_Z8mem_openPKhm: 55| 6|TSK_IMG_INFO *mem_open(const uint8_t *data, size_t size) { 56| 6| IMG_MEM_INFO *inmemory_img = 57| 6| reinterpret_cast(malloc(sizeof(IMG_MEM_INFO))); 58| 6| TSK_IMG_INFO *img; 59| 6| if (inmemory_img == nullptr) { ------------------ | Branch (59:7): [True: 0, False: 6] ------------------ 60| 0| return nullptr; 61| 0| } 62| 6| img = reinterpret_cast(inmemory_img); 63| 6| img->itype = TSK_IMG_TYPE_RAW; 64| 6| img->read = mem_read; 65| 6| img->close = mem_close; 66| 6| img->imgstat = mem_imgstat; 67| 6| img->size = size; 68| 6| img->sector_size = 512; 69| 6| tsk_init_lock(&(img->cache_lock)); 70| 6| inmemory_img->data = data; 71| 6| inmemory_img->size = size; 72| 6| return img; 73| 6|} sleuthkit_fls_fuzzer.cc:_ZL8mem_readP12TSK_IMG_INFOlPcm: 30| 60| size_t len) { 31| 60| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 32| | // Bounds-checking exists in the real drivers. 33| 60| if (offset > mem_info->size) { ------------------ | Branch (33:7): [True: 0, False: 60] ------------------ 34| 0| return -1; 35| 0| } 36| 60| ssize_t read_len = len; 37| 60| if (offset + len > mem_info->size) { ------------------ | Branch (37:7): [True: 0, False: 60] ------------------ 38| 0| read_len = mem_info->size - offset; 39| 0| } 40| 60| if (memcpy(buf, mem_info->data + offset, read_len) == nullptr) { ------------------ | Branch (40:7): [True: 0, False: 60] ------------------ 41| 0| return -1; 42| 60| } else { 43| 60| return read_len; 44| 60| } 45| 60|} sleuthkit_fls_fuzzer.cc:_ZL9mem_closeP12TSK_IMG_INFO: 47| 6|static void mem_close(TSK_IMG_INFO *img_info) { 48| 6| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 49| 6| tsk_deinit_lock(&(img_info->cache_lock)); 50| 6| free(mem_info); 51| 6|} _Z14hexDigitToCharc: 85| 256|{ 86| 256| if (ch > 47 && ch < 58) ------------------ | Branch (86:7): [True: 256, False: 0] | Branch (86:18): [True: 148, False: 108] ------------------ 87| 148| return ch - 48; 88| | 89| 108| if (ch > 96 && ch < 103) ------------------ | Branch (89:7): [True: 108, False: 0] | Branch (89:18): [True: 108, False: 0] ------------------ 90| 108| return ch - 87; 91| | 92| 0| if (ch > 64 && ch < 71) ------------------ | Branch (92:7): [True: 0, False: 0] | Branch (92:18): [True: 0, False: 0] ------------------ 93| 0| return ch - 55; 94| | 95| 0| return 0; 96| 0|} _Z13hexPairToCharcc: 100| 128|{ 101| 128| return hexDigitToChar(a) * 16 + hexDigitToChar(b); 102| 128|} _ZN7TSKGuidC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE: 106| 8|{ 107| 8| _bytes.clear(); 108| | 109| 8| char charOne, charTwo; 110| 8| bool lookingForFirstChar = true; 111| | 112| | // for (const char &ch : fromString) C++ 11 CODE CHANGED FOR TSK 113| 296| for (std::string::const_iterator it = fromString.begin(); it != fromString.end(); ++it) ------------------ | Branch (113:61): [True: 288, False: 8] ------------------ 114| 288| { 115| 288| char ch = *it; 116| 288| if (ch == '-') ------------------ | Branch (116:9): [True: 32, False: 256] ------------------ 117| 32| continue; 118| | 119| 256| if (lookingForFirstChar) ------------------ | Branch (119:9): [True: 128, False: 128] ------------------ 120| 128| { 121| 128| charOne = ch; 122| 128| lookingForFirstChar = false; 123| 128| } 124| 128| else 125| 128| { 126| 128| charTwo = ch; 127| 128| unsigned char byte = hexPairToChar(charOne, charTwo); 128| 128| _bytes.push_back(byte); 129| 128| lookingForFirstChar = true; 130| 128| } 131| 256| } 132| | 133| 8|} tsk_malloc: 29| 970|{ 30| 970| void *ptr; 31| | 32| 970| if ((ptr = calloc(len, 1)) == 0) { ------------------ | Branch (32:9): [True: 0, False: 970] ------------------ 33| 0| tsk_error_reset(); 34| 0| tsk_error_set_errno(TSK_ERR_AUX_MALLOC); ------------------ | | 307| 0|#define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0) | | ------------------ | | | | 298| 0|#define TSK_ERR_AUX 0x01000000 | | ------------------ ------------------ 35| 0| tsk_error_set_errstr("tsk_malloc: %s (%" PRIuSIZE" requested)", strerror(errno), len); 36| 0| } 37| | 38| 970| return ptr; 39| 970|} tsk_realloc: 44| 130|{ 45| | // Use tmpPtr to prevent memory leak when realloc failed 46| 130| void *tmpPtr = realloc(ptr, len); 47| 130| if (tmpPtr == 0) { ------------------ | Branch (47:9): [True: 0, False: 130] ------------------ 48| 0| tsk_error_reset(); 49| 0| tsk_error_set_errno(TSK_ERR_AUX_MALLOC); ------------------ | | 307| 0|#define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0) | | ------------------ | | | | 298| 0|#define TSK_ERR_AUX 0x01000000 | | ------------------ ------------------ 50| 0| tsk_error_set_errstr("tsk_realloc: %s (%" PRIuSIZE" requested)", strerror(errno), len); 51| 0| return (void *)0; 52| 0| } 53| 130| else { 54| 130| ptr = tmpPtr; 55| 130| } 56| 130| return ptr; 57| 130|} tsk_guess_end_u16: 35| 6|{ 36| | /* try little */ 37| 6| if (tsk_getu16(TSK_LIT_ENDIAN, x) == val) { ------------------ | | 86| 6|#define tsk_getu16(endian, x) \ | | 87| 6|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 6| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (37:9): [True: 6, False: 0] ------------------ 38| 6| *flag = TSK_LIT_ENDIAN; 39| 6| return 0; 40| 6| } 41| | 42| | /* ok, big now */ 43| 0| if (tsk_getu16(TSK_BIG_ENDIAN, x) == val) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (43:9): [True: 0, False: 0] ------------------ 44| 0| *flag = TSK_BIG_ENDIAN; 45| 0| return 0; 46| 0| } 47| | 48| | /* didn't find it */ 49| 0| return 1; 50| 0|} tsk_error_get_info: 148| 281|{ 149| 281| TSK_ERROR_INFO *ptr = NULL; 150| 281| (void) pthread_once(&pt_tls_key_once, make_pt_tls_key); 151| 281| if ((ptr = (TSK_ERROR_INFO *) pthread_getspecific(pt_tls_key)) == 0) { ------------------ | Branch (151:9): [True: 1, False: 280] ------------------ 152| | // Under high memory pressure malloc will return NULL. 153| 1| ptr = (TSK_ERROR_INFO *) malloc(sizeof(TSK_ERROR_INFO)); 154| | 155| 1| if( ptr != NULL ) { ------------------ | Branch (155:13): [True: 1, False: 0] ------------------ 156| 1| ptr->t_errno = 0; 157| 1| ptr->errstr[0] = 0; 158| 1| ptr->errstr2[0] = 0; 159| 1| } 160| 1| (void) pthread_setspecific(pt_tls_key, ptr); 161| 1| } 162| 281| return ptr; 163| 281|} tsk_error_reset: 444| 281|{ 445| 281| TSK_ERROR_INFO *info = tsk_error_get_info(); 446| | 447| 281| if( info != NULL ) { ------------------ | Branch (447:9): [True: 281, False: 0] ------------------ 448| 281| info->t_errno = 0; 449| 281| info->errstr[0] = 0; 450| 281| info->errstr2[0] = 0; 451| 281| info->errstr_print[0] = 0; 452| 281| } 453| 281|} tsk_error.c:make_pt_tls_key: 142| 1|{ 143| 1| (void) pthread_key_create(&pt_tls_key, free_error_info); 144| 1|} tsk_list_add: 47| 6|{ 48| 6| TSK_LIST *tmp; 49| | 50| | /* If the head is NULL, then create an entry */ 51| 6| if (*a_tsk_list_head == NULL) { ------------------ | Branch (51:9): [True: 6, False: 0] ------------------ 52| 6| TSK_LIST *ent; 53| | /* 54| | if (tsk_verbose) 55| | fprintf(stderr, "entry %" PRIu64 " is first on list\n", a_key); 56| | */ 57| 6| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (57:13): [True: 0, False: 6] ------------------ 58| 0| return 1; 59| | 60| 6| *a_tsk_list_head = ent; 61| 6| return 0; 62| 6| } 63| | 64| | /* If the new key is larger than the head, make it the head */ 65| 0| if (a_key > (*a_tsk_list_head)->key) { ------------------ | Branch (65:9): [True: 0, False: 0] ------------------ 66| | /* 67| | if (tsk_verbose) 68| | fprintf(stderr, 69| | "entry %" PRIu64 " added to head before %" PRIu64 "\n", 70| | a_key, (*a_tsk_list_head)->key); 71| | */ 72| | 73| | // If we can, update the length of the existing list entry 74| 0| if (a_key == (*a_tsk_list_head)->key + 1) { ------------------ | Branch (74:13): [True: 0, False: 0] ------------------ 75| 0| (*a_tsk_list_head)->key++; 76| 0| (*a_tsk_list_head)->len++; 77| 0| } 78| 0| else { 79| 0| TSK_LIST *ent; 80| 0| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (80:17): [True: 0, False: 0] ------------------ 81| 0| return 1; 82| 0| ent->next = *a_tsk_list_head; 83| 0| *a_tsk_list_head = ent; 84| 0| } 85| 0| return 0; 86| 0| } 87| | // get rid of duplicates 88| 0| else if (a_key == (*a_tsk_list_head)->key) { ------------------ | Branch (88:14): [True: 0, False: 0] ------------------ 89| 0| return 0; 90| 0| } 91| | 92| | /* At the start of this loop each time, we know that the key to add 93| | * is smaller than the entry being considered (tmp) */ 94| 0| tmp = *a_tsk_list_head; 95| 0| while (tmp != NULL) { ------------------ | Branch (95:12): [True: 0, False: 0] ------------------ 96| | 97| | /* First check if this is a duplicate and contained in tmp */ 98| 0| if (a_key > (tmp->key - tmp->len)) { ------------------ | Branch (98:13): [True: 0, False: 0] ------------------ 99| 0| return 0; 100| 0| } 101| | /* Can we append it to the end of tmp? */ 102| 0| else if (a_key == (tmp->key - tmp->len)) { ------------------ | Branch (102:18): [True: 0, False: 0] ------------------ 103| | // do a sanity check on the next entry 104| 0| if ((tmp->next) && (tmp->next->key == a_key)) { ------------------ | Branch (104:17): [True: 0, False: 0] | Branch (104:32): [True: 0, False: 0] ------------------ 105| | // @@@ We could fix this situation and remove the next entry... 106| 0| return 0; 107| 0| } 108| 0| tmp->len++; 109| 0| return 0; 110| 0| } 111| | 112| | /* The key is less than the current bucket and can't be added to it. 113| | * check if we are at the end of the list yet */ 114| 0| else if (tmp->next == NULL) { ------------------ | Branch (114:18): [True: 0, False: 0] ------------------ 115| 0| TSK_LIST *ent; 116| | 117| | /* 118| | if (tsk_verbose) 119| | fprintf(stderr, "entry %" PRIu64 " added to tail\n", 120| | a_key); 121| | */ 122| | 123| 0| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (123:17): [True: 0, False: 0] ------------------ 124| 0| return 1; 125| 0| tmp->next = ent; 126| | 127| 0| return 0; 128| 0| } 129| | // can we prepend it to the next bucket? 130| 0| else if (a_key == tmp->next->key + 1) { ------------------ | Branch (130:18): [True: 0, False: 0] ------------------ 131| 0| tmp->next->key++; 132| 0| tmp->next->len++; 133| 0| return 0; 134| 0| } 135| | // do we need a new bucket in between? 136| 0| else if (a_key > tmp->next->key) { ------------------ | Branch (136:18): [True: 0, False: 0] ------------------ 137| 0| TSK_LIST *ent; 138| | 139| | /* 140| | if (tsk_verbose) 141| | fprintf(stderr, 142| | "entry %" PRIu64 " added before %" PRIu64 "\n", 143| | a_key, tmp->next->key); 144| | */ 145| | 146| 0| if ((ent = tsk_list_create(a_key)) == NULL) ------------------ | Branch (146:17): [True: 0, False: 0] ------------------ 147| 0| return 1; 148| | 149| 0| ent->next = tmp->next; 150| 0| tmp->next = ent; 151| 0| return 0; 152| 0| } 153| 0| else if (a_key == tmp->next->key) { ------------------ | Branch (153:18): [True: 0, False: 0] ------------------ 154| 0| return 0; 155| 0| } 156| 0| tmp = tmp->next; 157| 0| } 158| 0| return 0; 159| 0|} tsk_list_find: 170| 12|{ 171| 12| TSK_LIST *tmp; 172| | 173| 12| tmp = a_tsk_list_head; 174| 13| while (tmp != NULL) { ------------------ | Branch (174:12): [True: 3, False: 10] ------------------ 175| | // check this bucket 176| | // use the key+1 and then subtract for unsigned cases when key-len == -1 177| 3| if ((a_key <= tmp->key) && (a_key >= tmp->key + 1 - tmp->len)) ------------------ | Branch (177:13): [True: 2, False: 1] | Branch (177:36): [True: 1, False: 1] ------------------ 178| 1| return 1; 179| | 180| | // Have we passed any potential buckets? 181| 2| else if (a_key > tmp->key) ------------------ | Branch (181:18): [True: 1, False: 1] ------------------ 182| 1| return 0; 183| | 184| 1| tmp = tmp->next; 185| 1| } 186| 10| return 0; 187| 12|} tsk_list_free: 196| 17|{ 197| 17| TSK_LIST *tmp; 198| | 199| 23| while (a_tsk_list_head) { ------------------ | Branch (199:12): [True: 6, False: 17] ------------------ 200| 6| tmp = a_tsk_list_head->next; 201| 6| free(a_tsk_list_head); 202| 6| a_tsk_list_head = tmp; 203| 6| } 204| 17|} tsk_list.c:tsk_list_create: 25| 6|{ 26| 6| TSK_LIST *ent; 27| 6| if ((ent = (TSK_LIST *) tsk_malloc(sizeof(TSK_LIST))) == NULL) { ------------------ | Branch (27:9): [True: 0, False: 6] ------------------ 28| 0| return NULL; 29| 0| } 30| | 31| 6| ent->key = a_key; 32| 6| ent->next = NULL; 33| 6| ent->len = 1; 34| | 35| 6| return ent; 36| 6|} tsk_init_lock: 46| 30|{ 47| 30| pthread_mutexattr_t attr; 48| 30| pthread_mutexattr_init(&attr); 49| | 50| | // Locks on Linux are not recursive (unlike on Windows), so things 51| | // will hang if the current thread tries to take the lock again. 52| | // While debugging, it's sometimes useful to call 53| | // 54| | // pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK_NP); 55| | // 56| | // which will provoke an immediate error rather than a hang. 57| | // 58| | // PTHREAD_MUTEX_ERRORCHECK is not defined by default on Linux, 59| | // but it is portable if you have the right_XOPEN_SOURCE settings. 60| | // However, that macro affects the availability of other features 61| | // like BSD-style u_int types used in afflib. 62| | // PTHREAD_MUTEX_ERRORCHECK -is- available by default on Mac. 63| | // 64| | // PTHREAD_MUTEX_ERRORCHECK_NP is the Linux/gcc non-portable 65| | // equivalent which does not require _XOPEN_SOURCE. 66| | // 67| | // Other interesting attributes are PTHREAD_MUTEX_RECURSIVE (and 68| | // PTHREAD_MUTEX_RECURSIVE_NP). We avoided those out of portability 69| | // concerns with the _XOPEN_SOURCE settings. 70| | 71| 30| int e = pthread_mutex_init(&lock->mutex, &attr); 72| 30| pthread_mutexattr_destroy(&attr); 73| 30| if (e != 0) { ------------------ | Branch (73:9): [True: 0, False: 30] ------------------ 74| 0| fprintf(stderr, "tsk_init_lock: thread_mutex_init failed %d\n", e); 75| 0| assert(0); 76| 0| } 77| 30|} tsk_deinit_lock: 81| 30|{ 82| 30| pthread_mutex_destroy(&lock->mutex); 83| 30|} tsk_take_lock: 87| 7.96k|{ 88| 7.96k| int e = pthread_mutex_lock(&lock->mutex); 89| 7.96k| if (e != 0) { ------------------ | Branch (89:9): [True: 0, False: 7.96k] ------------------ 90| 0| fprintf(stderr, "tsk_take_lock: thread_mutex_lock failed %d\n", e); 91| 0| assert(0); 92| 0| } 93| 7.96k|} tsk_release_lock: 97| 7.96k|{ 98| 7.96k| int e = pthread_mutex_unlock(&lock->mutex); 99| 7.96k| if (e != 0) { ------------------ | Branch (99:9): [True: 0, False: 7.96k] ------------------ 100| 0| fprintf(stderr, 101| 0| "tsk_release_lock: thread_mutex_unlock failed %d\n", e); 102| 0| assert(0); 103| 0| } 104| 7.96k|} tsk_stack_create: 24| 17|{ 25| 17| TSK_STACK *tsk_stack; 26| 17| if ((tsk_stack = (TSK_STACK *) tsk_malloc(sizeof(TSK_STACK))) == NULL) { ------------------ | Branch (26:9): [True: 0, False: 17] ------------------ 27| 0| return NULL; 28| 0| } 29| | 30| 17| tsk_stack->len = 64; 31| 17| tsk_stack->top = 0; 32| 17| if ((tsk_stack->vals = ------------------ | Branch (32:9): [True: 0, False: 17] ------------------ 33| 17| (uint64_t *) tsk_malloc(tsk_stack->len * sizeof(uint64_t))) == 34| 17| NULL) { 35| 0| free(tsk_stack); 36| 0| return NULL; 37| 0| } 38| 17| return tsk_stack; 39| 17|} tsk_stack_push: 50| 6|{ 51| 6| if (a_tsk_stack->top == a_tsk_stack->len) { ------------------ | Branch (51:9): [True: 0, False: 6] ------------------ 52| 0| a_tsk_stack->len += 64; 53| 0| if ((a_tsk_stack->vals = ------------------ | Branch (53:13): [True: 0, False: 0] ------------------ 54| 0| (uint64_t *) tsk_realloc((char *) a_tsk_stack->vals, 55| 0| a_tsk_stack->len * sizeof(uint64_t))) == NULL) { 56| 0| return 1; 57| 0| } 58| 0| } 59| 6| a_tsk_stack->vals[a_tsk_stack->top++] = a_val; 60| 6| return 0; 61| 6|} tsk_stack_pop: 70| 6|{ 71| 6| a_tsk_stack->top--; 72| 6|} tsk_stack_find: 83| 6|{ 84| 6| size_t i; 85| | 86| 6| for (i = 0; i < a_tsk_stack->top; i++) { ------------------ | Branch (86:17): [True: 0, False: 6] ------------------ 87| 0| if (a_tsk_stack->vals[i] == a_val) ------------------ | Branch (87:13): [True: 0, False: 0] ------------------ 88| 0| return 1; 89| 0| } 90| 6| return 0; 91| 6|} tsk_stack_free: 100| 17|{ 101| 17| free(a_tsk_stack->vals); 102| 17| free(a_tsk_stack); 103| 17|} fatfs_open: 34| 6|{ 35| 6| const char *func_name = "fatfs_open"; 36| 6| FATFS_INFO *fatfs = NULL; 37| 6| TSK_FS_INFO *fs = NULL; 38| 6| int find_boot_sector_attempt = 0; 39| | 40| 6| tsk_error_reset(); 41| | 42| 6| if (TSK_FS_TYPE_ISFAT(a_ftype) == 0) { ------------------ | | 843| 6| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:6): [True: 6, False: 0] | | ------------------ ------------------ | Branch (42:9): [True: 0, False: 6] ------------------ 43| 0| tsk_error_reset(); 44| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 45| 0| tsk_error_set_errstr("%s: Invalid FS Type", func_name); 46| 0| return NULL; 47| 0| } 48| | 49| 6| if (a_img_info->sector_size == 0) { ------------------ | Branch (49:9): [True: 0, False: 6] ------------------ 50| 0| tsk_error_reset(); 51| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 52| 0| tsk_error_set_errstr("fatfs_open: sector size is 0"); 53| 0| return NULL; 54| 0| } 55| | 56| | // Allocate an FATFS_INFO and initialize its generic TSK_FS_INFO members. 57| 6| if ((fatfs = (FATFS_INFO*)tsk_fs_malloc(sizeof(FATFS_INFO))) == NULL) { ------------------ | Branch (57:9): [True: 0, False: 6] ------------------ 58| 0| return NULL; 59| 0| } 60| 6| fs = &(fatfs->fs_info); 61| 6| fs->ftype = a_ftype; 62| 6| fs->img_info = a_img_info; 63| 6| fs->offset = a_offset; 64| 6| fs->dev_bsize = a_img_info->sector_size; 65| 6| fs->journ_inum = 0; 66| 6| fs->tag = TSK_FS_INFO_TAG; ------------------ | | 933| 6|#define TSK_FS_INFO_TAG 0x10101010 ------------------ 67| | 68| | // Look for a FAT boot sector. Try up to three times because FAT32 and exFAT file systems have backup boot sectors. 69| 6| for (find_boot_sector_attempt = 0; find_boot_sector_attempt < 3; ++find_boot_sector_attempt) { ------------------ | Branch (69:40): [True: 6, False: 0] ------------------ 70| 6| TSK_OFF_T boot_sector_offset; 71| 6| FATFS_MASTER_BOOT_RECORD *bootSector; 72| 6| ssize_t bytes_read = 0; 73| | 74| 6| switch (find_boot_sector_attempt) { ------------------ | Branch (74:17): [True: 0, False: 6] ------------------ 75| 6| case 0: ------------------ | Branch (75:13): [True: 6, False: 0] ------------------ 76| 6| boot_sector_offset = 0; 77| 6| break; 78| 0| case 1: ------------------ | Branch (78:13): [True: 0, False: 6] ------------------ 79| | // The FATXX backup boot sector is located in sector 6, look there. 80| 0| boot_sector_offset = 6 * fs->img_info->sector_size; 81| 0| break; 82| 0| case 2: ------------------ | Branch (82:13): [True: 0, False: 6] ------------------ 83| | // The exFAT backup boot sector is located in sector 12, look there. 84| 0| boot_sector_offset = 12 * fs->img_info->sector_size; 85| 0| break; 86| 6| } 87| | 88| | // Read in the prospective boot sector. 89| 6| bytes_read = tsk_fs_read(fs, boot_sector_offset, fatfs->boot_sector_buffer, FATFS_MASTER_BOOT_RECORD_SIZE); ------------------ | | 59| 6|#define FATFS_MASTER_BOOT_RECORD_SIZE 512 ------------------ 90| 6| if (bytes_read != FATFS_MASTER_BOOT_RECORD_SIZE) { ------------------ | | 59| 6|#define FATFS_MASTER_BOOT_RECORD_SIZE 512 ------------------ | Branch (90:13): [True: 0, False: 6] ------------------ 91| 0| if (bytes_read >= 0) { ------------------ | Branch (91:17): [True: 0, False: 0] ------------------ 92| 0| tsk_error_reset(); 93| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 94| 0| } 95| 0| tsk_error_set_errstr2("%s: boot sector", func_name); 96| 0| tsk_fs_free((TSK_FS_INFO *)fatfs); 97| 0| return NULL; 98| 0| } 99| | 100| | // Check it out... 101| 6| bootSector = (FATFS_MASTER_BOOT_RECORD*)fatfs->boot_sector_buffer; 102| 6| if (tsk_fs_guessu16(fs, bootSector->magic, FATFS_FS_MAGIC) != 0) { ------------------ | | 296| 6| tsk_guess_end_u16(&(fs->endian), (x), (mag)) ------------------ | Branch (102:13): [True: 0, False: 6] ------------------ 103| | // No magic, look for a backup boot sector. 104| 0| if ((tsk_getu16(TSK_LIT_ENDIAN, bootSector->magic) == 0) && (find_boot_sector_attempt < 3)) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (104:17): [True: 0, False: 0] | Branch (104:73): [True: 0, False: 0] ------------------ 105| 0| continue; 106| 0| } 107| 0| else { 108| 0| tsk_error_reset(); 109| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 110| 0| tsk_error_set_errstr("Not a FATFS file system (magic)"); 111| 0| if (tsk_verbose) { ------------------ | Branch (111:21): [True: 0, False: 0] ------------------ 112| 0| fprintf(stderr, "%s: Incorrect FATFS magic\n", func_name); 113| 0| } 114| 0| tsk_fs_free((TSK_FS_INFO *)fatfs); 115| 0| return NULL; 116| 0| } 117| 0| } 118| 6| else { 119| | // Found the magic. 120| 6| fatfs->using_backup_boot_sector = boot_sector_offset > 0; 121| 6| if (fatfs->using_backup_boot_sector && tsk_verbose) { ------------------ | Branch (121:17): [True: 0, False: 6] | Branch (121:52): [True: 0, False: 0] ------------------ 122| 0| fprintf(stderr, "%s: Using backup boot sector\n", func_name); 123| 0| } 124| 6| break; 125| 6| } 126| 6| } 127| | 128| | // Attempt to open the file system as one of the FAT types. 129| 6| if ((a_ftype == TSK_FS_TYPE_FAT_DETECT && (fatxxfs_open(fatfs) == 0 || exfatfs_open(fatfs) == 0)) || ------------------ | Branch (129:10): [True: 6, False: 0] | Branch (129:48): [True: 6, False: 0] | Branch (129:76): [True: 0, False: 0] ------------------ 130| 6| (a_ftype == TSK_FS_TYPE_EXFAT && exfatfs_open(fatfs) == 0) || ------------------ | Branch (130:4): [True: 0, False: 0] | Branch (130:36): [True: 0, False: 0] ------------------ 131| 6| (fatxxfs_open(fatfs) == 0)) { ------------------ | Branch (131:3): [True: 0, False: 0] ------------------ 132| 6| return (TSK_FS_INFO*)fatfs; 133| 6| } 134| 0| else { 135| 0| tsk_fs_free((TSK_FS_INFO *)fatfs); 136| 0| return NULL; 137| 0| } 138| 6|} fatfs_getFAT: 236| 3.49k|{ 237| 3.49k| uint8_t *a_ptr; 238| 3.49k| uint16_t tmp16; 239| 3.49k| TSK_FS_INFO *fs = (TSK_FS_INFO *) & fatfs->fs_info; 240| 3.49k| TSK_DADDR_T sect, offs; 241| 3.49k| int cidx; 242| | 243| | /* Sanity Check */ 244| 3.49k| if (clust > fatfs->lastclust) { ------------------ | Branch (244:9): [True: 0, False: 3.49k] ------------------ 245| | /* silently ignore requests for the unclustered sectors... */ 246| 0| if ((clust == fatfs->lastclust + 1) && ------------------ | Branch (246:13): [True: 0, False: 0] ------------------ 247| 0| ((fatfs->firstclustsect + fatfs->csize * fatfs->clustcnt - ------------------ | Branch (247:13): [True: 0, False: 0] ------------------ 248| 0| 1) != fs->last_block)) { 249| 0| if (tsk_verbose) ------------------ | Branch (249:17): [True: 0, False: 0] ------------------ 250| 0| tsk_fprintf(stderr, 251| 0| "fatfs_getFAT: Ignoring request for non-clustered sector\n"); 252| 0| return 0; 253| 0| } 254| | 255| 0| tsk_error_reset(); 256| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 257| 0| tsk_error_set_errstr("fatfs_getFAT: invalid cluster address: %" 258| 0| PRIuDADDR, clust); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 259| 0| return 1; 260| 0| } 261| | 262| 3.49k| switch (fatfs->fs_info.ftype) { 263| 2.50k| case TSK_FS_TYPE_FAT12: ------------------ | Branch (263:5): [True: 2.50k, False: 993] ------------------ 264| 2.50k| if (clust & 0xf000) { ------------------ | Branch (264:13): [True: 0, False: 2.50k] ------------------ 265| 0| tsk_error_reset(); 266| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 267| 0| tsk_error_set_errstr 268| 0| ("fatfs_getFAT: TSK_FS_TYPE_FAT12 Cluster %" PRIuDADDR 269| 0| " too large", clust); 270| 0| return 1; 271| 0| } 272| | 273| | /* id the sector in the FAT */ 274| 2.50k| sect = fatfs->firstfatsect + 275| 2.50k| ((clust + (clust >> 1)) >> fatfs->ssize_sh); 276| | 277| 2.50k| tsk_take_lock(&fatfs->cache_lock); 278| | 279| | /* Load the FAT if we don't have it */ 280| | // see if it is in the cache 281| 2.50k| if (-1 == (cidx = getFATCacheIdx(fatfs, sect))) { ------------------ | Branch (281:13): [True: 0, False: 2.50k] ------------------ 282| 0| tsk_release_lock(&fatfs->cache_lock); 283| 0| return 1; 284| 0| } 285| | 286| | /* get the offset into the cache */ 287| 2.50k| offs = ((sect - fatfs->fatc_addr[cidx]) << fatfs->ssize_sh) + 288| 2.50k| (clust + (clust >> 1)) % fatfs->ssize; 289| | 290| | /* special case when the 12-bit value goes across the cache 291| | * we load the cache to start at this sect. The cache 292| | * size must therefore be at least 2 sectors large 293| | */ 294| 2.50k| if (offs == (FATFS_FAT_CACHE_B - 1)) { ------------------ | | 57| 2.50k|#define FATFS_FAT_CACHE_B 4096 ------------------ | Branch (294:13): [True: 0, False: 2.50k] ------------------ 295| 0| ssize_t cnt; 296| | 297| | // read the data -- TTLs will already have been updated 298| 0| cnt = 299| 0| tsk_fs_read(fs, sect * fs->block_size, 300| 0| fatfs->fatc_buf[cidx], FATFS_FAT_CACHE_B); ------------------ | | 57| 0|#define FATFS_FAT_CACHE_B 4096 ------------------ 301| 0| if (cnt != FATFS_FAT_CACHE_B) { ------------------ | | 57| 0|#define FATFS_FAT_CACHE_B 4096 ------------------ | Branch (301:17): [True: 0, False: 0] ------------------ 302| 0| tsk_release_lock(&fatfs->cache_lock); 303| 0| if (cnt >= 0) { ------------------ | Branch (303:21): [True: 0, False: 0] ------------------ 304| 0| tsk_error_reset(); 305| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 306| 0| } 307| 0| tsk_error_set_errstr2 308| 0| ("fatfs_getFAT: TSK_FS_TYPE_FAT12 FAT overlap: %" 309| 0| PRIuDADDR, sect); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 310| 0| return 1; 311| 0| } 312| 0| fatfs->fatc_addr[cidx] = sect; 313| | 314| 0| offs = (clust + (clust >> 1)) % fatfs->ssize; 315| 0| } 316| | 317| | /* get pointer to entry in current buffer */ 318| 2.50k| a_ptr = (uint8_t *) fatfs->fatc_buf[cidx] + offs; 319| | 320| 2.50k| tmp16 = tsk_getu16(fs->endian, a_ptr); ------------------ | | 86| 2.50k|#define tsk_getu16(endian, x) \ | | 87| 2.50k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 2.50k, False: 0] | | ------------------ | | 88| 2.50k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 2.50k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 321| | 322| 2.50k| tsk_release_lock(&fatfs->cache_lock); 323| | 324| | /* slide it over if it is one of the odd clusters */ 325| 2.50k| if (clust & 1) ------------------ | Branch (325:13): [True: 1.25k, False: 1.25k] ------------------ 326| 1.25k| tmp16 >>= 4; 327| | 328| 2.50k| *value = tmp16 & FATFS_12_MASK; ------------------ | | 67| 2.50k|#define FATFS_12_MASK 0x00000fff ------------------ 329| | 330| | /* sanity check */ 331| 2.50k| if ((*value > (fatfs->lastclust)) && ------------------ | Branch (331:13): [True: 20, False: 2.48k] ------------------ 332| 2.50k| (*value < (0x0ffffff7 & FATFS_12_MASK))) { ------------------ | | 67| 20|#define FATFS_12_MASK 0x00000fff ------------------ | Branch (332:13): [True: 0, False: 20] ------------------ 333| 0| if (tsk_verbose) ------------------ | Branch (333:17): [True: 0, False: 0] ------------------ 334| 0| tsk_fprintf(stderr, 335| 0| "fatfs_getFAT: TSK_FS_TYPE_FAT12 cluster (%" PRIuDADDR 336| 0| ") too large (%" PRIuDADDR ") - resetting\n", clust, 337| 0| *value); 338| 0| *value = 0; 339| 0| } 340| 2.50k| return 0; 341| | 342| 0| case TSK_FS_TYPE_FAT16: ------------------ | Branch (342:5): [True: 0, False: 3.49k] ------------------ 343| | /* Get sector in FAT for cluster and load it if needed */ 344| 0| sect = fatfs->firstfatsect + ((clust << 1) >> fatfs->ssize_sh); 345| | 346| 0| tsk_take_lock(&fatfs->cache_lock); 347| | 348| 0| if (-1 == (cidx = getFATCacheIdx(fatfs, sect))) { ------------------ | Branch (348:13): [True: 0, False: 0] ------------------ 349| 0| tsk_release_lock(&fatfs->cache_lock); 350| 0| return 1; 351| 0| } 352| | 353| | 354| | /* get pointer to entry in the cache buffer */ 355| 0| a_ptr = (uint8_t *) fatfs->fatc_buf[cidx] + 356| 0| ((sect - fatfs->fatc_addr[cidx]) << fatfs->ssize_sh) + 357| 0| ((clust << 1) % fatfs->ssize); 358| | 359| 0| *value = tsk_getu16(fs->endian, a_ptr) & FATFS_16_MASK; ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ *value = tsk_getu16(fs->endian, a_ptr) & FATFS_16_MASK; ------------------ | | 68| 0|#define FATFS_16_MASK 0x0000ffff ------------------ 360| | 361| 0| tsk_release_lock(&fatfs->cache_lock); 362| | 363| | /* sanity check */ 364| 0| if ((*value > (fatfs->lastclust)) && ------------------ | Branch (364:13): [True: 0, False: 0] ------------------ 365| 0| (*value < (0x0ffffff7 & FATFS_16_MASK))) { ------------------ | | 68| 0|#define FATFS_16_MASK 0x0000ffff ------------------ | Branch (365:13): [True: 0, False: 0] ------------------ 366| 0| if (tsk_verbose) ------------------ | Branch (366:17): [True: 0, False: 0] ------------------ 367| 0| tsk_fprintf(stderr, 368| 0| "fatfs_getFAT: contents of TSK_FS_TYPE_FAT16 entry %" 369| 0| PRIuDADDR " too large - resetting\n", clust); 370| 0| *value = 0; 371| 0| } 372| 0| return 0; 373| | 374| 993| case TSK_FS_TYPE_FAT32: ------------------ | Branch (374:5): [True: 993, False: 2.50k] ------------------ 375| 993| case TSK_FS_TYPE_EXFAT: ------------------ | Branch (375:5): [True: 0, False: 3.49k] ------------------ 376| | /* Get sector in FAT for cluster and load if needed */ 377| 993| sect = fatfs->firstfatsect + ((clust << 2) >> fatfs->ssize_sh); 378| | 379| 993| tsk_take_lock(&fatfs->cache_lock); 380| | 381| 993| if (-1 == (cidx = getFATCacheIdx(fatfs, sect))) { ------------------ | Branch (381:13): [True: 0, False: 993] ------------------ 382| 0| tsk_release_lock(&fatfs->cache_lock); 383| 0| return 1; 384| 0| } 385| | 386| | /* get pointer to entry in current buffer */ 387| 993| a_ptr = (uint8_t *) fatfs->fatc_buf[cidx] + 388| 993| ((sect - fatfs->fatc_addr[cidx]) << fatfs->ssize_sh) + 389| 993| (clust << 2) % fatfs->ssize; 390| | 391| 993| *value = tsk_getu32(fs->endian, a_ptr) & FATFS_32_MASK; ------------------ | | 119| 993|#define tsk_getu32(endian, x) \ | | 120| 993|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 993, False: 0] | | ------------------ | | 121| 993| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 993| (((uint8_t *)(x))[1] << 8) + \ | | 123| 993| (((uint8_t *)(x))[2] << 16) + \ | | 124| 993| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 993| : \ | | 126| 993| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ *value = tsk_getu32(fs->endian, a_ptr) & FATFS_32_MASK; ------------------ | | 69| 993|#define FATFS_32_MASK 0x0fffffff ------------------ 392| | 393| 993| tsk_release_lock(&fatfs->cache_lock); 394| | 395| | /* sanity check */ 396| 993| if ((*value > fatfs->lastclust) && ------------------ | Branch (396:13): [True: 18, False: 975] ------------------ 397| 993| (*value < (0x0ffffff7 & FATFS_32_MASK))) { ------------------ | | 69| 18|#define FATFS_32_MASK 0x0fffffff ------------------ | Branch (397:13): [True: 0, False: 18] ------------------ 398| 0| if (tsk_verbose) ------------------ | Branch (398:17): [True: 0, False: 0] ------------------ 399| 0| tsk_fprintf(stderr, 400| 0| "fatfs_getFAT: contents of entry %" PRIuDADDR 401| 0| " too large - resetting\n", clust); 402| | 403| 0| *value = 0; 404| 0| } 405| 993| return 0; 406| | 407| 0| default: ------------------ | Branch (407:5): [True: 0, False: 3.49k] ------------------ 408| 0| tsk_error_reset(); 409| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 410| 0| tsk_error_set_errstr("fatfs_getFAT: Unknown FAT type: %d", 411| 0| fatfs->fs_info.ftype); 412| 0| return 1; 413| 3.49k| } 414| 3.49k|} fatfs_block_getflags: 698| 933|{ 699| 933| FATFS_INFO *fatfs = (FATFS_INFO *) a_fs; 700| 933| int flags = 0; 701| | 702| | // FATs and boot sector 703| 933| if (a_addr < fatfs->firstdatasect) { ------------------ | Branch (703:9): [True: 0, False: 933] ------------------ 704| 0| flags = TSK_FS_BLOCK_FLAG_META | TSK_FS_BLOCK_FLAG_ALLOC; 705| 0| } 706| | // root directory for FAT12/16 707| 933| else if (a_addr < fatfs->firstclustsect) { ------------------ | Branch (707:14): [True: 928, False: 5] ------------------ 708| 928| flags = TSK_FS_BLOCK_FLAG_CONT | TSK_FS_BLOCK_FLAG_ALLOC; 709| 928| } 710| 5| else { 711| 5| int retval; 712| 5| flags = TSK_FS_BLOCK_FLAG_CONT; 713| | 714| | /* Identify its allocation status */ 715| 5| retval = fatfs_is_sectalloc(fatfs, a_addr); 716| 5| if (retval != -1) { ------------------ | Branch (716:13): [True: 5, False: 0] ------------------ 717| 5| if (retval == 1) ------------------ | Branch (717:17): [True: 5, False: 0] ------------------ 718| 5| flags |= TSK_FS_BLOCK_FLAG_ALLOC; 719| 0| else 720| 0| flags |= TSK_FS_BLOCK_FLAG_UNALLOC; 721| 5| } 722| 5| } 723| 933| return (TSK_FS_BLOCK_FLAG_ENUM)flags; 724| 933|} fatfs_is_sectalloc: 736| 4.26k|{ 737| 4.26k| TSK_FS_INFO *fs = (TSK_FS_INFO *) fatfs; 738| | /* If less than the first cluster sector, then it is allocated 739| | * otherwise check the FAT 740| | */ 741| 4.26k| if (sect < fatfs->firstclustsect) ------------------ | Branch (741:9): [True: 771, False: 3.49k] ------------------ 742| 771| return 1; 743| | 744| | /* If we are in the unused area, then we are "unalloc" */ 745| 3.49k| if ((sect <= fs->last_block) && ------------------ | Branch (745:9): [True: 3.49k, False: 0] ------------------ 746| 3.49k| (sect >= (fatfs->firstclustsect + fatfs->csize * fatfs->clustcnt))) ------------------ | Branch (746:9): [True: 0, False: 3.49k] ------------------ 747| 0| return 0; 748| | 749| 3.49k| return fatfs->is_cluster_alloc(fatfs, FATFS_SECT_2_CLUST(fatfs, sect)); ------------------ | | 89| 3.49k| (TSK_DADDR_T)(2 + ((s) - fatfs->firstclustsect) / fatfs->csize) ------------------ 750| 3.49k|} fatfs_close: 818| 6|{ 819| 6| FATFS_INFO *fatfs = (FATFS_INFO *) fs; 820| | 821| 6| fatfs_dir_buf_free(fatfs); 822| | 823| 6| fs->tag = 0; 824| 6| memset(fatfs->boot_sector_buffer, 0, FATFS_MASTER_BOOT_RECORD_SIZE); ------------------ | | 59| 6|#define FATFS_MASTER_BOOT_RECORD_SIZE 512 ------------------ 825| 6| tsk_deinit_lock(&fatfs->cache_lock); 826| 6| tsk_deinit_lock(&fatfs->dir_lock); 827| | 828| 6| tsk_fs_free(fs); 829| 6|} fatfs.c:getFATCacheIdx: 150| 3.49k|{ 151| 3.49k| int i, cidx; 152| 3.49k| ssize_t cnt; 153| 3.49k| TSK_FS_INFO *fs = (TSK_FS_INFO *) & fatfs->fs_info; 154| | 155| | // see if we already have it in the cache 156| 14.0k| for (i = 0; i < FATFS_FAT_CACHE_N; i++) { ------------------ | | 56| 14.0k|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ | Branch (156:17): [True: 13.9k, False: 6] ------------------ 157| 13.9k| if ((fatfs->fatc_ttl[i] > 0) && ------------------ | Branch (157:13): [True: 3.49k, False: 10.5k] ------------------ 158| 13.9k| (sect >= fatfs->fatc_addr[i]) && ------------------ | Branch (158:13): [True: 3.49k, False: 0] ------------------ 159| 13.9k| (sect < (fatfs->fatc_addr[i] + (FATFS_FAT_CACHE_B >> fatfs->ssize_sh)))) { ------------------ | | 57| 3.49k|#define FATFS_FAT_CACHE_B 4096 ------------------ | Branch (159:13): [True: 3.49k, False: 0] ------------------ 160| 3.49k| int a; 161| | 162| | // update the TTLs to push i to the front 163| 17.4k| for (a = 0; a < FATFS_FAT_CACHE_N; a++) { ------------------ | | 56| 17.4k|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ | Branch (163:25): [True: 13.9k, False: 3.49k] ------------------ 164| 13.9k| if (fatfs->fatc_ttl[a] == 0) ------------------ | Branch (164:21): [True: 10.4k, False: 3.49k] ------------------ 165| 10.4k| continue; 166| | 167| 3.49k| if (fatfs->fatc_ttl[a] < fatfs->fatc_ttl[i]) ------------------ | Branch (167:21): [True: 0, False: 3.49k] ------------------ 168| 0| fatfs->fatc_ttl[a]++; 169| 3.49k| } 170| 3.49k| fatfs->fatc_ttl[i] = 1; 171| |// fprintf(stdout, "FAT Hit: %d\n", sect); 172| |// fflush(stdout); 173| 3.49k| return i; 174| 3.49k| } 175| 13.9k| } 176| | 177| |// fprintf(stdout, "FAT Miss: %d\n", (int)sect); 178| |// fflush(stdout); 179| | 180| | // Look for an unused entry or an entry with a TTL of FATFS_FAT_CACHE_N 181| 6| cidx = 0; 182| 30| for (i = 0; i < FATFS_FAT_CACHE_N; i++) { ------------------ | | 56| 30|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ | Branch (182:17): [True: 24, False: 6] ------------------ 183| 24| if ((fatfs->fatc_ttl[i] == 0) || ------------------ | Branch (183:13): [True: 24, False: 0] ------------------ 184| 24| (fatfs->fatc_ttl[i] >= FATFS_FAT_CACHE_N)) { ------------------ | | 56| 0|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ | Branch (184:13): [True: 0, False: 0] ------------------ 185| 24| cidx = i; 186| 24| } 187| 24| } 188| |// fprintf(stdout, "FAT Removing: %d\n", (int)fatfs->fatc_addr[cidx]); 189| | // fflush(stdout); 190| | 191| | // read the data 192| 6| cnt = 193| 6| tsk_fs_read(fs, sect * fs->block_size, fatfs->fatc_buf[cidx], 194| 6| FATFS_FAT_CACHE_B); ------------------ | | 57| 6|#define FATFS_FAT_CACHE_B 4096 ------------------ 195| 6| if (cnt != FATFS_FAT_CACHE_B) { ------------------ | | 57| 6|#define