM PRIu64 ------------------ 1280| 9.26k| } 1281| 9.26k| data->fs_name->meta_addr = a_fs_file->meta->addr; 1282| | /* unalloc MFT entries have their sequence number incremented 1283| | * when they are unallocated. Decrement it in the file name so 1284| | * that it matches the typical situation where the name is one 1285| | * less. */ 1286| 9.26k| data->fs_name->meta_seq = a_fs_file->meta->seq - 1; 1287| 9.26k| data->fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 1288| 9.26k| data->fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 1289| | 1290| 9.26k| if (tsk_fs_dir_add(data->fs_dir, data->fs_name)) ------------------ | Branch (1290:9): [True: 0, False: 9.26k] ------------------ 1291| 0| return TSK_WALK_ERROR; 1292| | 1293| | /* FAT file systems spend a lot of time hunting for parent 1294| | * directory addresses, so we put this code in here to save 1295| | * the info when we have it. */ 1296| 9.26k| if (TSK_FS_TYPE_ISFAT(fs->ftype)) { ------------------ | | 843| 9.26k| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:5): [True: 0, False: 9.26k] | | | Branch (843:6): [True: 0, False: 9.26k] | | ------------------ ------------------ 1297| 0| if (fatfs_dir_buf_add((FATFS_INFO *) fs, ------------------ | Branch (1297:13): [True: 0, False: 0] ------------------ 1298| 0| TSK_FS_ORPHANDIR_INUM(fs), a_fs_file->meta->addr)) ------------------ | | 530| 0| (fs_info->last_inum) ------------------ 1299| 0| return TSK_WALK_ERROR; 1300| 0| } 1301| | 1302| | /* Go into directories to mark their contents as "seen" */ 1303| 9.26k| if (a_fs_file->meta->type == TSK_FS_META_TYPE_DIR) { ------------------ | Branch (1303:9): [True: 1.07k, False: 8.19k] ------------------ 1304| | 1305| 1.07k| if (tsk_verbose) ------------------ | Branch (1305:13): [True: 0, False: 1.07k] ------------------ 1306| 0| fprintf(stderr, 1307| 0| "find_orphan_meta_walk_cb: Going into directory %" PRIuINUM 1308| 0| " to mark contents as seen\n", a_fs_file->meta->addr); 1309| | 1310| 1.07k| if (tsk_fs_dir_walk_internal(fs, a_fs_file->meta->addr, ------------------ | Branch (1310:13): [True: 16, False: 1.05k] ------------------ 1311| 1.07k| TSK_FS_DIR_WALK_FLAG_UNALLOC | TSK_FS_DIR_WALK_FLAG_RECURSE 1312| 1.07k| | TSK_FS_DIR_WALK_FLAG_NOORPHAN, load_orphan_dir_walk_cb, 1313| 1.07k| data, 0)) { 1314| 16| tsk_error_errstr2_concat 1315| 16| (" - find_orphan_meta_walk_cb: identifying inodes allocated by file names"); 1316| 16| return TSK_WALK_ERROR; 1317| 16| } 1318| 1.07k| } 1319| | 1320| 9.25k| return TSK_WALK_CONT; 1321| 9.26k|} tsk_fs_file_alloc: 28| 7.71k|{ 29| 7.71k| TSK_FS_FILE *fs_file; 30| | 31| 7.71k| fs_file = (TSK_FS_FILE *) tsk_malloc(sizeof(TSK_FS_FILE)); 32| 7.71k| if (fs_file == NULL) ------------------ | Branch (32:9): [True: 0, False: 7.71k] ------------------ 33| 0| return NULL; 34| 7.71k| fs_file->fs_info = a_fs; 35| 7.71k| fs_file->tag = TSK_FS_FILE_TAG; ------------------ | | 687| 7.71k|#define TSK_FS_FILE_TAG 0x11212212 ------------------ 36| 7.71k| return fs_file; 37| 7.71k|} tsk_fs_file_close: 61| 7.71k|{ 62| 7.71k| if ((a_fs_file == NULL) || (a_fs_file->tag != TSK_FS_FILE_TAG)) ------------------ | | 687| 7.71k|#define TSK_FS_FILE_TAG 0x11212212 ------------------ | Branch (62:9): [True: 0, False: 7.71k] | Branch (62:32): [True: 0, False: 7.71k] ------------------ 63| 0| return; 64| | 65| 7.71k| a_fs_file->tag = 0; 66| | 67| 7.71k| if (a_fs_file->meta) { ------------------ | Branch (67:9): [True: 5.57k, False: 2.14k] ------------------ 68| 5.57k| tsk_fs_meta_close(a_fs_file->meta); 69| 5.57k| a_fs_file->meta = NULL; 70| 5.57k| } 71| 7.71k| if (a_fs_file->name) { ------------------ | Branch (71:9): [True: 0, False: 7.71k] ------------------ 72| 0| tsk_fs_name_free(a_fs_file->name); 73| 0| a_fs_file->name = NULL; 74| 0| } 75| | 76| 7.71k| free(a_fs_file); 77| 7.71k|} tsk_fs_file_open_meta: 101| 5.01k|{ 102| 5.01k| TSK_FS_FILE *fs_file; 103| | 104| 5.01k| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) { ------------------ | | 933| 5.01k|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (104:9): [True: 0, False: 5.01k] | Branch (104:27): [True: 0, False: 5.01k] ------------------ 105| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 106| 0| tsk_error_set_errstr 107| 0| ("tsk_fs_file_open_meta: called with NULL or unallocated structures"); 108| 0| return NULL; 109| 0| } 110| | 111| 5.01k| fs_file = a_fs_file; 112| 5.01k| if (fs_file == NULL) { ------------------ | Branch (112:9): [True: 5.01k, False: 0] ------------------ 113| 5.01k| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) ------------------ | Branch (113:13): [True: 0, False: 5.01k] ------------------ 114| 0| return NULL; 115| 5.01k| } 116| 0| else { 117| | /* if the structure passed has a name structure, free it 118| | * because we won't use it. */ 119| 0| if (fs_file->name) { ------------------ | Branch (119:13): [True: 0, False: 0] ------------------ 120| 0| tsk_fs_name_free(fs_file->name); 121| 0| fs_file->name = NULL; 122| 0| } 123| | 124| | // reset the rest of it 125| 0| tsk_fs_file_reset(fs_file); 126| 0| } 127| | 128| 5.01k| if (a_fs->file_add_meta(a_fs, fs_file, a_addr)) { ------------------ | Branch (128:9): [True: 2.82k, False: 2.19k] ------------------ 129| 2.82k| if (a_fs_file == NULL) ------------------ | Branch (129:13): [True: 2.82k, False: 0] ------------------ 130| 2.82k| tsk_fs_file_close(fs_file); 131| 2.82k| return NULL; 132| 2.82k| } 133| | 134| 2.19k| return fs_file; 135| 5.01k|} tsk_fs_file_attr_get: 283| 29.7k|{ 284| 29.7k| TSK_FS_ATTR_TYPE_ENUM type; 285| 29.7k| TSK_FS_INFO *fs; 286| | 287| 29.7k| if (tsk_fs_file_attr_check(a_fs_file, "tsk_fs_file_attr_get")) ------------------ | Branch (287:9): [True: 16, False: 29.7k] ------------------ 288| 16| return NULL; 289| | 290| | // since they did not give us a type, get the default for the file 291| 29.7k| fs = a_fs_file->fs_info; 292| 29.7k| type = fs->get_default_attr_type(a_fs_file); 293| | 294| 29.7k| return tsk_fs_attrlist_get(a_fs_file->meta->attr, type); 295| 29.7k|} tsk_fs_file_read: 525| 29.7k|{ 526| 29.7k| const TSK_FS_ATTR *fs_attr; 527| | 528| 29.7k| if ((a_fs_file == NULL) || (a_fs_file->fs_info == NULL)) { ------------------ | Branch (528:9): [True: 0, False: 29.7k] | Branch (528:32): [True: 0, False: 29.7k] ------------------ 529| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 530| 0| tsk_error_set_errstr("tsk_fs_file_read: fs_info is NULL"); 531| 0| return -1; 532| 0| } 533| | 534| 29.7k| if ((fs_attr = tsk_fs_file_attr_get(a_fs_file)) == NULL) { ------------------ | Branch (534:9): [True: 16, False: 29.7k] ------------------ 535| 16| return -1; 536| 16| } 537| | 538| 29.7k| return tsk_fs_attr_read(fs_attr, a_offset, a_buf, a_len, a_flags); 539| 29.7k|} fs_file.c:tsk_fs_file_attr_check: 209| 29.7k|{ 210| 29.7k| TSK_FS_INFO *fs; 211| | // check the FS_INFO, FS_FILE structures 212| 29.7k| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL) ------------------ | Branch (212:9): [True: 0, False: 29.7k] | Branch (212:32): [True: 0, False: 29.7k] ------------------ 213| 29.7k| || (a_fs_file->fs_info == NULL)) { ------------------ | Branch (213:12): [True: 0, False: 29.7k] ------------------ 214| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 215| 0| tsk_error_set_errstr("%s: called with NULL pointers", a_func); 216| 0| return 1; 217| 0| } 218| 29.7k| else if (a_fs_file->meta->tag != TSK_FS_META_TAG) { ------------------ | | 445| 29.7k|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (218:14): [True: 0, False: 29.7k] ------------------ 219| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 220| 0| tsk_error_set_errstr("%s: called with unallocated structures", 221| 0| a_func); 222| 0| return 1; 223| 0| } 224| 29.7k| fs = a_fs_file->fs_info; 225| | 226| | // If the attributes haven't been