FATFS_FAT_CACHE_B 4096 ------------------ | Branch (195:9): [True: 0, False: 6] ------------------ 196| 0| if (cnt >= 0) { ------------------ | Branch (196:13): [True: 0, False: 0] ------------------ 197| 0| tsk_error_reset(); 198| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 199| 0| } 200| 0| tsk_error_set_errstr2("getFATCacheIdx: FAT: %" PRIuDADDR, sect); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 201| 0| return -1; 202| 0| } 203| | 204| | // update the TTLs 205| 6| if (fatfs->fatc_ttl[cidx] == 0) // special case for unused entry ------------------ | Branch (205:9): [True: 6, False: 0] ------------------ 206| 6| fatfs->fatc_ttl[cidx] = FATFS_FAT_CACHE_N + 1; ------------------ | | 56| 6|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ 207| | 208| 30| for (i = 0; i < FATFS_FAT_CACHE_N; i++) { ------------------ | | 56| 30|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ | Branch (208:17): [True: 24, False: 6] ------------------ 209| 24| if (fatfs->fatc_ttl[i] == 0) ------------------ | Branch (209:13): [True: 18, False: 6] ------------------ 210| 18| continue; 211| | 212| 6| if (fatfs->fatc_ttl[i] < fatfs->fatc_ttl[cidx]) ------------------ | Branch (212:13): [True: 0, False: 6] ------------------ 213| 0| fatfs->fatc_ttl[i]++; 214| 6| } 215| | 216| 6| fatfs->fatc_ttl[cidx] = 1; 217| 6| fatfs->fatc_addr[cidx] = sect; 218| | 219| 6| return cidx; 220| 6|} fatfs_dir_buf_add: 96| 2|{ 97| 2| tsk_take_lock(&fatfs->dir_lock); 98| 2| std::map *tmpMap = getParentMap(fatfs); 99| 2| (*tmpMap)[dir_inum] = par_inum; 100| 2| tsk_release_lock(&fatfs->dir_lock); 101| | 102| 2| return 0; 103| 2|} fatfs_dir_buf_free: 131| 6|void fatfs_dir_buf_free(FATFS_INFO *fatfs) { 132| 6| tsk_take_lock(&fatfs->dir_lock); 133| 6| if (fatfs->inum2par != NULL) { ------------------ | Branch (133:9): [True: 1, False: 5] ------------------ 134| 1| std::map *tmpMap = getParentMap(fatfs); 135| 1| delete tmpMap; 136| 1| fatfs->inum2par = NULL; 137| 1| } 138| 6| tsk_release_lock(&fatfs->dir_lock); 139| 6|} fatfs_dir_open_meta: 229| 34|{ 230| 34| const char *func_name = "fatfs_dir_open_meta"; 231| 34| TSK_OFF_T size, len; 232| 34| FATFS_INFO *fatfs = (FATFS_INFO *) a_fs; 233| 34| char *dirbuf; 234| 34| TSK_DADDR_T *addrbuf; 235| 34| FATFS_LOAD_DIR load; 236| 34| TSK_RETVAL_ENUM retval; 237| | 238| 34| TSK_FS_DIR *fs_dir; 239| | 240| 34| if ((a_addr < a_fs->first_inum) || (a_addr > a_fs->last_inum)) { ------------------ | Branch (240:9): [True: 0, False: 34] | Branch (240:40): [True: 0, False: 34] ------------------ 241| 0| tsk_error_reset(); 242| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| tsk_error_set_errstr("%s: invalid a_addr value: %" 244| 0| PRIuINUM "\n", func_name, a_addr); 245| 0| return TSK_ERR; 246| 0| } 247| 34| else if (a_fs_dir == NULL) { ------------------ | Branch (247:14): [True: 0, False: 34] ------------------ 248| 0| tsk_error_reset(); 249| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 250| 0| tsk_error_set_errstr 251| 0| ("%s: NULL fs_attr argument given", func_name); 252| 0| return TSK_ERR; 253| 0| } 254| | 255| 34| fs_dir = *a_fs_dir; 256| 34| if (fs_dir) { ------------------ | Branch (256:9): [True: 0, False: 34] ------------------ 257| 0| tsk_fs_dir_reset(fs_dir); 258| 0| fs_dir->addr = a_addr; 259| 0| } 260| 34| else { 261| 34| if ((*a_fs_dir = fs_dir = ------------------ | Branch (261:13): [True: 0, False: 34] ------------------ 262| 34| tsk_fs_dir_alloc(a_fs, a_addr, 128)) == NULL) { 263| 0| return TSK_ERR; 264| 0| } 265| 34| } 266| | 267| | // handle the orphan directory if its contents were requested 268| 34| if (a_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 34| (fs_info->last_inum) ------------------ | Branch (268:9): [True: 6, False: 28] ------------------ 269| 6| return tsk_fs_dir_find_orphans(a_fs, fs_dir); 270| 6| } 271| | 272| 28| fs_dir->fs_file = tsk_fs_file_open_meta(a_fs, NULL, a_addr); 273| 28| if (fs_dir->fs_file == NULL) { ------------------ | Branch (273:9): [True: 0, False: 28] ------------------ 274| 0| tsk_error_reset(); 275| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_NUM); ------------------ | | 353| 0|#define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 8) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 276| 0| tsk_error_set_errstr("%s: %" PRIuINUM 277| 0| " is not a valid inode", func_name, a_addr); 278| 0| return TSK_COR; 279| 0| } 280| | 281| 28| size = fs_dir->fs_file->meta->size; 282| 28| len = roundup(size, fatfs->ssize); 283| | 284| 28| if (tsk_verbose) { ------------------ | Branch (284:9): [True: 0, False: 28] ------------------ 285| 0| tsk_fprintf(stderr, 286| 0| "%s: Processing directory %" PRIuINUM "\n", 287| 0| func_name, a_addr); 288| 0| } 289| | 290| 28| if (size == 0) { ------------------ | Branch (290:9): [True: 0, False: 28] ------------------ 291| 0| if (tsk_verbose) ------------------ | Branch (291:13): [True: 0, False: 0] ------------------ 292| 0| tsk_fprintf(stderr, 293| 0| "%s: directory has 0 size\n", func_name); 294| 0| return TSK_OK; 295| 0| } 296| | 297| | /* Make a copy of the directory contents using file_walk */ 298| 28| if ((dirbuf = (char *)tsk_malloc((size_t) len)) == NULL) { ------------------ | Branch (298:9): [True: 0, False: 28] ------------------ 299| 0| return TSK_ERR; 300| 0| } 301| 28| load.curdirptr = dirbuf; 302| 28| load.dirleft = (size_t) size; 303| | 304| | /* We are going to save the address of each sector in the directory 305| | * in a stack - they are needed to determine the inode address. 306| | */ 307| 28| load.addrsize = (size_t) (len / fatfs->ssize); 308| 28| addrbuf = 309| 28| (TSK_DADDR_T *) tsk_malloc(load.addrsize * sizeof(TSK_DADDR_T)); 310| 28| if (addrbuf == NULL) { ------------------ | Branch (310:9): [True: 0, False: 28] ------------------ 311| 0| free(dirbuf); 312| 0| return TSK_ERR; 313| 0| } 314| | 315| | /* Set the variables that are used during the copy */ 316| 28| load.addridx = 0; 317| 28| load.addrbuf = addrbuf; 318| | 319| | /* save the directory contents into dirbuf */ 320| 28| if (tsk_fs_file_walk(fs_dir->fs_file, ------------------ | Branch (320:9): [True: 0, False: 28] ------------------ 321| 28| TSK_FS_FILE_WALK_FLAG_SLACK, 322| 28| fatfs_dent_action, (void *) &load)) { 323| 0| tsk_error_errstr2_concat("- %s", func_name); 324| 0| free(dirbuf); 325| 0| free(addrbuf); 326| 0| return TSK_COR; 327| 0| } 328| | 329| | /* We did not copy the entire directory, which occurs if an error occurred */ 330| 28| if (load.dirleft > 0) { ------------------ | Branch (330:9): [True: 0, False: 28] ------------------ 331| 0| tsk_error_reset(); 332| 0| tsk_error_set_errno(TSK_ERR_FS_FWALK); ------------------ | | 356| 0|#define TSK_ERR_FS_FWALK (TSK_ERR_FS | 11) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 333| 0| tsk_error_set_errstr 334| 0| ("%s: Error reading directory %" PRIuINUM, ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 335| 0| func_name, a_addr); 336| | 337| | /* Free the local buffers */ 338| 0| free(dirbuf); 339| 0| free(addrbuf); 340| 0| return TSK_COR; 341| 0| } 342| | 343| 28| if (tsk_verbose) ------------------ | Branch (343:9): [True: 0, False: 28] ------------------ 344| 0| fprintf(stderr, 345| 0| "%s: Parsing directory %" PRIuINUM "\n", 346| 0| func_name, a_addr); 347| | 348| 28| retval = fatfs->dent_parse_buf(fatfs, fs_dir, dirbuf, len, addrbuf, recursion_depth); 349| | 350| 28| free(dirbuf); 351| 28| free(addrbuf); 352| | 353| | // if we are listing the root directory, add the Orphan directory and special FAT file entries 354| 28| if (a_addr == a_fs->root_inum) { ------------------ | Branch (354:9): [True: 28, False: 0] ------------------ 355| 28| TSK_FS_NAME *fs_name = tsk_fs_name_alloc(256, 0); 356| 28| if (fs_name == NULL) ------------------ | Branch (356:13): [True: 0, False: 28] ------------------ 357| 0| return TSK_ERR; 358| | 359| | // MBR Entry 360| 28| strncpy(fs_name->name, FATFS_MBRNAME, fs_name->name_size); ------------------ | | 47| 28|#define FATFS_MBRNAME "$MBR" ------------------ 361| 28| fs_name->meta_addr = fatfs->mbr_virt_inum; 362| 28| fs_name->type = TSK_FS_NAME_TYPE_VIRT; 363| 28| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 364| 28| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (364:13): [True: 0, False: 28] ------------------ 365| 0| tsk_fs_name_free(fs_name); 366| 0| return TSK_ERR; 367| 0| } 368| | 369| | // FAT1 Entry 370| 28| strncpy(fs_name->name, FATFS_FAT1NAME, fs_name->name_size); ------------------ | | 48| 28|#define FATFS_FAT1NAME "$FAT1" ------------------ 371| 28| fs_name->meta_addr = fatfs->fat1_virt_inum; 372| 28| fs_name->type = TSK_FS_NAME_TYPE_VIRT; 373| 28| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 374| 28| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (374:13): [True: 0, False: 28] ------------------ 375| 0| tsk_fs_name_free(fs_name); 376| 0| return TSK_ERR; 377| 0| } 378| | 379| | // FAT2 Entry 380| 28| if (fatfs->numfat == 2) { ------------------ | Branch (380:13): [True: 28, False: 0] ------------------ 381| 28| strncpy(fs_name->name, FATFS_FAT2NAME, fs_name->name_size); ------------------ | | 49| 28|#define FATFS_FAT2NAME "$FAT2" ------------------ 382| 28| fs_name->meta_addr = fatfs->fat2_virt_inum; 383| 28| fs_name->type = TSK_FS_NAME_TYPE_VIRT; 384| 28| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 385| 28| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (385:17): [True: 0, False: 28] ------------------ 386| 0| tsk_fs_name_free(fs_name); 387| 0| return TSK_ERR; 388| 0| } 389| 28| } 390| | 391| | // orphan directory 392| 28| if (tsk_fs_dir_make_orphan_dir_name(a_fs, fs_name)) { ------------------ | Branch (392:13): [True: 0, False: 28] ------------------ 393| 0| tsk_fs_name_free(fs_name); 394| 0| return TSK_ERR; 395| 0| } 396| 28| if (tsk_fs_dir_add(fs_dir, fs_name)) { ------------------ | Branch (396:13): [True: 0, False: 28] ------------------ 397| 0| tsk_fs_name_free(fs_name); 398| 0| return TSK_ERR; 399| 0| } 400| 28| tsk_fs_name_free(fs_name); 401| 28| } 402| | 403| 28| return retval; 404| 28|} fatfs_dent.cpp:_ZL12getParentMapP10FATFS_INFO: 77| 3|static std::map * getParentMap(FATFS_INFO *fatfs) { 78| | // allocate it if it hasn't already been 79| 3| if (fatfs->inum2par == NULL) { ------------------ | Branch (79:9): [True: 1, False: 2] ------------------ 80| 1| fatfs->inum2par = new std::map; 81| 1| } 82| 3| return (std::map *)fatfs->inum2par; 83| 3|} fatfs_dent.cpp:_ZL17fatfs_dent_actionP11TSK_FS_FILElmPcm22TSK_FS_BLOCK_FLAG_ENUMPv: 178| 772|{ 179| 772| FATFS_LOAD_DIR *load = (FATFS_LOAD_DIR *) ptr; 180| | 181| | /* how much of the buffer are we copying */ 182| 772| size_t len = (load->dirleft < size) ? load->dirleft : size; ------------------ | Branch (182:18): [True: 0, False: 772] ------------------ 183| | 184| | /* Copy the sector into a buffer and increment the pointers */ 185| 772| memcpy(load->curdirptr, buf, len); 186| 772| load->curdirptr = (char *) ((uintptr_t) load->curdirptr + len); 187| 772| load->dirleft -= len; 188| | 189| | /* fill in the stack of addresses of sectors 190| | * 191| | * if we are at the last entry, then realloc more */ 192| 772| if (load->addridx == load->addrsize) { ------------------ | Branch (192:9): [True: 0, False: 772] ------------------ 193| 0| tsk_error_reset(); 194| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 195| 0| tsk_error_set_errstr 196| 0| ("fatfs_dent_walk: Trying to put more sector address in stack than were allocated (%lu)", 197| 0| (long) load->addridx); 198| 0| return TSK_WALK_ERROR; 199| 0| } 200| | 201| | /* Add this sector to the stack */ 202| 772| load->addrbuf[load->addridx++] = addr; 203| | 204| 772| if (load->dirleft) ------------------ | Branch (204:9): [True: 744, False: 28] ------------------ 205| 744| return TSK_WALK_CONT; 206| 28| else 207| 28| return TSK_WALK_STOP; 208| 772|} fatfs_get_default_attr_type: 32| 40|{ 33| 40| return TSK_FS_ATTR_TYPE_DEFAULT; 34| 40|} fatfs_dentry_load: 269| 7|{ 270| 7| const char *func_name = "fatfs_dentry_load"; 271| 7| TSK_FS_INFO *fs = (TSK_FS_INFO*)a_fatfs; 272| 7| TSK_DADDR_T sect = 0; 273| 7| size_t off = 0; 274| 7| ssize_t cnt = 0; 275| | 276| 7| tsk_error_reset(); 277| 7| if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name) || ------------------ | Branch (277:9): [True: 0, False: 7] ------------------ 278| 7| fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name) || ------------------ | Branch (278:9): [True: 0, False: 7] ------------------ 279| 7| !fatfs_inum_arg_is_in_range(a_fatfs, a_inum, func_name)) { ------------------ | Branch (279:9): [True: 0, False: 7] ------------------ 280| 0| return 1; 281| 0| } 282| | 283| | /* Map the inode address to a sector. */ 284| 7| sect = FATFS_INODE_2_SECT(a_fatfs, a_inum); ------------------ | | 95| 7| (TSK_DADDR_T)((i - FATFS_FIRST_NORMINO)/(fatfs->dentry_cnt_se) + fatfs->firstdatasect) | | ------------------ | | | | 44| 7|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 285| 7| if (sect > fs->last_block) { ------------------ | Branch (285:9): [True: 0, False: 7] ------------------ 286| 0| tsk_error_reset(); 287| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_NUM); ------------------ | | 353| 0|#define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 8) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 288| 0| tsk_error_set_errstr("%s: Inode %" PRIuINUM 289| 0| " in sector too big for image: %" PRIuDADDR, func_name, a_inum, sect); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 290| 0| return 1; 291| 0| } 292| | 293| | /* Get the byte offset of the inode address within the sector. */ 294| 7| off = FATFS_INODE_2_OFF(a_fatfs, a_inum); ------------------ | | 98| 7| (size_t)(((i - FATFS_FIRST_NORMINO) % fatfs->dentry_cnt_se) * sizeof(FATFS_DENTRY)) | | ------------------ | | | | 44| 7|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 295| | 296| | /* Read in the bytes. */ 297| 7| cnt = tsk_fs_read(fs, sect * fs->block_size + off, (char*)a_dentry, sizeof(FATFS_DENTRY)); 298| 7| if (cnt != sizeof(FATFS_DENTRY)) { ------------------ | Branch (298:9): [True: 0, False: 7] ------------------ 299| 0| if (cnt >= 0) { ------------------ | Branch (299:13): [True: 0, False: 0] ------------------ 300| 0| tsk_error_reset(); 301| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 302| 0| } 303| 0| tsk_error_set_errstr2("%s: block: %" PRIuDADDR, ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 304| 0| func_name, sect); 305| 0| return 1; 306| 0| } 307| | 308| 7| return 0; 309| 7|} fatfs_inode_lookup: 325| 103|{ 326| 103| const char *func_name = "fatfs_inode_lookup"; 327| 103| FATFS_INFO *fatfs = (FATFS_INFO*)a_fs; 328| | 329| 103| tsk_error_reset(); 330| 103| if (fatfs_ptr_arg_is_null(a_fs, "a_fs", func_name) || ------------------ | Branch (330:9): [True: 0, False: 103] ------------------ 331| 103| fatfs_ptr_arg_is_null(a_fs_file, "a_fs_file", func_name) || ------------------ | Branch (331:9): [True: 0, False: 103] ------------------ 332| 103| !fatfs_inum_arg_is_in_range(fatfs, a_inum, func_name)) { ------------------ | Branch (332:9): [True: 0, False: 103] ------------------ 333| 0| return 1; 334| 0| } 335| | 336| | /* Allocate or reset the TSK_FS_META struct. */ 337| 103| if (a_fs_file->meta == NULL) { ------------------ | Branch (337:9): [True: 103, False: 0] ------------------ 338| 103| if ((a_fs_file->meta = ------------------ | Branch (338:13): [True: 0, False: 103] ------------------ 339| 103| tsk_fs_meta_alloc(FATFS_FILE_CONTENT_LEN)) == NULL) { ------------------ | | 72| 103|#define FATFS_FILE_CONTENT_LEN sizeof(TSK_DADDR_T) // we will store the starting cluster ------------------ 340| 0| return 1; 341| 0| } 342| 103| } 343| 0| else { 344| 0| tsk_fs_meta_reset(a_fs_file->meta); 345| 0| } 346| | 347| | /* Manufacture an inode for the root directory or a FAT virtual file, 348| | * or do a look up. */ 349| 103| if (a_inum == a_fs->root_inum) { ------------------ | Branch (349:9): [True: 28, False: 75] ------------------ 350| 28| if (fatfs_make_root(fatfs, a_fs_file->meta)) ------------------ | Branch (350:13): [True: 0, False: 28] ------------------ 351| 0| return 1; 352| 28| else 353| 28| return 0; 354| 28| } 355| 75| else if (a_inum == fatfs->mbr_virt_inum) { ------------------ | Branch (355:14): [True: 17, False: 58] ------------------ 356| 17| if (fatfs_make_mbr(fatfs, a_fs_file->meta)) ------------------ | Branch (356:13): [True: 0, False: 17] ------------------ 357| 0| return 1; 358| 17| else 359| 17| return 0; 360| 17| } 361| 58| else if (a_inum == fatfs->fat1_virt_inum) { ------------------ | Branch (361:14): [True: 17, False: 41] ------------------ 362| 17| if (fatfs_make_fat(fatfs, 1, a_fs_file->meta)) ------------------ | Branch (362:13): [True: 0, False: 17] ------------------ 363| 0| return 1; 364| 17| else 365| 17| return 0; 366| 17| } 367| 41| else if (a_inum == fatfs->fat2_virt_inum && fatfs->numfat == 2) { ------------------ | Branch (367:14): [True: 17, False: 24] | Branch (367:49): [True: 17, False: 0] ------------------ 368| 17| if (fatfs_make_fat(fatfs, 2, a_fs_file->meta)) ------------------ | Branch (368:13): [True: 0, False: 17] ------------------ 369| 0| return 1; 370| 17| else 371| 17| return 0; 372| 17| } 373| 24| else if (a_inum == TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 24| (fs_info->last_inum) ------------------ | Branch (373:14): [True: 17, False: 7] ------------------ 374| 17| if (tsk_fs_dir_make_orphan_dir_meta(a_fs, a_fs_file->meta)) ------------------ | Branch (374:13): [True: 0, False: 17] ------------------ 375| 0| return 1; 376| 17| else 377| 17| return 0; 378| 17| } 379| 7| else { 380| 7| return fatfs->inode_lookup(fatfs, a_fs_file, a_inum); 381| 7| } 382| 103|} fatfs_make_data_runs: 395| 40|{ 396| 40| const char *func_name = "fatfs_make_data_runs"; 397| 40| TSK_FS_INFO *fs = NULL; 398| 40| TSK_FS_META *fs_meta = NULL; 399| 40| FATFS_INFO *fatfs = NULL; 400| 40| TSK_DADDR_T clust = 0; 401| 40| TSK_OFF_T size_remain = 0; 402| 40| TSK_FS_ATTR *fs_attr = NULL; 403| | 404| 40| if ((fatfs_ptr_arg_is_null(a_fs_file, "a_fs_file", func_name)) || ------------------ | Branch (404:9): [True: 0, False: 40] ------------------ 405| 40| (fatfs_ptr_arg_is_null(a_fs_file->meta, "a_fs_file->meta", func_name)) || ------------------ | Branch (405:9): [True: 0, False: 40] ------------------ 406| 40| (fatfs_ptr_arg_is_null(a_fs_file->fs_info, "a_fs_file->fs_info", func_name))) { ------------------ | Branch (406:9): [True: 0, False: 40] ------------------ 407| 0| return TSK_ERR; 408| 0| } 409| | 410| 40| fs_meta = a_fs_file->meta; 411| 40| fs = a_fs_file->fs_info; 412| 40| fatfs = (FATFS_INFO*)fs; 413| | 414| | /* Check for an already populated attribute list, since a lazy strategy 415| | * is used to fill in attributes. If the attribute list is not yet 416| | * allocated, do so now. */ 417| 40| if ((fs_meta->attr != NULL) ------------------ | Branch (417:9): [True: 0, False: 40] ------------------ 418| 40| && (fs_meta->attr_state == TSK_FS_META_ATTR_STUDIED)) { ------------------ | Branch (418:12): [True: 0, False: 0] ------------------ 419| 0| return 0; 420| 0| } 421| 40| else if (fs_meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (421:14): [True: 0, False: 40] ------------------ 422| 0| return 1; 423| 0| } 424| | 425| 40| if (fs_meta->attr != NULL) { ------------------ | Branch (425:9): [True: 0, False: 40] ------------------ 426| 0| tsk_fs_attrlist_markunused(fs_meta->attr); 427| 0| } 428| 40| else { 429| 40| fs_meta->attr = tsk_fs_attrlist_alloc(); 430| 40| } 431| | 432| | /* Get the stashed first cluster address of the file. */ 433| 40| clust = ((TSK_DADDR_T*)fs_meta->content_ptr)[0]; 434| 40| if ((clust > (fatfs->lastclust)) && ------------------ | Branch (434:9): [True: 0, False: 40] ------------------ 435| 40| (FATFS_ISEOF(clust, fatfs->mask) == 0)) { ------------------ | | 114| 0| ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 107| 0|#define FATFS_EOFS 0x0ffffff8 | | ------------------ | | ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 108| 0|#define FATFS_EOFE 0x0fffffff | | ------------------ | | | Branch (114:3): [True: 0, False: 0] | | | Branch (114:35): [True: 0, False: 0] | | ------------------ ------------------ | Branch (435:9): [True: 0, False: 0] ------------------ 436| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 437| 0| tsk_error_reset(); 438| 0| if (a_fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC) { ------------------ | Branch (438:13): [True: 0, False: 0] ------------------ 439| 0| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 0|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 440| 0| } 441| 0| else { 442| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 443| 0| } 444| 0| tsk_error_set_errstr 445| 0| ("%s: Starting cluster address too large: %" 446| 0| PRIuDADDR, func_name, clust); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 447| 0| return 1; 448| 0| } 449| | 450| | /* Figure out the allocated length of the file in bytes. Because the 451| | * allocation unit for FAT file systems is the cluster, round the 452| | * size up to a multiple of cluster size. */ 453| 40| size_remain = roundup(fs_meta->size, fatfs->csize * fs->block_size); 454| | 455| 40| if ((a_fs_file->meta->addr == fs->root_inum) && ------------------ | Branch (455:9): [True: 34, False: 6] ------------------ 456| 40| (fs->ftype != TSK_FS_TYPE_FAT32) && ------------------ | Branch (456:9): [True: 29, False: 5] ------------------ 457| 40| (fs->ftype != TSK_FS_TYPE_EXFAT) && ------------------ | Branch (457:9): [True: 29, False: 0] ------------------ 458| 40| (clust == 1)) { ------------------ | Branch (458:9): [True: 29, False: 0] ------------------ 459| | /* Make a single contiguous data run for a FAT12 or FAT16 root 460| | * directory. The root directory for these file systems is not 461| | * tracked in the FAT. */ 462| 29| TSK_FS_ATTR_RUN *data_run; 463| | 464| 29| if (tsk_verbose) { ------------------ | Branch (464:13): [True: 0, False: 29] ------------------ 465| 0| tsk_fprintf(stderr, 466| 0| "%s: Loading root directory\n", func_name); 467| 0| } 468| | 469| | /* Allocate the run. */ 470| 29| data_run = tsk_fs_attr_run_alloc(); 471| 29| if (data_run == NULL) { ------------------ | Branch (471:13): [True: 0, False: 29] ------------------ 472| 0| return 1; 473| 0| } 474| | 475| | /* Set the starting sector address and run length. The run begins with 476| | * the first sector of the data area. */ 477| 29| data_run->addr = fatfs->rootsect; 478| 29| data_run->len = fatfs->firstclustsect - fatfs->firstdatasect; 479| | 480| | /* Allocate a non-resident attribute to hold the run and add it 481| | to the attribute list. */ 482| 29| if ((fs_attr = ------------------ | Branch (482:13): [True: 0, False: 29] ------------------ 483| 29| tsk_fs_attrlist_getnew(fs_meta->attr, 484| 29| TSK_FS_ATTR_NONRES)) == NULL) { 485| 0| return 1; 486| 0| } 487| | 488| | /* Tie everything together. */ 489| 29| if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run, NULL, ------------------ | Branch (489:13): [True: 0, False: 29] ------------------ 490| 29| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 29|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 491| 29| data_run->len * fs->block_size, 492| 29| data_run->len * fs->block_size, 493| 29| data_run->len * fs->block_size, 0, 0)) { 494| 0| return 1; 495| 0| } 496| | 497| 29| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 498| | 499| 29| return 0; 500| 29| } 501| 11| else if ((a_fs_file->meta->addr >= fatfs->mbr_virt_inum) && ------------------ | Branch (501:14): [True: 6, False: 5] ------------------ 502| 11| (a_fs_file->meta->addr <= fatfs->mbr_virt_inum + fatfs->numfat)) { ------------------ | Branch (502:14): [True: 0, False: 6] ------------------ 503| | /* Make a single contiguous data run for a virtual file (MBR, FAT). */ 504| 0| TSK_FS_ATTR_RUN *data_run; 505| | 506| 0| if (tsk_verbose) { ------------------ | Branch (506:13): [True: 0, False: 0] ------------------ 507| 0| tsk_fprintf(stderr, 508| 0| "%s: Loading virtual file: %" PRIuINUM 509| 0| "\n", func_name, a_fs_file->meta->addr); 510| 0| } 511| | 512| | /* Allocate the run. */ 513| 0| data_run = tsk_fs_attr_run_alloc(); 514| 0| if (data_run == NULL) { ------------------ | Branch (514:13): [True: 0, False: 0] ------------------ 515| 0| return 1; 516| 0| } 517| | 518| | /* Set the starting sector address and run length. */ 519| 0| data_run->addr = clust; 520| 0| data_run->len = a_fs_file->meta->size / fs->block_size; 521| | 522| | /* Allocate a non-resident attribute to hold the run and add it 523| | to the attribute list. */ 524| 0| if ((fs_attr = ------------------ | Branch (524:13): [True: 0, False: 0] ------------------ 525| 0| tsk_fs_attrlist_getnew(fs_meta->attr, 526| 0| TSK_FS_ATTR_NONRES)) == NULL) { 527| 0| return 1; 528| 0| } 529| | 530| | /* Tie everything together. */ 531| 0| if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run, NULL, ------------------ | Branch (531:13): [True: 0, False: 0] ------------------ 532| 0| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 0|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 533| 0| data_run->len * fs->block_size, 534| 0| data_run->len * fs->block_size, 535| 0| data_run->len * fs->block_size, 0, 0)) { 536| 0| return 1; 537| 0| } 538| | 539| 0| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 540| 0| return 0; 541| 0| } 542| 11| else if (fs_meta->flags & TSK_FS_META_FLAG_UNALLOC) { ------------------ | Branch (542:14): [True: 0, False: 11] ------------------ 543| | /* Make data runs for a deleted file that we want to recover. 544| | * In this case, we could get a lot of errors because of inconsistent 545| | * data. To make it clear that these are from a recovery, we set most 546| | * error codes to _RECOVER so that they can be more easily suppressed. 547| | */ 548| 0| TSK_DADDR_T sbase; 549| 0| TSK_DADDR_T startclust = clust; 550| 0| TSK_OFF_T recoversize = fs_meta->size; 551| 0| TSK_FS_ATTR_RUN *data_run = NULL; 552| 0| TSK_FS_ATTR_RUN *data_run_tmp = NULL; 553| 0| TSK_FS_ATTR_RUN *data_run_head = NULL; 554| 0| TSK_OFF_T full_len_s = 0; 555| 0| uint8_t canRecover = 1; // set to 0 if recovery is not possible 556| | 557| 0| if (tsk_verbose) ------------------ | Branch (557:13): [True: 0, False: 0] ------------------ 558| 0| tsk_fprintf(stderr, 559| 0| "%s: Processing deleted file %" PRIuINUM 560| 0| " in recovery mode\n", func_name, fs_meta->addr); 561| | 562| | /* We know the size and the starting cluster 563| | * 564| | * We are going to take the clusters from the starting cluster 565| | * onwards and skip the clusters that are current allocated 566| | */ 567| | 568| | /* Quick check for exFAT only 569| | * Empty deleted files have a starting cluster of zero, which 570| | * causes problems in the exFAT functions since the first data 571| | * cluster should be 2. Since a starting cluster of zero indicates 572| | * no data, make an empty data run and skip any further processing 573| | */ 574| 0| if((fs->ftype == TSK_FS_TYPE_EXFAT) && (startclust == 0)){ ------------------ | Branch (574:6): [True: 0, False: 0] | Branch (574:42): [True: 0, False: 0] ------------------ 575| | // initialize the data run 576| 0| fs_attr = tsk_fs_attrlist_getnew(a_fs_file->meta->attr, TSK_FS_ATTR_NONRES); 577| 0| if (fs_attr == NULL) { ------------------ | Branch (577:8): [True: 0, False: 0] ------------------ 578| 0| a_fs_file->meta->attr_state = TSK_FS_META_ATTR_ERROR; 579| 0| return 1; 580| 0| } 581| | 582| | // Add the empty data run 583| 0| if (tsk_fs_attr_set_run(a_fs_file, fs_attr, NULL, NULL, ------------------ | Branch (583:17): [True: 0, False: 0] ------------------ 584| 0| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 0|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 585| 0| 0, 0, 0, (TSK_FS_ATTR_FLAG_ENUM)0, 0)) { 586| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 587| 0| return 1; 588| 0| } 589| 0| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 590| 0| return 0; 591| 0| } 592| | 593| | /* Sanity checks on the starting cluster */ 594| | /* Convert the cluster addr to a sector addr */ 595| 0| sbase = FATFS_CLUST_2_SECT(fatfs, startclust); ------------------ | | 86| 0| (TSK_DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize)) ------------------ 596| | 597| 0| if (sbase > fs->last_block) { ------------------ | Branch (597:13): [True: 0, False: 0] ------------------ 598| 0| tsk_error_reset(); 599| 0| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 0|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 600| 0| tsk_error_set_errstr 601| 0| ("%s: Starting cluster address too large (recovery): %" 602| 0| PRIuDADDR, func_name, sbase); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 603| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 604| 0| return 1; 605| 0| } 606| 0| else { 607| 0| int retval; 608| | 609| | /* If the starting cluster is already allocated then we can't 610| | * recover it */ 611| 0| retval = fatfs->is_cluster_alloc(fatfs, startclust); 612| 0| if (retval != 0) { ------------------ | Branch (612:17): [True: 0, False: 0] ------------------ 613| 0| canRecover = 0; 614| 0| } 615| 0| } 616| | 617| | /* Part 1 is to make sure there are enough unallocated clusters 618| | * for the size of the file 619| | */ 620| 0| clust = startclust; 621| 0| size_remain = recoversize; 622| | 623| | // we could make this negative so sign it for the comparison 624| 0| while (((int64_t) size_remain > 0) && (canRecover)) { ------------------ | Branch (624:16): [True: 0, False: 0] | Branch (624:47): [True: 0, False: 0] ------------------ 625| 0| int retval; 626| 0| sbase = FATFS_CLUST_2_SECT(fatfs, clust); ------------------ | | 86| 0| (TSK_DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize)) ------------------ 627| | 628| | /* Are we past the end of the FS? 629| | * that means we could not find enough unallocated clusters 630| | * for the file size */ 631| 0| if (sbase + fatfs->csize - 1 > fs->last_block) { ------------------ | Branch (631:17): [True: 0, False: 0] ------------------ 632| 0| canRecover = 0; 633| | 634| 0| if (tsk_verbose) ------------------ | Branch (634:21): [True: 0, False: 0] ------------------ 635| 0| tsk_fprintf(stderr, 636| 0| "%s: Could not find enough unallocated sectors to recover with - aborting\n", func_name); 637| 0| break; 638| 0| } 639| | 640| | /* Skip allocated clusters */ 641| 0| retval = fatfs->is_cluster_alloc(fatfs, clust); 642| 0| if (retval == -1) { ------------------ | Branch (642:17): [True: 0, False: 0] ------------------ 643| 0| canRecover = 0; 644| 0| break; 645| 0| } 646| 0| else if (retval == 1) { ------------------ | Branch (646:22): [True: 0, False: 0] ------------------ 647| 0| clust++; 648| 0| continue; 649| 0| } 650| | 651| | /* We can use this sector */ 652| | // see if we need a new run 653| 0| if ((data_run == NULL) ------------------ | Branch (653:17): [True: 0, False: 0] ------------------ 654| 0| || (data_run->addr + data_run->len != sbase)) { ------------------ | Branch (654:20): [True: 0, False: 0] ------------------ 655| | 656| 0| TSK_FS_ATTR_RUN *data_run_tmp = tsk_fs_attr_run_alloc(); 657| 0| if (data_run_tmp == NULL) { ------------------ | Branch (657:21): [True: 0, False: 0] ------------------ 658| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 659| 0| tsk_fs_attr_run_free(data_run_head); 660| 0| return 1; 661| 0| } 662| | 663| 0| if (data_run_head == NULL) { ------------------ | Branch (663:21): [True: 0, False: 0] ------------------ 664| 0| data_run_head = data_run_tmp; 665| 0| data_run_tmp->offset = 0; 666| 0| } 667| 0| else if (data_run != NULL) { ------------------ | Branch (667:26): [True: 0, False: 0] ------------------ 668| 0| data_run->next = data_run_tmp; 669| 0| data_run_tmp->offset = 670| 0| data_run->offset + data_run->len; 671| 0| } 672| 0| data_run = data_run_tmp; 673| 0| data_run->len = 0; 674| 0| data_run->addr = sbase; 675| 0| } 676| 0| data_run->len += fatfs->csize; 677| 0| full_len_s += fatfs->csize; 678| | 679| 0| size_remain -= (fatfs->csize << fatfs->ssize_sh); 680| 0| clust++; 681| 0| } 682| | 683| | // Get a FS_DATA structure and add the runlist to it 684| 0| if ((fs_attr = ------------------ | Branch (684:13): [True: 0, False: 0] ------------------ 685| 0| tsk_fs_attrlist_getnew(fs_meta->attr, 686| 0| TSK_FS_ATTR_NONRES)) == NULL) { 687| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 688| 0| tsk_fs_attr_run_free(data_run_head); 689| 0| return 1; 690| 0| } 691| | 692| 0| if (canRecover) { ------------------ | Branch (692:13): [True: 0, False: 0] ------------------ 693| | /* We can recover the file */ 694| | 695| | // initialize the data run 696| 0| if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run_head, ------------------ | Branch (696:17): [True: 0, False: 0] ------------------ 697| 0| NULL, TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 0|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 698| 0| fs_meta->size, fs_meta->size, roundup(fs_meta->size, 699| 0| fatfs->csize * fs->block_size), 0, 0)) { 700| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 701| 0| return 1; 702| 0| } 703| | 704| 0| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 705| 0| } 706| | // create a one cluster run 707| 0| else { 708| 0| tsk_fs_attr_run_free(data_run_head); 709| | 710| 0| data_run_tmp = tsk_fs_attr_run_alloc(); 711| 0| if (data_run_tmp == NULL) { ------------------ | Branch (711:17): [True: 0, False: 0] ------------------ 712| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 713| 0| return 1; 714| 0| } 715| 0| data_run_tmp->addr = sbase; 716| 0| data_run_tmp->len = fatfs->csize; 717| | 718| | // initialize the data run 719| 0| if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run_tmp, NULL, ------------------ | Branch (719:17): [True: 0, False: 0] ------------------ 720| 0| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 0|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 721| 0| fs_meta->size, fs_meta->size, roundup(fs_meta->size, 722| 0| fatfs->csize * fs->block_size), 0, 0)) { 723| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 724| 0| return 1; 725| 0| } 726| | 727| 0| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 728| 0| } 729| | 730| 0| return 0; 731| 0| } 732| 11| else { 733| 11| TSK_LIST *list_seen = NULL; 734| 11| TSK_FS_ATTR_RUN *data_run = NULL; 735| 11| TSK_FS_ATTR_RUN *data_run_head = NULL; 736| 11| TSK_OFF_T full_len_s = 0; 737| 11| TSK_DADDR_T sbase; 738| | /* Do normal cluster chain walking for a file or directory, including 739| | * FAT32 and exFAT root directories. */ 740| | 741| 11| if (tsk_verbose) { ------------------ | Branch (741:13): [True: 0, False: 11] ------------------ 742| 0| tsk_fprintf(stderr, 743| 0| "%s: Processing file %" PRIuINUM 744| 0| " in normal mode\n", func_name, fs_meta->addr); 745| 0| } 746| | 747| | /* Cycle through the cluster chain */ 748| 16| while ((clust & fatfs->mask) > 0 && (int64_t) size_remain > 0 && ------------------ | Branch (748:16): [True: 10, False: 6] | Branch (748:45): [True: 5, False: 5] ------------------ 749| 16| (0 == FATFS_ISEOF(clust, fatfs->mask))) { ------------------ | | 114| 5| ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 107| 5|#define FATFS_EOFS 0x0ffffff8 | | ------------------ | | ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 108| 0|#define FATFS_EOFE 0x0fffffff | | ------------------ | | | Branch (114:3): [True: 0, False: 5] | | | Branch (114:35): [True: 0, False: 0] | | ------------------ ------------------ | Branch (749:13): [True: 5, False: 0] ------------------ 750| | 751| | /* Convert the cluster addr to a sector addr */ 752| 5| sbase = FATFS_CLUST_2_SECT(fatfs, clust); ------------------ | | 86| 5| (TSK_DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize)) ------------------ 753| | 754| 5| if (sbase + fatfs->csize - 1 > fs->last_block) { ------------------ | Branch (754:17): [True: 0, False: 5] ------------------ 755| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 756| 0| tsk_error_reset(); 757| | 758| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 759| 0| tsk_error_set_errstr 760| 0| ("%s: Invalid sector address in FAT (too large): %" 761| 0| PRIuDADDR " (plus %d sectors)", func_name, sbase, fatfs->csize); 762| 0| tsk_fs_attr_run_free(data_run_head); 763| 0| if (list_seen != NULL) { ------------------ | Branch (763:21): [True: 0, False: 0] ------------------ 764| 0| tsk_list_free(list_seen); 765| 0| list_seen = NULL; 766| 0| } 767| 0| return 1; 768| 0| } 769| | 770| | // see if we need a new run 771| 5| if ((data_run == NULL) ------------------ | Branch (771:17): [True: 5, False: 0] ------------------ 772| 5| || (data_run->addr + data_run->len != sbase)) { ------------------ | Branch (772:20): [True: 0, False: 0] ------------------ 