loaded, then load them. 227| 29.7k| if (a_fs_file->meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (227:9): [True: 0, False: 29.7k] ------------------ 228| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 229| 0| tsk_error_set_errstr("%s: called for file with corrupt data", 230| 0| a_func); 231| 0| return 1; 232| 0| } 233| 29.7k| else if ((a_fs_file->meta->attr_state != TSK_FS_META_ATTR_STUDIED) ------------------ | Branch (233:14): [True: 81, False: 29.6k] ------------------ 234| 29.7k| || (a_fs_file->meta->attr == NULL)) { ------------------ | Branch (234:12): [True: 0, False: 29.6k] ------------------ 235| 81| if (fs->load_attrs(a_fs_file)) { ------------------ | Branch (235:13): [True: 16, False: 65] ------------------ 236| 16| return 1; 237| 16| } 238| 81| } 239| 29.7k| return 0; 240| 29.7k|} tsk_fs_meta_alloc: 38| 6.86k|{ 39| 6.86k| TSK_FS_META *fs_meta; 40| | 41| 6.86k| if ((fs_meta = ------------------ | Branch (41:9): [True: 0, False: 6.86k] ------------------ 42| 6.86k| (TSK_FS_META *) tsk_malloc(sizeof(TSK_FS_META))) == NULL) 43| 0| return NULL; 44| | 45| 6.86k| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 46| | 47| 6.86k| if (a_buf_len > 0) { ------------------ | Branch (47:9): [True: 6.86k, False: 0] ------------------ 48| 6.86k| if ((fs_meta->content_ptr = tsk_malloc(a_buf_len)) == NULL) { ------------------ | Branch (48:13): [True: 0, False: 6.86k] ------------------ 49| 0| free(fs_meta); 50| 0| return NULL; 51| 0| } 52| 6.86k| fs_meta->content_len = a_buf_len; 53| 6.86k| fs_meta->reset_content = NULL; 54| 6.86k| } 55| | 56| | // assign the id so we know the structure is still alloc 57| 6.86k| fs_meta->tag = TSK_FS_META_TAG; ------------------ | | 445| 6.86k|#define TSK_FS_META_TAG 0x13524635 ------------------ 58| | 59| 6.86k| return fs_meta; 60| 6.86k|} tsk_fs_meta_close: 99| 6.86k|{ 100| 6.86k| TSK_FS_META_NAME_LIST *fs_name, *fs_name2; 101| | 102| 6.86k| if ((!fs_meta) || (fs_meta->tag != TSK_FS_META_TAG)) ------------------ | | 445| 6.86k|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (102:9): [True: 0, False: 6.86k] | Branch (102:23): [True: 0, False: 6.86k] ------------------ 103| 0| return; 104| | 105| | // clear the tag so we know the structure isn't alloc 106| 6.86k| fs_meta->tag = 0; 107| | 108| 6.86k| if (fs_meta->content_ptr) { ------------------ | Branch (108:9): [True: 6.86k, False: 0] ------------------ 109| 6.86k| if (fs_meta->reset_content) { ------------------ | Branch (109:13): [True: 0, False: 6.86k] ------------------ 110| 0| fs_meta->reset_content(fs_meta->content_ptr); 111| 0| } 112| | 113| 6.86k| free((char *) fs_meta->content_ptr); 114| 6.86k| } 115| | 116| 6.86k| fs_meta->content_ptr = NULL; 117| 6.86k| fs_meta->content_len = 0; 118| | 119| 6.86k| if (fs_meta->attr) ------------------ | Branch (119:9): [True: 1.67k, False: 5.18k] ------------------ 120| 1.67k| tsk_fs_attrlist_free(fs_meta->attr); 121| 6.86k| fs_meta->attr = NULL; 122| | 123| 6.86k| free(fs_meta->link); 124| 6.86k| fs_meta->link = NULL; 125| | 126| 6.86k| fs_name = fs_meta->name2; 127| 7.94k| while (fs_name) { ------------------ | Branch (127:12): [True: 1.08k, False: 6.86k] ------------------ 128| 1.08k| fs_name2 = fs_name->next; 129| 1.08k| fs_name->next = NULL; 130| 1.08k| free(fs_name); 131| 1.08k| fs_name = fs_name2; 132| 1.08k| } 133| | 134| 6.86k| free(fs_meta); 135| 6.86k|} tsk_fs_meta_walk: 210| 557|{ 211| 557| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) ------------------ | | 933| 557|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (211:9): [True: 0, False: 557] | Branch (211:27): [True: 0, False: 557] ------------------ 212| 0| return 1; 213| | 214| 557| return a_fs->inode_walk(a_fs, a_start, a_end, a_flags, a_cb, a_ptr); 215| 557|} tsk_fs_read: 91| 107k|{ 92| 107k| return tsk_fs_read_decrypt(a_fs, a_off, a_buf, a_len, 0); 93| 107k|} tsk_fs_read_decrypt: 107| 135k|{ 108| | // do a sanity check on the read bounds, but only if the block 109| | // value has been set. 110| | // note that this could prevent us from viewing the FS slack... 111| 135k| if ((a_fs->last_block_act > 0) ------------------ | Branch (111:9): [True: 10.2k, False: 125k] ------------------ 112| 135k| && ((TSK_DADDR_T) a_off >= ------------------ | Branch (112:12): [True: 3.35k, False: 6.86k] ------------------ 113| 10.2k| ((a_fs->last_block_act + 1) * a_fs->block_size))) { 114| 3.35k| tsk_error_reset(); 115| 3.35k| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 3.35k|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 3.35k|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 116| 3.35k| if ((TSK_DADDR_T) a_off < ------------------ | Branch (116:13): [True: 3.35k, False: 0] ------------------ 117| 3.35k| ((a_fs->last_block + 1) * a_fs->block_size)) 118| 3.35k| tsk_error_set_errstr 119| 3.35k| ("tsk_fs_read: Offset missing in partial image: %" 120| 3.35k| PRIuDADDR ")", a_off); 121| 0| else 122| 0| tsk_error_set_errstr 123| 0| ("tsk_fs_read: Offset is too large for image: %" PRIuDADDR 124| 0| ")", a_off); 125| 3.35k| return -1; 126| 3.35k| } 127| | 128| | // We need different logic for encrypted file systems 129| 132k| if ((a_fs->flags & TSK_FS_INFO_FLAG_ENCRYPTED) && a_fs->block_size) { ------------------ | Branch (129:9): [True: 0, False: 132k] | Branch (129:55): [True: 0, False: 0] ------------------ 130| | // If we're reading on block boundaries and a multiple of block 131| | // sizes, we can just decrypt directly to the buffer. 132| 0| if ((a_off % a_fs->block_size == 0) && (a_len % a_fs->block_size == 0)) { ------------------ | Branch (132:13): [True: 0, False: 0] | Branch (132:48): [True: 0, False: 0] ------------------ 133| 0| return tsk_fs_read_block_decrypt(a_fs, a_off / a_fs->block_size, a_buf, a_len, crypto_id); 134| 0| } 135| | 136| | // Since we can only decrypt on block boundaries, we'll need to 137| | // decrypt the blocks and then copy to the output buffer. 138| | 139| | // Starting address needs to be aligned by block size; 140| 0| TSK_OFF_T bit_magic = a_fs->block_size - 1; 141| 0| TSK_OFF_T start = a_off & ~bit_magic; 142| | 143| | // Ending address needs to be rounded up to the nearest 144| | // block boundary. 145| 0| TSK_OFF_T end = (a_off + a_len + bit_magic) & ~bit_magic; 146| 0| TSK_OFF_T len = end - start; 147| | 148| | // Decrypt the blocks to a temp buffer 149| 0| char * temp_buffer = tsk_malloc(len); 150| 0| if (temp_buffer == NULL) { ------------------ | Branch (150:13): [True: 0, False: 0] ------------------ 151| 0| return -1; 152| 0| } 153| | 154| 0| if (tsk_fs_read_block_decrypt(a_fs, start / a_fs->block_size, temp_buffer, ------------------ | Branch (154:13): [True: 0, False: 0] ------------------ 155| 0| len, crypto_id) != len) { 156| 0| free(temp_buffer); 157| 0| return -1; 158| 0| } 159| | 160| | // Copy the decrypted data 161| 0| memcpy(a_buf, temp_buffer + a_off - start, a_len); 162| | 163| 0| free(temp_buffer); 164| | 165| 0| return a_len; 166| 0| } 167| | 168| 132k| if (((a_fs->block_pre_size) || (a_fs->block_post_size)) ------------------ | Branch (168:10): [True: 0, False: 132k] | Branch (168:36): [True: 0, False: 132k] ------------------ 169| 132k| && (a_fs->block_size)) { ------------------ | Branch (169:12): [True: 0, False: 0] ------------------ 170| 0| return fs_prepost_read(a_fs, a_off, a_buf, a_len); 171| 0| } 172| 132k| else { 173| 132k| return tsk_img_read(a_fs->img_info, a_off + a_fs->offset, a_buf, 174| 132k| a_len); 175| 132k| } 176| 132k|} tsk_fs_read_block: 193| 60|{ 194| 60| return tsk_fs_read_block_decrypt(a_fs, a_addr, a_buf, a_len, 0); 195| 60|} tsk_fs_read_block_decrypt: 213| 60|{ 214| 60| if (a_len % a_fs->block_size) { ------------------ | Branch (214:9): [True: 0, False: 60] ------------------ 215| 0| tsk_error_reset(); 216| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 217| 0| tsk_error_set_errstr("tsk_fs_read_block: length %" PRIuSIZE "" 218| 0| " not a multiple of %d", a_len, a_fs->block_size); 219| 0| return -1; 220| 0| } 221| | 222| 60| if (a_addr > a_fs->last_block_act) { ------------------ | Branch (222:9): [True: 0, False: 60] ------------------ 223| 0| tsk_error_reset(); 224| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 225| 0| if (a_addr <= a_fs->last_block) ------------------ | Branch (225:13): [True: 0, False: 0] ------------------ 226| 0| tsk_error_set_errstr 227| 0| ("tsk_fs_read_block: Address missing in partial image: %" 228| 0| PRIuDADDR ")", a_addr); 229| 0| else 230| 0| tsk_error_set_errstr 231| 0| ("tsk_fs_read_block: Address is too large for image: %" 232| 0| PRIuDADDR ")", a_addr); 233| 0| return -1; 234| 0| } 235| | 236| 60| ssize_t ret_len; 237| | 238| 60| if ((a_fs->block_pre_size == 0) && (a_fs->block_post_size == 0)) { ------------------ | Branch (238:9): [True: 60, False: 0] | Branch (238:40): [True: 60, False: 0] ------------------ 239| 60| TSK_OFF_T off = 240| 60| a_fs->offset + (TSK_OFF_T) (a_addr) * a_fs->block_size; 241| 60| ret_len = tsk_img_read(a_fs->img_info, off, a_buf, a_len); 242| 60| } 243| 0| else { 244| 0| TSK_OFF_T off = (TSK_OFF_T) (a_addr) * a_fs->block_size; 245| 0| ret_len = fs_prepost_read(a_fs, off, a_buf, a_len); 246| 0| } 247| | 248| 60| if ((a_fs->flags & TSK_FS_INFO_FLAG_ENCRYPTED) ------------------ | Branch (248:9): [True: 0, False: 60] ------------------ 249| 60| && ret_len > 0 ------------------ | Branch (249:12): [True: 0, False: 0] ------------------ 250| 60| && a_fs->decrypt_block) { ------------------ | Branch (250:12): [True: 0, False: 0] ------------------ 251| 0| TSK_DADDR_T i; 252| 0| for (i = 0; i < a_len / a_fs->block_size; i++) { ------------------ | Branch (252:21): [True: 0, False: 0] ------------------ 253| 0| a_fs->decrypt_block(a_fs, crypto_id + i, 254| 0| a_buf + (a_fs->block_size * i)); 255| 0| } 256| 0| } 257| | 258| 60| return ret_len; 259| 60|} tsk_fs_name_alloc: 44| 31.3k|{ 45| 31.3k| TSK_FS_NAME *fs_name; 46| 31.3k| fs_name = (TSK_FS_NAME *) tsk_malloc(sizeof(*fs_name)); 47| 31.3k| if (fs_name == NULL) ------------------ | Branch (47:9): [True: 0, False: 31.3k] ------------------ 48| 0| return NULL; 49| | 50| 31.3k| fs_name->name = (char *) tsk_malloc(norm_namelen + 1); 51| 31.3k| if (fs_name->name == NULL) { ------------------ | Branch (51:9): [True: 0, False: 31.3k] ------------------ 52| 0| free(fs_name); 53| 0| return NULL; 54| 0| } 55| 31.3k| fs_name->name_size = norm_namelen; 56| | 57| 31.3k| fs_name->flags = 0; 58| | 59| 31.3k| fs_name->shrt_name_size = shrt_namelen; 60| 31.3k| if (shrt_namelen == 0) { ------------------ | Branch (60:9): [True: 31.3k, False: 0] ------------------ 61| 31.3k| fs_name->shrt_name = NULL; 62| 31.3k| } 63| 0| else { 64| 0| fs_name->shrt_name = (char *) tsk_malloc(shrt_namelen + 1); 65| 0| if (fs_name->shrt_name == NULL) { ------------------ | Branch (65:13): [True: 0, False: 0] ------------------ 66| 0| free(fs_name->name); 67| 0| free(fs_name); 68| 0| return NULL; 69| 0| } 70| 0| } 71| | 72| 31.3k| fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 73| 31.3k| fs_name->tag = TSK_FS_NAME_TAG; ------------------ | | 594| 31.3k|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 74| 31.3k| return fs_name; 75| 31.3k|} tsk_fs_name_free: 130| 31.3k|{ 131| 31.3k| if ((!fs_name) || (fs_name->tag != TSK_FS_NAME_TAG)) ------------------ | | 594| 31.3k|#define TSK_FS_NAME_TAG 0x23147869 ------------------ | Branch (131:9): [True: 0, False: 31.3k] | Branch (131:23): [True: 0, False: 31.3k] ------------------ 132| 0| return; 133| | 134| 31.3k| free(fs_name->name); 135| 31.3k| fs_name->name = NULL; 136| | 137| 31.3k| free(fs_name->shrt_name); 138| 31.3k| fs_name->shrt_name = NULL; 139| | 140| 31.3k| free(fs_name); 141| 31.3k|} tsk_fs_name_copy: 153| 13.7k|{ 154| 13.7k| if ((a_fs_name_to == NULL) || (a_fs_name_from == NULL)) ------------------ | Branch (154:9): [True: 0, False: 13.7k] | Branch (154:35): [True: 0, False: 13.7k] ------------------ 155| 0| return 1; 156| | 157| | /* If the source has a full name, copy it */ 158| 13.7k| if (a_fs_name_from->name) { ------------------ | Branch (158:9): [True: 13.7k, False: 0] ------------------ 159| 13.7k| size_t name_len = strlen(a_fs_name_from->name); 160| | 161| | // make sure there is enough space 162| 13.7k| if (name_len >= a_fs_name_to->name_size) { ------------------ | Branch (162:13): [True: 13.7k, False: 0] ------------------ 163| 13.7k| char * to_name = 164| 13.7k| (char *) tsk_realloc(a_fs_name_to->name, 165| 13.7k| name_len + 16); 166| 13.7k| if (to_name == NULL) ------------------ | Branch (166:17): [True: 0, False: 13.7k] ------------------ 167| 0| return 1; 168| | 169| 13.7k| a_fs_name_to->name = to_name; 170| 13.7k| a_fs_name_to->name_size = name_len + 16; 171| 13.7k| } 172| 13.7k| strncpy(a_fs_name_to->name, a_fs_name_from->name, 173| 13.7k| name_len); 174| 13.7k| a_fs_name_to->name[name_len] = 0; 175| 13.7k| } 176| 0| else { 177| 0| if (a_fs_name_to->name_size > 0) ------------------ | Branch (177:13): [True: 0, False: 0] ------------------ 178| 0| a_fs_name_to->name[0] = '\0'; 179| 0| else 180| 0| a_fs_name_to->name = NULL; 181| 0| } 182| | 183| | // copy the short name, if one exists 184| 13.7k| if (a_fs_name_from->shrt_name) { ------------------ | Branch (184:9): [True: 0, False: 13.7k] ------------------ 185| 0| if (strlen(a_fs_name_from->shrt_name) >= ------------------ | Branch (185:13): [True: 0, False: 0] ------------------ 186| 0| a_fs_name_to->shrt_name_size) { 187| 0| a_fs_name_to->shrt_name_size = 188| 0| strlen(a_fs_name_from->shrt_name) + 16; 189| 0| a_fs_name_to->shrt_name = 190| 0| (char *) tsk_realloc(a_fs_name_to->shrt_name, 191| 0| a_fs_name_to->shrt_name_size); 192| 0| if (a_fs_name_to->shrt_name == NULL) ------------------ | Branch (192:17): [True: 0, False: 0] ------------------ 193| 0| return 1; 194| 0| } 195| 0| strncpy(a_fs_name_to->shrt_name, a_fs_name_from->shrt_name, 196| 0| a_fs_name_to->shrt_name_size); 197| 0| } 198| 13.7k| else { 199| 13.7k| if (a_fs_name_to->shrt_name_size > 0) ------------------ | Branch (199:13): [True: 0, False: 13.7k] ------------------ 200| 0| a_fs_name_to->shrt_name[0] = '\0'; 201| 13.7k| else 202| 13.7k| a_fs_name_to->shrt_name = NULL; 203| 13.7k| } 204| | 205| 13.7k| a_fs_name_to->meta_addr = a_fs_name_from->meta_addr; 206| 13.7k| a_fs_name_to->meta_seq = a_fs_name_from->meta_seq; 207| 13.7k| a_fs_name_to->par_addr = a_fs_name_from->par_addr; 208| 13.7k| a_fs_name_to->par_seq = a_fs_name_from->par_seq; 209| 13.7k| a_fs_name_to->type = a_fs_name_from->type; 210| 13.7k| a_fs_name_to->flags = a_fs_name_from->flags; 211| 13.7k| a_fs_name_to->date_added = a_fs_name_from->date_added; 212| | 213| 13.7k| return 0; 214| 13.7k|} tsk_fs_open_img: 108| 3.41k|{ 109| 3.41k| return tsk_fs_open_img_decrypt(a_img_info, a_offset, a_ftype, ""); 110| 3.41k|} tsk_fs_open_img_decrypt: 128| 3.41k|{ 129| 3.41k| TSK_FS_INFO *fs_info; 130| | 131| 3.41k| const struct { 132| 3.41k| char* name; 133| 3.41k| TSK_FS_INFO* (*open)(TSK_IMG_INFO*, TSK_OFF_T, 134| 3.41k| TSK_FS_TYPE_ENUM, uint8_t); 135| | // This type should be the _DETECT version because it used 136| | // during autodetection 137| 3.41k| TSK_FS_TYPE_ENUM type; 138| 3.41k| } FS_OPENERS[] = { 139| 3.41k| { "NTFS", ntfs_open, TSK_FS_TYPE_NTFS_DETECT }, 140| 3.41k| { "FAT", fatfs_open, TSK_FS_TYPE_FAT_DETECT }, 141| 3.41k| { "EXT2/3/4", ext2fs_open, TSK_FS_TYPE_EXT_DETECT }, 142| 3.41k| { "UFS", ffs_open, TSK_FS_TYPE_FFS_DETECT }, 143| 3.41k| { "YAFFS2", yaffs2_open, TSK_FS_TYPE_YAFFS2_DETECT }, 144| 3.41k|#if TSK_USE_HFS 145| 3.41k| { "HFS", hfs_open, TSK_FS_TYPE_HFS_DETECT }, 146| 3.41k|#endif 147| 3.41k| { "ISO9660", iso9660_open, TSK_FS_TYPE_ISO9660_DETECT }, 148| 3.41k| { "APFS", apfs_open_auto_detect, TSK_FS_TYPE_APFS_DETECT } 149| 3.41k| }; 150| 3.41k| if (a_img_info == NULL) { ------------------ | Branch (150:9): [True: 0, False: 3.41k] ------------------ 151| 0| tsk_error_reset(); 152| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 153| 0| tsk_error_set_errstr("tsk_fs_open_img: Null image handle"); 154| 0| return NULL; 155| 0| } 156| | 157| | /* If the image is type IMG_DIR_INFO, then the file system is 158| | * automatically the logical directory file system type. It is an 159| | * error to try to use any other file system type in that case. 160| | */ 161| 3.41k| if (a_img_info->itype == TSK_IMG_TYPE_LOGICAL) { ------------------ | Branch (161:6): [True: 0, False: 3.41k] ------------------ 162| 0| if (!