773| | 774| 5| TSK_FS_ATTR_RUN *data_run_tmp = tsk_fs_attr_run_alloc(); 775| 5| if (data_run_tmp == NULL) { ------------------ | Branch (775:21): [True: 0, False: 5] ------------------ 776| 0| tsk_fs_attr_run_free(data_run_head); 777| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 778| 0| if (list_seen != NULL) { ------------------ | Branch (778:25): [True: 0, False: 0] ------------------ 779| 0| tsk_list_free(list_seen); 780| 0| list_seen = NULL; 781| 0| } 782| 0| return 1; 783| 0| } 784| | 785| 5| if (data_run_head == NULL) { ------------------ | Branch (785:21): [True: 5, False: 0] ------------------ 786| 5| data_run_head = data_run_tmp; 787| 5| data_run_tmp->offset = 0; 788| 5| } 789| 0| else if (data_run != NULL) { ------------------ | Branch (789:26): [True: 0, False: 0] ------------------ 790| 0| data_run->next = data_run_tmp; 791| 0| data_run_tmp->offset = 792| 0| data_run->offset + data_run->len; 793| 0| } 794| 5| data_run = data_run_tmp; 795| 5| data_run->len = 0; 796| 5| data_run->addr = sbase; 797| 5| } 798| | 799| 5| data_run->len += fatfs->csize; 800| 5| full_len_s += fatfs->csize; 801| 5| size_remain -= (fatfs->csize * fs->block_size); 802| | 803| 5| if ((int64_t) size_remain > 0) { ------------------ | Branch (803:17): [True: 0, False: 5] ------------------ 804| 0| TSK_DADDR_T nxt; 805| 0| if (fatfs_getFAT(fatfs, clust, &nxt)) { ------------------ | Branch (805:21): [True: 0, False: 0] ------------------ 806| 0| tsk_error_set_errstr2("%s: Inode: %" PRIuINUM 807| 0| " cluster: %" PRIuDADDR, func_name, fs_meta->addr, clust); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 808| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 809| 0| tsk_fs_attr_run_free(data_run_head); 810| 0| if (list_seen != NULL) { ------------------ | Branch (810:25): [True: 0, False: 0] ------------------ 811| 0| tsk_list_free(list_seen); 812| 0| list_seen = NULL; 813| 0| } 814| 0| return 1; 815| 0| } 816| 0| clust = nxt; 817| | 818| | /* Make sure we do not get into an infinite loop */ 819| 0| if (tsk_list_find(list_seen, clust)) { ------------------ | Branch (819:21): [True: 0, False: 0] ------------------ 820| 0| if (tsk_verbose) ------------------ | Branch (820:25): [True: 0, False: 0] ------------------ 821| 0| tsk_fprintf(stderr, 822| 0| "Loop found while processing file\n"); 823| 0| if (data_run_head != NULL ) { ------------------ | Branch (823:25): [True: 0, False: 0] ------------------ 824| 0| tsk_fs_attr_run_free(data_run_head); 825| | // Make sure to set data_run_head to NULL to prevent a use-after-free 826| 0| data_run_head = NULL; 827| 0| } 828| 0| if (list_seen != NULL) { ------------------ | Branch (828:25): [True: 0, False: 0] ------------------ 829| 0| tsk_list_free(list_seen); 830| 0| list_seen = NULL; 831| 0| } 832| 0| break; 833| 0| } 834| | 835| 0| if (tsk_list_add(&list_seen, clust)) { ------------------ | Branch (835:21): [True: 0, False: 0] ------------------ 836| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 837| 0| tsk_fs_attr_run_free(data_run_head); 838| 0| if (list_seen != NULL) { ------------------ | Branch (838:25): [True: 0, False: 0] ------------------ 839| 0| tsk_list_free(list_seen); 840| 0| list_seen = NULL; 841| 0| } 842| 0| return 1; 843| 0| } 844| 0| } 845| 5| } 846| | 847| | // add the run list to the inode structure 848| 11| if ((fs_attr = ------------------ | Branch (848:13): [True: 0, False: 11] ------------------ 849| 11| tsk_fs_attrlist_getnew(fs_meta->attr, 850| 11| TSK_FS_ATTR_NONRES)) == NULL) { 851| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 852| 0| if (list_seen != NULL) { ------------------ | Branch (852:17): [True: 0, False: 0] ------------------ 853| 0| tsk_list_free(list_seen); 854| 0| list_seen = NULL; 855| 0| } 856| 0| return 1; 857| 0| } 858| | 859| | // initialize the data run 860| 11| if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run_head, NULL, ------------------ | Branch (860:13): [True: 0, False: 11] ------------------ 861| 11| TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT, ------------------ | | 262| 11|#define TSK_FS_ATTR_ID_DEFAULT 0 ///< Default Data ID used if file system does not assign one. ------------------ 862| 11| fs_meta->size, fs_meta->size, roundup(fs_meta->size, 863| 11| fatfs->csize * fs->block_size), 0, 0)) { 864| 0| fs_meta->attr_state = TSK_FS_META_ATTR_ERROR; 865| 0| tsk_fs_attr_run_free(data_run_head); 866| 0| if (list_seen != NULL) { ------------------ | Branch (866:17): [True: 0, False: 0] ------------------ 867| 0| tsk_list_free(list_seen); 868| 0| list_seen = NULL; 869| 0| } 870| 0| return 1; 871| 0| } 872| | 873| 11| tsk_list_free(list_seen); 874| 11| list_seen = NULL; 875| | 876| 11| fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED; 877| | 878| 11| return 0; 879| 11| } 880| 40|} fatfs_inode_walk: 1106| 6|{ 1107| 6| char *func_name = "fatfs_inode_walk"; 1108| 6| FATFS_INFO *fatfs = (FATFS_INFO*)a_fs; 1109| 6| unsigned int flags = a_selection_flags; 1110| 6| TSK_INUM_T end_inum_tmp = 0; 1111| 6| TSK_FS_FILE *fs_file = NULL; 1112| 6| TSK_DADDR_T ssect = 0; 1113| 6| TSK_DADDR_T lsect = 0; 1114| 6| TSK_DADDR_T sect = 0; 1115| 6| char *dino_buf = NULL; 1116| 6| FATFS_DENTRY *dep = NULL; 1117| 6| unsigned int dentry_idx = 0; 1118| 6| uint8_t *dir_sectors_bitmap = NULL; 1119| 6| ssize_t cnt = 0; 1120| 6| uint8_t done = 0; 1121| | 1122| 6| tsk_error_reset(); 1123| 6| if (fatfs_ptr_arg_is_null(a_fs, "a_fs", func_name) || ------------------ | Branch (1123:9): [True: 0, False: 6] ------------------ 1124| 6| fatfs_ptr_arg_is_null(*(void **) &a_action, "a_action", func_name)) { ------------------ | Branch (1124:9): [True: 0, False: 6] ------------------ 1125| 0| return 1; 1126| 0| } 1127| | 1128| 6| if (a_start_inum < a_fs->first_inum || a_start_inum > a_fs->last_inum) { ------------------ | Branch (1128:9): [True: 0, False: 6] | Branch (1128:44): [True: 0, False: 6] ------------------ 1129| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1130| 0| tsk_error_set_errstr("%s: Begin inode out of range: %" PRIuINUM "", 1131| 0| func_name, a_start_inum); 1132| 0| return 1; 1133| 0| } 1134| 6| else if (a_end_inum < a_fs->first_inum || ------------------ | Branch (1134:14): [True: 0, False: 6] ------------------ 1135| 6| a_end_inum > a_fs->last_inum || ------------------ | Branch (1135:14): [True: 0, False: 6] ------------------ 1136| 6| a_end_inum < a_start_inum) { ------------------ | Branch (1136:14): [True: 0, False: 6] ------------------ 1137| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1138| 0| tsk_error_set_errstr("%s: End inode out of range: %" PRIuINUM "", 1139| 0| func_name, a_end_inum); 1140| 0| return 1; 1141| 0| } 1142| | 1143| | /* FAT file systems do not really have the concept of unused inodes. */ 1144| 6| if ((flags & TSK_FS_META_FLAG_UNUSED) && !(flags & TSK_FS_META_FLAG_USED)) { ------------------ | Branch (1144:9): [True: 0, False: 6] | Branch (1144:46): [True: 0, False: 0] ------------------ 1145| 0| return 0; 1146| 0| } 1147| 6| flags |= TSK_FS_META_FLAG_USED; 1148| 6| flags &= ~TSK_FS_META_FLAG_UNUSED; 1149| | 1150| | /* Make sure the inode selection flags are set correctly. */ 1151| 6| if (flags & TSK_FS_META_FLAG_ORPHAN) { ------------------ | Branch (1151:9): [True: 0, False: 6] ------------------ 1152| | /* If ORPHAN file inodes are wanted, make sure that the UNALLOC 1153| | * selection flag is set. */ 1154| 0| flags |= TSK_FS_META_FLAG_UNALLOC; 1155| 0| flags &= ~TSK_FS_META_FLAG_ALLOC; 1156| 0| } 1157| 6| else { 1158| | /* If neither of the ALLOC or UNALLOC inode selection flags are set, 1159| | * then set them both. */ 1160| 6| if (((flags & TSK_FS_META_FLAG_ALLOC) == 0) && ------------------ | Branch (1160:13): [True: 6, False: 0] ------------------ 1161| 6| ((flags & TSK_FS_META_FLAG_UNALLOC) == 0)) { ------------------ | Branch (1161:13): [True: 0, False: 6] ------------------ 1162| 0| flags |= (TSK_FS_META_FLAG_ALLOC | TSK_FS_META_FLAG_UNALLOC); 1163| 0| } 1164| 6| } 1165| | 1166| 6| if (tsk_verbose) { ------------------ | Branch (1166:9): [True: 0, False: 6] ------------------ 1167| 0| tsk_fprintf(stderr, 1168| 0| "%s: Inode walking %" PRIuINUM " to %" 1169| 0| PRIuINUM "\n", func_name, a_start_inum, a_end_inum); 1170| 0| } 1171| | 1172| | /* If we are looking for orphan files and have not yet populated 1173| | * the list of files reachable by name for this file system, do so now. 1174| | */ 1175| 6| if ((flags & TSK_FS_META_FLAG_ORPHAN)) { ------------------ | Branch (1175:9): [True: 0, False: 6] ------------------ 1176| 0| if (tsk_fs_dir_load_inum_named(a_fs) != TSK_OK) { ------------------ | Branch (1176:13): [True: 0, False: 0] ------------------ 1177| 0| tsk_error_errstr2_concat( 1178| 0| "%s: Identifying orphan inodes", func_name); 1179| 0| return 1; 1180| 0| } 1181| 0| } 1182| | 1183| | /* Allocate a TSK_FS_FILE object with a TSK_FS_META object to populate and 1184| | * pass to the callback function when an inode that fits the inode 1185| | * selection criteria is found. */ 1186| 6| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) { ------------------ | Branch (1186:9): [True: 0, False: 6] ------------------ 1187| 0| return 1; 1188| 0| } 1189| | 1190| 6| if ((fs_file->meta = ------------------ | Branch (1190:9): [True: 0, False: 6] ------------------ 1191| 6| tsk_fs_meta_alloc(FATFS_FILE_CONTENT_LEN)) == NULL) { ------------------ | | 72| 6|#define FATFS_FILE_CONTENT_LEN sizeof(TSK_DADDR_T) // we will store the starting cluster ------------------ 1192| 0| return 1; 1193| 0| } 1194| | 1195| | /* Process the root directory inode, if it's included in the walk. */ 1196| 6| if (a_start_inum == a_fs->root_inum) { ------------------ | Branch (1196:9): [True: 6, False: 0] ------------------ 1197| 6| if (((TSK_FS_META_FLAG_ALLOC & flags) == TSK_FS_META_FLAG_ALLOC) ------------------ | Branch (1197:13): [True: 0, False: 6] ------------------ 1198| 6| && ((TSK_FS_META_FLAG_ORPHAN & flags) == 0)) { ------------------ | Branch (1198:16): [True: 0, False: 0] ------------------ 1199| 0| TSK_WALK_RET_ENUM retval = TSK_WALK_CONT; 1200| | 1201| 0| if (fatfs_make_root(fatfs, fs_file->meta)) { ------------------ | Branch (1201:17): [True: 0, False: 0] ------------------ 1202| 0| tsk_fs_file_close(fs_file); 1203| 0| return 1; 1204| 0| } 1205| | 1206| 0| retval = a_action(fs_file, a_ptr); 1207| 0| if (retval == TSK_WALK_STOP) { ------------------ | Branch (1207:17): [True: 0, False: 0] ------------------ 1208| 0| tsk_fs_file_close(fs_file); 1209| 0| return 0; 1210| 0| } 1211| 0| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (1211:22): [True: 0, False: 0] ------------------ 1212| 0| tsk_fs_file_close(fs_file); 1213| 0| return 1; 1214| 0| } 1215| 0| } 1216| | 1217| 6| a_start_inum++; 1218| 6| if (a_start_inum == a_end_inum) { ------------------ | Branch (1218:13): [True: 0, False: 6] ------------------ 1219| 0| tsk_fs_file_close(fs_file); 1220| 0| return 0; 1221| 0| } 1222| 6| } 1223| 6| size_t bitmap_len = (a_fs->block_count + 7) / 8; 1224| | 1225| | // Taking 128 MiB as an arbitrary upper bound 1226| 6| if ((bitmap_len == 0) || (bitmap_len > (128 * 1024 * 1024))) { ------------------ | Branch (1226:9): [True: 0, False: 6] | Branch (1226:30): [True: 0, False: 6] ------------------ 1227| 0| tsk_fs_file_close(fs_file); 1228| 0| return 1; 1229| 0| } 1230| | 1231| | /* Allocate a bitmap to keep track of which sectors are allocated to 1232| | * directories. */ 1233| 6| if ((dir_sectors_bitmap = (uint8_t*)tsk_malloc(bitmap_len)) == NULL) { ------------------ | Branch (1233:9): [True: 0, False: 6] ------------------ 1234| 0| tsk_fs_file_close(fs_file); 1235| 0| return 1; 1236| 0| } 1237| | 1238| | /* If not doing an orphan files search, populate the directory sectors 1239| | * bitmap. The bitmap will be used to make sure that no sector marked as 1240| | * allocated to a directory is skipped when searching for directory 1241| | * entries to map to inodes. */ 1242| 6| if ((flags & TSK_FS_META_FLAG_ORPHAN) == 0) { ------------------ | Branch (1242:9): [True: 6, False: 0] ------------------ 1243| 6| if (tsk_verbose) { ------------------ | Branch (1243:13): [True: 0, False: 6] ------------------ 1244| 0| tsk_fprintf(stderr, 1245| 0| "fatfs_inode_walk: Walking directories to collect sector info\n"); 1246| 0| } 1247| | 1248| | /* Manufacture an inode for the root directory. */ 1249| 6| if (fatfs_make_root(fatfs, fs_file->meta)) { ------------------ | Branch (1249:13): [True: 0, False: 6] ------------------ 1250| 0| tsk_fs_file_close(fs_file); 1251| 0| free(dir_sectors_bitmap); 1252| 0| return 1; 1253| 0| } 1254| | 1255| | /* Do a file_walk on the root directory to set the bits in the 1256| | * directory sectors bitmap for each sector allocated to the root 1257| | * directory. */ 1258| 6| if (tsk_fs_file_walk(fs_file, ------------------ | Branch (1258:13): [True: 0, False: 6] ------------------ 1259| 6| (TSK_FS_FILE_WALK_FLAG_ENUM)(TSK_FS_FILE_WALK_FLAG_SLACK | TSK_FS_FILE_WALK_FLAG_AONLY), 1260| 6| inode_walk_file_act, (void*)dir_sectors_bitmap)) { 1261| 0| tsk_fs_file_close(fs_file); 1262| 0| free(dir_sectors_bitmap); 1263| 0| return 1; 1264| 0| } 1265| | 1266| | /* Now walk recursively through the entire directory tree to set the 1267| | * bits in the directory sectors bitmap for each sector allocated to 1268| | * the children of the root directory. */ 1269| 6| if (tsk_fs_dir_walk(a_fs, a_fs->root_inum, ------------------ | Branch (1269:13): [True: 0, False: 6] ------------------ 1270| 6| (TSK_FS_DIR_WALK_FLAG_ENUM)(TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_RECURSE | 1271| 6| TSK_FS_DIR_WALK_FLAG_NOORPHAN), inode_walk_dent_act, 1272| 6| (void *) dir_sectors_bitmap)) { 1273| 0| tsk_error_errstr2_concat 1274| 0| ("- fatfs_inode_walk: mapping directories"); 1275| 0| tsk_fs_file_close(fs_file); 1276| 0| free(dir_sectors_bitmap); 1277| 0| return 1; 1278| 0| } 1279| 6| } 1280| | 1281| | /* If the end inode is the one of the virtual virtual FAT files or the 1282| | * virtual orphan files directory, adjust the end inum and handle the 1283| | * virtual inodes after the main inode walking loop below completes. */ 1284| 6| if (a_end_inum > a_fs->last_inum - FATFS_NUM_VIRT_FILES(fatfs)) { ------------------ | | 52| 6| (fatfs->numfat + 2) ------------------ | Branch (1284:9): [True: 6, False: 0] ------------------ 1285| 6| end_inum_tmp = a_fs->last_inum - FATFS_NUM_VIRT_FILES(fatfs); ------------------ | | 52| 6| (fatfs->numfat + 2) ------------------ 1286| 6| } 1287| 0| else { 1288| 0| end_inum_tmp = a_end_inum; 1289| 0| } 1290| | 1291| | /* Map the begin and end inodes to the sectors that contain them. 1292| | * This sets the image level boundaries for the inode walking loop. */ 1293| 6| ssect = FATFS_INODE_2_SECT(fatfs, a_start_inum); ------------------ | | 95| 6| (TSK_DADDR_T)((i - FATFS_FIRST_NORMINO)/(fatfs->dentry_cnt_se) + fatfs->firstdatasect) | | ------------------ | | | | 44| 6|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 1294| 6| if (ssect > a_fs->last_block) { ------------------ | Branch (1294:9): [True: 0, False: 6] ------------------ 1295| 0| tsk_error_reset(); 1296| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1297| 0| tsk_error_set_errstr 1298| 0| ("%s: Begin inode in sector too big for image: %" 1299| 0| PRIuDADDR, func_name, ssect); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 1300| 0| tsk_fs_file_close(fs_file); 1301| 0| free(dir_sectors_bitmap); 1302| 0| return 1; 1303| 0| } 1304| | 1305| 6| lsect = FATFS_INODE_2_SECT(fatfs, end_inum_tmp); ------------------ | | 95| 6| (TSK_DADDR_T)((i - FATFS_FIRST_NORMINO)/(fatfs->dentry_cnt_se) + fatfs->firstdatasect) | | ------------------ | | | | 44| 6|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 1306| 6| if (lsect > a_fs->last_block) { ------------------ | Branch (1306:9): [True: 0, False: 6] ------------------ 1307| 0| tsk_error_reset(); 1308| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1309| 0| tsk_error_set_errstr 1310| 0| ("%s: End inode in sector too big for image: %" 1311| 0| PRIuDADDR, func_name, lsect); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 1312| 0| tsk_fs_file_close(fs_file); 1313| 0| free(dir_sectors_bitmap); 1314| 0| return 1; 1315| 0| } 1316| | 1317| | /* Allocate a buffer big enough to read in a cluster at a time. */ 1318| 6| if ((dino_buf = (char*)tsk_malloc(fatfs->csize << fatfs->ssize_sh)) == ------------------ | Branch (1318:9): [True: 0, False: 6] ------------------ 1319| 6| NULL) { 1320| 0| tsk_fs_file_close(fs_file); 1321| 0| free(dir_sectors_bitmap); 1322| 0| return 1; 1323| 0| } 1324| | 1325| | /* Walk the inodes. */ 1326| 6| sect = ssect; 1327| 3.64k| while (sect <= lsect) { ------------------ | Branch (1327:12): [True: 3.64k, False: 6] ------------------ 1328| 3.64k| int cluster_is_alloc = 0; 1329| 3.64k| size_t num_sectors_to_process = 0; 1330| 3.64k| size_t sector_idx = 0; 1331| 3.64k| uint8_t do_basic_dentry_test = 0; 1332| | 1333| | /* Read in a chunk of the image to process on this iteration of the inode 1334| | * walk. The actual size of the read will depend on whether or not it is 1335| | * coming from the root directory of a FAT12 or FAT16 file system. As 1336| | * indicated by the size of the buffer, the data area (exFAT cluster 1337| | * heap) will for the most part be read in a cluster at a time. 1338| | * However, the root directory for a FAT12/FAT16 file system precedes 1339| | * the data area and the read size for it should be a sector, not a 1340| | * cluster. */ 1341| 3.64k| if (sect < fatfs->firstclustsect) { ------------------ | Branch (1341:13): [True: 160, False: 3.48k] ------------------ 1342| | 1343| 160| if ((flags & TSK_FS_META_FLAG_ORPHAN) != 0) { ------------------ | Branch (1343:17): [True: 0, False: 160] ------------------ 1344| | /* If orphan file hunting, there are no orphans in the root 1345| | * directory, so skip ahead to the data area. */ 1346| 0| sect = fatfs->firstclustsect; 1347| 0| continue; 1348| 0| } 1349| | 1350| | /* Read in a FAT12/FAT16 root directory sector. */ 1351| 160| cnt = tsk_fs_read_block(a_fs, sect, dino_buf, fatfs->ssize); 1352| 160| if (cnt != fatfs->ssize) { ------------------ | Branch (1352:17): [True: 0, False: 160] ------------------ 1353| 0| if (cnt >= 0) { ------------------ | Branch (1353:21): [True: 0, False: 0] ------------------ 1354| 0| tsk_error_reset(); 1355| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1356| 0| } 1357| 0| tsk_error_set_errstr2 1358| 0| ("%s (root dir): sector: %" PRIuDADDR, ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 1359| 0| func_name, sect); 1360| 0| tsk_fs_file_close(fs_file); 1361| 0| free(dir_sectors_bitmap); 1362| 0| free(dino_buf); 1363| 0| return 1; 1364| 0| } 1365| | 1366| 160| cluster_is_alloc = 1; 1367| 160| num_sectors_to_process = 1; 1368| 160| } 1369| 3.48k| else { 1370| | /* The walk has proceeded into the data area (exFAT cluster heap). 1371| | * It's time to read in a cluster at a time. Get the base sector 1372| | * for the cluster that contains the current sector. */ 1373| 3.48k| sect = 1374| 3.48k| FATFS_CLUST_2_SECT(fatfs, (FATFS_SECT_2_CLUST(fatfs, ------------------ | | 86| 3.48k| (TSK_DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize)) ------------------ 1375| 3.48k| sect))); 1376| | 1377| | /* Determine whether the cluster is allocated. Skip it if it is 1378| | * not allocated and the UNALLOCATED inode selection flag is not 1379| | * set. */ 1380| 3.48k| cluster_is_alloc = fatfs_is_sectalloc(fatfs, sect); 1381| 3.48k| if ((cluster_is_alloc == 0) ------------------ | Branch (1381:17): [True: 3.46k, False: 21] ------------------ 1382| 3.48k| && ((flags & TSK_FS_META_FLAG_UNALLOC) == 0)) { ------------------ | Branch (1382:20): [True: 0, False: 3.46k] ------------------ 1383| 0| sect += fatfs->csize; 1384| 0| continue; 1385| 0| } 1386| 3.48k| else if (cluster_is_alloc == -1) { ------------------ | Branch (1386:22): [True: 0, False: 3.48k] ------------------ 1387| 0| tsk_fs_file_close(fs_file); 1388| 0| free(dir_sectors_bitmap); 1389| 0| free(dino_buf); 1390| 0| return 1; 1391| 0| } 1392| | 1393| | /* If the cluster is allocated but is not allocated to a 1394| | * directory, then skip it. NOTE: This will miss orphan file 1395| | * entries in the slack space of files. 1396| | */ 1397| 3.48k| if ((cluster_is_alloc == 1) && (isset(dir_sectors_bitmap, sect) == 0)) { ------------------ | Branch (1397:17): [True: 21, False: 3.46k] | Branch (1397:44): [True: 20, False: 1] ------------------ 1398| 20| sect += fatfs->csize; 1399| 20| continue; 1400| 20| } 1401| | 1402| | /* The final cluster may not be full. */ 1403| 3.46k| if (lsect - sect + 1 < fatfs->csize) { ------------------ | Branch (1403:17): [True: 5, False: 3.45k] ------------------ 1404| 5| num_sectors_to_process = (size_t) (lsect - sect + 1); 1405| 5| } 1406| 3.45k| else { 1407| 3.45k| num_sectors_to_process = fatfs->csize; 1408| 3.45k| } 1409| | 1410| | /* Read in a cluster. */ 1411| 3.46k| cnt = tsk_fs_read_block 1412| 3.46k| (a_fs, sect, dino_buf, num_sectors_to_process << fatfs->ssize_sh); 1413| 3.46k| if (cnt != (ssize_t)(num_sectors_to_process << fatfs->ssize_sh)) { ------------------ | Branch (1413:17): [True: 0, False: 3.46k] ------------------ 1414| 0| if (cnt >= 0) { ------------------ | Branch (1414:21): [True: 0, False: 0] ------------------ 1415| 0| tsk_error_reset(); 1416| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1417| 0| } 1418| 0| tsk_error_set_errstr2("%s: sector: %" 1419| 0| PRIuDADDR, func_name, sect); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 1420| 0| tsk_fs_file_close(fs_file); 1421| 0| free(dir_sectors_bitmap); 1422| 0| free(dino_buf); 1423| 0| return 1; 1424| 0| } 1425| 3.46k| } 1426| | 1427| | /* Now that the sectors are read in, prepare to step through them in 1428| | * directory entry size chunks. Only do a basic test to confirm the 1429| | * contents of each chunk is a directory entry unless the sector that 1430| | * contains it is not allocated to a directory or is unallocated.*/ 1431| 3.62k| do_basic_dentry_test = 1; 1432| 3.62k| if ((isset(dir_sectors_bitmap, sect) == 0) || (cluster_is_alloc == 0)) { ------------------ | Branch (1432:13): [True: 3.46k, False: 161] | Branch (1432:55): [True: 0, False: 161] ------------------ 1433| 3.46k| do_basic_dentry_test = 0; 1434| 3.46k| } 1435| | 1436| | /* Walk through the sectors read in. */ 1437| 14.6k| for (sector_idx = 0; sector_idx < num_sectors_to_process; sector_idx++) { ------------------ | Branch (1437:30): [True: 11.0k, False: 3.62k] ------------------ 1438| 11.0k| TSK_INUM_T inum = 0; 1439| | 1440| | /* If the last inode in this sector is before the start 1441| | * inode, skip the sector. */ 1442| 11.0k| if (FATFS_SECT_2_INODE(fatfs, sect + 1) < a_start_inum) { ------------------ | | 102| 11.0k| (TSK_INUM_T)((s - fatfs->firstdatasect) * fatfs->dentry_cnt_se + FATFS_FIRST_NORMINO) | | ------------------ | | | | 44| 11.0k|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ | Branch (1442:17): [True: 0, False: 11.0k] ------------------ 1443| 0| sect++; 1444| 0| continue; 1445| 0| } 1446| | 1447| | /* Advance the directory entry pointer to the start of the 1448| | * sector. */ 1449| 11.0k| dep = (FATFS_DENTRY*)(&dino_buf[sector_idx << fatfs->ssize_sh]); 1450| | 1451| | /* If the sector is not allocated to a directory and the first 1452| | * chunk is not a directory entry, skip the sector. */ 1453| 11.0k| if (!isset(dir_sectors_bitmap, sect) && ------------------ | Branch (1453:17): [True: 10.9k, False: 161] ------------------ 1454| 11.0k| !fatfs->is_dentry(fatfs, dep, (FATFS_DATA_UNIT_ALLOC_STATUS_ENUM)cluster_is_alloc, do_basic_dentry_test)) { ------------------ | Branch (1454:17): [True: 10.9k, False: 1] ------------------ 1455| 10.9k| sect++; 1456| 10.9k| continue; 1457| 10.9k| } 1458| | 1459| | /* Get the base inode address of this sector. */ 1460| 162| inum = FATFS_SECT_2_INODE(fatfs, sect); ------------------ | | 102| 162| (TSK_INUM_T)((s - fatfs->firstdatasect) * fatfs->dentry_cnt_se + FATFS_FIRST_NORMINO) | | ------------------ | | | | 44| 162|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 1461| 162| if (tsk_verbose) { ------------------ | Branch (1461:17): [True: 0, False: 162] ------------------ 1462| 0| tsk_fprintf(stderr, 1463| 0| "%s: Processing sector %" PRIuDADDR 1464| 0| " starting at inode %" PRIuINUM "\n", func_name, sect, inum); 1465| 0| } 1466| | 1467| | /* Walk through the potential directory entries in the sector. */ 1468| 2.75k| for (dentry_idx = 0; dentry_idx < fatfs->dentry_cnt_se; ------------------ | Branch (1468:34): [True: 2.59k, False: 162] ------------------ 1469| 2.59k| dentry_idx++, inum++, dep++) { 1470| 2.59k| int retval; 1471| 2.59k| TSK_RETVAL_ENUM retval2 = TSK_OK; 1472| | 1473| | /* If the inode address of the potential entry is less than 1474| | * the beginning inode address for the inode walk, skip it. */ 1475| 2.59k| if (inum < a_start_inum) { ------------------ | Branch (1475:21): [True: 0, False: 2.59k] ------------------ 1476| 0| continue; 1477| 0| } 1478| | 1479| | /* If inode address of the potential entry is greater than the 1480| | * ending inode address for the walk, terminate the inode walk. */ 1481| 2.59k| if (inum > end_inum_tmp) { ------------------ | Branch (1481:21): [True: 0, False: 2.59k] ------------------ 1482| 0| done = 1; 1483| 0| break; 1484| 0| } 1485| | 1486| | /* If the potential entry is likely not an entry, or it is an 1487| | * entry that is not reported in an inode walk, or it does not 1488| | * satisfy the inode selection flags, then skip it. */ 1489| 2.59k| if (!fatfs->is_dentry(fatfs, dep, (FATFS_DATA_UNIT_ALLOC_STATUS_ENUM)cluster_is_alloc, do_basic_dentry_test) || ------------------ | Branch (1489:21): [True: 2.58k, False: 4] ------------------ 1490| 2.59k| fatfs->inode_walk_should_skip_dentry(fatfs, inum, dep, flags, cluster_is_alloc)) { ------------------ | Branch (1490:21): [True: 1, False: 3] ------------------ 1491| 2.58k| continue; 1492| 2.58k| } 1493| | 1494| 3| retval2 = fatfs->dinode_copy(fatfs, inum, dep, cluster_is_alloc, fs_file); 1495| | 1496| 3| if (retval2 != TSK_OK) { ------------------ | Branch (1496:21): [True: 0, False: 3] ------------------ 1497| 0| if (retval2 == TSK_COR) { ------------------ | Branch (1497:25): [True: 0, False: 0] ------------------ 1498| | /* Corrupted, move on to the next chunk. */ 1499| 0| if (tsk_verbose) { ------------------ | Branch (1499:29): [True: 0, False: 0] ------------------ 1500| 0| tsk_error_print(stderr); 1501| 0| } 1502| 0| tsk_error_reset(); 1503| 0| continue; 1504| 0| } 1505| 0| else { 1506| 0| tsk_fs_file_close(fs_file); 1507| 0| free(dir_sectors_bitmap); 1508| 0| free(dino_buf); 1509| 0| return 1; 1510| 0| } 1511| 0| } 1512| | 1513| 3| if (tsk_verbose) { ------------------ | Branch (1513:21): [True: 0, False: 3] ------------------ 1514| 0| tsk_fprintf(stderr, 1515| 0| "%s: Directory Entry %" PRIuINUM 1516| 0| " (%u) at sector %" PRIuDADDR "\n", func_name, inum, dentry_idx, 1517| 0| sect); 1518| 0| } 1519| | 1520| | /* Do the callback. */ 1521| 3| retval = a_action(fs_file, a_ptr); 1522| 3| if (retval == TSK_WALK_STOP) { ------------------ | Branch (1522:21): [True: 0, False: 3] ------------------ 1523| 0| tsk_fs_file_close(fs_file); 1524| 0| free(dir_sectors_bitmap); 1525| 0| free(dino_buf); 1526| 0| return 0; 1527| 0| } 1528| 3| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (1528:26): [True: 0, False: 3] ------------------ 1529| 0| tsk_fs_file_close(fs_file); 1530| 0| free(dir_sectors_bitmap); 1531| 0| free(dino_buf); 1532| 0| return 1; 1533| 0| } 1534| 3| } 1535| 162| sect++; 1536| 162| if (done) { ------------------ | Branch (1536:17): [True: 0, False: 162] ------------------ 1537| 0| break; 1538| 0| } 1539| 162| } 1540| 3.62k| if (done) { ------------------ | Branch (1540:13): [True: 0, False: 3.62k] ------------------ 1541| 0| break; 1542| 0| } 1543| 3.62k| } 1544| | 1545| 6| free(dir_sectors_bitmap); 1546| 6| free(dino_buf); 1547| | 1548| | // handle the virtual orphans folder and FAT files if they asked for them 1549| 6| if ((a_end_inum > a_fs->last_inum - FATFS_NUM_VIRT_FILES(fatfs)) ------------------ | | 52| 6| (fatfs->numfat + 2) ------------------ | Branch (1549:9): [True: 6, False: 0] ------------------ 1550| 6| && (flags & TSK_FS_META_FLAG_ALLOC) ------------------ | Branch (1550:12): [True: 0, False: 6] ------------------ 1551| 6| && ((flags & TSK_FS_META_FLAG_ORPHAN) == 0)) { ------------------ | Branch (1551:12): [True: 0, False: 0] ------------------ 1552| 0| TSK_INUM_T inum; 1553| | 1554| | // cycle through the special files 1555| 0| for (inum = a_fs->last_inum - FATFS_NUM_VIRT_FILES(fatfs) + 1; ------------------ | | 52| 0| (fatfs->numfat + 2) ------------------ 1556| 0| inum <= a_end_inum; inum++) { ------------------ | Branch (1556:13): [True: 0, False: 0] ------------------ 1557| 0| int retval; 1558| | 1559| 0| tsk_fs_meta_reset(fs_file->meta); 1560| | 1561| 0| if (inum == fatfs->mbr_virt_inum) { ------------------ | Branch (1561:17): [True: 0, False: 0] ------------------ 1562| 0| if (fatfs_make_mbr(fatfs, fs_file->meta)) { ------------------ | Branch (1562:21): [True: 0, False: 0] ------------------ 1563| 0| tsk_fs_file_close(fs_file); 1564| 0| return 1; 1565| 0| } 1566| 0| } 1567| 0| else if (inum == fatfs->fat1_virt_inum) { ------------------ | Branch (1567:22): [True: 0, False: 0] ------------------ 1568| 0| if (fatfs_make_fat(fatfs, 1, fs_file->meta)) { ------------------ | Branch (1568:21): [True: 0, False: 0] ------------------ 1569| 0| tsk_fs_file_close(fs_file); 1570| 0| return 1; 1571| 0| } 1572| 0| } 1573| 0| else if (inum == fatfs->fat2_virt_inum && fatfs->numfat == 2) { ------------------ | Branch (1573:22): [True: 0, False: 0] | Branch (1573:55): [True: 0, False: 0] ------------------ 1574| 0| if (fatfs_make_fat(fatfs, 2, fs_file->meta)) { ------------------ | Branch (1574:21): [True: 0, False: 0] ------------------ 1575| 0| tsk_fs_file_close(fs_file); 1576| 0| return 1; 1577| 0| } 1578| 0| } 1579| 0| else if (inum == TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 0| (fs_info->last_inum) ------------------ | Branch (1579:22): [True: 0, False: 0] ------------------ 1580| 0| if (tsk_fs_dir_make_orphan_dir_meta(a_fs, fs_file->meta)) { ------------------ | Branch (1580:21): [True: 0, False: 0] ------------------ 1581| 0| tsk_fs_file_close(fs_file); 1582| 0| return 1; 1583| 0| } 1584| 0| } 1585| | 1586| 0| retval = a_action(fs_file, a_ptr); 1587| 0| if (retval == TSK_WALK_STOP) { ------------------ | Branch (1587:17): [True: 0, False: 0] ------------------ 1588| 0| tsk_fs_file_close(fs_file); 1589| 0| return 0; 1590| 0| } 1591| 0| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (1591:22): [True: 0, False: 0] ------------------ 1592| 0| tsk_fs_file_close(fs_file); 1593| 0| return 1; 1594| 0| } 1595| 0| } 1596| 0| } 1597| | 1598| 6| tsk_fs_file_close(fs_file); 1599| 6| return 0; 1600| 6|} fatfs_meta.c:fatfs_make_root: 48| 34|{ 49| 34| const char *func_name = "fatfs_make_root"; 50| 34| TSK_DADDR_T *first_clust_addr_ptr = NULL; 51| | 52| 34| tsk_error_reset(); 53| 34| if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name) || ------------------ | Branch (53:9): [True: 0, False: 34] ------------------ 54| 34| fatfs_ptr_arg_is_null(a_fs_meta, "a_fs_meta", func_name)) { ------------------ | Branch (54:9): [True: 0, False: 34] ------------------ 55| 0| return 1; 56| 0| } 57| | 58| | /* Manufacture some metadata. */ 59| 34| a_fs_meta->type = TSK_FS_META_TYPE_DIR; 60| 34| a_fs_meta->mode = TSK_FS_META_MODE_UNSPECIFIED; 61| 34| a_fs_meta->nlink = 1; 62| 34| a_fs_meta->addr = FATFS_ROOTINO; ------------------ | | 43| 34|#define FATFS_ROOTINO 2 /* location of root directory inode */ ------------------ 63| 34| a_fs_meta->flags = (TSK_FS_META_FLAG_ENUM)(TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_ALLOC); 64| 34| a_fs_meta->uid = a_fs_meta->gid = 0; 65| 34| a_fs_meta->mtime = a_fs_meta->atime = a_fs_meta->ctime = a_fs_meta->crtime = 0; 66| 34| a_fs_meta->mtime_nano = a_fs_meta->atime_nano = a_fs_meta->ctime_nano = 67| 34| a_fs_meta->crtime_nano = 0; 68| | 69| | /* Give the root directory an empty name. */ 70| 34| if (a_fs_meta->name2 == NULL) { ------------------ | Branch (70:9): [True: 34, False: 0] ------------------ 71| 34| if ((a_fs_meta->name2 = (TSK_FS_META_NAME_LIST *) ------------------ | Branch (71:13): [True: 0, False: 34] ------------------ 72| 34| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST))) == NULL) { 73| 0| return 1; 74| 0| } 75| 34| a_fs_meta->name2->next = NULL; 76| 34| } 77| 34| a_fs_meta->name2->name[0] = '\0'; 78| | 79| | /* Mark the generic attribute list as not in use (in the generic file model 80| | * attributes are containers for data or metadata). Population of this 81| | * list is done by lazy look up. */ 82| 34| a_fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 83| 34| if (a_fs_meta->attr) { ------------------ | Branch (83:9): [True: 0, False: 34] ------------------ 84| 0| tsk_fs_attrlist_markunused(a_fs_meta->attr); 85| 0| } 86| | 87| | /* Determine the size of the root directory and the address of its 88| | * first cluster. */ 89| 34| first_clust_addr_ptr = (TSK_DADDR_T*)a_fs_meta->content_ptr; 90| 34| if (a_fatfs->fs_info.ftype == TSK_FS_TYPE_FAT32 || ------------------ | Branch (90:9): [True: 5, False: 29] ------------------ 91| 34| a_fatfs->fs_info.ftype == TSK_FS_TYPE_EXFAT) { ------------------ | Branch (91:9): [True: 0, False: 29] ------------------ 92| 5| TSK_DADDR_T cnum = 0; 93| 5| TSK_DADDR_T clust = 0; 94| 5| TSK_LIST *list_seen = NULL; 95| | 96| | /* Convert the address of the first sector of the root directory into 97| | * the address of its first cluster. */ 98| 5| clust = FATFS_SECT_2_CLUST(a_fatfs, a_fatfs->rootsect); ------------------ | | 89| 5| (TSK_DADDR_T)(2 + ((s) - fatfs->firstclustsect) / fatfs->csize) ------------------ 99| 5| first_clust_addr_ptr[0] = clust; 100| | 101| | /* Walk the FAT and count the clusters allocated to the root directory. */ 102| 5| cnum = 0; 103| 10| while ((clust) && (0 == FATFS_ISEOF(clust, FATFS_32_MASK))) { ------------------ | | 114| 10| ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 107| 10|#define FATFS_EOFS 0x0ffffff8 | | ------------------ | | ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 108| 5|#define FATFS_EOFE 0x0fffffff | | ------------------ | | | Branch (114:3): [True: 5, False: 5] | | | Branch (114:35): [True: 5, False: 0] | | ------------------ ------------------ | Branch (103:16): [True: 10, False: 0] | Branch (103:27): [True: 5, False: 5] ------------------ 104| 5| TSK_DADDR_T nxt = 0; 105| | 106| | /* Make sure we do not get into an infinite loop */ 107| 5| if (tsk_list_find(list_seen, clust)) { ------------------ | Branch (107:17): [True: 0, False: 5] ------------------ 108| 0| if (tsk_verbose) { ------------------ | Branch (108:21): [True: 0, False: 0] ------------------ 109| 0| tsk_fprintf(stderr, 110| 0| "Loop found while determining root directory size\n"); 111| 0| } 112| 0| break; 113| 0| } 114| 5| if (tsk_list_add(&list_seen, clust)) { ------------------ | Branch (114:17): [True: 0, False: 5] ------------------ 115| 0| tsk_list_free(list_seen); 116| 0| list_seen = NULL; 117| 0| return 1; 118| 0| } 119| | 120| 5| cnum++; 121| 5| if (fatfs_getFAT(a_fatfs, clust, &nxt)) { ------------------ | Branch (121:17): [True: 0, False: 5] ------------------ 122| 0| break; 123| 0| } 124| 5| else { 125| 5| clust = nxt; 126| 5| } 127| 5| } 128| 5| tsk_list_free(list_seen); 129| 5| list_seen = NULL; 130| | 131| | /* Calculate the size of the root directory. */ 132| 5| a_fs_meta->size = (cnum * a_fatfs->csize) << a_fatfs->ssize_sh; 133| 5| } 134| 29| else { 135| | /* FAT12 and FAT16 don't use the FAT for the root directory, so set 136| | * the first cluster address to a distinguished value that other code 137| | * will have to check as a special condition. */ 138| 29| first_clust_addr_ptr[0] = 1; 139| | 140| | /* Set the size equal to the number of bytes between the end of the 141| | * FATs and the start of the clusters. */ 142| 29| a_fs_meta->size = (a_fatfs->firstclustsect - a_fatfs->firstdatasect) << a_fatfs->ssize_sh; 143| 29| } 144| | 145| 34| return 0; 146| 34|} fatfs_meta.c:fatfs_make_mbr: 158| 17|{ 159| 17| TSK_DADDR_T *addr_ptr; 160| | 161| 17| fs_meta->type = TSK_FS_META_TYPE_VIRT; 162| 17| fs_meta->mode = TSK_FS_META_MODE_UNSPECIFIED; 163| 17| fs_meta->nlink = 1; 164| 17| fs_meta->addr = fatfs->mbr_virt_inum; 165| 17| fs_meta->flags = (TSK_FS_META_FLAG_ENUM) 166| 17| (TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_ALLOC); 167| 17| fs_meta->uid = fs_meta->gid = 0; 168| 17| fs_meta->mtime = fs_meta->atime = fs_meta->ctime = fs_meta->crtime = 0; 169| 17| fs_meta->mtime_nano = fs_meta->atime_nano = fs_meta->ctime_nano = 170| 17| fs_meta->crtime_nano = 0; 171| | 172| 17| if (fs_meta->name2 == NULL) { ------------------ | Branch (172:9): [True: 17, False: 0] ------------------ 173| 17| if ((fs_meta->name2 = (TSK_FS_META_NAME_LIST *) ------------------ | Branch (173:13): [True: 0, False: 17] ------------------ 174| 17| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST))) == NULL) { 175| 0| return 1; 176| 0| } 177| 17| fs_meta->name2->next = NULL; 178| 17| } 179| 17| strncpy(fs_meta->name2->name, FATFS_MBRNAME, ------------------ | | 47| 17|#define FATFS_MBRNAME "$MBR" ------------------ 180| 17| TSK_FS_META_NAME_LIST_NSIZE); ------------------ | | 348| 17|#define TSK_FS_META_NAME_LIST_NSIZE 512 ------------------ 181| | 182| 17| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 183| 17| if (fs_meta->attr) { ------------------ | Branch (183:9): [True: 0, False: 17] ------------------ 184| 0| tsk_fs_attrlist_markunused(fs_meta->attr); 185| 0| } 186| | 187| 17| addr_ptr = (TSK_DADDR_T*)fs_meta->content_ptr; 188| 17| addr_ptr[0] = 0; 189| 17| fs_meta->size = 512; 190| | 191| 17| return 0; 192| 17|} fatfs_meta.c:fatfs_make_fat: 205| 34|{ 206| 34| TSK_FS_INFO *fs = (TSK_FS_INFO*)fatfs; 207| 34| TSK_DADDR_T *addr_ptr = (TSK_DADDR_T *)fs_meta->content_ptr; 208| | 209| 34| if ((a_which != 1) && (a_which != 2)) { ------------------ | Branch (209:9): [True: 17, False: 17] | Branch (209:27): [True: 0, False: 17] ------------------ 210| 0| return 1; 211| 0| } 212| | 213| 34| if (a_which > fatfs->numfat) { ------------------ | Branch (213:9): [True: 0, False: 34] ------------------ 214| 0| return 1; 215| 0| } 216| | 217| 34| fs_meta->type = TSK_FS_META_TYPE_VIRT; 218| 34| fs_meta->mode = TSK_FS_META_MODE_UNSPECIFIED; 219| 34| fs_meta->nlink = 1; 220| | 221| 34| fs_meta->flags = (TSK_FS_META_FLAG_ENUM) 222| 34| (TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_ALLOC); 223| 34| fs_meta->uid = fs_meta->gid = 0; 224| 34| fs_meta->mtime = fs_meta->atime = fs_meta->ctime = fs_meta->crtime = 0; 225| 34| fs_meta->mtime_nano = fs_meta->atime_nano = fs_meta->ctime_nano = 226| 34| fs_meta->crtime_nano = 0; 227| | 228| 34| if (fs_meta->name2 == NULL) { ------------------ | Branch (228:9): [True: 34, False: 0] ------------------ 229| 34| if ((fs_meta->name2 = (TSK_FS_META_NAME_LIST *) ------------------ | Branch (229:13): [True: 0, False: 34] ------------------ 230| 34| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST))) == NULL) 231| 0| return 1; 232| 34| fs_meta->name2->next = NULL; 233| 34| } 234| | 235| 34| if (a_which == 1) { ------------------ | Branch (235:9): [True: 17, False: 17] ------------------ 236| 17| fs_meta->addr = fatfs->fat1_virt_inum; 237| 17| strncpy(fs_meta->name2->name, FATFS_FAT1NAME, ------------------ | | 48| 17|#define FATFS_FAT1NAME "$FAT1" ------------------ 238| 17| TSK_FS_META_NAME_LIST_NSIZE); ------------------ | | 348| 17|#define TSK_FS_META_NAME_LIST_NSIZE 512 ------------------ 239| 17| addr_ptr[0] = fatfs->firstfatsect; 240| 17| } 241| 17| else { 242| 17| fs_meta->addr = fatfs->fat2_virt_inum; 243| 17| strncpy(fs_meta->name2->name, FATFS_FAT2NAME, ------------------ | | 49| 17|#define FATFS_FAT2NAME "$FAT2" ------------------ 244| 17| TSK_FS_META_NAME_LIST_NSIZE); ------------------ | | 348| 17|#define TSK_FS_META_NAME_LIST_NSIZE 512 ------------------ 245| 17| addr_ptr[0] = fatfs->firstfatsect + fatfs->sectperfat; 246| 17| } 247| | 248| 34| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 249| 34| if (fs_meta->attr) { ------------------ | Branch (249:9): [True: 0, False: 34] ------------------ 250| 0| tsk_fs_attrlist_markunused(fs_meta->attr); 251| 0| } 252| | 253| 34| fs_meta->size = fatfs->sectperfat * fs->block_size; 254| | 255| 34| return 0; 256| 34|} fatfs_meta.c:inode_walk_file_act: 1061| 161|{ 1062| 161| setbit((uint8_t *) a_ptr, addr); 1063| 161| return TSK_WALK_CONT; 1064| 161|} fatfs_meta.c:inode_walk_dent_act: 1069| 25|{ 1070| 25| unsigned int flags = TSK_FS_FILE_WALK_FLAG_SLACK | TSK_FS_FILE_WALK_FLAG_AONLY; 1071| | 1072| 25| if ((fs_file->meta == NULL) ------------------ | Branch (1072:9): [True: 0, False: 25] ------------------ 1073| 25| || ( ! TSK_FS_IS_DIR_META(fs_file->meta->type))) ------------------ | | 414| 25|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 25] | | | Branch (414:63): [True: 6, False: 19] | | ------------------ ------------------ 1074| 19| return TSK_WALK_CONT; 1075| | 1076| | /* Get the sector addresses & ignore any errors */ 1077| 6| if (tsk_fs_file_walk(fs_file, ------------------ | Branch (1077:9): [True: 0, False: 6] ------------------ 1078| 6| (TSK_FS_FILE_WALK_FLAG_ENUM)flags, 1079| 6| inode_walk_file_act, a_ptr)) { 1080| 0| tsk_error_reset(); 1081| 0| } 1082| | 1083| 6| return TSK_WALK_CONT; 1084| 25|} fatfs_ptr_arg_is_null: 35| 813|{ 36| 813| const char *func_name = "fatfs_ptr_arg_is_null"; 37| | 38| 813| assert(a_param_name != NULL); 39| 813| assert(a_func_name != NULL); 40| | 41| 813| if (a_ptr == NULL) { ------------------ | Branch (41:9): [True: 0, False: 813] ------------------ 42| 0| tsk_error_reset(); 43| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 44| 0| if ((a_param_name != NULL) && (a_func_name != NULL)) { ------------------ | Branch (44:13): [True: 0, False: 0] | Branch (44:39): [True: 0, False: 0] ------------------ 45| 0| tsk_error_set_errstr("%s: %s is NULL", a_param_name, a_func_name); 46| 0| } 47| 0| else { 48| 0| tsk_error_set_errstr("%s: NULL pointer", func_name); 49| 0| } 50| | 51| 0| return 1; 52| 0| } 53| | 54| 813| return 0; 55| 813|} fatfs_inum_is_in_range: 68| 125|{ 69| 125| const char *func_name = "fatfs_inum_is_in_range"; 70| 125| TSK_FS_INFO *fs = (TSK_FS_INFO*)a_fatfs; 71| | 72| 125| assert(a_fatfs != NULL); 73| | 74| 125| if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name)) { ------------------ | Branch (74:9): [True: 0, False: 125] ------------------ 75| 0| return 0; 76| 0| } 77| | 78| 125| if ((a_inum < fs->first_inum) || (a_inum > fs->last_inum)) { ------------------ | Branch (78:9): [True: 0, False: 125] | Branch (78:38): [True: 0, False: 125] ------------------ 79| 0| return 0; 80| 0| } 81| | 82| 125| return 1; 83| 125|} fatfs_inum_arg_is_in_range: 100| 121|{ 101| 121| const char *func_name = "fatfs_inum_arg_is_in_range"; 102| | 103| 121| assert(a_fatfs != NULL); 104| 121| assert(a_func_name != NULL); 105| | 106| 121| if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name)) { ------------------ | Branch (106:9): [True: 0, False: 121] ------------------ 107| 0| return 0; 108| 0| } 109| | 110| 121| if (!fatfs_inum_is_in_range(a_fatfs, a_inum)) { ------------------ | Branch (110:9): [True: 0, False: 121] ------------------ 111| 0| tsk_error_reset(); 112| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 113| 0| if (a_func_name != NULL) { ------------------ | Branch (113:13): [True: 0, False: 0] ------------------ 114| 0| tsk_error_set_errstr("%s: inode address: %" PRIuINUM " out of range", a_func_name, a_inum); 115| 0| } 116| 0| else { 117| 0| tsk_error_set_errstr("%s: inode address: %" PRIuINUM " out of range", func_name, a_inum); 118| 0| } 119| | 120| 0| return 0; 121| 0| } 122| 121| return 1; 123| 121|} fatfs_dos_2_unix_time: 138| 10|{ 139| 10| struct tm tm1; 140| 10| time_t ret; 141| | 142| 10| if (date == 0) ------------------ | Branch (142:9): [True: 0, False: 10] ------------------ 143| 0| return 0; 144| | 145| 10| memset(&tm1, 0, sizeof(struct tm)); 146| | 147| 10| tm1.tm_sec = ((time & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) * 2; ------------------ | | 119| 10|#define FATFS_SEC_MASK 0x1f /* number of seconds div by 2 */ ------------------ tm1.tm_sec = ((time & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) * 2; ------------------ | | 120| 10|#define FATFS_SEC_SHIFT 0 ------------------ 148| 10| if ((tm1.tm_sec < 0) || (tm1.tm_sec > 60)) ------------------ | Branch (148:9): [True: 0, False: 10] | Branch (148:29): [True: 0, False: 10] ------------------ 149| 0| tm1.tm_sec = 0; 150| | 151| | /* The ctimetens value has a range of 0 to 199 */ 152| 10| if (timetens >= 100) ------------------ | Branch (152:9): [True: 0, False: 10] ------------------ 153| 0| tm1.tm_sec++; 154| | 155| 10| tm1.tm_min = ((time & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT); ------------------ | | 123| 10|#define FATFS_MIN_MASK 0x7e0 /* number of minutes 0-59 */ ------------------ tm1.tm_min = ((time & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT); ------------------ | | 124| 10|#define FATFS_MIN_SHIFT 5 ------------------ 156| 10| if ((tm1.tm_min < 0) || (tm1.tm_min > 59)) ------------------ | Branch (156:9): [True: 0, False: 10] | Branch (156:29): [True: 0, False: 10] ------------------ 157| 0| tm1.tm_min = 0; 158| | 159| 10| tm1.tm_hour = ((time & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT); ------------------ | | 127| 10|#define FATFS_HOUR_MASK 0xf800 /* number of hours 0-23 */ ------------------ tm1.tm_hour = ((time & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT); ------------------ | | 128| 10|#define FATFS_HOUR_SHIFT 11 ------------------ 160| 10| if ((tm1.tm_hour < 0) || (tm1.tm_hour > 23)) ------------------ | Branch (160:9): [True: 0, False: 10] | Branch (160:30): [True: 0, False: 10] ------------------ 161| 0| tm1.tm_hour = 0; 162| | 163| 10| tm1.tm_mday = ((date & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT); ------------------ | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ ------------------ tm1.tm_mday = ((date & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT); ------------------ | | 139| 10|#define FATFS_DAY_SHIFT 0 ------------------ 164| 10| if ((tm1.tm_mday < 1) || (tm1.tm_mday > 31)) ------------------ | Branch (164:9): [True: 0, False: 10] | Branch (164:30): [True: 0, False: 10] ------------------ 165| 0| tm1.tm_mday = 0; 166| | 167| 10| tm1.tm_mon = ((date & FATFS_MON_MASK) >> FATFS_MON_SHIFT) - 1; ------------------ | | 142| 10|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ ------------------ tm1.tm_mon = ((date & FATFS_MON_MASK) >> FATFS_MON_SHIFT) - 1; ------------------ | | 143| 10|#define FATFS_MON_SHIFT 5 ------------------ 168| 10| if ((tm1.tm_mon < 0) || (tm1.tm_mon > 11)) ------------------ | Branch (168:9): [True: 0, False: 10] | Branch (168:29): [True: 0, False: 10] ------------------ 169| 0| tm1.tm_mon = 0; 170| | 171| | /* There is a limit to the year because the UNIX time value is 172| | * a 32-bit value 173| | * the maximum UNIX time is Tue Jan 19 03:14:07 2038 */ 174| 10| tm1.tm_year = ((date & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) + 80; ------------------ | | 146| 10|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ ------------------ tm1.tm_year = ((date & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) + 80; ------------------ | | 147| 10|#define FATFS_YEAR_SHIFT 9 ------------------ 175| 10| if ((tm1.tm_year < 0) || (tm1.tm_year > 137)) ------------------ | Branch (175:9): [True: 0, False: 10] | Branch (175:30): [True: 0, False: 10] ------------------ 176| 0| tm1.tm_year = 0; 177| | 178| | /* set the daylight savings variable to -1 so that mktime() figures 179| | * it out */ 180| 10| tm1.tm_isdst = -1; 181| | 182| 10| ret = mktime(&tm1); 183| | 184| 10| if (ret < 0) { ------------------ | Branch (184:9): [True: 0, False: 10] ------------------ 185| 0| if (tsk_verbose) ------------------ | Branch (185:13): [True: 0, False: 0] ------------------ 186| 0| tsk_fprintf(stderr, 187| 0| "fatfs_dos_2_unix_time: Error running mktime() on: %d:%d:%d %d/%d/%d\n", 188| 0| ((time & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT), ------------------ | | 127| 0|#define FATFS_HOUR_MASK 0xf800 /* number of hours 0-23 */ ------------------ ((time & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT), ------------------ | | 128| 0|#define FATFS_HOUR_SHIFT 11 ------------------ 189| 0| ((time & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT), ------------------ | | 123| 0|#define FATFS_MIN_MASK 0x7e0 /* number of minutes 0-59 */ ------------------ ((time & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT), ------------------ | | 124| 0|#define FATFS_MIN_SHIFT 5 ------------------ 190| 0| ((time & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) * 2, ------------------ | | 119| 0|#define FATFS_SEC_MASK 0x1f /* number of seconds div by 2 */ ------------------ ((time & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) * 2, ------------------ | | 120| 0|#define FATFS_SEC_SHIFT 0 ------------------ 191| 0| ((date & FATFS_MON_MASK) >> FATFS_MON_SHIFT) - 1, ------------------ | | 142| 0|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ ------------------ ((date & FATFS_MON_MASK) >> FATFS_MON_SHIFT) - 1, ------------------ | | 143| 0|#define FATFS_MON_SHIFT 5 ------------------ 192| 0| ((date & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT), ------------------ | | 138| 0|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ ------------------ ((date & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT), ------------------ | | 139| 0|#define FATFS_DAY_SHIFT 0 ------------------ 193| 0| ((date & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) + 80); ------------------ | | 146| 0|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ ------------------ ((date & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) + 80); ------------------ | | 147| 0|#define FATFS_YEAR_SHIFT 9 ------------------ 194| 0| return 0; 195| 0| } 196| | 197| 10| return ret; 198| 10|} fatfs_cleanup_ascii: 224| 13|{ 225| 13| const char *func_name = "fatfs_cleanup_ascii"; 226| | 227| 13| assert(str != NULL); 228| | 229| 13| if (!fatfs_ptr_arg_is_null(str, "str", func_name)) { ------------------ | Branch (229:9): [True: 13, False: 0] ------------------ 230| 13| int i; 231| 46| for (i = 0; str[i] != '\0'; i++) { ------------------ | Branch (231:21): [True: 33, False: 13] ------------------ 232| 33| if ((unsigned char) (str[i]) > 0x7e) { ------------------ | Branch (232:17): [True: 0, False: 33] ------------------ 233| 0| str[i] = '^'; 234| 0| } 235| 33| } 236| 13| } 237| 13|} fatxxfs_open: 437| 6|{ 438| 6| const char *func_name = "fatxxfs_open"; 439| 6| TSK_FS_INFO *fs = &(fatfs->fs_info); 440| 6| FATXXFS_SB *fatsb = (FATXXFS_SB*)(&fatfs->boot_sector_buffer); 441| 6| int i = 0; 442| 6| TSK_DADDR_T sectors = 0; 443| 6| TSK_FS_DIR * test_dir1; // Directories used to try opening the root directory 444| | 445| | // clean up any error messages that are lying around 446| 6| tsk_error_reset(); 447| | 448| | /* Calculate block sizes and layout info */ 449| | // sector size 450| 6| fatfs->ssize = tsk_getu16(fs->endian, fatsb->ssize); ------------------ | | 86| 6|#define tsk_getu16(endian, x) \ | | 87| 6|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6, False: 0] | | ------------------ | | 88| 6| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 451| 6| if (fatfs->ssize == 512) { ------------------ | Branch (451:9): [True: 6, False: 0] ------------------ 452| 6| fatfs->ssize_sh = 9; 453| 6| } 454| 0| else if (fatfs->ssize == 1024) { ------------------ | Branch (454:14): [True: 0, False: 0] ------------------ 455| 0| fatfs->ssize_sh = 10; 456| 0| } 457| 0| else if (fatfs->ssize == 2048) { ------------------ | Branch (457:14): [True: 0, False: 0] ------------------ 458| 0| fatfs->ssize_sh = 11; 459| 0| } 460| 0| else if (fatfs->ssize == 4096) { ------------------ | Branch (460:14): [True: 0, False: 0] ------------------ 461| 0| fatfs->ssize_sh = 12; 462| 0| } 463| 0| else { 464| 0| tsk_error_reset(); 465| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 466| 0| tsk_error_set_errstr 467| 0| ("Error: sector size (%d) is not a multiple of device size (%d)\nDo you have a disk image instead of a partition image?", 468| 0| fatfs->ssize, fs->dev_bsize); 469| 0| if (tsk_verbose) ------------------ | Branch (469:13): [True: 0, False: 0] ------------------ 470| 0| fprintf(stderr, "%s: Invalid sector size (%d)\n", 471| 0| func_name, fatfs->ssize); 472| 0| return 1; 473| 0| } 474| | 475| | // cluster size 476| 6| fatfs->csize = fatsb->csize; 477| 6| if ((fatfs->csize != 0x01) && ------------------ | Branch (477:9): [True: 5, False: 1] ------------------ 478| 6| (fatfs->csize != 0x02) && ------------------ | Branch (478:9): [True: 5, False: 0] ------------------ 479| 6| (fatfs->csize != 0x04) && ------------------ | Branch (479:9): [True: 0, False: 5] ------------------ 480| 6| (fatfs->csize != 0x08) && ------------------ | Branch (480:9): [True: 0, False: 0] ------------------ 481| 6| (fatfs->csize != 0x10) && ------------------ | Branch (481:9): [True: 0, False: 0] ------------------ 482| 6| (fatfs->csize != 0x20) && ------------------ | Branch (482:9): [True: 0, False: 0] ------------------ 483| 6| (fatfs->csize != 0x40) && (fatfs->csize != 0x80)) { ------------------ | Branch (483:9): [True: 0, False: 0] | Branch (483:35): [True: 0, False: 0] ------------------ 484| 0| if (tsk_verbose) ------------------ | Branch (484:13): [True: 0, False: 0] ------------------ 485| 0| fprintf(stderr, "%s: Invalid cluster size (%d)\n", 486| 0| func_name, fatfs->csize); 487| 0| tsk_error_reset(); 488| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 489| 0| tsk_error_set_errstr("Not a FATXX file system (cluster size)"); 490| 0| return 1; 491| 0| } 492| | 493| | // number of FAT tables 494| 6| fatfs->numfat = fatsb->numfat; 495| 6| if ((fatfs->numfat == 0) || (fatfs->numfat > 8)) { ------------------ | Branch (495:9): [True: 0, False: 6] | Branch (495:33): [True: 0, False: 6] ------------------ 496| 0| if (tsk_verbose) ------------------ | Branch (496:13): [True: 0, False: 0] ------------------ 497| 0| fprintf(stderr, "%s: Invalid number of FATS (%d)\n", 498| 0| func_name, fatfs->numfat); 499| 0| tsk_error_reset(); 500| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 501| 0| tsk_error_set_errstr("Not a FATXX file system (number of FATs)"); 502| 0| return 1; 503| 0| } 504| | 505| | /* We can't do a sanity check on this b.c. TSK_FS_TYPE_FAT32 has a value of 0 */ 506| | /* num of root entries */ 507| 6| fatfs->numroot = tsk_getu16(fs->endian, fatsb->numroot); ------------------ | | 86| 6|#define tsk_getu16(endian, x) \ | | 87| 6|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6, False: 0] | | ------------------ | | 88| 6| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 508| | 509| | /* if sectors16 is 0, then the number of sectors is stored in sectors32 */ 510| 6| if (0 == (sectors = tsk_getu16(fs->endian, fatsb->sectors16))) ------------------ | | 86| 6|#define tsk_getu16(endian, x) \ | | 87| 6|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6, False: 0] | | ------------------ | | 88| 6| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (510:9): [True: 1, False: 5] ------------------ 511| 1| sectors = tsk_getu32(fs->endian, fatsb->sectors32); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 512| | 513| | /* if secperfat16 is 0, then read sectperfat32 */ 514| 6| if (0 == (fatfs->sectperfat = ------------------ | Branch (514:9): [True: 1, False: 5] ------------------ 515| 6| tsk_getu16(fs->endian, fatsb->sectperfat16))) ------------------ | | 86| 6|#define tsk_getu16(endian, x) \ | | 87| 6|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6, False: 0] | | ------------------ | | 88| 6| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 516| 1| fatfs->sectperfat = 517| 1| tsk_getu32(fs->endian, fatsb->a.f32.sectperfat32); ------------------ | | 119| 1|#define tsk_getu32(endian, x) \ | | 120| 1|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1, False: 0] | | ------------------ | | 121| 1| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1| : \ | | 126| 1| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 518| | 519| 6| if (fatfs->sectperfat == 0) { ------------------ | Branch (519:9): [True: 0, False: 6] ------------------ 520| 0| if (tsk_verbose) ------------------ | Branch (520:13): [True: 0, False: 0] ------------------ 521| 0| fprintf(stderr, 522| 0| "%s: Invalid number of sectors per FAT (%d)\n", 523| 0| func_name, fatfs->sectperfat); 524| 0| tsk_error_reset(); 525| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 526| 0| tsk_error_set_errstr 527| 0| ("Not a FATXX file system (invalid sectors per FAT)"); 528| 0| return 1; 529| 0| } 530| | 531| 6| fatfs->firstfatsect = tsk_getu16(fs->endian, fatsb->reserved); ------------------ | | 86| 6|#define tsk_getu16(endian, x) \ | | 87| 6|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6, False: 0] | | ------------------ | | 88| 6| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 532| 6| if ((fatfs->firstfatsect == 0) || (fatfs->firstfatsect > sectors)) { ------------------ | Branch (532:9): [True: 0, False: 6] | Branch (532:39): [True: 0, False: 6] ------------------ 533| 0| tsk_error_reset(); 534| 0| tsk_error_set_errno(TSK_ERR_FS_WALK_RNG); ------------------ | | 348| 0|#define TSK_ERR_FS_WALK_RNG (TSK_ERR_FS | 3) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 535| 0| tsk_error_set_errstr 536| 0| ("Not a FATXX file system (invalid first FAT sector %" 537| 0| PRIuDADDR ")", fatfs->firstfatsect); 538| 0| if (tsk_verbose) ------------------ | Branch (538:13): [True: 0, False: 0] ------------------ 539| 0| fprintf(stderr, 540| 0| "%s: Invalid first FAT (%" PRIuDADDR ")\n", 541| 0| func_name, fatfs->firstfatsect); 542| 0| return 1; 543| 0| } 544| | 545| | /* Calculate the block info 546| | * 547| | * The sector of the beginning of the data area - which is 548| | * after all of the FATs 549| | * 550| | * For TSK_FS_TYPE_FAT12 and TSK_FS_TYPE_FAT16, the data area starts with the root 551| | * directory entries and then the first cluster. For TSK_FS_TYPE_FAT32, 552| | * the data area starts with clusters and the root directory 553| | * is somewhere in the data area 554| | */ 555| 6| fatfs->firstdatasect = fatfs->firstfatsect + 556| 6| fatfs->sectperfat * fatfs->numfat; 557| | 558| | /* The sector where the first cluster is located. It will be used 559| | * to translate cluster addresses to sector addresses 560| | * 561| | * For TSK_FS_TYPE_FAT32, the first cluster is the start of the data area and 562| | * it is after the root directory for TSK_FS_TYPE_FAT12 and TSK_FS_TYPE_FAT16. At this 563| | * point in the program, numroot is set to 0 for TSK_FS_TYPE_FAT32 564| | */ 565| 6| fatfs->firstclustsect = fatfs->firstdatasect + 566| 6| ((fatfs->numroot * 32 + fatfs->ssize - 1) / fatfs->ssize); 567| | 568| | /* total number of clusters */ 569| 6| fatfs->clustcnt = (sectors - fatfs->firstclustsect) / fatfs->csize; 570| | 571| | /* the first cluster is #2, so the final cluster is: */ 572| 6| fatfs->lastclust = 1 + fatfs->clustcnt; 573| | 574| | 575| | /* identify the FAT type by the total number of data clusters 576| | * this calculation is from the MS FAT Overview Doc 577| | * 578| | * A FAT file system made by another OS could use different values 579| | */ 580| 6| if (fatfs->fs_info.ftype == TSK_FS_TYPE_FAT_DETECT) { ------------------ | Branch (580:9): [True: 6, False: 0] ------------------ 581| | 582| 6| if (fatfs->clustcnt < 4085) { ------------------ | Branch (582:13): [True: 5, False: 1] ------------------ 583| 5| fatfs->fs_info.ftype = TSK_FS_TYPE_FAT12; 584| 5| } 585| 1| else if (fatfs->clustcnt < 65525) { ------------------ | Branch (585:18): [True: 0, False: 1] ------------------ 586| 0| fatfs->fs_info.ftype = TSK_FS_TYPE_FAT16; 587| 0| } 588| 1| else { 589| 1| fatfs->fs_info.ftype = TSK_FS_TYPE_FAT32; 590| 1| } 591| | 592| 6| fatfs->fs_info.ftype = fatfs->fs_info.ftype; 593| 6| } 594| | 595| | /* Some sanity checks */ 596| 0| else { 597| 0| if ((fatfs->fs_info.ftype == TSK_FS_TYPE_FAT12) ------------------ | Branch (597:13): [True: 0, False: 0] ------------------ 598| 0| && (fatfs->clustcnt >= 4085)) { ------------------ | Branch (598:16): [True: 0, False: 0] ------------------ 599| 0| tsk_error_reset(); 600| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 601| 0| tsk_error_set_errstr 602| 0| ("Too many sectors for TSK_FS_TYPE_FAT12: try auto-detect mode"); 603| 0| if (tsk_verbose) ------------------ | Branch (603:17): [True: 0, False: 0] ------------------ 604| 0| fprintf(stderr, 605| 0| "%s: Too many sectors for FAT12\n", func_name); 606| 0| return 1; 607| 0| } 608| 0| } 609| | 610| 6| if ((fatfs->fs_info.ftype == TSK_FS_TYPE_FAT32) && (fatfs->numroot != 0)) { ------------------ | Branch (610:9): [True: 1, False: 5] | Branch (610:56): [True: 0, False: 1] ------------------ 611| 0| tsk_error_reset(); 612| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 613| 0| tsk_error_set_errstr 614| 0| ("Invalid TSK_FS_TYPE_FAT32 image (numroot != 0)"); 615| 0| if (tsk_verbose) ------------------ | Branch (615:13): [True: 0, False: 0] ------------------ 616| 0| fprintf(stderr, "%s: numroom != 0 for FAT32\n", func_name); 617| 0| return 1; 618| 0| } 619| | 620| 6| if ((fatfs->fs_info.ftype != TSK_FS_TYPE_FAT32) && (fatfs->numroot == 0)) { ------------------ | Branch (620:9): [True: 5, False: 1] | Branch (620:56): [True: 0, False: 5] ------------------ 621| 0| tsk_error_reset(); 622| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 623| 0| tsk_error_set_errstr 624| 0| ("Invalid FAT image (numroot == 0, and not TSK_FS_TYPE_FAT32)"); 625| 0| if (tsk_verbose) ------------------ | Branch (625:13): [True: 0, False: 0] ------------------ 626| 0| fprintf(stderr, "%s: numroom == 0 and not FAT32\n", func_name); 627| 0| return 1; 628| 0| } 629| | 630| | /* additional sanity checks if we think we are using the backup boot sector. 631| | * The scenario to prevent here is if fat_open is called 6 sectors before the real start 632| | * of the file system, then we want to detect that it was not a backup that we saw. 633| | */ 634| 6| if (fatfs->using_backup_boot_sector) { ------------------ | Branch (634:9): [True: 0, False: 6] ------------------ 635| | // only FAT32 has backup boot sectors.. 636| 0| if (fatfs->fs_info.ftype != TSK_FS_TYPE_FAT32) { ------------------ | Branch (636:13): [True: 0, False: 0] ------------------ 637| 0| tsk_error_reset(); 638| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 639| 0| tsk_error_set_errstr 640| 0| ("Invalid FAT image (Used what we thought was a backup boot sector, but it is not TSK_FS_TYPE_FAT32)"); 641| 0| if (tsk_verbose) ------------------ | Branch (641:17): [True: 0, False: 0] ------------------ 642| 0| fprintf(stderr, 643| 0| "%s: Had to use backup boot sector, but this isn't FAT32\n", func_name); 644| 0| return 1; 645| 0| } 646| 0| if (fatfs->numroot > 1) { ------------------ | Branch (646:13): [True: 0, False: 0] ------------------ 647| 0| uint8_t buf1[512]; 648| 0| uint8_t buf2[512]; 649| 0| int i2; 650| 0| int numDiffs; 651| 0| ssize_t cnt = 0; 652| | 653| 0| cnt = 654| 0| tsk_fs_read(fs, fatfs->firstfatsect * fatfs->ssize, 655| 0| (char *) buf1, 512); 656| 0| if (cnt != 512) { ------------------ | Branch (656:17): [True: 0, False: 0] ------------------ 657| 0| if (cnt >= 0) { ------------------ | Branch (657:21): [True: 0, False: 0] ------------------ 658| 0| tsk_error_reset(); 659| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 660| 0| } 661| 0| tsk_error_set_errstr2("%s: FAT1", func_name); 662| 0| fs->tag = 0; 663| 0| return 1; 664| 0| } 665| | 666| 0| cnt = 667| 0| tsk_fs_read(fs, 668| 0| (fatfs->firstfatsect + fatfs->sectperfat) * fatfs->ssize, 669| 0| (char *) buf2, 512); 670| 0| if (cnt != 512) { ------------------ | Branch (670:17): [True: 0, False: 0] ------------------ 671| 0| if (cnt >= 0) { ------------------ | Branch (671:21): [True: 0, False: 0] ------------------ 672| 0| tsk_error_reset(); 673| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 674| 0| } 675| 0| tsk_error_set_errstr2("%s: FAT2", func_name); 676| 0| fs->tag = 0; 677| 0| return 1; 678| 0| } 679| | 680| 0| numDiffs = 0; 681| 0| for (i2 = 0; i2 < 512; i2++) { ------------------ | Branch (681:26): [True: 0, False: 0] ------------------ 682| 0| if (buf1[i2] != buf2[i2]) { ------------------ | Branch (682:21): [True: 0, False: 0] ------------------ 683| 0| numDiffs++; 684| 0| } 685| 0| } 686| 0| if (numDiffs > 25) { ------------------ | Branch (686:17): [True: 0, False: 0] ------------------ 687| 0| tsk_error_reset(); 688| 0| tsk_error_set_errno(TSK_ERR_FS_MAGIC); ------------------ | | 355| 0|#define TSK_ERR_FS_MAGIC (TSK_ERR_FS | 10) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 689| 0| tsk_error_set_errstr 690| 0| ("Invalid FAT image (Too many differences between FATS from guessing (%d diffs))", 691| 0| numDiffs); 692| 0| if (tsk_verbose) ------------------ | Branch (692:21): [True: 0, False: 0] ------------------ 693| 0| fprintf(stderr, 694| 0| "%s: Too many differences in FAT from guessing (%d diffs)\n", 695| 0| func_name, numDiffs); 696| 0| return 1; 697| 0| } 698| 0| } 699| 0| } 700| | 701| | /* Set the mask to use on the cluster values */ 702| 6| if (fatfs->fs_info.ftype == TSK_FS_TYPE_FAT12) { ------------------ | Branch (702:9): [True: 5, False: 1] ------------------ 703| 5| fatfs->mask = FATFS_12_MASK; ------------------ | | 67| 5|#define FATFS_12_MASK 0x00000fff ------------------ 704| 5| } 705| 1| else if (fatfs->fs_info.ftype == TSK_FS_TYPE_FAT16) { ------------------ | Branch (705:14): [True: 0, False: 1] ------------------ 706| 0| fatfs->mask = FATFS_16_MASK; ------------------ | | 68| 0|#define FATFS_16_MASK 0x0000ffff ------------------ 707| 0| } 708| 1| else if (fatfs->fs_info.ftype == TSK_FS_TYPE_FAT32) { ------------------ | Branch (708:14): [True: 1, False: 0] ------------------ 709| 1| fatfs->mask = FATFS_32_MASK; ------------------ | | 69| 1|#define FATFS_32_MASK 0x0fffffff ------------------ 710| 1| } 711| 0| else { 712| 0| tsk_error_reset(); 713| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 714| 0| tsk_error_set_errstr("Unknown FAT type in %s: %d\n", 715| 0| func_name, fatfs->fs_info.ftype); 716| 0| return 1; 717| 0| } 718| 6| fs->duname = "Sector"; 719| | 720| | /* the root directories are always after the FAT for TSK_FS_TYPE_FAT12 and TSK_FS_TYPE_FAT16, 721| | * but are dynamically located for TSK_FS_TYPE_FAT32 722| | */ 723| 6| if (fatfs->fs_info.ftype == TSK_FS_TYPE_FAT32) ------------------ | Branch (723:9): [True: 1, False: 5] ------------------ 724| 1| fatfs->rootsect = FATFS_CLUST_2_SECT(fatfs, ------------------ | | 86| 2| (TSK_DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize)) | | ------------------ | | | Branch (86:44): [True: 1, False: 0] | | ------------------ ------------------ 725| 6| tsk_getu32(fs->endian, fatsb->a.f32.rootclust)); 726| 5| else 727| 5| fatfs->rootsect = fatfs->firstdatasect; 728| | 729| 30| for (i = 0; i < FATFS_FAT_CACHE_N; i++) { ------------------ | | 56| 30|#define FATFS_FAT_CACHE_N 4 // number of caches ------------------ | Branch (729:17): [True: 24, False: 6] ------------------ 730| 24| fatfs->fatc_addr[i] = 0; 731| 24| fatfs->fatc_ttl[i] = 0; 732| 24| } 733| | 734| | /* 735| | * block calculations : although there are no blocks in fat, we will 736| | * use these fields for sector calculations 737| | */ 738| 6| fs->first_block = 0; 739| 6| fs->block_count = sectors; 740| 6| fs->last_block = fs->last_block_act = fs->block_count - 1; 741| 6| fs->block_size = fatfs->ssize; 742| | 743| | // determine the last block we have in this image 744| 6| if ((TSK_DADDR_T) ((fatfs->fs_info.img_info->size - fatfs->fs_info.offset) / fs->block_size) < ------------------ | Branch (744:9): [True: 6, False: 0] ------------------ 745| 6| fs->block_count) 746| 6| fs->last_block_act = 747| 6| (fatfs->fs_info.img_info->size - fatfs->fs_info.offset) / fs->block_size - 1; 748| | 749| | /* 750| | * inode calculations 751| | */ 752| | 753| | /* maximum number of dentries in a sector & cluster */ 754| 6| fatfs->dentry_cnt_se = fatfs->ssize / sizeof(FATXXFS_DENTRY); 755| 6| fatfs->dentry_cnt_cl = fatfs->dentry_cnt_se * fatfs->csize; 756| | 757| 6| fs->root_inum = FATFS_ROOTINO; ------------------ | | 43| 6|#define FATFS_ROOTINO 2 /* location of root directory inode */ ------------------ 758| 6| fs->first_inum = FATFS_FIRSTINO; ------------------ | | 42| 6|#define FATFS_FIRSTINO 2 ------------------ 759| | 760| | /* Calculate inode addresses for the virtual files (MBR, one or two FATS) 761| | * and the virtual orphan files directory. */ 762| 6| fs->last_inum = (FATFS_SECT_2_INODE(fatfs, fs->last_block_act + 1) - 1) + FATFS_NUM_VIRT_FILES(fatfs); ------------------ | | 102| 6| (TSK_INUM_T)((s - fatfs->firstdatasect) * fatfs->dentry_cnt_se + FATFS_FIRST_NORMINO) | | ------------------ | | | | 44| 6|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ fs->last_inum = (FATFS_SECT_2_INODE(fatfs, fs->last_block_act + 1) - 1) + FATFS_NUM_VIRT_FILES(fatfs); ------------------ | | 52| 6| (fatfs->numfat + 2) ------------------ 763| 6| fatfs->mbr_virt_inum = fs->last_inum - FATFS_NUM_VIRT_FILES(fatfs) + 1; ------------------ | | 52| 6| (fatfs->numfat + 2) ------------------ 764| 6| fatfs->fat1_virt_inum = fatfs->mbr_virt_inum + 1; 765| 6| if (fatfs->numfat == 2) { ------------------ | Branch (765:9): [True: 6, False: 0] ------------------ 766| 6| fatfs->fat2_virt_inum = fatfs->fat1_virt_inum + 1; 767| 6| } 768| 0| else { 769| 0| fatfs->fat2_virt_inum = fatfs->fat1_virt_inum; 770| 0| } 771| | 772| | /* Calculate the total number of inodes. */ 773| 6| fs->inum_count = fs->last_inum - fs->first_inum + 1; 774| | 775| | /* Volume ID */ 776| 30| for (fs->fs_id_used = 0; fs->fs_id_used < 4; fs->fs_id_used++) { ------------------ | Branch (776:30): [True: 24, False: 6] ------------------ 777| 24| if (fatfs->fs_info.ftype == TSK_FS_TYPE_FAT32) ------------------ | Branch (777:13): [True: 4, False: 20] ------------------ 778| 4| fs->fs_id[fs->fs_id_used] = 779| 4| fatsb->a.f32.vol_id[fs->fs_id_used]; 780| 20| else 781| 20| fs->fs_id[fs->fs_id_used] = 782| 20| fatsb->a.f16.vol_id[fs->fs_id_used]; 783| 24| } 784| | 785| | /* 786| | * Set the function pointers 787| | */ 788| | 789| 6| fs->block_walk = fatfs_block_walk; 790| 6| fs->block_getflags = fatfs_block_getflags; 791| | 792| 6| fs->inode_walk = fatfs_inode_walk; 793| 6| fs->istat = fatfs_istat; 794| 6| fs->file_add_meta = fatfs_inode_lookup; 795| | 796| 6| fs->get_default_attr_type = fatfs_get_default_attr_type; 797| 6| fs->load_attrs = fatfs_make_data_runs; 798| | 799| 6| fs->dir_open_meta = fatfs_dir_open_meta; 800| 6| fs->name_cmp = fatfs_name_cmp; 801| | 802| 6| fs->fsstat = fatxxfs_fsstat; 803| 6| fs->fscheck = fatfs_fscheck; 804| | 805| 6| fs->close = fatfs_close; 806| | 807| 6| fs->jblk_walk = fatfs_jblk_walk; 808| 6| fs->jentry_walk = fatfs_jentry_walk; 809| 6| fs->jopen = fatfs_jopen; 810| | 811| 6| fatfs->is_cluster_alloc = fatxxfs_is_cluster_alloc; 812| 6| fatfs->is_dentry = fatxxfs_is_dentry; 813| 6| fatfs->dinode_copy = fatxxfs_dinode_copy; 814| 6| fatfs->inode_lookup = fatxxfs_inode_lookup; 815| 6| fatfs->inode_walk_should_skip_dentry = fatxxfs_inode_walk_should_skip_dentry; 816| 6| fatfs->istat_attr_flags = fatxxfs_istat_attr_flags; 817| 6| fatfs->dent_parse_buf = fatxxfs_dent_parse_buf; 818| | 819| | // initialize the caches 820| 6| tsk_init_lock(&fatfs->cache_lock); 821| 6| tsk_init_lock(&fatfs->dir_lock); 822| 6| fatfs->inum2par = NULL; 823| | 824| | // Test to see if this is the odd Android case where the FAT entries have no short name 825| | // 826| | // If there are no entries found with the normal short name 827| | // and we find more entries by removing the short name test for allocated directories, then assume 828| | // this is the case where we have no short names 829| 6| fatfs->subtype = TSK_FATFS_SUBTYPE_SPEC; 830| 6| test_dir1 = tsk_fs_dir_open_meta(fs, fs->root_inum); 831| | 832| 6| if (test_dir1 != NULL && test_dir1->names_used <= 4){ // At most four automatic directories ($MBR, $FAT1, $FAT1, $OrphanFiles) ------------------ | Branch (832:6): [True: 6, False: 0] | Branch (832:27): [True: 5, False: 1] ------------------ 833| 5| TSK_FS_DIR * test_dir2; // to see if it's the Android FAT version 834| | 835| 5| fatfs->subtype = TSK_FATFS_SUBTYPE_ANDROID_1; 836| 5| test_dir2 = tsk_fs_dir_open_meta(fs, fs->root_inum); 837| | 838| 5| if (test_dir2 != NULL && test_dir2->names_used > test_dir1->names_used){ ------------------ | Branch (838:7): [True: 5, False: 0] | Branch (838:28): [True: 1, False: 4] ------------------ 839| 1| fatfs->subtype = TSK_FATFS_SUBTYPE_ANDROID_1; 840| 1| } 841| 4| else{ 842| 4| fatfs->subtype = TSK_FATFS_SUBTYPE_SPEC; 843| 4| } 844| 5| tsk_fs_dir_close(test_dir2); 845| 5| } 846| 6| tsk_fs_dir_close(test_dir1); 847| | 848| 6| return 0; 849| 6|} fatxxfs_is_cluster_alloc: 854| 3.49k|{ 855| 3.49k| TSK_DADDR_T content = 0; 856| | 857| 3.49k| if (fatfs_getFAT(fatfs, clust, &content)) ------------------ | Branch (857:9): [True: 0, False: 3.49k] ------------------ 858| 0| return -1; 859| 3.49k| else if (content == FATFS_UNALLOC) ------------------ | | 105| 3.49k|#define FATFS_UNALLOC 0 ------------------ | Branch (859:14): [True: 3.46k, False: 33] ------------------ 860| 3.46k| return 0; 861| 33| else 862| 33| return 1; 863| 3.49k|} fatxxfs_dent_parse_buf: 61| 28|{ 62| 28| char *func_name = "fatxxfs_dent_parse_buf"; 63| 28| unsigned int idx = 0; 64| 28| unsigned int sidx = 0; 65| 28| int a = 0; 66| 28| int b = 0; 67| 28| TSK_INUM_T ibase = 0; 68| 28| FATXXFS_DENTRY *dep = NULL; 69| 28| TSK_FS_INFO *fs = (TSK_FS_INFO*)&fatfs->fs_info; 70| 28| int sectalloc = 0; 71| 28| TSK_FS_NAME *fs_name = NULL; 72| 28| FATXXFS_LFN lfninfo; 73| 28| int entrySeenCount = 0; 74| 28| int entryInvalidCount = 0; 75| 28| uint8_t isCorruptDir = 0; 76| | 77| 28| tsk_error_reset(); 78| 28| if (fatfs_ptr_arg_is_null(fatfs, "fatfs", func_name) || ------------------ | Branch (78:9): [True: 0, False: 28] ------------------ 79| 28| fatfs_ptr_arg_is_null(a_fs_dir, "a_fs_dir", func_name) || ------------------ | Branch (79:9): [True: 0, False: 28] ------------------ 80| 28| fatfs_ptr_arg_is_null(buf, "buf", func_name) || ------------------ | Branch (80:9): [True: 0, False: 28] ------------------ 81| 28| fatfs_ptr_arg_is_null(addrs, "addrs", func_name)) { ------------------ | Branch (81:9): [True: 0, False: 28] ------------------ 82| 0| return TSK_ERR; 83| 0| } 84| | 85| 28| assert(len > 0); 86| 28| if (len < 0) { ------------------ | Branch (86:9): [True: 0, False: 28] ------------------ 87| 0| tsk_error_reset(); 88| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 89| 0| tsk_error_set_errstr("%s: invalid buffer length", func_name); 90| 0| return TSK_ERR; 91| 0| } 92| | 93| 28| dep = (FATXXFS_DENTRY*)buf; 94| | 95| 28| if ((fs_name = tsk_fs_name_alloc(FATFS_MAXNAMLEN_UTF8, 32)) == NULL) { ------------------ | | 163| 28|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ | Branch (95:9): [True: 0, False: 28] ------------------ 96| 0| return TSK_ERR; 97| 0| } 98| | 99| 28| memset(&lfninfo, 0, sizeof(FATXXFS_LFN)); 100| 28| lfninfo.start = FATFS_MAXNAMLEN_UTF8 - 1; ------------------ | | 163| 28|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 101| | 102| | /* Loop through the sectors in the buffer. */ 103| 800| for (sidx = 0; sidx < (unsigned int) (len / fatfs->ssize); sidx++) { ------------------ | Branch (103:20): [True: 772, False: 28] ------------------ 104| | 105| | /* Get the base inode for the current sector */ 106| 772| ibase = FATFS_SECT_2_INODE(fatfs, addrs[sidx]); ------------------ | | 102| 772| (TSK_INUM_T)((s - fatfs->firstdatasect) * fatfs->dentry_cnt_se + FATFS_FIRST_NORMINO) | | ------------------ | | | | 44| 772|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 107| 772| if (ibase > fs->last_inum) { ------------------ | Branch (107:13): [True: 0, False: 772] ------------------ 108| 0| tsk_error_reset(); 109| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 110| 0| tsk_error_set_errstr 111| 0| ("fatfs_parse: inode address is too large"); 112| 0| tsk_fs_name_free(fs_name); 113| 0| return TSK_COR; 114| 0| } 115| | 116| 772| if (tsk_verbose) ------------------ | Branch (116:13): [True: 0, False: 772] ------------------ 117| 0| tsk_fprintf(stderr, 118| 0| "fatfs_dent_parse_buf: Parsing sector %" PRIuDADDR 119| 0| " for dir %" PRIuINUM "\n", addrs[sidx], a_fs_dir->addr); 120| | 121| | /* Get the allocation status of the current sector. */ 122| 772| if ((sectalloc = fatfs_is_sectalloc(fatfs, addrs[sidx])) == -1) { ------------------ | Branch (122:13): [True: 0, False: 772] ------------------ 123| 0| if (tsk_verbose) { ------------------ | Branch (123:17): [True: 0, False: 0] ------------------ 124| 0| tsk_fprintf(stderr, 125| 0| "fatfs_dent_parse_buf: Error looking up sector allocation: %" 126| 0| PRIuDADDR "\n", addrs[sidx]); 127| 0| tsk_error_print(stderr); 128| 0| } 129| 0| tsk_error_reset(); 130| 0| continue; 131| 0| } 132| | 133| | /* Loop through the putative directory entries in the current sector. */ 134| 13.1k| for (idx = 0; idx < fatfs->dentry_cnt_se; idx++, dep++) { ------------------ | Branch (134:23): [True: 12.3k, False: 772] ------------------ 135| 12.3k| FATXXFS_DENTRY *dir; 136| 12.3k| TSK_INUM_T inode; 137| | 138| 12.3k| entrySeenCount++; 139| | 140| | /* Is the current entry a valid entry? */ 141| 12.3k| if (0 == fatxxfs_is_dentry(fatfs, (FATFS_DENTRY*)dep, ------------------ | Branch (141:17): [True: 12.3k, False: 7] ------------------ 142| 12.3k| (FATFS_DATA_UNIT_ALLOC_STATUS_ENUM)sectalloc, 143| 12.3k| ((isCorruptDir == 0) && (sectalloc)) ? 