(a_ftype == TSK_FS_TYPE_DETECT || a_ftype == TSK_FS_TYPE_LOGICAL)) { ------------------ | Branch (162:9): [True: 0, False: 0] | Branch (162:42): [True: 0, False: 0] ------------------ 163| 0| tsk_error_reset(); 164| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 165| 0| tsk_error_set_errstr("tsk_fs_open_img: Incompatable file system type given for logical file image"); 166| 0| return NULL; 167| 0| } 168| | 169| 0| return logical_fs_open(a_img_info); 170| 0| } 171| | 172| | /* We will try different file systems ... 173| | * We need to try all of them in case more than one matches 174| | */ 175| 3.41k| if (a_ftype == TSK_FS_TYPE_DETECT) { ------------------ | Branch (175:9): [True: 0, False: 3.41k] ------------------ 176| 0| unsigned long i; 177| 0| const char *name_first = ""; 178| 0| TSK_FS_INFO *fs_first = NULL; 179| | 180| 0| if (tsk_verbose) ------------------ | Branch (180:13): [True: 0, False: 0] ------------------ 181| 0| tsk_fprintf(stderr, 182| 0| "fsopen: Auto detection mode at offset %" PRIdOFF "\n", 183| 0| a_offset); 184| | 185| 0| for (i = 0; i < sizeof(FS_OPENERS)/sizeof(FS_OPENERS[0]); ++i) { ------------------ | Branch (185:21): [True: 0, False: 0] ------------------ 186| 0| if ((fs_info = FS_OPENERS[i].open( ------------------ | Branch (186:17): [True: 0, False: 0] ------------------ 187| 0| a_img_info, a_offset, FS_OPENERS[i].type, 1)) != NULL) { 188| | // fs opens as type i 189| 0| if (fs_first == NULL) { ------------------ | Branch (189:21): [True: 0, False: 0] ------------------ 190| | // first success opening fs 191| 0| name_first = FS_OPENERS[i].name; 192| 0| fs_first = fs_info; 193| 0| } 194| 0| else { 195| | // second success opening fs, which means we 196| | // cannot autodetect the fs type and must give up 197| 0| fs_first->close(fs_first); 198| 0| fs_info->close(fs_info); 199| 0| tsk_error_reset(); 200| 0| tsk_error_set_errno(TSK_ERR_FS_MULTTYPE); ------------------ | | 365| 0|#define TSK_ERR_FS_MULTTYPE (TSK_ERR_FS | 20) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 201| 0| tsk_error_set_errstr( 202| 0| "%s or %s", FS_OPENERS[i].name, name_first); 203| 0| return NULL; 204| 0| } 205| 0| } 206| 0| else { 207| | // fs does not open as type i 208| 0| tsk_error_reset(); 209| 0| } 210| 0| } 211| | 212| 0| if (fs_first == NULL) { ------------------ | Branch (212:13): [True: 0, False: 0] ------------------ 213| 0| tsk_error_reset(); 214| | 215| | // If we're still at the start of the image and haven't identified any volume systems or file 216| | // systems, check if the image type is a known unsupported type. 217| 0| int unsupportedSignatureFound = 0; 218| 0| if (a_offset == 0) { ------------------ | Branch (218:17): [True: 0, False: 0] ------------------ 219| 0| char * imageType = detectUnsupportedImageType(a_img_info); 220| 0| if (imageType != NULL) { ------------------ | Branch (220:21): [True: 0, False: 0] ------------------ 221| 0| unsupportedSignatureFound = 1; 222| 0| tsk_error_reset(); 223| 0| tsk_error_set_errno(TSK_ERR_IMG_UNSUPTYPE); ------------------ | | 314| 0|#define TSK_ERR_IMG_UNSUPTYPE (TSK_ERR_IMG | 3) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 224| 0| tsk_error_set_errstr("%s", imageType); 225| 0| free(imageType); 226| 0| } 227| 0| } 228| | 229| 0| if (!unsupportedSignatureFound) { ------------------ | Branch (229:17): [True: 0, False: 0] ------------------ 230| | // Check if the file system appears to be encrypted 231| 0| encryption_detected_result* result = detectVolumeEncryption(a_img_info, a_offset); 232| 0| if (result != NULL) { ------------------ | Branch (232:21): [True: 0, False: 0] ------------------ 233| 0| if (result->encryptionType == ENCRYPTION_DETECTED_SIGNATURE) { ------------------ | Branch (233:25): [True: 0, False: 0] ------------------ 234| 0| tsk_error_set_errno(TSK_ERR_FS_ENCRYPTED); ------------------ | | 363| 0|#define TSK_ERR_FS_ENCRYPTED (TSK_ERR_FS | 18) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 235| 0| tsk_error_set_errstr("%s", result->desc); 236| 0| } 237| 0| else if (result->encryptionType == ENCRYPTION_DETECTED_ENTROPY) { ------------------ | Branch (237:30): [True: 0, False: 0] ------------------ 238| 0| tsk_error_set_errno(TSK_ERR_FS_POSSIBLY_ENCRYPTED); ------------------ | | 364| 0|#define TSK_ERR_FS_POSSIBLY_ENCRYPTED (TSK_ERR_FS | 19) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 239| 0| tsk_error_set_errstr("%s", result->desc); 240| 0| } 241| 0| else { 242| 0| tsk_error_set_errno(TSK_ERR_FS_UNKTYPE); ------------------ | | 345| 0|#define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| } 244| 0| free(result); 245| 0| result = NULL; 246| 0| } 247| 0| else { 248| 0| tsk_error_set_errno(TSK_ERR_FS_UNKTYPE); ------------------ | | 345| 0|#define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 249| 0| } 250| 0| } 251| 0| } 252| 0| return fs_first; 253| 0| } 254| 3.41k| else if (TSK_FS_TYPE_ISNTFS(a_ftype)) { ------------------ | | 836| 3.41k| (((ftype) & TSK_FS_TYPE_NTFS_DETECT)?1:0) | | ------------------ | | | Branch (836:5): [True: 0, False: 3.41k] | | | Branch (836:6): [True: 0, False: 3.41k] | | ------------------ ------------------ 255| 0| return ntfs_open(a_img_info, a_offset, a_ftype, 0); 256| 0| } 257| 3.41k| else if (TSK_FS_TYPE_ISFAT(a_ftype)) { ------------------ | | 843| 3.41k| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:5): [True: 0, False: 3.41k] | | | Branch (843:6): [True: 0, False: 3.41k] | | ------------------ ------------------ 258| 0| return fatfs_open(a_img_info, a_offset, a_ftype, 0); 259| 0| } 260| 3.41k| else if (TSK_FS_TYPE_ISFFS(a_ftype)) { ------------------ | | 850| 3.41k| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:5): [True: 0, False: 3.41k] | | | Branch (850:6): [True: 0, False: 3.41k] | | ------------------ ------------------ 261| 0| return ffs_open(a_img_info, a_offset, a_ftype, 0); 262| 0| } 263| 3.41k| else if (TSK_FS_TYPE_ISEXT(a_ftype)) { ------------------ | | 857| 3.41k| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:5): [True: 3.41k, False: 0] | | | Branch (857:6): [True: 3.41k, False: 0] | | ------------------ ------------------ 264| 3.41k| return ext2fs_open(a_img_info, a_offset, a_ftype, 0); 265| 3.41k| } 266| 0| else if (TSK_FS_TYPE_ISHFS(a_ftype)) { ------------------ | | 871| 0| (((ftype) & TSK_FS_TYPE_HFS_DETECT)?1:0) | | ------------------ | | | Branch (871:5): [True: 0, False: 0] | | | Branch (871:6): [True: 0, False: 0] | | ------------------ ------------------ 267| 0| return hfs_open(a_img_info, a_offset, a_ftype, 0); 268| 0| } 269| 0| else if (TSK_FS_TYPE_ISISO9660(a_ftype)) { ------------------ | | 864| 0| (((ftype) & TSK_FS_TYPE_ISO9660_DETECT)?1:0) | | ------------------ | | | Branch (864:5): [True: 0, False: 0] | | | Branch (864:6): [True: 0, False: 0] | | ------------------ ------------------ 270| 0| return iso9660_open(a_img_info, a_offset, a_ftype, 0); 271| 0| } 272| 0| else if (TSK_FS_TYPE_ISRAW(a_ftype)) { ------------------ | | 899| 0| (((ftype) & TSK_FS_TYPE_RAW_DETECT)?1:0) | | ------------------ | | | Branch (899:5): [True: 0, False: 0] | | | Branch (899:6): [True: 0, False: 0] | | ------------------ ------------------ 273| 0| return rawfs_open(a_img_info, a_offset); 274| 0| } 275| 0| else if (TSK_FS_TYPE_ISSWAP(a_ftype)) { ------------------ | | 878| 0| (((ftype) & TSK_FS_TYPE_SWAP_DETECT)?1:0) | | ------------------ | | | Branch (878:5): [True: 0, False: 0] | | | Branch (878:6): [True: 0, False: 0] | | ------------------ ------------------ 276| 0| return swapfs_open(a_img_info, a_offset); 277| 0| } 278| 0| else if (TSK_FS_TYPE_ISYAFFS2(a_ftype)) { ------------------ | | 885| 0| (((ftype) & TSK_FS_TYPE_YAFFS2_DETECT)?1:0) | | ------------------ | | | Branch (885:5): [True: 0, False: 0] | | | Branch (885:6): [True: 0, False: 0] | | ------------------ ------------------ 279| 0| return yaffs2_open(a_img_info, a_offset, a_ftype, 0); 280| 0| } 281| 0| else if (TSK_FS_TYPE_ISAPFS(a_ftype)) { ------------------ | | 906| 0| (((ftype) & TSK_FS_TYPE_APFS_DETECT)?1:0) | | ------------------ | | | Branch (906:5): [True: 0, False: 0] | | | Branch (906:6): [True: 0, False: 0] | | ------------------ ------------------ 282| 0| return apfs_open(a_img_info, a_offset, a_ftype, a_pass); 283| 0| } 284| 0| tsk_error_reset(); 285| 0| tsk_error_set_errno(TSK_ERR_FS_UNSUPTYPE); ------------------ | | 346| 0|#define TSK_ERR_FS_UNSUPTYPE (TSK_ERR_FS | 1) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 286| 0| tsk_error_set_errstr("%X", (int) a_ftype); 287| 0| return NULL; 288| 3.41k|} tsk_fs_malloc: 311| 3.41k|{ 312| 3.41k| TSK_FS_INFO *fs_info; 313| 3.41k| if ((fs_info = (TSK_FS_INFO *) tsk_malloc(a_len)) == NULL) ------------------ | Branch (313:9): [True: 0, False: 3.41k] ------------------ 314| 0| return NULL; 315| 3.41k| tsk_init_lock(&fs_info->list_inum_named_lock); 316| 3.41k| tsk_init_lock(&fs_info->orphan_dir_lock); 317| | 318| 3.41k| fs_info->list_inum_named = NULL; 319| | 320| 3.41k| return fs_info; 321| 3.41k|} tsk_fs_free: 328| 3.41k|{ 329| 3.41k| if (a_fs_info->list_inum_named) { ------------------ | Branch (329:9): [True: 14, False: 3.39k] ------------------ 330| 14| tsk_list_free(a_fs_info->list_inum_named); 331| 14| a_fs_info->list_inum_named = NULL; 332| 14| } 333| | 334| | /* we should probably get the lock, but we're 335| | * about to kill the entire object so there are 336| | * bigger problems if another thread is still 337| | * using the fs */ 338| 3.41k| if (a_fs_info->orphan_dir) { ------------------ | Branch (338:9): [True: 0, False: 3.41k] ------------------ 339| 0| tsk_fs_dir_close(a_fs_info->orphan_dir); 340| 0| a_fs_info->orphan_dir = NULL; 341| 0| } 342| | 343| | 344| 3.41k| tsk_deinit_lock(&a_fs_info->list_inum_named_lock); 345| 3.41k| tsk_deinit_lock(&a_fs_info->orphan_dir_lock); 346| | 347| 3.41k| free(a_fs_info); 348| 3.41k|} tsk_fs_unix_make_data_run: 251| 49|{ 252| 49| TSK_OFF_T length = 0; 253| 49| TSK_OFF_T read_b = 0; 254| 49| TSK_FS_ATTR *fs_attr; 255| 49| TSK_FS_META *fs_meta = fs_file->meta; 256| 49| TSK_FS_INFO *fs = fs_file->fs_info; 257| | 258| | // clean up any error messages that are lying around 259| 49| tsk_error_reset(); 260| | 261| 49| if (tsk_verbose) ------------------ | Branch (261:9): [True: 0, False: 49] ------------------ 262| 0| tsk_fprintf(stderr, 263| 0| "unix_make_data_run: Processing file %" PRIuINUM "\n", 264| 0| fs_meta->addr); 265| | 266| | // see if we have already loaded the runs 267| 49| if ((fs_meta->attr != NULL) ------------------ | Branch (267:9): [True: 0, False: 49] ------------------ 268| 49| && (fs_meta->attr_state == TSK_FS_META_ATTR_STUDIED)) { ------------------ | Branch (268:12): [True: 0, False: 0] ------------------ 269| 0| return 0; 270| 0| } 271| 49| if (fs_meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (271:9): [True: 0, False: 49] ------------------ 272| 0| return 1; 273| 0| } 274| | 275| | // not sure why this would ever happen, but... 276| 49| if (fs_meta->attr != NULL) { ------------------ | Branch (276:9): [True: 0, False: 49] ------------------ 277| 0| tsk_fs_attrlist_markunused(fs_meta->attr); 278| 0| } 279| 49| else { 280| 49| fs_meta->attr = tsk_fs_attrlist_alloc(); 281| 49| } 282| | 283| 49| if ((TSK_FS_TYPE_ISFFS(fs->ftype) == 0) ------------------ | | 850| 49| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:6): [True: 0, False: 49] | | ------------------ ------------------ | Branch (283:9): [True: 49, False: 0] ------------------ 284| 49| && (TSK_FS_TYPE_ISEXT(fs->ftype) == 0)) { ------------------ | | 857| 49| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:6): [True: 49, False: 0] | | ------------------ ------------------ | Branch (284:12): [True: 0, False: 49] ------------------ 285| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 286| 0| tsk_error_set_errstr 287| 0| ("unix_make_run: Called with non-Unix file system: %x", 288| 0| fs->ftype); 289| 0| return 1; 290| 0| } 291| | 292| 49| length = roundup(fs_meta->size, fs->block_size); 293| | 294| 49| if ((fs_attr = ------------------ | Branch (294:9): [True: 0, False: 49] ------------------ 295| 49| tsk_fs_attrlist_getnew(fs_meta->attr, 296| 49| TSK_FS_ATTR_NONRES)) == NULL) { 297| 0| return 1; 298| 0| } 299| | 300| | // initialize the data run 301| 49| if (tsk_fs_attr_set_run(fs_file, fs_attr, NULL, NULL, ------------------ | Branch (301:9): [True: 0, False: 49] ------------------ 302| 49| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 49|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 303| 49| fs_meta->size, fs_meta->size, roundup(fs_meta->size, 304| 49| fs->block_size), 0, 0)) { 305| 0| return 1; 306| 0| } 307| | 308| 49| read_b = 309| 49| unix_make_data_run_direct(fs, fs_attr, 310| 49| (TSK_DADDR_T *) fs_meta->content_ptr, 12, length); 311| 49| if (read_b == -1) { ------------------ | Branch (311:9): [True: 0, False: 49] ------------------ 312| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 313| 0| if (fs_meta->flags & TSK_FS_META_FLAG_UNALLOC) ------------------ | Branch (313:13): [True: 0, False: 0] ------------------ 314| 0| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 0|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 315| 0| return 1; 316| 0| } 317| 49| length -= read_b; 318| | 319| | /* if there is still data left, read the indirect */ 320| 49| if (length > 0) { ------------------ | Branch (320:9): [True: 14, False: 35] ------------------ 321| 14| int level; 322| 14| char *buf[4] = {NULL}; 323| 14| size_t fs_bufsize0; 324| 14| size_t fs_bufsize1; 325| 14| size_t ptrsperblock; 326| 14| int numBlocks = 0; 327| 14| int numSingIndirect = 0; 328| 14| int numDblIndirect = 0; 329| 14| int numTripIndirect = 0; 330| 14| TSK_FS_ATTR *fs_attr_indir; 331| | 332| | 333| | /* With FFS/UFS a full block contains the addresses, but block_size is 334| | * only a fragment. Figure out the scratch buffer size and the buffers to 335| | * store the cleaned addresses (endian converted) */ 336| 14| if (TSK_FS_TYPE_ISFFS(fs->ftype)) { ------------------ | | 850| 14| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:5): [True: 0, False: 14] | | | Branch (850:6): [True: 0, False: 14] | | ------------------ ------------------ 337| 0| FFS_INFO *ffs = (FFS_INFO *) fs; 338| | 339| 0| fs_bufsize0 = ffs->ffsbsize_b; 340| 0| if ((fs->ftype == TSK_FS_TYPE_FFS1) ------------------ | Branch (340:17): [True: 0, False: 0] ------------------ 341| 0| || (fs->ftype == TSK_FS_TYPE_FFS1B)) { ------------------ | Branch (341:20): [True: 0, False: 0] ------------------ 342| 0| ptrsperblock = fs_bufsize0 / 4; 343| 0| } 344| 0| else { 345| 0| ptrsperblock = fs_bufsize0 / 8; 346| 0| } 347| 0| } 348| 14| else { 349| 14| fs_bufsize0 = fs->block_size; 350| 14| ptrsperblock = fs_bufsize0 / 4; 351| 14| } 352| 14| fs_bufsize1 = sizeof(TSK_DADDR_T) * ptrsperblock; 353| | 354| | /* 355| | * Initialize a buffer for the 3 levels of indirection that are supported by 356| | * this inode. Each level of indirection will have a buffer to store 357| | * addresses in. buf[0] is a special scratch buffer that is used to store 358| | * raw data from the image (before endian conversions are applied). It is 359| | * equal to one block size. The others will store TSK_DADDR_T structures 360| | * and will have a size depending on the FS type. 361| | */ 362| 14| if ((fs_attr_indir = ------------------ | Branch (362:13): [True: 0, False: 14] ------------------ 363| 14| tsk_fs_attrlist_getnew(fs_meta->attr, 364| 14| TSK_FS_ATTR_NONRES)) == NULL) { 365| 0| return 1; 366| 0| } 367| | 368| | // determine number of indirect lbocks needed for file size... 369| 14| numBlocks = 370| 14| (int) (((fs_meta->size + fs_bufsize0 - 1) / fs_bufsize0) - 12); 371| 14| numSingIndirect = 372| 14| (int) ((numBlocks + ptrsperblock - 1) / ptrsperblock); 373| 14| numDblIndirect = 0; 374| 14| numTripIndirect = 0; 375| | 376| | // double block pointer? 