1 : 0)) { ------------------ | Branch (143:18): [True: 160, False: 12.1k] | Branch (143:41): [True: 160, False: 0] ------------------ 144| 12.3k| if (tsk_verbose) ------------------ | Branch (144:25): [True: 0, False: 12.3k] ------------------ 145| 0| tsk_fprintf(stderr, 146| 0| "fatfs_dent_parse_buf: Entry %u is invalid\n", 147| 0| idx); 148| 12.3k| entryInvalidCount++; 149| | /* If we have seen four entries and all of them are corrupt, 150| | * then test every remaining entry in this folder -- 151| | * even if the sector is allocated. The scenario is one 152| | * where we are processing a cluster that is allocated 153| | * to a file and we happen to get some data that matches 154| | * every now and then. */ 155| 12.3k| if ((entrySeenCount == 4) && (entryInvalidCount == 4)) { ------------------ | Branch (155:25): [True: 28, False: 12.3k] | Branch (155:50): [True: 24, False: 4] ------------------ 156| 24| isCorruptDir = 1; 157| 24| } 158| 12.3k| continue; 159| 12.3k| } 160| | 161| 7| dir = dep; 162| | 163| | /* Compute the inode address corresponding to this directory entry. */ 164| 7| inode = ibase + idx; 165| | 166| 7| if ((dir->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 7|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ if ((dir->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 7|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (166:17): [True: 0, False: 7] ------------------ 167| | /* The current entry is a long file name entry. */ 168| 0| FATXXFS_DENTRY_LFN *dirl = (FATXXFS_DENTRY_LFN *) dir; 169| | 170| | /* Store the name in dinfo until we get the 8.3 name 171| | * Use the checksum to identify a new sequence. */ 172| 0| if (((dirl->seq & FATXXFS_LFN_SEQ_FIRST) && (dirl->seq != FATXXFS_SLOT_DELETED)) || ------------------ | | 71| 0|#define FATXXFS_LFN_SEQ_FIRST 0x40 /* This bit is set for the first lfn entry */ ------------------ if (((dirl->seq & FATXXFS_LFN_SEQ_FIRST) && (dirl->seq != FATXXFS_SLOT_DELETED)) || ------------------ | | 34| 0|#define FATXXFS_SLOT_DELETED 0xe5 ------------------ | Branch (172:22): [True: 0, False: 0] | Branch (172:61): [True: 0, False: 0] ------------------ 173| 0| (dirl->chksum != lfninfo.chk)) { ------------------ | Branch (173:21): [True: 0, False: 0] ------------------ 174| | // @@@ Do a partial output here 175| | 176| | /* This is the last long file name entry in a sequence. 177| | * Reset the sequence number, check sum, and next char 178| | * address. */ 179| 0| lfninfo.seq = dirl->seq & FATXXFS_LFN_SEQ_MASK; ------------------ | | 72| 0|#define FATXXFS_LFN_SEQ_MASK 0x3f /* These bits are a mask for the decreasing ------------------ 180| 0| lfninfo.chk = dirl->chksum; 181| 0| lfninfo.start = FATFS_MAXNAMLEN_UTF8 - 1; ------------------ | | 163| 0|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 182| 0| } 183| 0| else if (dirl->seq != lfninfo.seq - 1) { ------------------ | Branch (183:26): [True: 0, False: 0] ------------------ 184| | // @@@ Check the sequence number - the checksum is correct though... 185| 0| } 186| | 187| | /* Copy the UTF16 values starting at end of buffer */ 188| 0| for (a = 3; a >= 0; a--) { ------------------ | Branch (188:29): [True: 0, False: 0] ------------------ 189| 0| if ((lfninfo.start > 0)) ------------------ | Branch (189:25): [True: 0, False: 0] ------------------ 190| 0| lfninfo.name[lfninfo.start--] = dirl->part3[a]; 191| 0| } 192| 0| for (a = 11; a >= 0; a--) { ------------------ | Branch (192:30): [True: 0, False: 0] ------------------ 193| 0| if ((lfninfo.start > 0)) ------------------ | Branch (193:25): [True: 0, False: 0] ------------------ 194| 0| lfninfo.name[lfninfo.start--] = dirl->part2[a]; 195| 0| } 196| 0| for (a = 9; a >= 0; a--) { ------------------ | Branch (196:29): [True: 0, False: 0] ------------------ 197| 0| if ((lfninfo.start > 0)) ------------------ | Branch (197:25): [True: 0, False: 0] ------------------ 198| 0| lfninfo.name[lfninfo.start--] = dirl->part1[a]; 199| 0| } 200| | 201| | // Skip ahead until we get a new sequence num or the 8.3 name 202| 0| continue; 203| 0| } 204| 7| else if ((dir->attrib & FATFS_ATTR_VOLUME) == FATFS_ATTR_VOLUME) { ------------------ | | 79| 7|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ else if ((dir->attrib & FATFS_ATTR_VOLUME) == FATFS_ATTR_VOLUME) { ------------------ | | 79| 7|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ | Branch (204:22): [True: 4, False: 3] ------------------ 205| | /* Special case for volume label: name does not have an 206| | * extension and we add a note at the end that it is a label */ 207| 4| a = 0; 208| | 209| 36| for (b = 0; b < 8; b++) { ------------------ | Branch (209:29): [True: 32, False: 4] ------------------ 210| 32| if ((dir->name[b] >= 0x20) && (dir->name[b] != 0xff)) { ------------------ | Branch (210:25): [True: 32, False: 0] | Branch (210:51): [True: 32, False: 0] ------------------ 211| 32| fs_name->name[a++] = dir->name[b]; 212| 32| } 213| 0| else { 214| 0| fs_name->name[a++] = '^'; 215| 0| } 216| 32| } 217| 16| for (b = 0; b < 3; b++) { ------------------ | Branch (217:29): [True: 12, False: 4] ------------------ 218| 12| if ((dir->ext[b] >= 0x20) && (dir->ext[b] != 0xff)) { ------------------ | Branch (218:25): [True: 12, False: 0] | Branch (218:50): [True: 12, False: 0] ------------------ 219| 12| fs_name->name[a++] = dir->ext[b]; 220| 12| } 221| 0| else { 222| 0| fs_name->name[a++] = '^'; 223| 0| } 224| 12| } 225| | 226| 4| fs_name->name[a] = '\0'; 227| | /* Append a string to show it is a label */ 228| 4| if (a + 22 < FATFS_MAXNAMLEN_UTF8) { ------------------ | | 163| 4|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ | Branch (228:21): [True: 4, False: 0] ------------------ 229| 4| const char *volstr = " (Volume Label Entry)"; 230| 4| strncat(fs_name->name, volstr, 231| 4| FATFS_MAXNAMLEN_UTF8 - a); ------------------ | | 163| 4|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 232| 4| } 233| 4| } 234| 3| else { 235| | /* A short (8.3) entry */ 236| 3| char *name_ptr; // The dest location for the short name 237| | 238| | /* if we have a lfn, copy it into fs_name->name 239| | * and put the short name in fs_name->shrt_name */ 240| 3| if (lfninfo.start != FATFS_MAXNAMLEN_UTF8 - 1) { ------------------ | | 163| 3|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ | Branch (240:21): [True: 0, False: 3] ------------------ 241| 0| int retVal; 242| | 243| | /* @@@ Check the checksum */ 244| | 245| | /* Convert the UTF16 to UTF8 */ 246| 0| UTF16 *name16 = 247| 0| (UTF16 *) ((uintptr_t) & lfninfo. 248| 0| name[lfninfo.start + 1]); 249| 0| UTF8 *name8 = (UTF8 *) fs_name->name; 250| | 251| 0| retVal = 252| 0| tsk_UTF16toUTF8(fs->endian, 253| 0| (const UTF16 **) &name16, 254| 0| (UTF16 *) & lfninfo.name[FATFS_MAXNAMLEN_UTF8], ------------------ | | 163| 0|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 255| 0| &name8, 256| 0| (UTF8 *) ((uintptr_t) name8 + 257| 0| FATFS_MAXNAMLEN_UTF8), TSKlenientConversion); ------------------ | | 163| 0|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 258| | 259| 0| if (retVal != TSKconversionOK) { ------------------ | Branch (259:25): [True: 0, False: 0] ------------------ 260| 0| tsk_error_reset(); 261| 0| tsk_error_set_errno(TSK_ERR_FS_UNICODE); ------------------ | | 358| 0|#define TSK_ERR_FS_UNICODE (TSK_ERR_FS | 13) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 262| 0| tsk_error_set_errstr 263| 0| ("fatfs_parse: Error converting FAT LFN to UTF8: %d", 264| 0| retVal); 265| 0| continue; 266| 0| } 267| | 268| | /* Make sure it is NULL Terminated */ 269| 0| if ((uintptr_t) name8 > ------------------ | Branch (269:25): [True: 0, False: 0] ------------------ 270| 0| (uintptr_t) fs_name->name + FATFS_MAXNAMLEN_UTF8) ------------------ | | 163| 0|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 271| 0| fs_name->name[FATFS_MAXNAMLEN_UTF8 - 1] = '\0'; ------------------ | | 163| 0|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 272| 0| else 273| 0| *name8 = '\0'; 274| | 275| 0| lfninfo.start = FATFS_MAXNAMLEN_UTF8 - 1; ------------------ | | 163| 0|#define FATFS_MAXNAMLEN_UTF8 1024 ------------------ 276| 0| name_ptr = fs_name->shrt_name; // put 8.3 into shrt_name 277| 0| } 278| | /* We don't have a LFN, so put the short name in 279| | * fs_name->name */ 280| 3| else { 281| 3| fs_name->shrt_name[0] = '\0'; 282| 3| name_ptr = fs_name->name; // put 8.3 into normal location 283| 3| } 284| | 285| | /* copy in the short name into the place specified above. 286| | * Skip spaces and put in the . */ 287| 3| a = 0; 288| 27| for (b = 0; b < 8; b++) { ------------------ | Branch (288:29): [True: 24, False: 3] ------------------ 289| 24| if ((dir->name[b] != 0) && (dir->name[b] != 0xff) && ------------------ | Branch (289:25): [True: 0, False: 24] | Branch (289:48): [True: 0, False: 0] ------------------ 290| 24| (dir->name[b] != 0x20)) { ------------------ | Branch (290:25): [True: 0, False: 0] ------------------ 291| | 292| 0| if ((b == 0) ------------------ | Branch (292:33): [True: 0, False: 0] ------------------ 293| 0| && (dir->name[0] == FATXXFS_SLOT_DELETED)) { ------------------ | | 34| 0|#define FATXXFS_SLOT_DELETED 0xe5 ------------------ | Branch (293:36): [True: 0, False: 0] ------------------ 294| 0| name_ptr[a++] = '_'; 295| 0| } 296| 0| else if ((dir->lowercase & FATXXFS_CASE_LOWER_BASE) ------------------ | | 66| 0|#define FATXXFS_CASE_LOWER_BASE 0x08 /* base is lower case */ ------------------ | Branch (296:38): [True: 0, False: 0] ------------------ 297| 0| && (dir->name[b] >= 'A') ------------------ | Branch (297:36): [True: 0, False: 0] ------------------ 298| 0| && (dir->name[b] <= 'Z')) { ------------------ | Branch (298:36): [True: 0, False: 0] ------------------ 299| 0| name_ptr[a++] = dir->name[b] + 32; 300| 0| } 301| 0| else { 302| 0| name_ptr[a++] = dir->name[b]; 303| 0| } 304| 0| } 305| 24| } 306| | 307| 12| for (b = 0; b < 3; b++) { ------------------ | Branch (307:29): [True: 9, False: 3] ------------------ 308| 9| if ((dir->ext[b] != 0) && (dir->ext[b] != 0xff) && ------------------ | Branch (308:25): [True: 0, False: 9] | Branch (308:47): [True: 0, False: 0] ------------------ 309| 9| (dir->ext[b] != 0x20)) { ------------------ | Branch (309:25): [True: 0, False: 0] ------------------ 310| 0| if (b == 0) ------------------ | Branch (310:33): [True: 0, False: 0] ------------------ 311| 0| name_ptr[a++] = '.'; 312| 0| if ((dir->lowercase & FATXXFS_CASE_LOWER_EXT) && ------------------ | | 67| 0|#define FATXXFS_CASE_LOWER_EXT 0x10 /* extension is lower case */ ------------------ | Branch (312:33): [True: 0, False: 0] ------------------ 313| 0| (dir->ext[b] >= 'A') && (dir->ext[b] <= 'Z')) ------------------ | Branch (313:33): [True: 0, False: 0] | Branch (313:57): [True: 0, False: 0] ------------------ 314| 0| name_ptr[a++] = dir->ext[b] + 32; 315| 0| else 316| 0| name_ptr[a++] = dir->ext[b]; 317| 0| } 318| 9| } 319| 3| name_ptr[a] = '\0'; 320| | 321| | // make sure that only ASCII is in the short name 322| 3| fatfs_cleanup_ascii(name_ptr); 323| 3| } 324| | 325| | /* file type: FAT only knows DIR and FILE */ 326| 7| if ((dir->attrib & FATFS_ATTR_DIRECTORY) == ------------------ | | 80| 7|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ | Branch (326:17): [True: 0, False: 7] ------------------ 327| 7| FATFS_ATTR_DIRECTORY) ------------------ | | 80| 7|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ 328| 0| fs_name->type = TSK_FS_NAME_TYPE_DIR; 329| 7| else 330| 7| fs_name->type = TSK_FS_NAME_TYPE_REG; 331| | 332| | /* set the inode */ 333| 7| fs_name->meta_addr = inode; 334| 7| inode = 0; // so that we don't use it anymore -- use only fs_name->meta_addr 335| | 336| | /* Handle the . and .. entries specially 337| | * The current inode 'address' they have is for the current 338| | * slot in the cluster, but it needs to refer to the original 339| | * slot 340| | */ 341| 7| if (TSK_FS_ISDOT(fs_name->name) ------------------ | | 1179| 14|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:27): [True: 0, False: 7] | | | Branch (1179:30): [True: 0, False: 7] | | ------------------ | | 1180| 7| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ 342| 7| && (fs_name->type == TSK_FS_NAME_TYPE_DIR) ------------------ | Branch (342:24): [True: 0, False: 0] ------------------ 343| 7| && idx < 2) { ------------------ | Branch (343:24): [True: 0, False: 0] ------------------ 344| 0| if (fs_name->name[1] == '\0') { ------------------ | Branch (344:21): [True: 0, False: 0] ------------------ 345| | /* Current directory - "." */ 346| 0| fs_name->meta_addr = 347| 0| a_fs_dir->fs_file->meta->addr; 348| 0| } 349| | /* for the parent directory, look up in the list that 350| | * is maintained in fafs_info */ 351| 0| else if (fs_name->name[1] == '.') { ------------------ | Branch (351:26): [True: 0, False: 0] ------------------ 352| | /* Parent directory - ".." */ 353| 0| uint8_t dir_found = 0; 354| | 355| 0| if (fatfs_dir_buf_get(fatfs, a_fs_dir->fs_file->meta->addr, &(fs_name->meta_addr)) == 0) { ------------------ | Branch (355:25): [True: 0, False: 0] ------------------ 356| 0| dir_found = 1; 357| 0| } 358| | 359| 0| if ((dir_found == 0) ------------------ | Branch (359:25): [True: 0, False: 0] ------------------ 360| 0| && (addrs[0] == fatfs->firstdatasect)) { ------------------ | Branch (360:28): [True: 0, False: 0] ------------------ 361| | /* if we are currently in the root directory, we aren't going to find 362| | * a parent. This shouldn't happen, but could result in an infinite loop. */ 363| 0| fs_name->meta_addr = 0; 364| 0| dir_found = 1; 365| 0| } 366| 0| if (dir_found == 0) { ------------------ | Branch (366:25): [True: 0, False: 0] ------------------ 367| 0| if (tsk_verbose) ------------------ | Branch (367:29): [True: 0, False: 0] ------------------ 368| 0| fprintf(stderr, 369| 0| "fatfs_dent_parse_buf: Walking directory to find parent\n"); 370| | 371| | /* The parent directory is not in the list. We are going to walk 372| | * the directory until we hit this directory. This process will 373| | * populate the buffer table and we will then rescan it */ 374| 0| if (tsk_fs_dir_walk_internal(fs, fs->root_inum, ------------------ | Branch (374:29): [True: 0, False: 0] ------------------ 375| 0| (TSK_FS_DIR_WALK_FLAG_ENUM)(TSK_FS_DIR_WALK_FLAG_ALLOC | 376| 0| TSK_FS_DIR_WALK_FLAG_UNALLOC | 377| 0| TSK_FS_DIR_WALK_FLAG_RECURSE), 378| 0| fatfs_find_parent_act, 379| 0| (void *) &a_fs_dir->fs_file->meta->addr, recursion_depth)) { 380| 0| return TSK_OK; 381| 0| } 382| | 383| 0| if (tsk_verbose) ------------------ | Branch (383:29): [True: 0, False: 0] ------------------ 384| 0| fprintf(stderr, 385| 0| "fatfs_dent_parse_buf: Finished walking directory to find parent\n"); 386| | 387| 0| if (fatfs_dir_buf_get(fatfs, a_fs_dir->fs_file->meta->addr, &(fs_name->meta_addr)) == 0) { ------------------ | Branch (387:29): [True: 0, False: 0] ------------------ 388| 0| dir_found = 1; 389| 0| } 390| | 391| | // if we did not find it, then it was probably 392| | // from the orphan directory... 393| 0| if (dir_found == 0) ------------------ | Branch (393:29): [True: 0, False: 0] ------------------ 394| 0| fs_name->meta_addr = TSK_FS_ORPHANDIR_INUM(fs); ------------------ | | 530| 0| (fs_info->last_inum) ------------------ 395| 0| } 396| 0| } 397| 0| } 398| 7| else { 399| | /* Save the (non-. or ..) directory to parent directory info to local 400| | * structures so that we can later fill into the inode 401| | * info for '..' entries */ 402| 7| if (fs_name->type == TSK_FS_NAME_TYPE_DIR) { ------------------ | Branch (402:21): [True: 0, False: 7] ------------------ 403| 0| if (fatfs_dir_buf_add(fatfs, ------------------ | Branch (403:25): [True: 0, False: 0] ------------------ 404| 0| a_fs_dir->fs_file->meta->addr, fs_name->meta_addr)) 405| 0| return TSK_ERR; 406| 0| } 407| 7| } 408| | 409| | 410| | /* The allocation status of an entry is based on the allocation 411| | * status of the sector it is in and the flag. Deleted directories 412| | * do not always clear the flags of each entry 413| | */ 414| 7| if (sectalloc == 1) { ------------------ | Branch (414:17): [True: 7, False: 0] ------------------ 415| 7| if(FATXXFS_IS_DELETED(dep->name, fatfs)){ ------------------ | | 41| 7| (fatfs->subtype == TSK_FATFS_SUBTYPE_ANDROID_1) ? \ | | ------------------ | | | Branch (41:2): [True: 3, False: 4] | | | Branch (41:2): [True: 3, False: 4] | | ------------------ | | 42| 7| ((name[0] == 0) && (name[1] == 0)) : \ | | ------------------ | | | Branch (42:3): [True: 3, False: 0] | | | Branch (42:21): [True: 3, False: 0] | | ------------------ | | 43| 7| (name[0] == FATXXFS_SLOT_DELETED) | | ------------------ | | | | 34| 4|#define FATXXFS_SLOT_DELETED 0xe5 | | ------------------ ------------------ 416| 3| fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 417| 3| } 418| 4| else{ 419| 4| fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 420| 4| } 421| 7| } 422| 0| else { 423| 0| fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 424| 0| } 425| | 426| 7| tsk_fs_dir_add(a_fs_dir, fs_name); 427| 7| } 428| 772| } 429| 28| tsk_fs_name_free(fs_name); 430| | 431| 28| return TSK_OK; 432| 28|} fatxxfs_is_dentry: 155| 25.8k|{ 156| 25.8k| const char *func_name = "fatxxfs_is_dentry"; 157| 25.8k| TSK_FS_INFO *fs = (TSK_FS_INFO *) & a_fatfs->fs_info; 158| 25.8k| FATXXFS_DENTRY *dentry = (FATXXFS_DENTRY*)a_dentry; 159| | 160| 25.8k| if (!a_dentry) ------------------ | Branch (160:9): [True: 0, False: 25.8k] ------------------ 161| 0| return 0; 162| | 163| | /* LFN have their own checks, which are pretty weak since most 164| | * fields are UTF16 */ 165| 25.8k| if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 25.8k|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 25.8k|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (165:9): [True: 18, False: 25.8k] ------------------ 166| 18| FATXXFS_DENTRY_LFN *de_lfn = (FATXXFS_DENTRY_LFN*) dentry; 167| | 168| 18| if ((de_lfn->seq > (FATXXFS_LFN_SEQ_FIRST | 0x0f)) ------------------ | | 71| 18|#define FATXXFS_LFN_SEQ_FIRST 0x40 /* This bit is set for the first lfn entry */ ------------------ | Branch (168:13): [True: 18, False: 0] ------------------ 169| 18| && (de_lfn->seq != FATXXFS_SLOT_DELETED)) { ------------------ | | 34| 18|#define FATXXFS_SLOT_DELETED 0xe5 ------------------ | Branch (169:16): [True: 18, False: 0] ------------------ 170| 18| if (tsk_verbose) ------------------ | Branch (170:17): [True: 0, False: 18] ------------------ 171| 0| fprintf(stderr, "%s: LFN seq\n", func_name); 172| 18| return 0; 173| 18| } 174| | 175| 0| return 1; 176| 18| } 177| 25.8k| else { 178| | // the basic test is only for the 'essential data'. 179| 25.8k| if (a_do_basic_tests_only == 0) { ------------------ | Branch (179:13): [True: 23.1k, False: 2.73k] ------------------ 180| 23.1k| if (dentry->lowercase & ~(FATXXFS_CASE_LOWER_ALL)) { ------------------ | | 68| 23.1k|#define FATXXFS_CASE_LOWER_ALL 0x18 /* both are lower */ ------------------ | Branch (180:17): [True: 84, False: 23.0k] ------------------ 181| 84| if (tsk_verbose) ------------------ | Branch (181:21): [True: 0, False: 84] ------------------ 182| 0| fprintf(stderr, "%s: lower case all\n", func_name); 183| 84| return 0; 184| 84| } 185| 23.0k| else if (dentry->attrib & ~(FATFS_ATTR_ALL)) { ------------------ | | 83| 23.0k|#define FATFS_ATTR_ALL 0x3f /* all flags set */ ------------------ | Branch (185:22): [True: 0, False: 23.0k] ------------------ 186| 0| if (tsk_verbose) ------------------ | Branch (186:21): [True: 0, False: 0] ------------------ 187| 0| fprintf(stderr, "%s: attribute all\n", func_name); 188| 0| return 0; 189| 0| } 190| | 191| | // verify we do not have too many flags set 192| 23.0k| if (dentry->attrib & FATFS_ATTR_VOLUME) { ------------------ | | 79| 23.0k|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ | Branch (192:17): [True: 0, False: 23.0k] ------------------ 193| 0| if ((dentry->attrib & FATFS_ATTR_DIRECTORY) || ------------------ | | 80| 0|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ | Branch (193:21): [True: 0, False: 0] ------------------ 194| 0| (dentry->attrib & FATFS_ATTR_READONLY) || ------------------ | | 76| 0|#define FATFS_ATTR_READONLY 0x01 /* file is readonly */ ------------------ | Branch (194:21): [True: 0, False: 0] ------------------ 195| 0| (dentry->attrib & FATFS_ATTR_ARCHIVE)) { ------------------ | | 81| 0|#define FATFS_ATTR_ARCHIVE 0x20 /* file is new or modified */ ------------------ | Branch (195:21): [True: 0, False: 0] ------------------ 196| 0| if (tsk_verbose) ------------------ | Branch (196:25): [True: 0, False: 0] ------------------ 197| 0| fprintf(stderr, 198| 0| "%s: Vol and Dir/RO/Arch\n", func_name); 199| 0| return 0; 200| 0| } 201| 0| } 202| | 203| | /* The ctime, cdate, and adate fields are optional and 204| | * therefore 0 is a valid value 205| | * We have had scenarios where ISDATE and ISTIME return true, 206| | * but the unix2dos fail during the conversion. This has been 207| | * useful to detect corrupt entries, so we do both. 208| | */ 209| 23.0k| if ((tsk_getu16(fs->endian, dentry->ctime) != 0) && ------------------ | | 86| 23.0k|#define tsk_getu16(endian, x) \ | | 87| 23.0k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 23.0k, False: 0] | | ------------------ | | 88| 23.0k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 23.0k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (209:17): [True: 0, False: 23.0k] ------------------ 210| 23.0k| (FATFS_ISTIME(tsk_getu16(fs->endian, dentry->ctime)) == 0)) { ------------------ | | 134| 0| (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \ | | ------------------ | | | | 119| 0|#define FATFS_SEC_MASK 0x1f /* number of seconds div by 2 */ | | ------------------ | | (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \ | | ------------------ | | | | 120| 0|#define FATFS_SEC_SHIFT 0 | | ------------------ | | (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \ | | ------------------ | | | | 122| 0|#define FATFS_SEC_MAX 30 | | ------------------ | | | Branch (134:4): [True: 0, False: 0] | | | Branch (134:7): [True: 0, False: 0] | | ------------------ | | 135| 0| (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \ | | ------------------ | | | | 123| 0|#define FATFS_MIN_MASK 0x7e0 /* number of minutes 0-59 */ | | ------------------ | | (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \ | | ------------------ | | | | 124| 0|#define FATFS_MIN_SHIFT 5 | | ------------------ | | (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \ | | ------------------ | | | | 126| 0|#define FATFS_MIN_MAX 59 | | ------------------ | | | Branch (135:4): [True: 0, False: 0] | | | Branch (135:7): [True: 0, False: 0] | | ------------------ | | 136| 0| (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0) | | ------------------ | | | | 127| 0|#define FATFS_HOUR_MASK 0xf800 /* number of hours 0-23 */ | | ------------------ | | (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0) | | ------------------ | | | | 128| 0|#define FATFS_HOUR_SHIFT 11 | | ------------------ | | (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0) | | ------------------ | | | | 130| 0|#define FATFS_HOUR_MAX 23 | | ------------------ | | | Branch (136:4): [True: 0, False: 0] | | | Branch (136:7): [True: 0, False: 0] | | ------------------ ------------------ | Branch (210:17): [True: 0, False: 0] ------------------ 211| 0| if (tsk_verbose) ------------------ | Branch (211:21): [True: 0, False: 0] ------------------ 212| 0| fprintf(stderr, "%s: ctime\n", func_name); 213| 0| return 0; 214| 0| } 215| 23.0k| else if ((tsk_getu16(fs->endian, dentry->wtime) != 0) && ------------------ | | 86| 23.0k|#define tsk_getu16(endian, x) \ | | 87| 23.0k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 23.0k, False: 0] | | ------------------ | | 88| 23.0k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 23.0k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (215:22): [True: 0, False: 23.0k] ------------------ 216| 23.0k| (FATFS_ISTIME(tsk_getu16(fs->endian, dentry->wtime)) == 0)) { ------------------ | | 134| 0| (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \ | | ------------------ | | | | 119| 0|#define FATFS_SEC_MASK 0x1f /* number of seconds div by 2 */ | | ------------------ | | (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \ | | ------------------ | | | | 120| 0|#define FATFS_SEC_SHIFT 0 | | ------------------ | | (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \ | | ------------------ | | | | 122| 0|#define FATFS_SEC_MAX 30 | | ------------------ | | | Branch (134:4): [True: 0, False: 0] | | | Branch (134:7): [True: 0, False: 0] | | ------------------ | | 135| 0| (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \ | | ------------------ | | | | 123| 0|#define FATFS_MIN_MASK 0x7e0 /* number of minutes 0-59 */ | | ------------------ | | (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \ | | ------------------ | | | | 124| 0|#define FATFS_MIN_SHIFT 5 | | ------------------ | | (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \ | | ------------------ | | | | 126| 0|#define FATFS_MIN_MAX 59 | | ------------------ | | | Branch (135:4): [True: 0, False: 0] | | | Branch (135:7): [True: 0, False: 0] | | ------------------ | | 136| 0| (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0) | | ------------------ | | | | 127| 0|#define FATFS_HOUR_MASK 0xf800 /* number of hours 0-23 */ | | ------------------ | | (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0) | | ------------------ | | | | 128| 0|#define FATFS_HOUR_SHIFT 11 | | ------------------ | | (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0) | | ------------------ | | | | 130| 0|#define FATFS_HOUR_MAX 23 | | ------------------ | | | Branch (136:4): [True: 0, False: 0] | | | Branch (136:7): [True: 0, False: 0] | | ------------------ ------------------ | Branch (216:17): [True: 0, False: 0] ------------------ 217| 0| if (tsk_verbose) ------------------ | Branch (217:21): [True: 0, False: 0] ------------------ 218| 0| fprintf(stderr, "%s: wtime\n", func_name); 219| 0| return 0; 220| 0| } 221| 23.0k| else if ((tsk_getu16(fs->endian, dentry->cdate) != 0) && ------------------ | | 86| 23.0k|#define tsk_getu16(endian, x) \ | | 87| 23.0k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 23.0k, False: 0] | | ------------------ | | 88| 23.0k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 23.0k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (221:22): [True: 1, False: 23.0k] ------------------ 222| 23.0k| ((FATFS_ISDATE(tsk_getu16(fs->endian, dentry->cdate)) == 0) || ------------------ | | 153| 2| (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 138| 1|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 139| 1|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 141| 1|#define FATFS_DAY_MAX 31 | | ------------------ | | | Branch (153:5): [True: 0, False: 1] | | | Branch (153:8): [True: 1, False: 0] | | ------------------ | | 154| 2| (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 138| 1|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 139| 1|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 140| 1|#define FATFS_DAY_MIN 1 | | ------------------ | | | Branch (154:5): [True: 0, False: 1] | | | Branch (154:8): [True: 1, False: 0] | | ------------------ | | 155| 2| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 142| 1|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 143| 1|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 145| 1|#define FATFS_MON_MAX 12 | | ------------------ | | | Branch (155:5): [True: 0, False: 1] | | | Branch (155:8): [True: 1, False: 0] | | ------------------ | | 156| 2| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 142| 1|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 143| 1|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 144| 1|#define FATFS_MON_MIN 1 | | ------------------ | | | Branch (156:5): [True: 1, False: 0] | | | Branch (156:8): [True: 1, False: 0] | | ------------------ | | 157| 1| (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 146| 0|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 147| 0|#define FATFS_YEAR_SHIFT 9 | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 149| 0|#define FATFS_YEAR_MAX 127 | | ------------------ | | | Branch (157:5): [True: 0, False: 0] | | | Branch (157:8): [True: 0, False: 0] | | ------------------ ------------------ | Branch (222:18): [True: 1, False: 0] ------------------ 223| 1| (fatfs_dos_2_unix_time(tsk_getu16(fs->endian, dentry->cdate), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (223:21): [True: 0, False: 0] ------------------ 224| 0| tsk_getu16(fs->endian, dentry->ctime), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 225| 1| dentry->ctimeten) == 0))) { 226| 1| if (tsk_verbose) ------------------ | Branch (226:21): [True: 0, False: 1] ------------------ 227| 0| fprintf(stderr, "%s: cdate\n", func_name); 228| 1| return 0; 229| 1| } 230| 23.0k| else if (dentry->ctimeten > 200) { ------------------ | Branch (230:22): [True: 0, False: 23.0k] ------------------ 231| 0| if (tsk_verbose) ------------------ | Branch (231:21): [True: 0, False: 0] ------------------ 232| 0| fprintf(stderr, "%s: ctimeten\n", func_name); 233| 0| return 0; 234| 0| } 235| 23.0k| else if ((tsk_getu16(fs->endian, dentry->adate) != 0) && ------------------ | | 86| 23.0k|#define tsk_getu16(endian, x) \ | | 87| 23.0k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 23.0k, False: 0] | | ------------------ | | 88| 23.0k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 23.0k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (235:22): [True: 4, False: 23.0k] ------------------ 236| 23.0k| ((FATFS_ISDATE(tsk_getu16(fs->endian, dentry->adate)) == 0) || ------------------ | | 153| 8| (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 138| 4|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 139| 4|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 141| 4|#define FATFS_DAY_MAX 31 | | ------------------ | | | Branch (153:5): [True: 0, False: 4] | | | Branch (153:8): [True: 4, False: 0] | | ------------------ | | 154| 8| (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 138| 4|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 139| 4|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 140| 4|#define FATFS_DAY_MIN 1 | | ------------------ | | | Branch (154:5): [True: 0, False: 4] | | | Branch (154:8): [True: 4, False: 0] | | ------------------ | | 155| 8| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 142| 4|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 143| 4|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 145| 4|#define FATFS_MON_MAX 12 | | ------------------ | | | Branch (155:5): [True: 0, False: 4] | | | Branch (155:8): [True: 4, False: 0] | | ------------------ | | 156| 8| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 142| 4|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 143| 4|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 144| 4|#define FATFS_MON_MIN 1 | | ------------------ | | | Branch (156:5): [True: 0, False: 4] | | | Branch (156:8): [True: 4, False: 0] | | ------------------ | | 157| 8| (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 146| 4|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 147| 4|#define FATFS_YEAR_SHIFT 9 | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 149| 4|#define FATFS_YEAR_MAX 127 | | ------------------ | | | Branch (157:5): [True: 0, False: 4] | | | Branch (157:8): [True: 4, False: 0] | | ------------------ ------------------ | Branch (236:18): [True: 0, False: 4] ------------------ 237| 4| (fatfs_dos_2_unix_time(tsk_getu16(fs->endian, dentry->adate), ------------------ | | 86| 4|#define tsk_getu16(endian, x) \ | | 87| 4|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4, False: 0] | | ------------------ | | 88| 4| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (237:21): [True: 0, False: 4] ------------------ 238| 4| 0, 0) == 0))) { 239| 0| if (tsk_verbose) ------------------ | Branch (239:21): [True: 0, False: 0] ------------------ 240| 0| fprintf(stderr, "%s: adate\n", func_name); 241| 0| return 0; 242| 0| } 243| 23.0k| else if ((tsk_getu16(fs->endian, dentry->wdate) != 0) && ------------------ | | 86| 23.0k|#define tsk_getu16(endian, x) \ | | 87| 23.0k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 23.0k, False: 0] | | ------------------ | | 88| 23.0k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 23.0k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (243:22): [True: 9, False: 23.0k] ------------------ 244| 23.0k| ((FATFS_ISDATE(tsk_getu16(fs->endian, dentry->wdate)) == 0) || ------------------ | | 153| 18| (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 138| 9|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 139| 9|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 141| 9|#define FATFS_DAY_MAX 31 | | ------------------ | | | Branch (153:5): [True: 0, False: 9] | | | Branch (153:8): [True: 9, False: 0] | | ------------------ | | 154| 18| (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 138| 9|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 139| 9|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 140| 9|#define FATFS_DAY_MIN 1 | | ------------------ | | | Branch (154:5): [True: 0, False: 9] | | | Branch (154:8): [True: 9, False: 0] | | ------------------ | | 155| 18| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 142| 9|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 143| 9|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 145| 9|#define FATFS_MON_MAX 12 | | ------------------ | | | Branch (155:5): [True: 9, False: 0] | | | Branch (155:8): [True: 9, False: 0] | | ------------------ | | 156| 9| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 142| 0|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 143| 0|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 144| 0|#define FATFS_MON_MIN 1 | | ------------------ | | | Branch (156:5): [True: 0, False: 0] | | | Branch (156:8): [True: 0, False: 0] | | ------------------ | | 157| 9| (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 146| 0|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 147| 0|#define FATFS_YEAR_SHIFT 9 | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 149| 0|#define FATFS_YEAR_MAX 127 | | ------------------ | | | Branch (157:5): [True: 0, False: 0] | | | Branch (157:8): [True: 0, False: 0] | | ------------------ ------------------ | Branch (244:18): [True: 9, False: 0] ------------------ 245| 9| (fatfs_dos_2_unix_time(tsk_getu16(fs->endian, dentry->wdate), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (245:21): [True: 0, False: 0] ------------------ 246| 9| tsk_getu16(fs->endian, dentry->wtime), 0) == 0))) { ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 247| 9| if (tsk_verbose) ------------------ | Branch (247:21): [True: 0, False: 9] ------------------ 248| 0| fprintf(stderr, "%s: wdate\n", func_name); 249| 9| return 0; 250| 9| } 251| 23.0k| } 252| | 253| | /* verify the starting cluster is small enough */ 254| 25.7k| if ((FATXXFS_DENTRY_CLUST(fs, dentry) > (a_fatfs->lastclust)) && ------------------ | | 30| 25.7k| (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 25.7k|#define tsk_getu16(endian, x) \ | | | | 87| 25.7k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 25.7k, False: 0] | | | | ------------------ | | | | 88| 25.7k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 25.7k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ | | (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 25.7k|#define tsk_getu16(endian, x) \ | | | | 87| 25.7k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 25.7k, False: 0] | | | | ------------------ | | | | 88| 25.7k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 25.7k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ ------------------ | Branch (254:13): [True: 64, False: 25.6k] ------------------ 255| 25.7k| (FATFS_ISEOF(FATXXFS_DENTRY_CLUST(fs, dentry), a_fatfs->mask) == 0)) { ------------------ | | 114| 256| ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 107| 64|#define FATFS_EOFS 0x0ffffff8 | | ------------------ | | ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 108| 64|#define FATFS_EOFE 0x0fffffff | | ------------------ | | | Branch (114:3): [True: 64, False: 0] | | | Branch (114:4): [True: 64, False: 0] | | | Branch (114:4): [True: 64, False: 0] | | | Branch (114:35): [True: 3, False: 61] | | | Branch (114:36): [True: 64, False: 0] | | | Branch (114:36): [True: 64, False: 0] | | ------------------ ------------------ | Branch (255:13): [True: 61, False: 3] ------------------ 256| 61| if (tsk_verbose) ------------------ | Branch (256:17): [True: 0, False: 61] ------------------ 257| 0| fprintf(stderr, "%s: start cluster\n", func_name); 258| 61| return 0; 259| 61| } 260| | 261| | /* Verify the file size is smaller than the data area */ 262| 25.6k| else if (tsk_getu32(fs->endian, dentry->size) > ------------------ | | 119| 25.6k|#define tsk_getu32(endian, x) \ | | 120| 25.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 25.6k, False: 0] | | ------------------ | | 121| 25.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 25.6k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 25.6k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 25.6k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 25.6k| : \ | | 126| 25.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (262:18): [True: 11, False: 25.6k] ------------------ 263| 25.6k| ((a_fatfs->clustcnt * a_fatfs->csize) << a_fatfs->ssize_sh)) { 264| 11| if (tsk_verbose) ------------------ | Branch (264:17): [True: 0, False: 11] ------------------ 265| 0| fprintf(stderr, "%s: size\n", func_name); 266| 11| return 0; 267| 11| } 268| | 269| 25.6k| else if ((tsk_getu32(fs->endian, dentry->size) > 0) ------------------ | | 119| 25.6k|#define tsk_getu32(endian, x) \ | | 120| 25.6k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 25.6k, False: 0] | | ------------------ | | 121| 25.6k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 25.6k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 25.6k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 25.6k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 25.6k| : \ | | 126| 25.6k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (269:18): [True: 0, False: 25.6k] ------------------ 270| 25.6k| && (FATXXFS_DENTRY_CLUST(fs, dentry) == 0)) { ------------------ | | 30| 0| (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 0|#define tsk_getu16(endian, x) \ | | | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 0, False: 0] | | | | ------------------ | | | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ | | (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 0|#define tsk_getu16(endian, x) \ | | | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 0, False: 0] | | | | ------------------ | | | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ ------------------ | Branch (270:16): [True: 0, False: 0] ------------------ 271| 0| if (tsk_verbose) ------------------ | Branch (271:17): [True: 0, False: 0] ------------------ 272| 0| fprintf(stderr, 273| 0| "%s: non-zero size and NULL starting cluster\n", func_name); 274| 0| return 0; 275| 0| } 276| | 277| 25.6k| else if((a_fatfs->subtype == TSK_FATFS_SUBTYPE_SPEC) && (is_83_name(dentry) == 0)) ------------------ | Branch (277:11): [True: 19.6k, False: 6.05k] | Branch (277:59): [True: 19.6k, False: 8] ------------------ 278| 19.6k| return 0; 279| | 280| | // basic sanity check on values 281| 6.05k| else if ((tsk_getu16(fs->endian, dentry->ctime) == 0) ------------------ | | 86| 6.05k|#define tsk_getu16(endian, x) \ | | 87| 6.05k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.05k, False: 0] | | ------------------ | | 88| 6.05k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6.05k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (281:18): [True: 6.05k, False: 0] ------------------ 282| 6.05k| && (tsk_getu16(fs->endian, dentry->wtime) == 0) ------------------ | | 86| 6.05k|#define tsk_getu16(endian, x) \ | | 87| 6.05k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.05k, False: 0] | | ------------------ | | 88| 6.05k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6.05k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (282:16): [True: 6.05k, False: 8] ------------------ 283| 6.05k| && (tsk_getu16(fs->endian, dentry->cdate) == 0) ------------------ | | 86| 6.05k|#define tsk_getu16(endian, x) \ | | 87| 6.05k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.05k, False: 0] | | ------------------ | | 88| 6.05k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6.05k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (283:16): [True: 6.05k, False: 0] ------------------ 284| 6.05k| && (tsk_getu16(fs->endian, dentry->adate) == 0) ------------------ | | 86| 6.05k|#define tsk_getu16(endian, x) \ | | 87| 6.05k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.05k, False: 0] | | ------------------ | | 88| 6.05k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6.05k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (284:16): [True: 6.04k, False: 6] ------------------ 285| 6.05k| && (tsk_getu16(fs->endian, dentry->wdate) == 0) ------------------ | | 86| 6.04k|#define tsk_getu16(endian, x) \ | | 87| 6.04k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 6.04k, False: 0] | | ------------------ | | 88| 6.04k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 6.04k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (285:16): [True: 6.04k, False: 2] ------------------ 286| 6.05k| && (FATXXFS_DENTRY_CLUST(fs, dentry) == 0) ------------------ | | 30| 6.04k| (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 6.04k|#define tsk_getu16(endian, x) \ | | | | 87| 6.04k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 6.04k, False: 0] | | | | ------------------ | | | | 88| 6.04k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 6.04k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ | | (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 6.04k|#define tsk_getu16(endian, x) \ | | | | 87| 6.04k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 6.04k, False: 0] | | | | ------------------ | | | | 88| 6.04k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 6.04k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ ------------------ | Branch (286:16): [True: 6.04k, False: 3] ------------------ 287| 6.05k| && (tsk_getu32(fs->endian, dentry->size) == 0)) { ------------------ | | 119| 6.04k|#define tsk_getu32(endian, x) \ | | 120| 6.04k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 6.04k, False: 0] | | ------------------ | | 121| 6.04k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 6.04k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 6.04k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 6.04k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 6.04k| : \ | | 126| 6.04k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (287:16): [True: 6.04k, False: 0] ------------------ 288| 6.04k| if (tsk_verbose) ------------------ | Branch (288:17): [True: 0, False: 6.04k] ------------------ 289| 0| fprintf(stderr, 290| 0| "%s: nearly all values zero\n", func_name); 291| 6.04k| return 0; 292| 6.04k| } 293| | 294| 19| return 1; 295| 25.7k| } 296| 25.8k|} fatxxfs_dinode_copy: 336| 10|{ 337| 10| const char *func_name = "fatxxfs_dinode_copy"; 338| 10| int i; 339| 10| TSK_FS_INFO *fs = (TSK_FS_INFO *) & a_fatfs->fs_info; 340| 10| TSK_FS_META *fs_meta = a_fs_file->meta; 341| 10| FATXXFS_DENTRY *dentry = (FATXXFS_DENTRY*)a_dentry; 342| 10| TSK_DADDR_T *addr_ptr; 343| 10| uint32_t flags = 0; 344| | 345| 10| if (fs_meta->content_len < FATFS_FILE_CONTENT_LEN) { ------------------ | | 72| 10|#define FATFS_FILE_CONTENT_LEN sizeof(TSK_DADDR_T) // we will store the starting cluster ------------------ | Branch (345:9): [True: 0, False: 10] ------------------ 346| 0| if ((fs_meta = ------------------ | Branch (346:13): [True: 0, False: 0] ------------------ 347| 0| tsk_fs_meta_realloc(fs_meta, 348| 0| FATFS_FILE_CONTENT_LEN)) == NULL) { ------------------ | | 72| 0|#define FATFS_FILE_CONTENT_LEN sizeof(TSK_DADDR_T) // we will store the starting cluster ------------------ 349| 0| return TSK_ERR; 350| 0| } 351| 0| } 352| | 353| 10| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 354| 10| if (fs_meta->attr) { ------------------ | Branch (354:9): [True: 3, False: 7] ------------------ 355| 3| tsk_fs_attrlist_markunused(fs_meta->attr); 356| 3| } 357| | 358| 10| fs_meta->mode = (TSK_FS_META_MODE_ENUM)attr2mode(dentry->attrib); 359| 10| fs_meta->type = attr2type(dentry->attrib); 360| | 361| 10| fs_meta->addr = a_inum; 362| | 363| 10| if (a_cluster_is_alloc) { ------------------ | Branch (363:9): [True: 8, False: 2] ------------------ 364| 8| if(FATXXFS_IS_DELETED(dentry->name, a_fatfs)){ ------------------ | | 41| 8| (fatfs->subtype == TSK_FATFS_SUBTYPE_ANDROID_1) ? \ | | ------------------ | | | Branch (41:2): [True: 5, False: 3] | | | Branch (41:2): [True: 5, False: 3] | | ------------------ | | 42| 8| ((name[0] == 0) && (name[1] == 0)) : \ | | ------------------ | | | Branch (42:3): [True: 5, False: 0] | | | Branch (42:21): [True: 5, False: 0] | | ------------------ | | 43| 8| (name[0] == FATXXFS_SLOT_DELETED) | | ------------------ | | | | 34| 3|#define FATXXFS_SLOT_DELETED 0xe5 | | ------------------ ------------------ 365| 5| flags = TSK_FS_META_FLAG_UNALLOC; 366| 5| } 367| 3| else{ 368| 3| flags = TSK_FS_META_FLAG_ALLOC; 369| 3| } 370| 8| } 371| 2| else { 372| 2| flags = TSK_FS_META_FLAG_UNALLOC; 373| 2| } 374| | 375| 10| flags |= (dentry->name[0] == FATXXFS_SLOT_EMPTY ? ------------------ | | 35| 10|#define FATXXFS_SLOT_EMPTY 0x00 ------------------ | Branch (375:15): [True: 7, False: 3] ------------------ 376| 7| TSK_FS_META_FLAG_UNUSED : TSK_FS_META_FLAG_USED); 377| | 378| 10| fs_meta->flags = (TSK_FS_META_FLAG_ENUM)flags; 379| | 380| 10| if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 10|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 10|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (380:9): [True: 0, False: 10] ------------------ 381| | /* LFN entries don't have these values */ 382| 0| fs_meta->nlink = 0; 383| 0| fs_meta->size = 0; 384| 0| fs_meta->mtime = 0; 385| 0| fs_meta->atime = 0; 386| 0| fs_meta->ctime = 0; 387| 0| fs_meta->crtime = 0; 388| 0| fs_meta->mtime_nano = fs_meta->atime_nano = fs_meta->ctime_nano = 389| 0| fs_meta->crtime_nano = 0; 390| 0| } 391| 10| else { 392| | /* There is no notion of link in FAT, just deleted or not */ 393| 10| if(FATXXFS_IS_DELETED(dentry->name, a_fatfs)){ ------------------ | | 41| 10| (fatfs->subtype == TSK_FATFS_SUBTYPE_ANDROID_1) ? \ | | ------------------ | | | Branch (41:2): [True: 7, False: 3] | | | Branch (41:2): [True: 7, False: 3] | | ------------------ | | 42| 10| ((name[0] == 0) && (name[1] == 0)) : \ | | ------------------ | | | Branch (42:3): [True: 7, False: 0] | | | Branch (42:21): [True: 7, False: 0] | | ------------------ | | 43| 10| (name[0] == FATXXFS_SLOT_DELETED) | | ------------------ | | | | 34| 3|#define FATXXFS_SLOT_DELETED 0xe5 | | ------------------ ------------------ 394| 7| fs_meta->nlink = 0; 395| 7| } 396| 3| else{ 397| 3| fs_meta->nlink = 1; 398| 3| } 399| 10| fs_meta->size = (TSK_OFF_T) tsk_getu32(fs->endian, dentry->size); ------------------ | | 119| 10|#define tsk_getu32(endian, x) \ | | 120| 10|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 10, False: 0] | | ------------------ | | 121| 10| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 10| (((uint8_t *)(x))[1] << 8) + \ | | 123| 10| (((uint8_t *)(x))[2] << 16) + \ | | 124| 10| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 10| : \ | | 126| 10| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 0| (((uint8_t *)(x))[2] << 8) + \ | | 128| 0| (((uint8_t *)(x))[1] << 16) + \ | | 129| 0| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 400| | 401| | /* If these are valid dates, then convert to a unix date format */ 402| 10| if (FATFS_ISDATE(tsk_getu16(fs->endian, dentry->wdate))) ------------------ | | 153| 20| (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 139| 10|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 141| 10|#define FATFS_DAY_MAX 31 | | ------------------ | | | Branch (153:3): [True: 3, False: 7] | | | Branch (153:5): [True: 0, False: 10] | | | Branch (153:8): [True: 10, False: 0] | | ------------------ | | 154| 20| (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 139| 10|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 140| 10|#define FATFS_DAY_MIN 1 | | ------------------ | | | Branch (154:5): [True: 5, False: 5] | | | Branch (154:8): [True: 10, False: 0] | | ------------------ | | 155| 10| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 142| 5|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 143| 5|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 145| 5|#define FATFS_MON_MAX 12 | | ------------------ | | | Branch (155:5): [True: 2, False: 3] | | | Branch (155:8): [True: 5, False: 0] | | ------------------ | | 156| 10| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 142| 3|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 143| 3|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 144| 3|#define FATFS_MON_MIN 1 | | ------------------ | | | Branch (156:5): [True: 0, False: 3] | | | Branch (156:8): [True: 3, False: 0] | | ------------------ | | 157| 10| (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 146| 3|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 147| 3|#define FATFS_YEAR_SHIFT 9 | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 149| 3|#define FATFS_YEAR_MAX 127 | | ------------------ | | | Branch (157:5): [True: 0, False: 3] | | | Branch (157:8): [True: 3, False: 0] | | ------------------ ------------------ 403| 3| fs_meta->mtime = 404| 3| fatfs_dos_2_unix_time(tsk_getu16(fs->endian, dentry->wdate), ------------------ | | 86| 3|#define tsk_getu16(endian, x) \ | | 87| 3|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 3, False: 0] | | ------------------ | | 88| 3| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 405| 3| tsk_getu16(fs->endian, dentry->wtime), 0); ------------------ | | 86| 3|#define tsk_getu16(endian, x) \ | | 87| 3|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 3, False: 0] | | ------------------ | | 88| 3| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 406| 7| else 407| 7| fs_meta->mtime = 0; 408| 10| fs_meta->mtime_nano = 0; 409| | 410| 10| if (FATFS_ISDATE(tsk_getu16(fs->endian, dentry->adate))) ------------------ | | 153| 20| (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 139| 10|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 141| 10|#define FATFS_DAY_MAX 31 | | ------------------ | | | Branch (153:3): [True: 3, False: 7] | | | Branch (153:5): [True: 0, False: 10] | | | Branch (153:8): [True: 10, False: 0] | | ------------------ | | 154| 20| (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 139| 10|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 140| 10|#define FATFS_DAY_MIN 1 | | ------------------ | | | Branch (154:5): [True: 7, False: 3] | | | Branch (154:8): [True: 10, False: 0] | | ------------------ | | 155| 10| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 142| 3|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 143| 3|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 145| 3|#define FATFS_MON_MAX 12 | | ------------------ | | | Branch (155:5): [True: 0, False: 3] | | | Branch (155:8): [True: 3, False: 0] | | ------------------ | | 156| 10| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 142| 3|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 143| 3|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 144| 3|#define FATFS_MON_MIN 1 | | ------------------ | | | Branch (156:5): [True: 0, False: 3] | | | Branch (156:8): [True: 3, False: 0] | | ------------------ | | 157| 10| (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 146| 3|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 147| 3|#define FATFS_YEAR_SHIFT 9 | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 149| 3|#define FATFS_YEAR_MAX 127 | | ------------------ | | | Branch (157:5): [True: 0, False: 3] | | | Branch (157:8): [True: 3, False: 0] | | ------------------ ------------------ 411| 3| fs_meta->atime = 412| 3| fatfs_dos_2_unix_time(tsk_getu16(fs->endian, dentry->adate), 0, 0); ------------------ | | 86| 3|#define tsk_getu16(endian, x) \ | | 87| 3|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 3, False: 0] | | ------------------ | | 88| 3| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 413| 7| else 414| 7| fs_meta->atime = 0; 415| 10| fs_meta->atime_nano = 0; 416| | 417| | 418| | /* cdate is the creation date in FAT and there is no change, 419| | * so we just put in into change and set create to 0. The other 420| | * front-end code knows how to handle it and display it 421| | */ 422| 10| if (FATFS_ISDATE(tsk_getu16(fs->endian, dentry->cdate))) { ------------------ | | 153| 20| (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 139| 10|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \ | | ------------------ | | | | 141| 10|#define FATFS_DAY_MAX 31 | | ------------------ | | | Branch (153:3): [True: 0, False: 10] | | | Branch (153:5): [True: 0, False: 10] | | | Branch (153:8): [True: 10, False: 0] | | ------------------ | | 154| 20| (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 138| 10|#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */ | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 139| 10|#define FATFS_DAY_SHIFT 0 | | ------------------ | | (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \ | | ------------------ | | | | 140| 10|#define FATFS_DAY_MIN 1 | | ------------------ | | | Branch (154:5): [True: 10, False: 0] | | | Branch (154:8): [True: 10, False: 0] | | ------------------ | | 155| 10| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 142| 0|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 143| 0|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \ | | ------------------ | | | | 145| 0|#define FATFS_MON_MAX 12 | | ------------------ | | | Branch (155:5): [True: 0, False: 0] | | | Branch (155:8): [True: 0, False: 0] | | ------------------ | | 156| 10| (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 142| 0|#define FATFS_MON_MASK 0x1e0 /* month 1-12 */ | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 143| 0|#define FATFS_MON_SHIFT 5 | | ------------------ | | (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \ | | ------------------ | | | | 144| 0|#define FATFS_MON_MIN 1 | | ------------------ | | | Branch (156:5): [True: 0, False: 0] | | | Branch (156:8): [True: 0, False: 0] | | ------------------ | | 157| 10| (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 146| 0|#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */ | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 147| 0|#define FATFS_YEAR_SHIFT 9 | | ------------------ | | (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0) | | ------------------ | | | | 149| 0|#define FATFS_YEAR_MAX 127 | | ------------------ | | | Branch (157:5): [True: 0, False: 0] | | | Branch (157:8): [True: 0, False: 0] | | ------------------ ------------------ 423| 0| fs_meta->crtime = 424| 0| fatfs_dos_2_unix_time(tsk_getu16(fs->endian, dentry->cdate), ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 425| 0| tsk_getu16(fs->endian, dentry->ctime), dentry->ctimeten); ------------------ | | 86| 0|#define tsk_getu16(endian, x) \ | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 0, False: 0] | | ------------------ | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 426| 0| fs_meta->crtime_nano = fatfs_dos_2_nanosec(dentry->ctimeten); 427| 0| } 428| 10| else { 429| 10| fs_meta->crtime = 0; 430| 10| fs_meta->crtime_nano = 0; 431| 10| } 432| | 433| | // FAT does not have a changed time 434| 10| fs_meta->ctime = 0; 435| 10| fs_meta->ctime_nano = 0; 436| 10| } 437| | 438| | /* Values that do not exist in FAT */ 439| 10| fs_meta->uid = 0; 440| 10| fs_meta->gid = 0; 441| 10| fs_meta->seq = 0; 442| | 443| | 444| | /* We will be copying a name, so allocate a structure */ 445| 10| if (fs_meta->name2 == NULL) { ------------------ | Branch (445:9): [True: 7, False: 3] ------------------ 446| 7| if ((fs_meta->name2 = (TSK_FS_META_NAME_LIST *) ------------------ | Branch (446:13): [True: 0, False: 7] ------------------ 447| 7| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST))) == NULL) 448| 0| return TSK_ERR; 449| 7| fs_meta->name2->next = NULL; 450| 7| } 451| | 452| | /* If we have a LFN entry, then we need to convert the three 453| | * parts of the name to UTF-8 and copy it into the name structure . 454| | */ 455| 10| if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 10|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 10|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (455:9): [True: 0, False: 10] ------------------ 456| 0| FATXXFS_DENTRY_LFN *lfn = (FATXXFS_DENTRY_LFN *) dentry; 457| | 458| | /* Convert the first part of the name */ 459| 0| UTF8 *name8 = (UTF8 *) fs_meta->name2->name; 460| 0| UTF16 *name16 = (UTF16 *) lfn->part1; 461| | 462| 0| int retVal = tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16, 463| 0| (UTF16 *) & lfn->part1[10], 464| 0| &name8, 465| 0| (UTF8 *) ((uintptr_t) fs_meta->name2->name + 466| 0| sizeof(fs_meta->name2->name)), 467| 0| TSKlenientConversion); 468| | 469| 0| if (retVal != TSKconversionOK) { ------------------ | Branch (469:13): [True: 0, False: 0] ------------------ 470| 0| tsk_error_reset(); 471| 0| tsk_error_set_errno(TSK_ERR_FS_UNICODE); ------------------ | | 358| 0|#define TSK_ERR_FS_UNICODE (TSK_ERR_FS | 13) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 472| 0| tsk_error_set_errstr 473| 0| ("%s: Error converting FAT LFN (1) to UTF8: %d", 474| 0| func_name, retVal); 475| 0| *name8 = '\0'; 476| | 477| 0| return TSK_COR; 478| 0| } 479| | 480| | /* Convert the second part of the name */ 481| 0| name16 = (UTF16 *) lfn->part2; 482| 0| retVal = tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16, 483| 0| (UTF16 *) & lfn->part2[12], 484| 0| &name8, 485| 0| (UTF8 *) ((uintptr_t) fs_meta->name2->name + 486| 0| sizeof(fs_meta->name2->name)), TSKlenientConversion); 487| | 488| 0| if (retVal != TSKconversionOK) { ------------------ | Branch (488:13): [True: 0, False: 0] ------------------ 489| 0| tsk_error_reset(); 490| 0| tsk_error_set_errno(TSK_ERR_FS_UNICODE); ------------------ | | 358| 0|#define TSK_ERR_FS_UNICODE (TSK_ERR_FS | 13) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 491| 0| tsk_error_set_errstr 492| 0| ("%s: Error converting FAT LFN (2) to UTF8: %d", 493| 0| func_name, retVal); 494| 0| *name8 = '\0'; 495| | 496| 0| return TSK_COR; 497| 0| } 498| | 499| | /* Convert the third part of the name */ 500| 0| name16 = (UTF16 *) lfn->part3; 501| 0| retVal = tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16, 502| 0| (UTF16 *) & lfn->part3[4], 503| 0| &name8, 504| 0| (UTF8 *) ((uintptr_t) fs_meta->name2->name + 505| 0| sizeof(fs_meta->name2->name)), TSKlenientConversion); 506| | 507| 0| if (retVal != TSKconversionOK) { ------------------ | Branch (507:13): [True: 0, False: 0] ------------------ 508| 0| tsk_error_reset(); 509| 0| tsk_error_set_errno(TSK_ERR_FS_UNICODE); ------------------ | | 358| 0|#define TSK_ERR_FS_UNICODE (TSK_ERR_FS | 13) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 510| 0| tsk_error_set_errstr 511| 0| ("%s: Error converting FAT LFN (3) to UTF8: %d", 512| 0| func_name, retVal); 513| 0| *name8 = '\0'; 514| | 515| 0| return TSK_COR; 516| 0| } 517| | 518| | /* Make sure it is NULL Terminated */ 519| 0| if ((uintptr_t) name8 > ------------------ | Branch (519:13): [True: 0, False: 0] ------------------ 520| 0| (uintptr_t) fs_meta->name2->name + 521| 0| sizeof(fs_meta->name2->name)) 522| 0| fs_meta->name2->name[sizeof(fs_meta->name2->name) - 1] = '\0'; 523| 0| else 524| 0| *name8 = '\0'; 525| 0| } 526| | /* If the entry is for a volume label, then copy the label. 527| | */ 528| 10| else if ((dentry->attrib & FATFS_ATTR_VOLUME) == FATFS_ATTR_VOLUME) { ------------------ | | 79| 10|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ else if ((dentry->attrib & FATFS_ATTR_VOLUME) == FATFS_ATTR_VOLUME) { ------------------ | | 79| 10|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ | Branch (528:14): [True: 3, False: 7] ------------------ 529| 3| int a; 530| | 531| 3| i = 0; 532| 27| for (a = 0; a < 8; a++) { ------------------ | Branch (532:21): [True: 24, False: 3] ------------------ 533| 24| if ((dentry->name[a] != 0x00) && (dentry->name[a] != 0xff)) ------------------ | Branch (533:17): [True: 24, False: 0] | Branch (533:46): [True: 24, False: 0] ------------------ 534| 24| fs_meta->name2->name[i++] = dentry->name[a]; 535| 24| } 536| 12| for (a = 0; a < 3; a++) { ------------------ | Branch (536:21): [True: 9, False: 3] ------------------ 537| 9| if ((dentry->ext[a] != 0x00) && (dentry->ext[a] != 0xff)) ------------------ | Branch (537:17): [True: 9, False: 0] | Branch (537:45): [True: 9, False: 0] ------------------ 538| 9| fs_meta->name2->name[i++] = dentry->ext[a]; 539| 9| } 540| 3| fs_meta->name2->name[i] = '\0'; 541| | 542| | /* clean up non-ASCII because we are 543| | * copying it into a buffer that is supposed to be UTF-8 and 544| | * we don't know what encoding it is actually in or if it is 545| | * simply junk. */ 546| 3| fatfs_cleanup_ascii(fs_meta->name2->name); 547| 3| } 548| | /* If the entry is a normal short entry, then copy the name 549| | * and add the '.' for the extension 550| | */ 551| 7| else { 552| 7| for (i = 0; (i < 8) && (dentry->name[i] != 0) && (dentry->name[i] != ' '); ------------------ | Branch (552:21): [True: 7, False: 0] | Branch (552:32): [True: 0, False: 7] | Branch (552:58): [True: 0, False: 0] ------------------ 553| 7| i++) { 554| 0| if ((i == 0) && (dentry->name[0] == FATXXFS_SLOT_DELETED)) ------------------ | | 34| 0|#define FATXXFS_SLOT_DELETED 0xe5 ------------------ | Branch (554:17): [True: 0, False: 0] | Branch (554:29): [True: 0, False: 0] ------------------ 555| 0| fs_meta->name2->name[0] = '_'; 556| 0| else if ((dentry->lowercase & FATXXFS_CASE_LOWER_BASE) && ------------------ | | 66| 0|#define FATXXFS_CASE_LOWER_BASE 0x08 /* base is lower case */ ------------------ | Branch (556:22): [True: 0, False: 0] ------------------ 557| 0| (dentry->name[i] >= 'A') && (dentry->name[i] <= 'Z')) ------------------ | Branch (557:17): [True: 0, False: 0] | Branch (557:45): [True: 0, False: 0] ------------------ 558| 0| fs_meta->name2->name[i] = dentry->name[i] + 32; 559| 0| else 560| 0| fs_meta->name2->name[i] = dentry->name[i]; 561| 0| } 562| | 563| 7| if ((dentry->ext[0]) && (dentry->ext[0] != ' ')) { ------------------ | Branch (563:13): [True: 0, False: 7] | Branch (563:33): [True: 0, False: 0] ------------------ 564| 0| int a; 565| 0| fs_meta->name2->name[i++] = '.'; 566| 0| for (a = 0; 567| 0| (a < 3) && (dentry->ext[a] != 0) && (dentry->ext[a] != ' '); ------------------ | Branch (567:17): [True: 0, False: 0] | Branch (567:28): [True: 0, False: 0] | Branch (567:53): [True: 0, False: 0] ------------------ 568| 0| a++, i++) { 569| 0| if ((dentry->lowercase & FATXXFS_CASE_LOWER_EXT) ------------------ | | 67| 0|#define FATXXFS_CASE_LOWER_EXT 0x10 /* extension is lower case */ ------------------ | Branch (569:21): [True: 0, False: 0] ------------------ 570| 0| && (dentry->ext[a] >= 'A') && (dentry->ext[a] <= 'Z')) ------------------ | Branch (570:24): [True: 0, False: 0] | Branch (570:51): [True: 0, False: 0] ------------------ 571| 0| fs_meta->name2->name[i] = dentry->ext[a] + 32; 572| 0| else 573| 0| fs_meta->name2->name[i] = dentry->ext[a]; 574| 0| } 575| 0| } 576| 7| fs_meta->name2->name[i] = '\0'; 577| | 578| | /* clean up non-ASCII because we are 579| | * copying it into a buffer that is supposed to be UTF-8 and 580| | * we don't know what encoding it is actually in or if it is 581| | * simply junk. */ 582| 7| fatfs_cleanup_ascii(fs_meta->name2->name); 583| 7| } 584| | 585| | /* Clean up name to remove control characters */ 586| 10| i = 0; 587| 43| while (fs_meta->name2->name[i] != '\0') { ------------------ | Branch (587:12): [True: 33, False: 10] ------------------ 588| 33| if (TSK_IS_CNTRL(fs_meta->name2->name[i])) ------------------ | | 203| 33|#define TSK_IS_CNTRL(x) \ | | 204| 33|(((x) < 0x20) && ((x) >= 0x00)) | | ------------------ | | | Branch (204:2): [True: 0, False: 33] | | | Branch (204:18): [True: 0, False: 0] | | ------------------ ------------------ 589| 0| fs_meta->name2->name[i] = '^'; 590| 33| i++; 591| 33| } 592| | 593| | /* get the starting cluster */ 594| 10| addr_ptr = (TSK_DADDR_T *) fs_meta->content_ptr; 595| 10| if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 10|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 10|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (595:9): [True: 0, False: 10] ------------------ 596| 0| addr_ptr[0] = 0; 597| 0| } 598| 10| else { 599| 10| addr_ptr[0] = FATXXFS_DENTRY_CLUST(fs, dentry) & a_fatfs->mask; ------------------ | | 30| 10| (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 10|#define tsk_getu16(endian, x) \ | | | | 87| 10|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 10, False: 0] | | | | ------------------ | | | | 88| 10| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 10| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ | | (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 10|#define tsk_getu16(endian, x) \ | | | | 87| 10|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 10, False: 0] | | | | ------------------ | | | | 88| 10| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 10| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ ------------------ 600| 10| } 601| | 602| | /* FAT does not store a size for its directories so make one based 603| | * on the number of allocated sectors 604| | */ 605| 10| if ((dentry->attrib & FATFS_ATTR_DIRECTORY) && ------------------ | | 80| 10|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ | Branch (605:9): [True: 0, False: 10] ------------------ 606| 10| ((dentry->attrib & FATFS_ATTR_LFN) != FATFS_ATTR_LFN)) { ------------------ | | 82| 0|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ ((dentry->attrib & FATFS_ATTR_LFN) != FATFS_ATTR_LFN)) { ------------------ | | 82| 0|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (606:9): [True: 0, False: 0] ------------------ 607| 0| if (fs_meta->flags & TSK_FS_META_FLAG_ALLOC) { ------------------ | Branch (607:13): [True: 0, False: 0] ------------------ 608| 0| TSK_LIST *list_seen = NULL; 609| | 610| | /* count the total number of clusters in this file */ 611| 0| TSK_DADDR_T clust = FATXXFS_DENTRY_CLUST(fs, dentry); ------------------ | | 30| 0| (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 0|#define tsk_getu16(endian, x) \ | | | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 0, False: 0] | | | | ------------------ | | | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ | | (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 0|#define tsk_getu16(endian, x) \ | | | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 0, False: 0] | | | | ------------------ | | | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ ------------------ 612| 0| int cnum = 0; 613| | 614| 0| while ((clust) && (0 == FATFS_ISEOF(clust, a_fatfs->mask))) { ------------------ | | 114| 0| ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 107| 0|#define FATFS_EOFS 0x0ffffff8 | | ------------------ | | ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE))) | | ------------------ | | | | 108| 0|#define FATFS_EOFE 0x0fffffff | | ------------------ | | | Branch (114:3): [True: 0, False: 0] | | | Branch (114:35): [True: 0, False: 0] | | ------------------ ------------------ | Branch (614:20): [True: 0, False: 0] | Branch (614:31): [True: 0, False: 0] ------------------ 615| 0| TSK_DADDR_T nxt; 616| | 617| | /* Make sure we do not get into an infinite loop */ 618| 0| if (tsk_list_find(list_seen, clust)) { ------------------ | Branch (618:21): [True: 0, False: 0] ------------------ 619| 0| if (tsk_verbose) ------------------ | Branch (619:25): [True: 0, False: 0] ------------------ 620| 0| tsk_fprintf(stderr, 621| 0| "Loop found while determining directory size\n"); 622| 0| break; 623| 0| } 624| 0| if (tsk_list_add(&list_seen, clust)) { ------------------ | Branch (624:21): [True: 0, False: 0] ------------------ 625| 0| tsk_list_free(list_seen); 626| 0| list_seen = NULL; 627| 0| return TSK_ERR; 628| 0| } 629| | 630| 0| cnum++; 631| | 632| 0| if (fatfs_getFAT(a_fatfs, clust, &nxt)) ------------------ | Branch (632:21): [True: 0, False: 0] ------------------ 633| 0| break; 634| 0| else 635| 0| clust = nxt; 636| 0| } 637| | 638| 0| tsk_list_free(list_seen); 639| 0| list_seen = NULL; 640| | 641| 0| fs_meta->size = 642| 0| (TSK_OFF_T) ((cnum * a_fatfs->csize) << a_fatfs->ssize_sh); 643| 