377| 14| if (numSingIndirect > 1) { ------------------ | Branch (377:13): [True: 14, False: 0] ------------------ 378| 14| numDblIndirect = (int) 379| 14| ((numSingIndirect - 1 + ptrsperblock - 1) / ptrsperblock); 380| 14| if (numDblIndirect > 1) { ------------------ | Branch (380:17): [True: 14, False: 0] ------------------ 381| 14| numTripIndirect = (int) 382| 14| ((numDblIndirect - 1 + ptrsperblock - 383| 14| 1) / ptrsperblock); 384| 14| } 385| 14| } 386| | 387| | // initialize the data run 388| 14| if (tsk_fs_attr_set_run(fs_file, fs_attr_indir, NULL, NULL, ------------------ | Branch (388:13): [True: 0, False: 14] ------------------ 389| 14| TSK_FS_ATTR_TYPE_UNIX_INDIR, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 14|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 390| 14| fs_bufsize0 * (numSingIndirect + numDblIndirect + 391| 14| numTripIndirect), 392| 14| fs_bufsize0 * (numSingIndirect + numDblIndirect + 393| 14| numTripIndirect), 394| 14| fs_bufsize0 * (numSingIndirect + numDblIndirect + 395| 14| numTripIndirect), 0, 0)) { 396| 0| return 1; 397| 0| } 398| | 399| 14| if ((buf[0] = (char *) tsk_malloc(fs_bufsize0)) == NULL) { ------------------ | Branch (399:13): [True: 0, False: 14] ------------------ 400| 0| return 1; 401| 0| } 402| | 403| 14| for (level = 1; length > 0 && level < 4; level++) { ------------------ | Branch (403:25): [True: 14, False: 0] | Branch (403:39): [True: 14, False: 0] ------------------ 404| 14| TSK_DADDR_T *addr_ptr = (TSK_DADDR_T *) fs_meta->content_ptr; 405| | 406| 14| if ((buf[level] = (char *) tsk_malloc(fs_bufsize1)) == NULL) { ------------------ | Branch (406:17): [True: 0, False: 14] ------------------ 407| 0| int f; 408| 0| for (f = 0; f < level; f++) { ------------------ | Branch (408:29): [True: 0, False: 0] ------------------ 409| 0| free(buf[f]); 410| 0| } 411| 0| return 1; 412| 0| } 413| | 414| | /* the indirect addresses are stored in addr_ptr after the 12 415| | * direct addresses */ 416| 14| read_b = 417| 14| unix_make_data_run_indirect(fs, fs_attr, fs_attr_indir, 418| 14| buf, level, addr_ptr[12 + level - 1], length); 419| 14| if (read_b == -1) ------------------ | Branch (419:17): [True: 14, False: 0] ------------------ 420| 14| break; 421| 0| length -= read_b; 422| 0| } 423| | 424| | /* 425| | * Cleanup. 426| | */ 427| 70| for (level = 0; level < 4; ++level) { ------------------ | Branch (427:25): [True: 56, False: 14] ------------------ 428| 56| free(buf[level]); 429| 56| } 430| 14| } 431| | 432| 49| if (read_b == -1) { ------------------ | Branch (432:9): [True: 14, False: 35] ------------------ 433| 14| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 434| 14| if (fs_meta->flags & TSK_FS_META_FLAG_UNALLOC) ------------------ | Branch (434:13): [True: 14, False: 0] ------------------ 435| 14| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 14|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 14|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 436| 14| return 1; 437| 14| } 438| | 439| 35| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 440| | 441| 35| return 0; 442| 49|} tsk_fs_unix_get_default_attr_type: 447| 29.7k|{ 448| 29.7k| return TSK_FS_ATTR_TYPE_DEFAULT; 449| 29.7k|} unix_misc.c:unix_make_data_run_direct: 37| 49|{ 38| 49| TSK_DADDR_T run_start = 0; 39| 49| TSK_DADDR_T run_len = 0; 40| 49| TSK_DADDR_T blks_processed = 0; 41| 49| size_t i; 42| 49| size_t fs_blen; // how big is each "block" (in fragments) 43| | 44| 49| if (addr_len == 0) { ------------------ | Branch (44:9): [True: 0, False: 49] ------------------ 45| 0| return 0; 46| 0| } 47| | 48| | // block_size is a fragment size in UFS, so we need to maintain length in fragments 49| 49| if (TSK_FS_TYPE_ISFFS(fs->ftype)) { ------------------ | | 850| 49| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:5): [True: 0, False: 49] | | | Branch (850:6): [True: 0, False: 49] | | ------------------ ------------------ 50| 0| FFS_INFO *ffs = (FFS_INFO *) fs; 51| 0| fs_blen = ffs->ffsbsize_f; 52| 0| } 53| 49| else { 54| 49| fs_blen = 1; 55| 49| } 56| | 57| 49| run_start = addrs[0]; 58| 49| run_len = fs_blen; 59| | 60| | /* Note that we are lazy about length. We stop only when a run is past length, 61| | * we do not end exactly at length -- although that should happen anyway. 62| | */ 63| 537| for (i = 0; i < addr_len; i++) { ------------------ | Branch (63:17): [True: 523, False: 14] ------------------ 64| | 65| | /* Make a new run if: 66| | * - This is the last addresss in the buffer 67| | * - The next address is not part of the current run 68| | * -- special case for sparse since they use 0 as an address 69| | */ 70| 523| if ((i + 1 == addr_len) || ------------------ | Branch (70:13): [True: 14, False: 509] ------------------ 71| 523| ((run_start + run_len != addrs[i + 1]) && (run_start != 0)) || ------------------ | Branch (71:14): [True: 509, False: 0] | Branch (71:55): [True: 262, False: 247] ------------------ 72| 523| ((run_start == 0) && (addrs[i + 1] != 0))) { ------------------ | Branch (72:14): [True: 247, False: 0] | Branch (72:34): [True: 81, False: 166] ------------------ 73| | 74| 357| TSK_FS_ATTR_RUN *data_run; 75| | 76| | // make a non-resident run 77| 357| data_run = tsk_fs_attr_run_alloc(); 78| 357| if (data_run == NULL) ------------------ | Branch (78:17): [True: 0, False: 357] ------------------ 79| 0| return -1; 80| | 81| 357| data_run->addr = run_start; 82| 357| data_run->len = run_len; 83| | 84| 357| if (run_start == 0) ------------------ | Branch (84:17): [True: 81, False: 276] ------------------ 85| 81| data_run->flags = TSK_FS_ATTR_RUN_FLAG_SPARSE; 86| | 87| | // save the run 88| 357| tsk_fs_attr_append_run(fs, fs_attr, data_run); 89| | 90| | // get ready for the next run 91| 357| if (i + 1 != addr_len) ------------------ | Branch (91:17): [True: 343, False: 14] ------------------ 92| 343| run_start = addrs[i + 1]; 93| 357| run_len = 0; 94| | 95| | // stop if we are past the length requested 96| 357| if (blks_processed * fs->block_size > (TSK_DADDR_T) length) ------------------ | Branch (96:17): [True: 35, False: 322] ------------------ 97| 35| break; 98| 357| } 99| 488| run_len += fs_blen; 100| 488| blks_processed += fs_blen; 101| 488| } 102| | 103| 49| return blks_processed * fs->block_size; 104| 49|} unix_misc.c:unix_make_data_run_indirect: 124| 14|{ 125| 14| size_t addr_cnt = 0; 126| 14| TSK_DADDR_T *myaddrs = (TSK_DADDR_T *) buf[level]; 127| 14| TSK_OFF_T length_remain = length; 128| 14| TSK_OFF_T retval; 129| 14| size_t fs_bufsize; 130| 14| size_t fs_blen; 131| 14| TSK_FS_ATTR_RUN *data_run; 132| | 133| 14| if (tsk_verbose) ------------------ | Branch (133:9): [True: 0, False: 14] ------------------ 134| 0| tsk_fprintf(stderr, "%s: level %d block %" PRIuDADDR "\n", "unix_make_data_run_indirect", 135| 0| level, addr); 136| | 137| | // block_size is a fragment size in UFS, so we need to maintain length in fragments 138| 14| if (TSK_FS_TYPE_ISFFS(fs->ftype)) { ------------------ | | 850| 14| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:5): [True: 0, False: 14] | | | Branch (850:6): [True: 0, False: 14] | | ------------------ ------------------ 139| 0| FFS_INFO *ffs = (FFS_INFO *) fs; 140| 0| fs_blen = ffs->ffsbsize_f; 141| 0| fs_bufsize = ffs->ffsbsize_b; 142| 0| } 143| 14| else { 144| 14| fs_blen = 1; 145| 14| fs_bufsize = fs->block_size; 146| 14| } 147| | 148| 14| if (addr > fs->last_block) { ------------------ | Branch (148:9): [True: 14, False: 0] ------------------ 149| 14| tsk_error_reset(); 150| 14| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 14|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 14|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 151| 14| tsk_error_set_errstr("unix: Indirect block address too large: %" 152| 14| PRIuDADDR "", addr); 153| 14| return -1; 154| 14| } 155| | 156| | // make a non-resident run 157| 0| data_run = tsk_fs_attr_run_alloc(); 158| 0| if (data_run == NULL) ------------------ | Branch (158:9): [True: 0, False: 0] ------------------ 159| 0| return -1; 160| | 161| 0| data_run->addr = addr; 162| 0| data_run->len = fs_blen; 163| | 164| | /* 165| | * Read a block of disk addresses. 166| | */ 167| | // sparse 168| 0| if (addr == 0) { ------------------ | Branch (168:9): [True: 0, False: 0] ------------------ 169| 0| memset(buf[0], 0, fs_bufsize); 170| 0| data_run->flags = TSK_FS_ATTR_RUN_FLAG_SPARSE; 171| 0| } 172| 0| else { 173| 0| ssize_t cnt; 174| | // read the data into the scratch buffer 175| 0| cnt = tsk_fs_read_block(fs, addr, buf[0], fs_bufsize); 176| 0| if (cnt != (ssize_t)fs_bufsize) { ------------------ | Branch (176:13): [True: 0, False: 0] ------------------ 177| 0| if (cnt >= 0) { ------------------ | Branch (177:17): [True: 0, False: 0] ------------------ 178| 0| tsk_error_reset(); 179| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 180| 0| } 181| 0| tsk_error_set_errstr2("unix_make_data_run_indir: Block %" 182| 0| PRIuDADDR, addr); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 183| 0| free(data_run); 184| 0| return -1; 185| 0| } 186| 0| } 187| | 188| | // save the run 189| 0| tsk_fs_attr_append_run(fs, fs_attr_indir, data_run); 190| | 191| 0| data_run = NULL; 192| | 193| | // convert the raw addresses to the correct endian ordering 194| 0| if ((fs->ftype == TSK_FS_TYPE_FFS1) ------------------ | Branch (194:9): [True: 0, False: 0] ------------------ 195| 0| || (fs->ftype == TSK_FS_TYPE_FFS1B) ------------------ | Branch (195:12): [True: 0, False: 0] ------------------ 196| 0| || (TSK_FS_TYPE_ISEXT(fs->ftype))) { ------------------ | | 857| 0| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:6): [True: 0, False: 0] | | ------------------ ------------------ | Branch (196:12): [True: 0, False: 0] ------------------ 197| 0| size_t n; 198| 0| uint32_t *iaddr = (uint32_t *) buf[0]; 199| 0| addr_cnt = fs_bufsize / sizeof(*iaddr); 200| 0| for (n = 0; n < addr_cnt; n++) { ------------------ | Branch (200:21): [True: 0, False: 0] ------------------ 201| 0| myaddrs[n] = tsk_getu32(fs->endian, (uint8_t *) & iaddr[n]); ------------------ | | 119| 0|#define tsk_getu32(endian, x) \ | | 120| 0|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 0, False: 0] | | ------------------ | | 121| 0| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 0| (((uint8_t *)(x))[1] << 8) + \ | | 123| 0| (((uint8_t *)(x))[2] << 16) + \ | | 124| 0| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 0| : \ | | 126| 0| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 202| 0| } 203| 0| } 204| 0| else if (fs->ftype == TSK_FS_TYPE_FFS2) { ------------------ | Branch (204:14): [True: 0, False: 0] ------------------ 205| 0| size_t n; 206| 0| uint64_t *iaddr = (uint64_t *) buf[0]; 207| 0| addr_cnt = fs_bufsize / sizeof(*iaddr); 208| 0| for (n = 0; n < addr_cnt; n++) { ------------------ | Branch (208:21): [True: 0, False: 0] ------------------ 209| 0| myaddrs[n] = tsk_getu64(fs->endian, (uint8_t *) & iaddr[n]); ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 210| 0| } 211| 0| } 212| | 213| | // pass the addresses to the next level 214| 0| if (level == 1) { ------------------ | Branch (214:9): [True: 0, False: 0] ------------------ 215| 0| retval = 216| 0| unix_make_data_run_direct(fs, fs_attr, myaddrs, addr_cnt, 217| 0| length_remain); 218| 0| if (retval != -1) { ------------------ | Branch (218:13): [True: 0, False: 0] ------------------ 219| 0| length_remain -= retval; 220| 0| } 221| 0| } 222| 0| else { 223| 0| size_t i; 224| 0| retval = 0; 225| 0| for (i = 0; i < addr_cnt && retval != -1; i++) { ------------------ | Branch (225:21): [True: 0, False: 0] | Branch (225:37): [True: 0, False: 0] ------------------ 226| 0| retval = 227| 0| unix_make_data_run_indirect(fs, fs_attr, fs_attr_indir, 228| 0| buf, level - 1, myaddrs[i], length_remain); 229| 0| if (retval == -1) { ------------------ | Branch (229:17): [True: 0, False: 0] ------------------ 230| 0| break; 231| 0| } 232| 0| else { 233| 0| length_remain -= retval; 234| 0| } 235| 0| } 236| 0| } 237| | 238| 0| if (retval == -1) { ------------------ | Branch (238:9): [True: 0, False: 0] ------------------ 239| 0| return -1; 240| 0| } 241| 0| return length - length_remain; 242| 0|} tsk_img_read: 60| 132k|{ 61| 132k|#define CACHE_AGE 1000 62| 132k| ssize_t read_count = 0; 63| 132k| int cache_index = 0; 64| 132k| int cache_next = 0; // index to lowest age cache (to use next) 65| 132k| size_t len2 = 0; 66| | 67| 132k| if (a_img_info == NULL) { ------------------ | Branch (67:9): [True: 0, False: 132k] ------------------ 68| 0| tsk_error_reset(); 69| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 70| 0| tsk_error_set_errstr("tsk_img_read: a_img_info: NULL"); 71| 0| return -1; 72| 0| } 73| | 74| | // Do not allow a_buf to be NULL. 75| 132k| if (a_buf == NULL) { ------------------ | Branch (75:9): [True: 0, False: 132k] ------------------ 76| 0| tsk_error_reset(); 77| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 78| 0| tsk_error_set_errstr("tsk_img_read: a_buf: NULL"); 79| 0| return -1; 80| 0| } 81| | 82| | // The function cannot handle negative offsets. 83| 132k| if (a_off < 0) { ------------------ | Branch (83:9): [True: 0, False: 132k] ------------------ 84| 0| tsk_error_reset(); 85| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 86| 0| tsk_error_set_errstr("tsk_img_read: a_off: %" PRIdOFF, a_off); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 87| 0| return -1; 88| 0| } 89| | 90| | // Protect a_off against overflowing when a_len is added since TSK_OFF_T 91| | // maps to an int64 we prefer it over size_t although likely checking 92| | // for ( a_len > SSIZE_MAX ) is better but the code does not seem to 93| | // use that approach. 94| | 95| 132k| if ((TSK_OFF_T) a_len < 0) { ------------------ | Branch (95:9): [True: 0, False: 132k] ------------------ 96| 0| tsk_error_reset(); 97| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 98| 0| tsk_error_set_errstr("tsk_img_read: a_len: %zd", a_len); 99| 0| return -1; 100| 0| } 101| | 102| | /* cache_lock is used for both the cache in IMG_INFO and 103| | * the shared variables in the img type specific INFO structs. 104| | * grab it now so that it is held before any reads. 105| | */ 106| 132k| tsk_take_lock(&(a_img_info->cache_lock)); 107| | 108| | // if they ask for more than the cache length, skip the cache 109| 132k| if ((a_len + (a_off % 512)) > TSK_IMG_INFO_CACHE_LEN) { ------------------ | | 85| 132k|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ | Branch (109:9): [True: 0, False: 132k] ------------------ 110| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 111| 0| tsk_release_lock(&(a_img_info->cache_lock)); 112| 0| return read_count; 113| 0| } 114| | 115| | // TODO: why not just return 0 here (and be POSIX compliant)? 