0| } 644| | /* if the dir is unallocated, then assume 0 or cluster size 645| | * Ideally, we would have a smart algo here to do recovery 646| | * and look for dentries. However, we do not have that right 647| | * now and if we do not add this special check then it can 648| | * assume that an allocated file cluster chain belongs to the 649| | * directory */ 650| 0| else { 651| | // if the first cluster is allocated, then set size to be 0 652| 0| if (fatxxfs_is_cluster_alloc(a_fatfs, FATXXFS_DENTRY_CLUST(fs, ------------------ | | 30| 0| (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 0|#define tsk_getu16(endian, x) \ | | | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 0, False: 0] | | | | ------------------ | | | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ | | (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16)) | | ------------------ | | | | 86| 0|#define tsk_getu16(endian, x) \ | | | | 87| 0|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | | | ------------------ | | | | | Branch (87:12): [True: 0, False: 0] | | | | ------------------ | | | | 88| 0| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | | | 89| 0| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) | | ------------------ ------------------ | Branch (652:17): [True: 0, False: 0] ------------------ 653| 0| dentry)) == 1) 654| 0| fs_meta->size = 0; 655| 0| else 656| 0| fs_meta->size = a_fatfs->csize << a_fatfs->ssize_sh; 657| 0| } 658| 0| } 659| | 660| 10| return TSK_OK; 661| 10|} fatxxfs_inode_lookup: 677| 7|{ 678| 7| const char *func_name = "fatxxfs_inode_lookup"; 679| 7| TSK_DADDR_T sector = 0; 680| 7| int8_t ret_val = 0; 681| 7| FATFS_DATA_UNIT_ALLOC_STATUS_ENUM sector_alloc_status = FATFS_DATA_UNIT_ALLOC_STATUS_UNKNOWN; 682| 7| FATFS_DENTRY dentry; 683| 7| TSK_RETVAL_ENUM copy_result = TSK_OK; 684| | 685| 7| tsk_error_reset(); 686| 7| if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name) || ------------------ | Branch (686:9): [True: 0, False: 7] ------------------ 687| 7| fatfs_ptr_arg_is_null(a_fs_file, "a_fs_file", func_name) || ------------------ | Branch (687:9): [True: 0, False: 7] ------------------ 688| 7| !fatfs_inum_arg_is_in_range(a_fatfs, a_inum, func_name)) { ------------------ | Branch (688:9): [True: 0, False: 7] ------------------ 689| 0| return 1; 690| 0| } 691| | 692| 7| sector = FATFS_INODE_2_SECT(a_fatfs, a_inum); ------------------ | | 95| 7| (TSK_DADDR_T)((i - FATFS_FIRST_NORMINO)/(fatfs->dentry_cnt_se) + fatfs->firstdatasect) | | ------------------ | | | | 44| 7|#define FATFS_FIRST_NORMINO 3 | | ------------------ ------------------ 693| 7| if (sector > a_fatfs->fs_info.last_block) { ------------------ | Branch (693:9): [True: 0, False: 7] ------------------ 694| 0| tsk_error_reset(); 695| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_NUM); ------------------ | | 353| 0|#define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 8) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 696| 0| tsk_error_set_errstr("%s: Inode %" PRIuINUM 697| 0| " in sector too big for image: %" PRIuDADDR, func_name, a_inum, sector); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 698| 0| return 1; 699| 0| } 700| | 701| 7| if (fatfs_dentry_load(a_fatfs, &dentry, a_inum) != 0) { ------------------ | Branch (701:9): [True: 0, False: 7] ------------------ 702| 0| return 1; 703| 0| } 704| | 705| 7| ret_val = fatfs_is_sectalloc(a_fatfs, sector); 706| 7| if (ret_val == -1) { ------------------ | Branch (706:9): [True: 0, False: 7] ------------------ 707| 0| return 1; 708| 0| } 709| 7| else { 710| 7| sector_alloc_status = (FATFS_DATA_UNIT_ALLOC_STATUS_ENUM)ret_val; 711| 7| } 712| | 713| | /* Note that only the sector allocation status is used to choose 714| | * between the basic or in-depth version of the inode validity 715| | * test. In other places in the code information about whether or not 716| | * the sector that contains the inode is part of a folder is used to 717| | * make this decision. Here, that information is not available. Thus, 718| | * the test here is less reliable and may result in some false 719| | * positives. */ 720| 7| if (!fatxxfs_is_dentry(a_fatfs, &dentry, sector_alloc_status, sector_alloc_status)) { ------------------ | Branch (720:9): [True: 0, False: 7] ------------------ 721| 0| tsk_error_reset(); 722| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_NUM); ------------------ | | 353| 0|#define TSK_ERR_FS_INODE_NUM (TSK_ERR_FS | 8) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 723| 0| tsk_error_set_errstr("%s: %" PRIuINUM 724| 0| " is not an inode", func_name, a_inum); 725| 0| return 1; 726| 0| } 727| | 728| 7| copy_result = fatxxfs_dinode_copy(a_fatfs, a_inum, &dentry, (uint8_t)sector_alloc_status, a_fs_file); 729| 7| if (copy_result == TSK_OK) { ------------------ | Branch (729:9): [True: 7, False: 0] ------------------ 730| 7| return 0; 731| 7| } 732| 0| else if (copy_result == TSK_COR) { ------------------ | Branch (732:14): [True: 0, False: 0] ------------------ 733| | /* If there was a Unicode conversion error, 734| | * then still return the inode. */ 735| 0| if (tsk_verbose) { ------------------ | Branch (735:13): [True: 0, False: 0] ------------------ 736| 0| tsk_error_print(stderr); 737| 0| } 738| 0| tsk_error_reset(); 739| 0| return 0; 740| 0| } 741| 0| else { 742| 0| return 1; 743| 0| } 744| 7|} fatxxfs_inode_walk_should_skip_dentry: 802| 4|{ 803| 4| const char *func_name = "fatxxfs_inode_walk_should_skip_dentry"; 804| 4| FATXXFS_DENTRY *dentry = (FATXXFS_DENTRY*)a_dentry; 805| 4| unsigned int dentry_flags = 0; 806| | 807| 4| assert(a_fatfs != NULL); 808| 4| assert(fatfs_inum_is_in_range(a_fatfs, a_inum)); 809| 4| assert(a_dentry != NULL); 810| | 811| 4| tsk_error_reset(); 812| 4| if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name) || ------------------ | Branch (812:9): [True: 0, False: 4] ------------------ 813| 4| !fatfs_inum_arg_is_in_range(a_fatfs, a_inum, func_name) || ------------------ | Branch (813:9): [True: 0, False: 4] ------------------ 814| 4| fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) { ------------------ | Branch (814:9): [True: 0, False: 4] ------------------ 815| 0| return 1; 816| 0| } 817| | 818| | /* If this is a long file name entry, then skip it and 819| | * wait for the short name. */ 820| 4| if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 4|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ if ((dentry->attrib & FATFS_ATTR_LFN) == FATFS_ATTR_LFN) { ------------------ | | 82| 4|#define FATFS_ATTR_LFN 0x0f /* A long file name entry */ ------------------ | Branch (820:9): [True: 0, False: 4] ------------------ 821| 0| return 1; 822| 0| } 823| | 824| | /* Skip the "." and ".." entries because they are redundant. */ 825| 4| if (((dentry->attrib & FATFS_ATTR_DIRECTORY) == FATFS_ATTR_DIRECTORY) && ------------------ | | 80| 4|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ if (((dentry->attrib & FATFS_ATTR_DIRECTORY) == FATFS_ATTR_DIRECTORY) && ------------------ | | 80| 4|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ | Branch (825:9): [True: 0, False: 4] ------------------ 826| 4| (dentry->name[0] == '.')) { ------------------ | Branch (826:10): [True: 0, False: 0] ------------------ 827| 0| return 1; 828| 0| } 829| | 830| | /* Compare directory entry allocation status with the inode selection 831| | * flags. Allocation status is determined first by the allocation status 832| | * of the sector that contains the entry, then by the deleted status of 833| | * the file. This is necessary because when a directory is deleted, its 834| | * contents are not always marked as unallocated. */ 835| 4| if (a_cluster_is_alloc == 1) { ------------------ | Branch (835:9): [True: 3, False: 1] ------------------ 836| 3| if(FATXXFS_IS_DELETED(dentry->name, a_fatfs)){ ------------------ | | 41| 3| (fatfs->subtype == TSK_FATFS_SUBTYPE_ANDROID_1) ? \ | | ------------------ | | | Branch (41:2): [True: 2, False: 1] | | | Branch (41:2): [True: 2, False: 1] | | ------------------ | | 42| 3| ((name[0] == 0) && (name[1] == 0)) : \ | | ------------------ | | | Branch (42:3): [True: 2, False: 0] | | | Branch (42:21): [True: 2, False: 0] | | ------------------ | | 43| 3| (name[0] == FATXXFS_SLOT_DELETED) | | ------------------ | | | | 34| 1|#define FATXXFS_SLOT_DELETED 0xe5 | | ------------------ ------------------ 837| 2| dentry_flags = TSK_FS_META_FLAG_UNALLOC; 838| 2| } 839| 1| else{ 840| 1| dentry_flags = TSK_FS_META_FLAG_ALLOC; 841| 1| } 842| 3| } 843| 1| else { 844| 1| dentry_flags = TSK_FS_META_FLAG_UNALLOC; 845| 1| } 846| | 847| 4| if ((a_selection_flags & dentry_flags) != dentry_flags) { ------------------ | Branch (847:9): [True: 1, False: 3] ------------------ 848| 1| return 1; 849| 1| } 850| | 851| | /* If the processing flags call for only processing orphan files, check 852| | * whether or not this inode is in list of non-orphan files found via name 853| | * walk. */ 854| 3| if ((dentry_flags & TSK_FS_META_FLAG_UNALLOC) && ------------------ | Branch (854:9): [True: 3, False: 0] ------------------ 855| 3| (a_selection_flags & TSK_FS_META_FLAG_ORPHAN) && ------------------ | Branch (855:9): [True: 0, False: 3] ------------------ 856| 3| (tsk_fs_dir_find_inum_named(&(a_fatfs->fs_info), a_inum))) { ------------------ | Branch (856:9): [True: 0, False: 0] ------------------ 857| 0| return 1; 858| 0| } 859| | 860| 3| return 0; 861| 3|} fatxxfs_meta.c:is_83_name: 38| 19.6k|{ 39| 19.6k| if (!de) ------------------ | Branch (39:9): [True: 0, False: 19.6k] ------------------ 40| 0| return 0; 41| | 42| | /* The IS_NAME macro will fail if the value is 0x05, which is only 43| | * valid in name[0], similarly with '.' */ 44| 19.6k| if ((de->name[0] != FATXXFS_SLOT_E5) && (de->name[0] != '.') && ------------------ | | 33| 19.6k|#define FATXXFS_SLOT_E5 0x05 /* actual value is 0xe5 */ ------------------ | Branch (44:9): [True: 19.6k, False: 0] | Branch (44:45): [True: 19.6k, False: 0] ------------------ 45| 19.6k| (FATXXFS_IS_83_NAME(de->name[0]) == 0)) { ------------------ | | 52| 19.6k| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 19.6k, False: 14] | | ------------------ | | 53| 19.6k| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 14] | | ------------------ | | 54| 19.6k| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 14, False: 0] | | | Branch (54:22): [True: 0, False: 14] | | ------------------ | | 55| 19.6k| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 14] | | ------------------ | | 56| 19.6k| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 14] | | ------------------ | | 57| 19.6k| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 14, False: 0] | | | Branch (57:22): [True: 0, False: 14] | | ------------------ | | 58| 19.6k| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 6, False: 8] | | | Branch (58:22): [True: 0, False: 6] | | ------------------ | | 59| 19.6k| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 14] | | ------------------ ------------------ | Branch (45:9): [True: 19.6k, False: 14] ------------------ 46| 19.6k| if (tsk_verbose) ------------------ | Branch (46:13): [True: 0, False: 19.6k] ------------------ 47| 0| fprintf(stderr, "fatfs_is_83_name: name[0] is invalid\n"); 48| 19.6k| return 0; 49| 19.6k| } 50| | 51| | // the name cannot start with 0x20 52| 14| else if (de->name[0] == 0x20) { ------------------ | Branch (52:14): [True: 0, False: 14] ------------------ 53| 0| if (tsk_verbose) ------------------ | Branch (53:13): [True: 0, False: 0] ------------------ 54| 0| fprintf(stderr, "fatfs_is_83_name: name[0] has 0x20\n"); 55| 0| return 0; 56| 0| } 57| | 58| | /* the second name field can only be . if the first one is a . */ 59| 14| if (de->name[1] == '.') { ------------------ | Branch (59:9): [True: 0, False: 14] ------------------ 60| 0| if (de->name[0] != '.') { ------------------ | Branch (60:13): [True: 0, False: 0] ------------------ 61| 0| if (tsk_verbose) ------------------ | Branch (61:17): [True: 0, False: 0] ------------------ 62| 0| fprintf(stderr, "fatfs_is_83_name: name[1] is .\n"); 63| 0| return 0; 64| 0| } 65| 0| } 66| 14| else if (FATXXFS_IS_83_NAME(de->name[1]) == 0) { ------------------ | | 52| 14| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 14] | | ------------------ | | 53| 14| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 14] | | ------------------ | | 54| 14| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 14, False: 0] | | | Branch (54:22): [True: 0, False: 14] | | ------------------ | | 55| 14| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 14] | | ------------------ | | 56| 14| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 14] | | ------------------ | | 57| 14| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 14, False: 0] | | | Branch (57:22): [True: 0, False: 14] | | ------------------ | | 58| 14| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 6, False: 8] | | | Branch (58:22): [True: 0, False: 6] | | ------------------ | | 59| 14| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 14] | | ------------------ ------------------ | Branch (66:14): [True: 0, False: 14] ------------------ 67| 0| if (tsk_verbose) ------------------ | Branch (67:13): [True: 0, False: 0] ------------------ 68| 0| fprintf(stderr, "fatfs_is_83_name: name[1] is invalid\n"); 69| 0| return 0; 70| 0| } 71| | 72| 14| if (FATXXFS_IS_83_NAME(de->name[2]) == 0) { ------------------ | | 52| 14| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 5, False: 9] | | ------------------ | | 53| 14| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 9] | | ------------------ | | 54| 14| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 9, False: 0] | | | Branch (54:22): [True: 0, False: 9] | | ------------------ | | 55| 14| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 9] | | ------------------ | | 56| 14| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 9] | | ------------------ | | 57| 14| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 9, False: 0] | | | Branch (57:22): [True: 0, False: 9] | | ------------------ | | 58| 14| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 1, False: 8] | | | Branch (58:22): [True: 0, False: 1] | | ------------------ | | 59| 14| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 9] | | ------------------ ------------------ | Branch (72:9): [True: 5, False: 9] ------------------ 73| 5| if (tsk_verbose) ------------------ | Branch (73:13): [True: 0, False: 5] ------------------ 74| 0| fprintf(stderr, "fatfs_is_83_name: name[2] is invalid\n"); 75| 5| return 0; 76| 5| } 77| 9| else if (FATXXFS_IS_83_NAME(de->name[3]) == 0) { ------------------ | | 52| 9| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 1, False: 8] | | ------------------ | | 53| 9| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 9| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 8, False: 0] | | | Branch (54:22): [True: 0, False: 8] | | ------------------ | | 55| 9| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 9| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 9| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 8, False: 0] | | | Branch (57:22): [True: 0, False: 8] | | ------------------ | | 58| 9| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 9| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (77:14): [True: 1, False: 8] ------------------ 78| 1| if (tsk_verbose) ------------------ | Branch (78:13): [True: 0, False: 1] ------------------ 79| 0| fprintf(stderr, "fatfs_is_83_name: name[3] is invalid\n"); 80| 1| return 0; 81| 1| } 82| 8| else if (FATXXFS_IS_83_NAME(de->name[4]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 8, False: 0] | | | Branch (54:22): [True: 0, False: 8] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 8, False: 0] | | | Branch (57:22): [True: 0, False: 8] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (82:14): [True: 0, False: 8] ------------------ 83| 0| if (tsk_verbose) ------------------ | Branch (83:13): [True: 0, False: 0] ------------------ 84| 0| fprintf(stderr, "fatfs_is_83_name: name[4] is invalid\n"); 85| 0| return 0; 86| 0| } 87| 8| else if (FATXXFS_IS_83_NAME(de->name[5]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 8, False: 0] | | | Branch (54:22): [True: 0, False: 8] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 0, False: 8] | | | Branch (57:22): [True: 0, False: 0] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (87:14): [True: 0, False: 8] ------------------ 88| 0| if (tsk_verbose) ------------------ | Branch (88:13): [True: 0, False: 0] ------------------ 89| 0| fprintf(stderr, "fatfs_is_83_name: name[5] is invalid\n"); 90| 0| return 0; 91| 0| } 92| 8| else if (FATXXFS_IS_83_NAME(de->name[6]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 0, False: 8] | | | Branch (54:22): [True: 0, False: 0] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 0, False: 8] | | | Branch (57:22): [True: 0, False: 0] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (92:14): [True: 0, False: 8] ------------------ 93| 0| if (tsk_verbose) ------------------ | Branch (93:13): [True: 0, False: 0] ------------------ 94| 0| fprintf(stderr, "fatfs_is_83_name: name[6] is invalid\n"); 95| 0| return 0; 96| 0| } 97| 8| else if (FATXXFS_IS_83_NAME(de->name[7]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 0, False: 8] | | | Branch (54:22): [True: 0, False: 0] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 0, False: 8] | | | Branch (57:22): [True: 0, False: 0] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (97:14): [True: 0, False: 8] ------------------ 98| 0| if (tsk_verbose) ------------------ | Branch (98:13): [True: 0, False: 0] ------------------ 99| 0| fprintf(stderr, "fatfs_is_83_name: name[7] is invalid\n"); 100| 0| return 0; 101| 0| } 102| 8| else if (FATXXFS_IS_83_NAME(de->ext[0]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 0, False: 8] | | | Branch (54:22): [True: 0, False: 0] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 0, False: 8] | | | Branch (57:22): [True: 0, False: 0] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (102:14): [True: 0, False: 8] ------------------ 103| 0| if (tsk_verbose) ------------------ | Branch (103:13): [True: 0, False: 0] ------------------ 104| 0| fprintf(stderr, "fatfs_is_83_name: ext[0] is invalid\n"); 105| 0| return 0; 106| 0| } 107| 8| else if (FATXXFS_IS_83_NAME(de->ext[1]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 0, False: 8] | | | Branch (54:22): [True: 0, False: 0] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 0, False: 8] | | | Branch (57:22): [True: 0, False: 0] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (107:14): [True: 0, False: 8] ------------------ 108| 0| if (tsk_verbose) ------------------ | Branch (108:13): [True: 0, False: 0] ------------------ 109| 0| fprintf(stderr, "fatfs_is_83_name: ext[1] is invalid\n"); 110| 0| return 0; 111| 0| } 112| 8| else if (FATXXFS_IS_83_NAME(de->ext[2]) == 0) { ------------------ | | 52| 8| ((((c) < 0x20) || \ | | ------------------ | | | Branch (52:4): [True: 0, False: 8] | | ------------------ | | 53| 8| ((c) == 0x22) || \ | | ------------------ | | | Branch (53:4): [True: 0, False: 8] | | ------------------ | | 54| 8| (((c) >= 0x2a) && ((c) <= 0x2c)) || \ | | ------------------ | | | Branch (54:5): [True: 0, False: 8] | | | Branch (54:22): [True: 0, False: 0] | | ------------------ | | 55| 8| ((c) == 0x2e) || \ | | ------------------ | | | Branch (55:4): [True: 0, False: 8] | | ------------------ | | 56| 8| ((c) == 0x2f) || \ | | ------------------ | | | Branch (56:4): [True: 0, False: 8] | | ------------------ | | 57| 8| (((c) >= 0x3a) && ((c) <= 0x3f)) || \ | | ------------------ | | | Branch (57:5): [True: 0, False: 8] | | | Branch (57:22): [True: 0, False: 0] | | ------------------ | | 58| 8| (((c) >= 0x5b) && ((c) <= 0x5d)) || \ | | ------------------ | | | Branch (58:5): [True: 0, False: 8] | | | Branch (58:22): [True: 0, False: 0] | | ------------------ | | 59| 8| ((c) == 0x7c)) == 0) | | ------------------ | | | Branch (59:4): [True: 0, False: 8] | | ------------------ ------------------ | Branch (112:14): [True: 0, False: 8] ------------------ 113| 0| if (tsk_verbose) ------------------ | Branch (113:13): [True: 0, False: 0] ------------------ 114| 0| fprintf(stderr, "fatfs_is_83_name: ext[2] is invalid\n"); 115| 0| return 0; 116| 0| } 117| | 118| | /* Ensure that if we get a "space", that the rest of the 119| | * name is spaces. This is not in the spec, but is how 120| | * windows operates and serves as a good check to remove 121| | * false positives. We do not do this check for the 122| | * volume label though. */ 123| 8| if ((de->attrib & FATFS_ATTR_VOLUME) != FATFS_ATTR_VOLUME) { ------------------ | | 79| 8|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ if ((de->attrib & FATFS_ATTR_VOLUME) != FATFS_ATTR_VOLUME) { ------------------ | | 79| 8|#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */ ------------------ | Branch (123:9): [True: 0, False: 8] ------------------ 124| 0| if (((de->name[1] == 0x20) && (de->name[2] != 0x20)) || ------------------ | Branch (124:14): [True: 0, False: 0] | Branch (124:39): [True: 0, False: 0] ------------------ 125| 0| ((de->name[2] == 0x20) && (de->name[3] != 0x20)) || ------------------ | Branch (125:14): [True: 0, False: 0] | Branch (125:39): [True: 0, False: 0] ------------------ 126| 0| ((de->name[3] == 0x20) && (de->name[4] != 0x20)) || ------------------ | Branch (126:14): [True: 0, False: 0] | Branch (126:39): [True: 0, False: 0] ------------------ 127| 0| ((de->name[4] == 0x20) && (de->name[5] != 0x20)) || ------------------ | Branch (127:14): [True: 0, False: 0] | Branch (127:39): [True: 0, False: 0] ------------------ 128| 0| ((de->name[5] == 0x20) && (de->name[6] != 0x20)) || ------------------ | Branch (128:14): [True: 0, False: 0] | Branch (128:39): [True: 0, False: 0] ------------------ 129| 0| ((de->name[6] == 0x20) && (de->name[7] != 0x20)) || ------------------ | Branch (129:14): [True: 0, False: 0] | Branch (129:39): [True: 0, False: 0] ------------------ 130| 0| ((de->ext[1] == 0x20) && (de->ext[2] != 0x20))) { ------------------ | Branch (130:14): [True: 0, False: 0] | Branch (130:38): [True: 0, False: 0] ------------------ 131| 0| if (tsk_verbose) ------------------ | Branch (131:17): [True: 0, False: 0] ------------------ 132| 0| fprintf(stderr, 133| 0| "fatfs_is_83_name: space before non-space\n"); 134| 0| return 0; 135| 0| } 136| 0| } 137| | 138| 8| return 1; 139| 8|} fatxxfs_meta.c:attr2mode: 312| 10|{ 313| 10| int mode; 314| | 315| | /* every file is executable */ 316| 10| mode = 317| 10| (TSK_FS_META_MODE_IXUSR | TSK_FS_META_MODE_IXGRP | 318| 10| TSK_FS_META_MODE_IXOTH); 319| | 320| 10| if ((attr & FATFS_ATTR_READONLY) == 0) ------------------ | | 76| 10|#define FATFS_ATTR_READONLY 0x01 /* file is readonly */ ------------------ | Branch (320:9): [True: 10, False: 0] ------------------ 321| 10| mode |= 322| 10| (TSK_FS_META_MODE_IRUSR | TSK_FS_META_MODE_IRGRP | 323| 10| TSK_FS_META_MODE_IROTH); 324| | 325| 10| if ((attr & FATFS_ATTR_HIDDEN) == 0) ------------------ | | 77| 10|#define FATFS_ATTR_HIDDEN 0x02 /* file is hidden */ ------------------ | Branch (325:9): [True: 10, False: 0] ------------------ 326| 10| mode |= 327| 10| (TSK_FS_META_MODE_IWUSR | TSK_FS_META_MODE_IWGRP | 328| 10| TSK_FS_META_MODE_IWOTH); 329| | 330| 10| return mode; 331| 10|} fatxxfs_meta.c:attr2type: 303| 10|{ 304| 10| if (attr & FATFS_ATTR_DIRECTORY) ------------------ | | 80| 10|#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */ ------------------ | Branch (304:9): [True: 0, False: 10] ------------------ 305| 0| return TSK_FS_META_TYPE_DIR; 306| 10| else 307| 10| return TSK_FS_META_TYPE_REG; 308| 10|} tsk_fs_fls: 212| 6|{ 213| 6| FLS_DATA data; 214| | 215| 6| data.flags = lclflags; 216| 6| data.sec_skew = skew; 217| | 218| |#ifdef TSK_WIN32 219| | { 220| | UTF8 *ptr8; 221| | UTF16 *ptr16; 222| | int retval; 223| | 224| | if ((tpre != NULL) && (TSTRLEN(tpre) > 0)) { 225| | size_t clen = TSTRLEN(tpre) * 4; 226| | data.macpre = (char *) tsk_malloc(clen); 227| | if (data.macpre == NULL) { 228| | return 1; 229| | } 230| | ptr8 = (UTF8 *) data.macpre; 231| | ptr16 = (UTF16 *) tpre; 232| | 233| | retval = 234| | tsk_UTF16toUTF8_lclorder((const UTF16 **) &ptr16, (UTF16 *) 235| | & ptr16[TSTRLEN(tpre) + 1], &ptr8, 236| | (UTF8 *) ((uintptr_t) ptr8 + clen), TSKlenientConversion); 237| | if (retval != TSKconversionOK) { 238| | tsk_error_reset(); 239| | tsk_error_set_errno(TSK_ERR_FS_UNICODE); 240| | tsk_error_set_errstr 241| | ("Error converting fls mactime pre-text to UTF-8 %d\n", 242| | retval); 243| | return 1; 244| | } 245| | } 246| | else { 247| | data.macpre = (char *) tsk_malloc(1); 248| | if (data.macpre == NULL) { 249| | return 1; 250| | } 251| | data.macpre[0] = '\0'; 252| | } 253| | 254| | retval = tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data); 255| | 256| | free(data.macpre); 257| | data.macpre = NULL; 258| | return retval; 259| | } 260| |#else 261| 6| data.macpre = tpre; 262| 6| return tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data); 263| 6|#endif 264| 6|} fls_lib.c:print_dent_act: 115| 28|{ 116| 28| FLS_DATA *fls_data = (FLS_DATA *) ptr; 117| | 118| | /* only print dirs if TSK_FS_FLS_DIR is set and only print everything 119| | ** else if TSK_FS_FLS_FILE is set (or we aren't sure what it is) 120| | */ 121| 28| if (((fls_data->flags & TSK_FS_FLS_DIR) && ------------------ | Branch (121:10): [True: 0, False: 28] ------------------ 122| 28| ((fs_file->meta) && ------------------ | Branch (122:14): [True: 0, False: 0] ------------------ 123| 0| (TSK_FS_IS_DIR_META(fs_file->meta->type)))) ------------------ | | 414| 0|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 0] | | | Branch (414:63): [True: 0, False: 0] | | ------------------ ------------------ 124| 28| || ((fls_data->flags & TSK_FS_FLS_FILE) && (((fs_file->meta) ------------------ | Branch (124:13): [True: 0, False: 28] | Branch (124:54): [True: 0, False: 0] ------------------ 125| 0| && ( ! TSK_FS_IS_DIR_META(fs_file->meta->type))) ------------------ | | 414| 0|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 0] | | | Branch (414:63): [True: 0, False: 0] | | ------------------ ------------------ 126| 0| || (!fs_file->meta)))) { ------------------ | Branch (126:20): [True: 0, False: 0] ------------------ 127| | 128| | 129| | /* Make a special case for NTFS so we can identify all of the 130| | * alternate data streams! 131| | */ 132| 0| if ((TSK_FS_TYPE_ISNTFS(fs_file->fs_info->ftype)) ------------------ | | 836| 0| (((ftype) & TSK_FS_TYPE_NTFS_DETECT)?1:0) | | ------------------ | | | Branch (836:6): [True: 0, False: 0] | | ------------------ ------------------ | Branch (132:13): [True: 0, False: 0] ------------------ 133| 0| && (fs_file->meta)) { ------------------ | Branch (133:16): [True: 0, False: 0] ------------------ 134| 0| uint8_t printed = 0; 135| 0| int i, cnt; 136| | 137| | // cycle through the attributes 138| 0| cnt = tsk_fs_file_attr_getsize(fs_file); 139| 0| for (i = 0; i < cnt; i++) { ------------------ | Branch (139:25): [True: 0, False: 0] ------------------ 140| 0| const TSK_FS_ATTR *fs_attr = 141| 0| tsk_fs_file_attr_get_idx(fs_file, i); 142| 0| if (!fs_attr) ------------------ | Branch (142:21): [True: 0, False: 0] ------------------ 143| 0| continue; 144| | 145| 0| if (fs_attr->type == TSK_FS_ATTR_TYPE_NTFS_DATA) { ------------------ | Branch (145:21): [True: 0, False: 0] ------------------ 146| 0| printed = 1; 147| | 148| 0| if (fs_file->meta->type == TSK_FS_META_TYPE_DIR) { ------------------ | Branch (148:25): [True: 0, False: 0] ------------------ 149| | 150| | /* we don't want to print the ..:blah stream if 151| | * the -a flag was not given 152| | */ 153| 0| if ((fs_file->name->name[0] == '.') ------------------ | Branch (153:29): [True: 0, False: 0] ------------------ 154| 0| && (fs_file->name->name[1]) ------------------ | Branch (154:32): [True: 0, False: 0] ------------------ 155| 0| && (fs_file->name->name[2] == '\0') ------------------ | Branch (155:32): [True: 0, False: 0] ------------------ 156| 0| && ((fls_data->flags & TSK_FS_FLS_DOT) == 0)) { ------------------ | Branch (156:32): [True: 0, False: 0] ------------------ 157| 0| continue; 158| 0| } 159| 0| } 160| | 161| 0| printit(fs_file, a_path, fs_attr, fls_data); 162| 0| } 163| 0| else if (fs_attr->type == TSK_FS_ATTR_TYPE_NTFS_IDXROOT) { ------------------ | Branch (163:26): [True: 0, False: 0] ------------------ 164| 0| printed = 1; 165| | 166| | /* If it is . or .. only print it if the flags say so, 167| | * we continue with other streams though in case the 168| | * directory has a data stream 169| | */ 170| 0| if (!((TSK_FS_ISDOT(fs_file->name->name)) && ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (170:27): [True: 0, False: 0] ------------------ 171| 0| ((fls_data->flags & TSK_FS_FLS_DOT) == 0))) ------------------ | Branch (171:29): [True: 0, False: 0] ------------------ 172| 0| printit(fs_file, a_path, fs_attr, fls_data); 173| 0| } 174| | /* Print the FILE_NAME times if this is the same attribute 175| | * that we collected the times from. */ 176| 0| else if ((fs_attr->type == TSK_FS_ATTR_TYPE_NTFS_FNAME) && ------------------ | Branch (176:26): [True: 0, False: 0] ------------------ 177| 0| (fs_attr->id == fs_file->meta->time2.ntfs.fn_id) && ------------------ | Branch (177:21): [True: 0, False: 0] ------------------ 178| 0| (fls_data->flags & TSK_FS_FLS_MAC)) { ------------------ | Branch (178:21): [True: 0, False: 0] ------------------ 179| | /* If it is . or .. only print it if the flags say so, 180| | * we continue with other streams though in case the 181| | * directory has a data stream 182| | */ 183| 0| if (!((TSK_FS_ISDOT(fs_file->name->name)) && ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (183:27): [True: 0, False: 0] ------------------ 184| 0| ((fls_data->flags & TSK_FS_FLS_DOT) == 0))) ------------------ | Branch (184:29): [True: 0, False: 0] ------------------ 185| 0| printit(fs_file, a_path, fs_attr, fls_data); 186| 0| } 187| 0| } 188| | 189| | /* A user reported that an allocated file had the standard 190| | * attributes, but no $Data. We should print something */ 191| 0| if (printed == 0) { ------------------ | Branch (191:17): [True: 0, False: 0] ------------------ 192| 0| printit(fs_file, a_path, NULL, fls_data); 193| 0| } 194| | 195| 0| } 196| 0| else { 197| | /* skip it if it is . or .. and we don't want them */ 198| 0| if (!((TSK_FS_ISDOT(fs_file->name->name)) ------------------ | | 1179| 0|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 0] | | ------------------ | | 1180| 0| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (198:19): [True: 0, False: 0] ------------------ 199| 0| && ((fls_data->flags & TSK_FS_FLS_DOT) == 0))) ------------------ | Branch (199:24): [True: 0, False: 0] ------------------ 200| 0| printit(fs_file, a_path, NULL, fls_data); 201| 0| } 202| 0| } 203| 28| return TSK_WALK_CONT; 204| 28|} tsk_fs_attr_run_alloc: 47| 34|{ 48| 34| TSK_FS_ATTR_RUN *fs_attr_run = 49| 34| (TSK_FS_ATTR_RUN *) tsk_malloc(sizeof(TSK_FS_ATTR_RUN)); 50| 34| if (fs_attr_run == NULL) ------------------ | Branch (50:9): [True: 0, False: 34] ------------------ 51| 0| return NULL; 52| | 53| 34| return fs_attr_run; 54| 34|} tsk_fs_attr_run_free: 64| 34|{ 65| 68| while (fs_attr_run) { ------------------ | Branch (65:12): [True: 34, False: 34] ------------------ 66| 34| TSK_FS_ATTR_RUN *fs_attr_run_prev = fs_attr_run; 67| 34| fs_attr_run = fs_attr_run->next; 68| 34| fs_attr_run_prev->next = NULL; 69| 34| free(fs_attr_run_prev); 70| 34| } 71| 34|} tsk_fs_attr_alloc: 85| 40|{ 86| 40| TSK_FS_ATTR *fs_attr = (TSK_FS_ATTR *) tsk_malloc(sizeof(TSK_FS_ATTR)); 87| 40| if (fs_attr == NULL) { ------------------ | Branch (87:9): [True: 0, False: 40] ------------------ 88| 0| return NULL; 89| 0| } 90| | 91| 40| fs_attr->name_size = 128; 92| 40| if ((fs_attr->name = (char *) tsk_malloc(fs_attr->name_size)) == NULL) { ------------------ | Branch (92:9): [True: 0, False: 40] ------------------ 93| 0| free(fs_attr); 94| 0| return NULL; 95| 0| } 96| | 97| 40| if (type == TSK_FS_ATTR_NONRES) { ------------------ | Branch (97:9): [True: 40, False: 0] ------------------ 98| 40| fs_attr->flags = (TSK_FS_ATTR_NONRES | TSK_FS_ATTR_INUSE); 99| 40| } 100| 0| else if (type == TSK_FS_ATTR_RES) { ------------------ | Branch (100:14): [True: 0, False: 0] ------------------ 101| 0| fs_attr->rd.buf_size = 1024; 102| 0| fs_attr->rd.buf = (uint8_t *) tsk_malloc(fs_attr->rd.buf_size); 103| 0| if (fs_attr->rd.buf == NULL) { ------------------ | Branch (103:13): [True: 0, False: 0] ------------------ 104| 0| free(fs_attr->name); 105| 0| return NULL; 106| 0| } 107| 0| fs_attr->flags = (TSK_FS_ATTR_RES | TSK_FS_ATTR_INUSE); 108| 0| } 109| 0| else { 110| 0| tsk_error_reset(); 111| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 112| 0| tsk_error_set_errstr("tsk_fs_attr_alloc: Invalid Type: %d\n", 113| 0| type); 114| 0| return NULL; 115| 0| } 116| | 117| 40| return fs_attr; 118| 40|} tsk_fs_attr_free: 129| 40|{ 130| 40| if (a_fs_attr == NULL) ------------------ | Branch (130:9): [True: 0, False: 40] ------------------ 131| 0| return; 132| | 133| 40| if (a_fs_attr->nrd.run) ------------------ | Branch (133:9): [True: 33, False: 7] ------------------ 134| 33| tsk_fs_attr_run_free(a_fs_attr->nrd.run); 135| 40| a_fs_attr->nrd.run = NULL; 136| | 137| 40| free(a_fs_attr->rd.buf); 138| 40| a_fs_attr->rd.buf = NULL; 139| | 140| 40| free(a_fs_attr->name); 141| 40| a_fs_attr->name = NULL; 142| | 143| 40| free(a_fs_attr); 144| 40|} tsk_fs_attr_clear: 155| 3|{ 156| 3| a_fs_attr->size = a_fs_attr->type = 157| 3| a_fs_attr->id = a_fs_attr->flags = 0; 158| 3| if (a_fs_attr->nrd.run) { ------------------ | Branch (158:9): [True: 1, False: 2] ------------------ 159| 1| tsk_fs_attr_run_free(a_fs_attr->nrd.run); 160| 1| a_fs_attr->nrd.run = NULL; 161| 1| a_fs_attr->nrd.run_end = NULL; 162| 1| a_fs_attr->nrd.allocsize = 0; 163| 1| a_fs_attr->nrd.initsize = 0; 164| 1| } 165| 3|} tsk_fs_attr_set_run: 279| 40|{ 280| 40| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)) { ------------------ | Branch (280:9): [True: 0, False: 40] | Branch (280:32): [True: 0, False: 40] ------------------ 281| 0| tsk_error_reset(); 282| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 283| 0| tsk_error_set_errstr("Null fs_file in tsk_fs_attr_set_run"); 284| 0| return 1; 285| 0| } 286| 40| if (a_fs_attr == NULL) { ------------------ | Branch (286:9): [True: 0, False: 40] ------------------ 287| 0| tsk_error_reset(); 288| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 289| 0| tsk_error_set_errstr("Null fs_attr in tsk_fs_attr_set_run"); 290| 0| return 1; 291| 0| } 292| | 293| 40| if (alloc_size < size) { ------------------ | Branch (293:9): [True: 0, False: 40] ------------------ 294| 0| tsk_error_reset(); 295| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 296| 0| tsk_error_set_errstr("tsk_fs_attr_set_run: alloc_size (%" PRIdOFF 297| 0| ") is less than size (%" PRIdOFF ")", alloc_size, size); 298| 0| return 1; 299| 0| } 300| | 301| 40| a_fs_attr->fs_file = a_fs_file; 302| 40| a_fs_attr->flags = (TSK_FS_ATTR_INUSE | TSK_FS_ATTR_NONRES | flags); 303| 40| a_fs_attr->type = type; 304| 40| a_fs_attr->id = id; 305| 40| a_fs_attr->size = size; 306| 40| a_fs_attr->nrd.allocsize = alloc_size; 307| 40| a_fs_attr->nrd.initsize = init_size; 308| 40| a_fs_attr->nrd.compsize = compsize; 309| | 310| 40| if (fs_attr_put_name(a_fs_attr, name)) { ------------------ | Branch (310:9): [True: 0, False: 40] ------------------ 311| 0| return 1; 312| 0| } 313| | 314| | /* Add the a_data_run_new to the attribute. */ 315| | 316| | /* We support the ODD case where the run is NULL. In this case, 317| | * we set the attribute size info, but set everything else to NULL. 318| | */ 319| 40| if (a_data_run_new == NULL) { ------------------ | Branch (319:9): [True: 6, False: 34] ------------------ 320| 6| a_fs_attr->nrd.run = NULL; 321| 6| a_fs_attr->nrd.run_end = NULL; 322| 6| return 0; 323| 6| } 324| | 325| | /* 326| | * If this is not in the beginning, then we need to make a filler 327| | * to account for the cluster numbers we haven't seen yet 328| | * 329| | * This commonly happens when we process an MFT entry that 330| | * is not a base entry and it is referenced in an $ATTR_LIST 331| | * 332| | * The $DATA attribute in the non-base have a non-zero 333| | * a_data_run_new->offset. 