116| | // and why not check earlier for this condition? 117| 132k| if (a_off >= a_img_info->size) { ------------------ | Branch (117:9): [True: 61, False: 132k] ------------------ 118| 61| tsk_release_lock(&(a_img_info->cache_lock)); 119| 61| tsk_error_reset(); 120| 61| tsk_error_set_errno(TSK_ERR_IMG_READ_OFF); ------------------ | | 319| 61|#define TSK_ERR_IMG_READ_OFF (TSK_ERR_IMG | 8) | | ------------------ | | | | 299| 61|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 121| 61| tsk_error_set_errstr("tsk_img_read - %" PRIdOFF, a_off); ------------------ | | 269| 61|#define PRIdOFF PRId64 ------------------ 122| 61| return -1; 123| 61| } 124| | 125| | /* See if the requested length is going to be too long. 126| | * we'll use this length when checking the cache. */ 127| 132k| len2 = a_len; 128| | 129| | // Protect against INT64_MAX + INT64_MAX > value 130| 132k| if (((TSK_OFF_T) len2 > a_img_info->size) ------------------ | Branch (130:9): [True: 0, False: 132k] ------------------ 131| 132k| || (a_off >= (a_img_info->size - (TSK_OFF_T)len2))) { ------------------ | Branch (131:12): [True: 1.46k, False: 131k] ------------------ 132| 1.46k| len2 = (size_t) (a_img_info->size - a_off); 133| 1.46k| } 134| | 135| | // check if it is in the cache 136| 132k| for (cache_index = 0; 137| 4.37M| cache_index < TSK_IMG_INFO_CACHE_NUM; cache_index++) { ------------------ | | 84| 4.37M|#define TSK_IMG_INFO_CACHE_NUM 32 ------------------ | Branch (137:9): [True: 4.24M, False: 132k] ------------------ 138| | 139| | // Look into the in-use cache entries 140| 4.24M| if (a_img_info->cache_len[cache_index] > 0) { ------------------ | Branch (140:13): [True: 3.98M, False: 254k] ------------------ 141| | 142| | // the read_count check makes sure we don't go back in after data was read 143| 3.98M| if ((read_count == 0) ------------------ | Branch (143:17): [True: 1.19M, False: 2.79M] ------------------ 144| 3.98M| && (a_img_info->cache_off[cache_index] <= a_off) ------------------ | Branch (144:20): [True: 207k, False: 983k] ------------------ 145| 3.98M| && (a_img_info->cache_off[cache_index] + ------------------ | Branch (145:20): [True: 132k, False: 75.5k] ------------------ 146| 207k| a_img_info->cache_len[cache_index] >= a_off + len2)) { 147| | 148| | /* 149| | if (tsk_verbose) 150| | fprintf(stderr, 151| | "tsk_img_read: Read found in cache %d\n", cache_index ); 152| | */ 153| | 154| | // We found it... 155| 132k| memcpy(a_buf, 156| 132k| &a_img_info->cache[cache_index][a_off - 157| 132k| a_img_info->cache_off[cache_index]], len2); 158| 132k| read_count = (ssize_t) len2; 159| | 160| | // reset its "age" since it was useful 161| 132k| a_img_info->cache_age[cache_index] = CACHE_AGE; ------------------ | | 61| 132k|#define CACHE_AGE 1000 ------------------ 162| | 163| | // we don't break out of the loop so that we update all ages 164| 132k| } 165| 3.85M| else { 166| | /* decrease its "age" since it was not useful. 167| | * We don't let used ones go below 1 so that they are not 168| | * confused with entries that have never been used. */ 169| 3.85M| a_img_info->cache_age[cache_index]--; 170| | 171| | // see if this is the most eligible replacement 172| 3.85M| if ((a_img_info->cache_len[cache_next] > 0) ------------------ | Branch (172:21): [True: 3.17M, False: 679k] ------------------ 173| 3.85M| && (a_img_info->cache_age[cache_index] < ------------------ | Branch (173:24): [True: 825k, False: 2.34M] ------------------ 174| 3.17M| a_img_info->cache_age[cache_next])) 175| 825k| cache_next = cache_index; 176| 3.85M| } 177| 3.98M| } 178| 254k| else { 179| 254k| cache_next = cache_index; 180| 254k| } 181| 4.24M| } 182| | 183| | // if we didn't find it, then load it into the cache_next entry 184| 132k| if (read_count == 0) { ------------------ | Branch (184:9): [True: 172, False: 132k] ------------------ 185| 172| size_t read_size = 0; 186| | 187| | // round the offset down to a sector boundary 188| 172| a_img_info->cache_off[cache_next] = (a_off / 512) * 512; 189| | 190| | /* 191| | if (tsk_verbose) 192| | fprintf(stderr, 193| | "tsk_img_read: Loading data into cache %d (%" PRIdOFF 194| | ")\n", cache_next, a_img_info->cache_off[cache_next]); 195| | */ 196| | 197| | // Read a full cache block or the remaining data. 198| 172| read_size = TSK_IMG_INFO_CACHE_LEN; ------------------ | | 85| 172|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ 199| | 200| 172| if ((a_img_info->cache_off[cache_next] + (TSK_OFF_T)read_size) > ------------------ | Branch (200:13): [True: 38, False: 134] ------------------ 201| 172| a_img_info->size) { 202| 38| read_size = 203| 38| (size_t) (a_img_info->size - 204| 38| a_img_info->cache_off[cache_next]); 205| 38| } 206| | 207| 172| read_count = a_img_info->read(a_img_info, 208| 172| a_img_info->cache_off[cache_next], 209| 172| a_img_info->cache[cache_next], read_size); 210| | 211| | // if no error, then set the variables and copy the data 212| | // Although a read_count of -1 indicates an error, 213| | // since read_count is used in the calculation it may not be negative. 214| | // Also it does not make sense to copy data when the read_count is 0. 215| 172| if (read_count > 0) { ------------------ | Branch (215:13): [True: 172, False: 0] ------------------ 216| | 217| 172| TSK_OFF_T rel_off = 0; 218| 172| a_img_info->cache_age[cache_next] = CACHE_AGE; ------------------ | | 61| 172|#define CACHE_AGE 1000 ------------------ 219| 172| a_img_info->cache_len[cache_next] = read_count; 220| | 221| | // Determine the offset relative to the start of the cached data. 222| 172| rel_off = a_off - a_img_info->cache_off[cache_next]; 223| | 224| | // Make sure we were able to read sufficient data into the cache. 225| 172| if (rel_off > (TSK_OFF_T) read_count) { ------------------ | Branch (225:17): [True: 0, False: 172] ------------------ 226| 0| len2 = 0; 227| 0| } 228| | // Make sure not to copy more than is available in the cache. 229| 172| else if ((rel_off + (TSK_OFF_T) len2) > (TSK_OFF_T) read_count) { ------------------ | Branch (229:22): [True: 0, False: 172] ------------------ 230| 0| len2 = (size_t) (read_count - rel_off); 231| 0| } 232| | // Only copy data when we have something to copy. 233| 172| if (len2 > 0) { ------------------ | Branch (233:17): [True: 172, False: 0] ------------------ 234| 172| memcpy(a_buf, &(a_img_info->cache[cache_next][rel_off]), len2); 235| 172| } 236| 172| read_count = (ssize_t) len2; 237| 172| } 238| 0| else { 239| 0| a_img_info->cache_len[cache_next] = 0; 240| 0| a_img_info->cache_age[cache_next] = 0; 241| 0| a_img_info->cache_off[cache_next] = 0; 242| | 243| | // Something went wrong so let's try skipping the cache 244| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 245| 0| } 246| 172| } 247| | 248| 132k| tsk_release_lock(&(a_img_info->cache_lock)); 249| 132k| return read_count; 250| 132k|} LLVMFuzzerTestOneInput: 25| 3.41k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 26| 3.41k| TSK_IMG_INFO *img; 27| 3.41k| TSK_FS_INFO *fs; 28| | 29| 3.41k| img = mem_open(data, size); 30| 3.41k| if (img == nullptr) ------------------ | Branch (30:7): [True: 0, False: 3.41k] ------------------ 31| 0| return 0; 32| | 33| 3.41k| fs = tsk_fs_open_img(img, 0, FSTYPE); 34| 3.41k| if (fs != nullptr) { ------------------ | Branch (34:7): [True: 3.37k, False: 39] ------------------ 35| 3.37k| tsk_fs_fls(fs, TSK_FS_FLS_FULL, fs->root_inum, TSK_FS_DIR_WALK_FLAG_RECURSE, 36| 3.37k| nullptr, 0); 37| | 38| 3.37k| fs->close(fs); 39| 3.37k| } 40| | 41| 3.41k| img->close(img); 42| 3.41k| return 0; 43| 3.41k|}