334| | */ 335| 34| if (a_data_run_new->offset != 0) { ------------------ | Branch (335:9): [True: 0, False: 34] ------------------ 336| 0| TSK_FS_ATTR_RUN *fill_run = tsk_fs_attr_run_alloc(); 337| 0| fill_run->flags = TSK_FS_ATTR_RUN_FLAG_FILLER; 338| 0| fill_run->offset = 0; 339| 0| fill_run->addr = 0; 340| 0| fill_run->len = a_data_run_new->offset; 341| 0| fill_run->next = a_data_run_new; 342| 0| a_data_run_new = fill_run; 343| 0| } 344| | 345| 34| a_fs_attr->nrd.run = a_data_run_new; 346| | 347| | // update the pointer to the end of the list 348| 34| a_fs_attr->nrd.run_end = a_data_run_new; 349| 34| while (a_fs_attr->nrd.run_end->next) { ------------------ | Branch (349:12): [True: 0, False: 34] ------------------ 350| 0| a_fs_attr->nrd.run_end = a_fs_attr->nrd.run_end->next; 351| 0| } 352| | 353| 34| return 0; 354| 40|} tsk_fs_attr_walk: 1037| 40|{ 1038| 40| TSK_FS_INFO *fs; 1039| | 1040| | // clean up any error messages that are lying around 1041| 40| tsk_error_reset(); 1042| | 1043| | // check the FS_INFO, FS_FILE structures 1044| 40| if ((a_fs_attr == NULL) || (a_fs_attr->fs_file == NULL) ------------------ | Branch (1044:9): [True: 0, False: 40] | Branch (1044:32): [True: 0, False: 40] ------------------ 1045| 40| || (a_fs_attr->fs_file->meta == NULL) ------------------ | Branch (1045:12): [True: 0, False: 40] ------------------ 1046| 40| || (a_fs_attr->fs_file->fs_info == NULL)) { ------------------ | Branch (1046:12): [True: 0, False: 40] ------------------ 1047| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1048| 0| tsk_error_set_errstr 1049| 0| ("tsk_fs_attr_walk: called with NULL pointers"); 1050| 0| return 1; 1051| 0| } 1052| 40| fs = a_fs_attr->fs_file->fs_info; 1053| | 1054| 40| if (fs->tag != TSK_FS_INFO_TAG) { ------------------ | | 933| 40|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (1054:9): [True: 0, False: 40] ------------------ 1055| |// || (a_fs_attr->id != TSK_FS_ATTR_ID)) { 1056| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1057| 0| tsk_error_set_errstr 1058| 0| ("tsk_fs_attr_walk: called with unallocated structures"); 1059| 0| return 1; 1060| 0| } 1061| 40| if (a_fs_attr->flags & TSK_FS_ATTR_COMP) { ------------------ | Branch (1061:9): [True: 0, False: 40] ------------------ 1062| 0| if (a_fs_attr->w == NULL) { ------------------ | Branch (1062:13): [True: 0, False: 0] ------------------ 1063| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1064| 0| tsk_error_set_errstr 1065| 0| ("tsk_fs_attr_walk: compressed attribute found, but special function not defined"); 1066| 0| return 1; 1067| 0| } 1068| 0| return a_fs_attr->w(a_fs_attr, a_flags, a_action, a_ptr); 1069| 0| } 1070| | // resident data 1071| 40| if (a_fs_attr->flags & TSK_FS_ATTR_RES) { ------------------ | Branch (1071:9): [True: 0, False: 40] ------------------ 1072| 0| fflush(stderr); 1073| 0| return tsk_fs_attr_walk_res(a_fs_attr, a_flags, a_action, a_ptr); 1074| 0| } 1075| | // non-resident data 1076| 40| else if (a_fs_attr->flags & TSK_FS_ATTR_NONRES) { ------------------ | Branch (1076:14): [True: 40, False: 0] ------------------ 1077| 40| return tsk_fs_attr_walk_nonres(a_fs_attr, a_flags, a_action, 1078| 40| a_ptr); 1079| 40| } 1080| | 1081| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 1082| 0| tsk_error_set_errstr 1083| 0| ("tsk_fs_attr_walk: called with unknown attribute type: %x", 1084| 0| a_fs_attr->flags); 1085| 0| return 1; 1086| 40|} fs_attr.c:fs_attr_put_name: 181| 40|{ 182| 40| if ((name == NULL) || (strlen(name) == 0)) { ------------------ | Branch (182:9): [True: 40, False: 0] | Branch (182:27): [True: 0, False: 0] ------------------ 183| 40| if (fs_attr->name_size > 0) { ------------------ | Branch (183:13): [True: 40, False: 0] ------------------ 184| 40| free(fs_attr->name); 185| 40| fs_attr->name_size = 0; 186| 40| } 187| 40| fs_attr->name = NULL; 188| 40| return 0; 189| 40| } 190| | 191| 0| if (fs_attr->name_size < (strlen(name) + 1)) { ------------------ | Branch (191:9): [True: 0, False: 0] ------------------ 192| 0| fs_attr->name = tsk_realloc(fs_attr->name, strlen(name) + 1); 193| 0| if (fs_attr->name == NULL) ------------------ | Branch (193:13): [True: 0, False: 0] ------------------ 194| 0| return 1; 195| 0| fs_attr->name_size = strlen(name) + 1; 196| 0| } 197| 0| strncpy(fs_attr->name, name, fs_attr->name_size); 198| 0| return 0; 199| 0|} fs_attr.c:tsk_fs_attr_walk_nonres: 843| 40|{ 844| 40| char *buf = NULL; 845| 40| TSK_OFF_T tot_size; 846| 40| TSK_OFF_T off = 0; 847| 40| TSK_FS_ATTR_RUN *fs_attr_run; 848| 40| int retval; 849| 40| uint32_t skip_remain; 850| 40| TSK_FS_INFO *fs = fs_attr->fs_file->fs_info; 851| 40| uint8_t stop_loop = 0; 852| | 853| 40| if ((fs_attr->flags & TSK_FS_ATTR_NONRES) == 0) { ------------------ | Branch (853:9): [True: 0, False: 40] ------------------ 854| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 855| 0| tsk_error_set_errstr 856| 0| ("tsk_fs_file_walk_nonres: called with non-non-resident data"); 857| 0| return 1; 858| 0| } 859| | 860| | /* if we want the slack space too, then use the allocsize */ 861| 40| if (a_flags & TSK_FS_FILE_WALK_FLAG_SLACK) ------------------ | Branch (861:9): [True: 40, False: 0] ------------------ 862| 40| tot_size = fs_attr->nrd.allocsize; 863| 0| else 864| 0| tot_size = fs_attr->size; 865| | 866| 40| skip_remain = fs_attr->nrd.skiplen; 867| | 868| 40| if ((a_flags & TSK_FS_FILE_WALK_FLAG_AONLY) == 0) { ------------------ | Branch (868:9): [True: 28, False: 12] ------------------ 869| 28| if ((buf = (char *) tsk_malloc(fs->block_size)) == NULL) { ------------------ | Branch (869:13): [True: 0, False: 28] ------------------ 870| 0| return 1; 871| 0| } 872| 28| } 873| | 874| | /* cycle through the number of runs we have */ 875| 40| retval = TSK_WALK_CONT; 876| 40| for (fs_attr_run = fs_attr->nrd.run; fs_attr_run; ------------------ | Branch (876:42): [True: 34, False: 6] ------------------ 877| 40| fs_attr_run = fs_attr_run->next) { 878| 34| TSK_DADDR_T addr, len_idx; 879| | 880| 34| addr = fs_attr_run->addr; 881| | 882| | /* cycle through each block in the run */ 883| 933| for (len_idx = 0; len_idx < fs_attr_run->len; len_idx++) { ------------------ | Branch (883:27): [True: 933, False: 0] ------------------ 884| | 885| 933| TSK_FS_BLOCK_FLAG_ENUM myflags; 886| | 887| | /* If the address is too large then give an error */ 888| 933| if (addr + len_idx > fs->last_block) { ------------------ | Branch (888:17): [True: 0, False: 933] ------------------ 889| 0| if (fs_attr->fs_file-> ------------------ | Branch (889:21): [True: 0, False: 0] ------------------ 890| 0| meta->flags & TSK_FS_META_FLAG_UNALLOC) 891| 0| tsk_error_set_errno(TSK_ERR_FS_RECOVER); ------------------ | | 359| 0|#define TSK_ERR_FS_RECOVER (TSK_ERR_FS | 14) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 892| 0| else 893| 0| tsk_error_set_errno(TSK_ERR_FS_BLK_NUM); ------------------ | | 352| 0|#define TSK_ERR_FS_BLK_NUM (TSK_ERR_FS | 7) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 894| 0| tsk_error_set_errstr 895| 0| ("Invalid address in run (too large): %" PRIuDADDR "", 896| 0| addr + len_idx); 897| 0| free(buf); 898| 0| return 1; 899| 0| } 900| | 901| | // load the buffer if they want more than just the address 902| 933| if ((a_flags & TSK_FS_FILE_WALK_FLAG_AONLY) == 0) { ------------------ | Branch (902:17): [True: 772, False: 161] ------------------ 903| | 904| | /* sparse files just get 0s */ 905| 772| if (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) { ------------------ | Branch (905:21): [True: 0, False: 772] ------------------ 906| 0| memset(buf, 0, fs->block_size); 907| 0| } 908| | /* FILLER entries exist when the source file system can store run 909| | * info out of order and we did not get all of the run info. We 910| | * return 0s if data is read from this type of run. */ 911| 772| else if (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) { ------------------ | Branch (911:26): [True: 0, False: 772] ------------------ 912| 0| memset(buf, 0, fs->block_size); 913| 0| if (tsk_verbose) ------------------ | Branch (913:25): [True: 0, False: 0] ------------------ 914| 0| fprintf(stderr, 915| 0| "tsk_fs_attr_walk_nonres: File %" PRIuINUM 916| 0| " has FILLER entry, using 0s\n", 917| 0| fs_attr->fs_file->meta->addr); 918| 0| } 919| | 920| | // we return 0s for reads past the initsize 921| 772| else if ((off >= fs_attr->nrd.initsize) ------------------ | Branch (921:26): [True: 0, False: 772] ------------------ 922| 772| && ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) { ------------------ | Branch (922:24): [True: 0, False: 0] ------------------ 923| 0| memset(buf, 0, fs->block_size); 924| 0| } 925| 772| else { 926| 772| ssize_t cnt; 927| 772| if (fs->ftype == TSK_FS_TYPE_LOGICAL) { ------------------ | Branch (927:10): [True: 0, False: 772] ------------------ 928| | // We can't read logical files directly from the image. 929| 0| cnt = logicalfs_read_block(fs, fs_attr->fs_file, addr + len_idx, buf); 930| 0| } 931| 772| else { 932| 772| cnt = tsk_fs_read_block_decrypt 933| 772| (fs, addr + len_idx, buf, fs->block_size, fs_attr_run->crypto_id + len_idx); 934| 772| } 935| 772| if (cnt != fs->block_size) { ------------------ | Branch (935:25): [True: 0, False: 772] ------------------ 936| 0| if (cnt >= 0) { ------------------ | Branch (936:29): [True: 0, False: 0] ------------------ 937| 0| tsk_error_reset(); 938| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 939| 0| } 940| 0| tsk_error_set_errstr2 941| 0| ("tsk_fs_file_walk: Error reading block at %" 942| 0| PRIuDADDR, addr + len_idx); ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 943| 0| free(buf); 944| 0| return 1; 945| 0| } 946| 772| if ((off + fs->block_size > fs_attr->nrd.initsize) ------------------ | Branch (946:25): [True: 0, False: 772] ------------------ 947| 772| && ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) { ------------------ | Branch (947:28): [True: 0, False: 0] ------------------ 948| 0| memset(&buf[fs_attr->nrd.initsize - off], 0, 949| 0| fs->block_size - 950| 0| (size_t) (fs_attr->nrd.initsize - off)); 951| 0| } 952| 772| } 953| 772| } 954| | 955| | /* Need to account for the skip length, which is the number of bytes 956| | * in the start of the attribute that are skipped and that are not 957| | * included in the overall length. We will seek past those and not 958| | * return those in the action. We just read a block size so check 959| | * if there is data to be returned in this buffer. */ 960| 933| if (skip_remain >= fs->block_size) { ------------------ | Branch (960:17): [True: 0, False: 933] ------------------ 961| 0| skip_remain -= fs->block_size; 962| 0| } 963| 933| else { 964| 933| size_t ret_len; 965| | 966| | /* Do we want to return a full block, or just the end? */ 967| 933| if ((TSK_OFF_T) fs->block_size - skip_remain < ------------------ | Branch (967:21): [True: 899, False: 34] ------------------ 968| 933| tot_size - off) 969| 899| ret_len = fs->block_size - skip_remain; 970| 34| else 971| 34| ret_len = (size_t) (tot_size - off); 972| | 973| | /* Only do sparse or FILLER clusters if NOSPARSE is not set */ 974| 933| if ((fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) || ------------------ | Branch (974:21): [True: 0, False: 933] ------------------ 975| 933| (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) || ------------------ | Branch (975:21): [True: 0, False: 933] ------------------ 976| 933| (off > fs_attr->nrd.initsize)) { ------------------ | Branch (976:21): [True: 0, False: 933] ------------------ 977| 0| myflags = fs->block_getflags(fs, 0); 978| 0| myflags |= TSK_FS_BLOCK_FLAG_SPARSE; 979| 0| if ((a_flags & TSK_FS_FILE_WALK_FLAG_NOSPARSE) == 0) { ------------------ | Branch (979:25): [True: 0, False: 0] ------------------ 980| 0| retval = 981| 0| a_action(fs_attr->fs_file, off, 0, 982| 0| &buf[skip_remain], ret_len, myflags, a_ptr); 983| 0| } 984| 0| } 985| 933| else { 986| 933| myflags = fs->block_getflags(fs, addr + len_idx); 987| 933| myflags |= TSK_FS_BLOCK_FLAG_RAW; 988| | 989| 933| retval = 990| 933| a_action(fs_attr->fs_file, off, addr + len_idx, 991| 933| &buf[skip_remain], ret_len, myflags, a_ptr); 992| 933| } 993| 933| off += ret_len; 994| 933| skip_remain = 0; 995| | 996| 933| if (retval != TSK_WALK_CONT) { ------------------ | Branch (996:21): [True: 28, False: 905] ------------------ 997| 28| stop_loop = 1; 998| 28| break; 999| 28| } 1000| | 1001| 905| if (off >= tot_size) { ------------------ | Branch (1001:21): [True: 6, False: 899] ------------------ 1002| 6| stop_loop = 1; 1003| 6| break; 1004| 6| } 1005| 905| } 1006| 933| } 1007| 34| if (stop_loop) ------------------ | Branch (1007:13): [True: 34, False: 0] ------------------ 1008| 34| break; 1009| 34| } 1010| | 1011| 40| free(buf); 1012| | 1013| 40| if (retval == TSK_WALK_ERROR) ------------------ | Branch (1013:9): [True: 0, False: 40] ------------------ 1014| 0| return 1; 1015| 40| else 1016| 40| return 0; 1017| 40|} tsk_fs_attrlist_alloc: 26| 40|{ 27| 40| TSK_FS_ATTRLIST *fs_attrlist; 28| | 29| 40| if ((fs_attrlist = ------------------ | Branch (29:9): [True: 0, False: 40] ------------------ 30| 40| (TSK_FS_ATTRLIST *) tsk_malloc(sizeof(TSK_FS_ATTRLIST))) == 31| 40| NULL) 32| 0| return NULL; 33| 40| return fs_attrlist; 34| 40|} tsk_fs_attrlist_free: 41| 40|{ 42| 40| TSK_FS_ATTR *fs_attr_cur, *fs_attr_tmp; 43| 40| if (a_fs_attrlist == NULL) ------------------ | Branch (43:9): [True: 0, False: 40] ------------------ 44| 0| return; 45| | 46| 40| fs_attr_cur = a_fs_attrlist->head; 47| 80| while (fs_attr_cur) { ------------------ | Branch (47:12): [True: 40, False: 40] ------------------ 48| 40| fs_attr_tmp = fs_attr_cur->next; 49| 40| tsk_fs_attr_free(fs_attr_cur); 50| 40| fs_attr_cur = fs_attr_tmp; 51| 40| } 52| 40| free(a_fs_attrlist); 53| 40|} tsk_fs_attrlist_add: 65| 40|{ 66| 40| if (a_fs_attrlist == NULL) { ------------------ | Branch (66:9): [True: 0, False: 40] ------------------ 67| 0| tsk_error_reset(); 68| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 69| 0| tsk_error_set_errstr("Null list in tsk_fs_attrlist_add"); 70| 0| return 1; 71| 0| } 72| | 73| | // verify INUSE is set 74| 40| a_fs_attr->flags |= TSK_FS_ATTR_INUSE; 75| | 76| 40| if (a_fs_attrlist->head == NULL) { ------------------ | Branch (76:9): [True: 40, False: 0] ------------------ 77| 40| a_fs_attrlist->head = a_fs_attr; 78| 40| } 79| 0| else { 80| 0| TSK_FS_ATTR *fs_attr_cur; 81| 0| fs_attr_cur = a_fs_attrlist->head; 82| 0| while (fs_attr_cur) { ------------------ | Branch (82:16): [True: 0, False: 0] ------------------ 83| | // check if it already exists 84| 0| if ((fs_attr_cur->type == a_fs_attr->type) ------------------ | Branch (84:17): [True: 0, False: 0] ------------------ 85| 0| && (fs_attr_cur->id == a_fs_attr->id)) { ------------------ | Branch (85:20): [True: 0, False: 0] ------------------ 86| 0| tsk_error_reset(); 87| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 88| 0| tsk_error_set_errstr 89| 0| ("datalist_add: Type %d and Id %d already in list", 90| 0| a_fs_attr->type, a_fs_attr->id); 91| 0| return 1; 92| 0| } 93| 0| if (fs_attr_cur->next == NULL) { ------------------ | Branch (93:17): [True: 0, False: 0] ------------------ 94| 0| fs_attr_cur->next = a_fs_attr; 95| 0| break; 96| 0| } 97| 0| fs_attr_cur = fs_attr_cur->next; 98| 0| } 99| 0| } 100| 40| return 0; 101| 40|} tsk_fs_attrlist_getnew: 120| 40|{ 121| 40| TSK_FS_ATTR *fs_attr_cur; 122| 40| TSK_FS_ATTR *fs_attr_ok = NULL; 123| | 124| 40| if (a_fs_attrlist == NULL) { ------------------ | Branch (124:9): [True: 0, False: 40] ------------------ 125| 0| tsk_error_reset(); 126| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 127| 0| tsk_error_set_errstr("Null list in tsk_fs_attrlist_getnew()"); 128| 0| return NULL; 129| 0| } 130| | 131| 40| if ((a_atype != TSK_FS_ATTR_NONRES) && (a_atype != TSK_FS_ATTR_RES)) { ------------------ | Branch (131:9): [True: 0, False: 40] | Branch (131:44): [True: 0, False: 0] ------------------ 132| 0| tsk_error_reset(); 133| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 134| 0| tsk_error_set_errstr("Invalid Type in tsk_fs_attrlist_getnew()"); 135| 0| return NULL; 136| 0| } 137| | 138| 40| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (138:45): [True: 0, False: 40] ------------------ 139| 40| fs_attr_cur = fs_attr_cur->next) { 140| 0| if (fs_attr_cur->flags == 0) { ------------------ | Branch (140:13): [True: 0, False: 0] ------------------ 141| 0| if (a_atype == TSK_FS_ATTR_NONRES) { ------------------ | Branch (141:17): [True: 0, False: 0] ------------------ 142| 0| if (fs_attr_cur->nrd.run) ------------------ | Branch (142:21): [True: 0, False: 0] ------------------ 143| 0| break; 144| 0| else if (!fs_attr_ok) ------------------ | Branch (144:26): [True: 0, False: 0] ------------------ 145| 0| fs_attr_ok = fs_attr_cur; 146| 0| } 147| | /* we want one with an allocated buf */ 148| 0| else { 149| 0| if (fs_attr_cur->rd.buf_size) ------------------ | Branch (149:21): [True: 0, False: 0] ------------------ 150| 0| break; 151| 0| else if (!fs_attr_ok) ------------------ | Branch (151:26): [True: 0, False: 0] ------------------ 152| 0| fs_attr_ok = fs_attr_cur; 153| 0| } 154| 0| } 155| 0| } 156| | 157| | /* if we fell out then check fs_attr_tmp */ 158| 40| if (!fs_attr_cur) { ------------------ | Branch (158:9): [True: 40, False: 0] ------------------ 159| 40| if (fs_attr_ok) ------------------ | Branch (159:13): [True: 0, False: 40] ------------------ 160| 0| fs_attr_cur = fs_attr_ok; 161| 40| else { 162| | /* make a new one */ 163| 40| if ((fs_attr_cur = tsk_fs_attr_alloc(a_atype)) == NULL) ------------------ | Branch (163:17): [True: 0, False: 40] ------------------ 164| 0| return NULL; 165| | 166| | // add it to the list 167| 40| if (tsk_fs_attrlist_add(a_fs_attrlist, fs_attr_cur)) { ------------------ | Branch (167:17): [True: 0, False: 40] ------------------ 168| 0| tsk_fs_attr_free(fs_attr_cur); 169| 0| return NULL; 170| 0| } 171| 40| } 172| 40| } 173| | 174| 40| fs_attr_cur->flags = (TSK_FS_ATTR_INUSE | a_atype); 175| 40| return fs_attr_cur; 176| 40|} tsk_fs_attrlist_markunused: 185| 3|{ 186| 3| TSK_FS_ATTR *fs_attr_cur; 187| 3| if (a_fs_attrlist == NULL) ------------------ | Branch (187:9): [True: 0, False: 3] ------------------ 188| 0| return; 189| | 190| 3| fs_attr_cur = a_fs_attrlist->head; 191| 6| while (fs_attr_cur) { ------------------ | Branch (191:12): [True: 3, False: 3] ------------------ 192| 3| tsk_fs_attr_clear(fs_attr_cur); 193| 3| fs_attr_cur = fs_attr_cur->next; 194| 3| } 195| 3|} tsk_fs_attrlist_get: 212| 40|{ 213| 40| TSK_FS_ATTR *fs_attr_cur; 214| 40| TSK_FS_ATTR *fs_attr_ok = NULL; 215| | 216| 40| if (!a_fs_attrlist) { ------------------ | Branch (216:9): [True: 0, False: 40] ------------------ 217| 0| tsk_error_reset(); 218| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 219| 0| tsk_error_set_errstr("tsk_fs_attrlist_get: Null list pointer"); 220| 0| return NULL; 221| 0| } 222| | 223| 80| for (fs_attr_cur = a_fs_attrlist->head; fs_attr_cur; ------------------ | Branch (223:45): [True: 40, False: 40] ------------------ 224| 40| fs_attr_cur = fs_attr_cur->next) { 225| 40| if ((fs_attr_cur->flags & TSK_FS_ATTR_INUSE) ------------------ | Branch (225:13): [True: 40, False: 0] ------------------ 226| 40| && (fs_attr_cur->type == a_type)) { ------------------ | Branch (226:16): [True: 40, False: 0] ------------------ 227| | 228| | /* If we are looking for NTFS $Data, 229| | * then return default when we see it */ 230| 40| if ((fs_attr_cur->type == TSK_FS_ATTR_TYPE_NTFS_DATA) && ------------------ | Branch (230:17): [True: 0, False: 40] ------------------ 231| 40| (fs_attr_cur->name == NULL)) { ------------------ | Branch (231:17): [True: 0, False: 0] ------------------ 232| 0| return fs_attr_cur; 233| 0| } 234| | 235| | // make sure we return the lowest if multiple exist 236| 40| if ((fs_attr_ok == NULL) || (fs_attr_ok->id > fs_attr_cur->id)) ------------------ | Branch (236:17): [True: 40, False: 0] | Branch (236:41): [True: 0, False: 0] ------------------ 237| 40| fs_attr_ok = fs_attr_cur; 238| 40| } 239| 40| } 240| | 241| 40| if (!fs_attr_ok) { ------------------ | Branch (241:9): [True: 0, False: 40] ------------------ 242| 0| tsk_error_set_errno(TSK_ERR_FS_ATTR_NOTFOUND); ------------------ | | 362| 0|#define TSK_ERR_FS_ATTR_NOTFOUND (TSK_ERR_FS | 17) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| tsk_error_set_errstr("tsk_fs_attrlist_get: Attribute %d not found", 244| 0| a_type); 245| 0| return NULL; 246| 0| } 247| 40| else { 248| 40| return fs_attr_ok; 249| 40| } 250| 40|} tsk_fs_dir_alloc: 29| 40|{ 30| 40| TSK_FS_DIR *fs_dir; 31| 40| size_t i; 32| | 33| | // allocate and initialize the structure 34| 40| if ((fs_dir = (TSK_FS_DIR *) tsk_malloc(sizeof(TSK_FS_DIR))) == NULL) { ------------------ | Branch (34:9): [True: 0, False: 40] ------------------ 35| 0| return NULL; 36| 0| } 37| | 38| 40| fs_dir->names_alloc = a_cnt; 39| 40| fs_dir->names_used = 0; 40| 40| if ((fs_dir->names = ------------------ | Branch (40:9): [True: 0, False: 40] ------------------ 41| 40| (TSK_FS_NAME *) tsk_malloc(sizeof(TSK_FS_NAME) * 42| 40| fs_dir->names_alloc)) == NULL) { 43| 0| free(fs_dir); 44| 0| return NULL; 45| 0| } 46| 40| fs_dir->fs_info = a_fs; 47| 40| fs_dir->addr = a_addr; 48| 40| fs_dir->tag = TSK_FS_DIR_TAG; ------------------ | | 633| 40|#define TSK_FS_DIR_TAG 0x57531246 ------------------ 49| 4.39k| for (i = 0; i < a_cnt; i++) { ------------------ | Branch (49:17): [True: 4.35k, False: 40] ------------------ 50| 4.35k| fs_dir->names[i].tag = TSK_FS_NAME_TAG; ------------------ | | 594| 4.35k|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 51| 4.35k| } 52| | 53| 40| return fs_dir; 54| 40|} tsk_fs_dir_add: 210| 121|{ 211| 121| TSK_FS_NAME *fs_name_dest = NULL; 212| 121| size_t i; 213| | 214| | /* see if we already have it in the buffer / queue 215| | * We skip this check for FAT because it will always fail because two entries 216| | * never have the same meta address. */ 217| | // @@@ We could do something more efficient here too with orphan files because we do not 218| | // need to check the contents of that directory either and this takes a lot of time on those 219| | // large images. 220| 121| if (TSK_FS_TYPE_ISFAT(a_fs_dir->fs_info->ftype) == 0) { ------------------ | | 843| 121| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:6): [True: 121, False: 0] | | ------------------ ------------------ | Branch (220:9): [True: 0, False: 121] ------------------ 221| 0| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (221:21): [True: 0, False: 0] ------------------ 222| 0| if ((a_fs_name->meta_addr == a_fs_dir->names[i].meta_addr) && ------------------ | Branch (222:17): [True: 0, False: 0] ------------------ 223| 0| (strcmp(a_fs_name->name, a_fs_dir->names[i].name) == 0)) { ------------------ | Branch (223:17): [True: 0, False: 0] ------------------ 224| | 225| 0| if (tsk_verbose) ------------------ | Branch (225:21): [True: 0, False: 0] ------------------ 226| 0| tsk_fprintf(stderr, 227| 0| "tsk_fs_dir_add: removing duplicate entry: %s (%" 228| 0| PRIuINUM ")\n", a_fs_name->name, 229| 0| a_fs_name->meta_addr); 230| | 231| | /* We do not check type because then we cannot detect NTFS orphan file 232| | * duplicates that are added as "-/r" while a similar entry exists as "r/r" 233| | (a_fs_name->type == a_fs_dir->names[i].type)) { */ 234| | 235| | // if the one in the list is unalloc and we have an alloc, replace it 236| 0| if ((a_fs_dir->names[i].flags & TSK_FS_NAME_FLAG_UNALLOC) ------------------ | Branch (236:21): [True: 0, False: 0] ------------------ 237| 0| && (a_fs_name->flags & TSK_FS_NAME_FLAG_ALLOC)) { ------------------ | Branch (237:24): [True: 0, False: 0] ------------------ 238| 0| fs_name_dest = &a_fs_dir->names[i]; 239| | 240| | // free the memory - not the most efficient, but prevents 241| | // duplicate code. 242| 0| tsk_fs_dir_free_name_internal(fs_name_dest); 243| 0| break; 244| 0| } 245| 0| else { 246| 0| return 0; 247| 0| } 248| 0| } 249| 0| } 250| 0| } 251| | 252| 121| if (fs_name_dest == NULL) { ------------------ | Branch (252:9): [True: 121, False: 0] ------------------ 253| | // make sure we got the room 254| 121| if (a_fs_dir->names_used >= a_fs_dir->names_alloc) { ------------------ | Branch (254:13): [True: 0, False: 121] ------------------ 255| | 256| | // Protect against trying to process very large directories 257| 0| if (a_fs_dir->names_used >= MAX_DIR_SIZE_TO_PROCESS) { ------------------ | | 75| 0|#define MAX_DIR_SIZE_TO_PROCESS 1000000 ------------------ | Branch (257:8): [True: 0, False: 0] ------------------ 258| 0| tsk_error_reset(); 259| 0| tsk_error_set_errno(TSK_ERR_FS_GENFS); ------------------ | | 360| 0|#define TSK_ERR_FS_GENFS (TSK_ERR_FS | 15) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 260| 0| tsk_error_set_errstr("tsk_fs_dir_add: Directory too large to process (addr: %" PRIuSIZE")", a_fs_dir->addr); 261| 0| return 1; 262| 0| } 263| | 264| 0| if (tsk_fs_dir_realloc(a_fs_dir, a_fs_dir->names_used + 512)) ------------------ | Branch (264:17): [True: 0, False: 0] ------------------ 265| 0| return 1; 266| 0| } 267| | 268| 121| fs_name_dest = &a_fs_dir->names[a_fs_dir->names_used++]; 269| 121| } 270| | 271| 121| if (tsk_fs_name_copy(fs_name_dest, a_fs_name)) ------------------ | Branch (271:9): [True: 0, False: 121] ------------------ 272| 0| return 1; 273| | 274| | // add the parent address 275| 121| if (a_fs_dir->addr) { ------------------ | Branch (275:9): [True: 121, False: 0] ------------------ 276| 121| fs_name_dest->par_addr = a_fs_dir->addr; 277| 121| fs_name_dest->par_seq = a_fs_dir->seq; 278| 121| } 279| | 280| 121| return 0; 281| 121|} tsk_fs_dir_open_meta: 328| 11|{ 329| 11| return tsk_fs_dir_open_meta_internal(a_fs, a_addr, 0); 330| 11|} tsk_fs_dir_close: 387| 40|{ 388| 40| size_t i; 389| 40| if ((a_fs_dir == NULL) || (a_fs_dir->tag != TSK_FS_DIR_TAG)) { ------------------ | | 633| 40|#define TSK_FS_DIR_TAG 0x57531246 ------------------ | Branch (389:9): [True: 0, False: 40] | Branch (389:31): [True: 0, False: 40] ------------------ 390| 0| return; 391| 0| } 392| | 393| 40| if (a_fs_dir->names != NULL) { ------------------ | Branch (393:9): [True: 40, False: 0] ------------------ 394| 163| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (394:21): [True: 123, False: 40] ------------------ 395| 123| tsk_fs_dir_free_name_internal(&a_fs_dir->names[i]); 396| 123| } 397| 40| free(a_fs_dir->names); 398| 40| } 399| | 400| 40| if (a_fs_dir->fs_file) { ------------------ | Branch (400:9): [True: 34, False: 6] ------------------ 401| 34| tsk_fs_file_close(a_fs_dir->fs_file); 402| 34| a_fs_dir->fs_file = NULL; 403| 34| } 404| | 405| 40| a_fs_dir->tag = 0; 406| 40| free(a_fs_dir); 407| 40|} tsk_fs_dir_walk_internal: 958| 17|{ 959| 17| DENT_DINFO dinfo; 960| 17| TSK_WALK_RET_ENUM retval; 961| | 962| 17| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) { ------------------ | | 933| 17|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (962:9): [True: 0, False: 17] | Branch (962:27): [True: 0, False: 17] ------------------ 963| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 964| 0| tsk_error_set_errstr 965| 0| ("tsk_fs_dir_walk_internal: called with NULL or unallocated structures"); 966| 0| return 1; 967| 0| } 968| | 969| | // 128 is a somewhat arbitrary value. 970| | // https://github.com/sleuthkit/sleuthkit/issues/1859 identified 971| | // an overflow with 240 levels of recursion with FAT 972| 17| if (macro_recursion_depth > 128) { ------------------ | Branch (972:9): [True: 0, False: 17] ------------------ 973| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 974| 0| tsk_error_set_errstr 975| 0| ("tsk_fs_dir_walk_internal: recursion depth exceeds maximum (%d)", macro_recursion_depth); 976| 0| return 1; 977| 0| } 978| | 979| 17| memset(&dinfo, 0, sizeof(DENT_DINFO)); 980| 17| if ((dinfo.stack_seen = tsk_stack_create()) == NULL) ------------------ | Branch (980:9): [True: 0, False: 17] ------------------ 981| 0| return 1; 982| | 983| | /* Sanity check on flags -- make sure at least one ALLOC is set */ 984| 17| if (((a_flags & TSK_FS_DIR_WALK_FLAG_ALLOC) == 0) && ------------------ | Branch (984:9): [True: 11, False: 6] ------------------ 985| 17| ((a_flags & TSK_FS_DIR_WALK_FLAG_UNALLOC) == 0)) { ------------------ | Branch (985:9): [True: 6, False: 5] ------------------ 986| 6| a_flags |= 987| 6| (TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC); 988| 6| } 989| | 990| | /* if the flags are right, we can collect info that may be needed 991| | * for an orphan walk. If the walk fails or stops, the code that 992| | * calls the action will clear this stuff. 993| | */ 994| 17| tsk_take_lock(&a_fs->list_inum_named_lock); 995| 17| if ((a_fs->list_inum_named == NULL) && (a_addr == a_fs->root_inum) ------------------ | Branch (995:9): [True: 16, False: 1] | Branch (995:44): [True: 16, False: 0] ------------------ 996| 17| && (a_flags & TSK_FS_DIR_WALK_FLAG_RECURSE)) { ------------------ | Branch (996:12): [True: 16, False: 0] ------------------ 997| 16| dinfo.save_inum_named = 1; 998| 16| } 999| 17| tsk_release_lock(&a_fs->list_inum_named_lock); 1000| | 1001| 17| retval = tsk_fs_dir_walk_recursive(a_fs, &dinfo, a_addr, a_flags, 1002| 17| a_action, a_ptr, macro_recursion_depth); 1003| | 1004| | // if we were saving the list of named files in the temp list, 1005| | // then now save them to FS_INFO 1006| 17| if (dinfo.save_inum_named == 1) { ------------------ | Branch (1006:9): [True: 0, False: 17] ------------------ 1007| 0| if (retval != TSK_WALK_CONT) { ------------------ | Branch (1007:13): [True: 0, False: 0] ------------------ 1008| | /* There was an error and we stopped early, so we should get 1009| | * rid of the partial list we were making. 1010| | */ 1011| 0| tsk_list_free(dinfo.list_inum_named); 1012| 0| dinfo.list_inum_named = NULL; 1013| 0| } 1014| 0| else { 1015| 0| save_inum_named(a_fs, &dinfo); 1016| 0| } 1017| 0| } 1018| | 1019| 17| tsk_stack_free(dinfo.stack_seen); 1020| | 1021| 17| if (retval == TSK_WALK_ERROR) ------------------ | Branch (1021:9): [True: 0, False: 17] ------------------ 1022| 0| return 1; 1023| 17| else 1024| 17| return 0; 1025| 17|} tsk_fs_dir_walk: 1042| 12|{ 1043| 12| return tsk_fs_dir_walk_internal(a_fs, a_addr, a_flags, a_action, a_ptr, 0); 1044| 12|} tsk_fs_dir_make_orphan_dir_name: 1055| 28|{ 1056| 28| snprintf(a_fs_name->name, a_fs_name->name_size, "$OrphanFiles"); 1057| 28| if (a_fs_name->shrt_name_size > 0) ------------------ | Branch (1057:9): [True: 0, False: 28] ------------------ 1058| 0| a_fs_name->shrt_name[0] = '\0'; 1059| 28| a_fs_name->meta_addr = TSK_FS_ORPHANDIR_INUM(a_fs); ------------------ | | 530| 28| (fs_info->last_inum) ------------------ 1060| 28| a_fs_name->flags = TSK_FS_NAME_FLAG_ALLOC; 1061| 28| a_fs_name->type = TSK_FS_NAME_TYPE_VIRT_DIR; 1062| 28| return 0; 1063| 28|} tsk_fs_dir_make_orphan_dir_meta: 1074| 23|{ 1075| 23| a_fs_meta->type = TSK_FS_META_TYPE_VIRT_DIR; 1076| 23| a_fs_meta->mode = 0; 1077| 23| a_fs_meta->nlink = 1; 1078| | 1079| 23| a_fs_meta->flags = (TSK_FS_META_FLAG_USED | TSK_FS_META_FLAG_ALLOC); 1080| 23| a_fs_meta->uid = a_fs_meta->gid = 0; 1081| 23| a_fs_meta->mtime = a_fs_meta->atime = a_fs_meta->ctime = 1082| 23| a_fs_meta->crtime = 0; 1083| 23| a_fs_meta->mtime_nano = a_fs_meta->atime_nano = a_fs_meta->ctime_nano = 1084| 23| a_fs_meta->crtime_nano = 0; 1085| | 1086| 23| if (a_fs_meta->name2 == NULL) { ------------------ | Branch (1086:9): [True: 23, False: 0] ------------------ 1087| 23| if ((a_fs_meta->name2 = (TSK_FS_META_NAME_LIST *) ------------------ | Branch (1087:13): [True: 0, False: 23] ------------------ 1088| 23| tsk_malloc(sizeof(TSK_FS_META_NAME_LIST))) == NULL) 1089| 0| return 1; 1090| 23| a_fs_meta->name2->next = NULL; 1091| 23| } 1092| | 1093| 23| a_fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 1094| 23| if (a_fs_meta->attr) { ------------------ | Branch (1094:9): [True: 0, False: 23] ------------------ 1095| 0| tsk_fs_attrlist_markunused(a_fs_meta->attr); 1096| 0| } 1097| | 1098| 23| a_fs_meta->addr = TSK_FS_ORPHANDIR_INUM(a_fs); ------------------ | | 530| 23| (fs_info->last_inum) ------------------ 1099| 23| strncpy(a_fs_meta->name2->name, "$OrphanFiles", 1100| 23| TSK_FS_META_NAME_LIST_NSIZE); ------------------ | | 348| 23|#define TSK_FS_META_NAME_LIST_NSIZE 512 ------------------ 1101| 23| if (a_fs_meta->content_len) { ------------------ | Branch (1101:9): [True: 23, False: 0] ------------------ 1102| 23| TSK_DADDR_T *addr_ptr = (TSK_DADDR_T *) a_fs_meta->content_ptr; 1103| 23| addr_ptr[0] = 0; 1104| 23| } 1105| 23| a_fs_meta->size = 0; 1106| 23| return 0; 1107| 23|} tsk_fs_dir_load_inum_named: 1147| 6|{ 1148| 6| tsk_take_lock(&a_fs->list_inum_named_lock); 1149| 6| if (a_fs->list_inum_named != NULL) { ------------------ | Branch (1149:9): [True: 1, False: 5] ------------------ 1150| 1| tsk_release_lock(&a_fs->list_inum_named_lock); 1151| 1| if (tsk_verbose) ------------------ | Branch (1151:13): [True: 0, False: 1] ------------------ 1152| 0| fprintf(stderr, 1153| 0| "tsk_fs_dir_load_inum_named: List already populated. Skipping walk.\n"); 1154| 1| return TSK_OK; 1155| 1| } 1156| 5| tsk_release_lock(&a_fs->list_inum_named_lock); 1157| | 1158| 5| if (tsk_verbose) ------------------ | Branch (1158:9): [True: 0, False: 5] ------------------ 1159| 0| fprintf(stderr, 1160| 0| "tsk_fs_dir_load_inum_named: Performing dir walk to find named files\n"); 1161| | 1162| | /* Do a dir_walk. There is internal caching code that will populate 1163| | * the structure. The callback is really a dummy call. This could 1164| | * be made more efficient in the future (not do callbacks...). We 1165| | * specify UNALLOC only as a flag on the assumption that there will 1166| | * be fewer callbacks for UNALLOC than ALLOC. 1167| | */ 1168| 5| if (tsk_fs_dir_walk_internal(a_fs, a_fs->root_inum, ------------------ | Branch (1168:9): [True: 0, False: 5] ------------------ 1169| 5| TSK_FS_NAME_FLAG_UNALLOC | TSK_FS_DIR_WALK_FLAG_RECURSE | 1170| 5| TSK_FS_DIR_WALK_FLAG_NOORPHAN, load_named_dir_walk_cb, NULL, 0)) { 1171| 0| tsk_error_errstr2_concat 1172| 0| ("- tsk_fs_dir_load_inum_named: identifying inodes allocated by file names"); 1173| 0| return TSK_ERR; 1174| 0| } 1175| | 1176| 5| return TSK_OK; 1177| 5|} tsk_fs_dir_find_orphans: 1356| 6|{ 1357| 6| FIND_ORPHAN_DATA data; 1358| 6| size_t i; 1359| | 1360| 6| tsk_take_lock(&a_fs->orphan_dir_lock); 1361| | 1362| 6| if (a_fs->orphan_dir != NULL) { ------------------ | Branch (1362:9): [True: 0, False: 6] ------------------ 1363| 0| if (tsk_fs_dir_copy(a_fs->orphan_dir, a_fs_dir)) { ------------------ | Branch (1363:13): [True: 0, False: 0] ------------------ 1364| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1365| 0| return TSK_ERR; 1366| 0| } 1367| | 1368| 0| if (tsk_fs_dir_add_orphan_dir_meta(a_fs, a_fs_dir)) { ------------------ | Branch (1368:13): [True: 0, False: 0] ------------------ 1369| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1370| 0| return TSK_ERR; 1371| 0| } 1372| | 1373| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1374| 0| return TSK_OK; 1375| 0| } 1376| | 1377| 6| if (tsk_verbose) ------------------ | Branch (1377:9): [True: 0, False: 6] ------------------ 1378| 0| fprintf(stderr, 1379| 0| "tsk_fs_dir_find_orphans: Searching for orphan files\n"); 1380| | 1381| 6| memset(&data, 0, sizeof(FIND_ORPHAN_DATA)); 1382| | 1383| | /* We first need to determine which of the unallocated meta structures 1384| | * have a name pointing to them. We cache this data, so see if it is 1385| | * already known. */ 1386| 6| if (tsk_fs_dir_load_inum_named(a_fs) != TSK_OK) { ------------------ | Branch (1386:9): [True: 0, False: 6] ------------------ 1387| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1388| 0| return TSK_ERR; 1389| 0| } 1390| | // note that list_inum_named could still be NULL if there are no deleted names. 1391| | 1392| | /* Now we walk the unallocated metadata structures and find ones that are 1393| | * not named. The callback will add the names to the FS_DIR structure. 1394| | */ 1395| 6| data.fs_dir = a_fs_dir; 1396| | 1397| | // allocate a name once so that we will reuse for each name we add to FS_DIR 1398| 6| if ((data.fs_name = tsk_fs_name_alloc(256, 0)) == NULL) { ------------------ | Branch (1398:9): [True: 0, False: 6] ------------------ 1399| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1400| 0| return TSK_ERR; 1401| 0| } 1402| | 1403| 6| if (tsk_verbose) ------------------ | Branch (1403:9): [True: 0, False: 6] ------------------ 1404| 0| fprintf(stderr, 1405| 0| "tsk_fs_dir_find_orphans: Performing inode_walk to find unnamed metadata structures\n"); 1406| | 1407| 6| if (tsk_fs_meta_walk(a_fs, a_fs->first_inum, a_fs->last_inum, ------------------ | Branch (1407:9): [True: 0, False: 6] ------------------ 1408| 6| TSK_FS_META_FLAG_UNALLOC | TSK_FS_META_FLAG_USED, 1409| 6| find_orphan_meta_walk_cb, &data)) { 1410| 0| tsk_fs_name_free(data.fs_name); 1411| 0| if (data.orphan_subdir_list) { ------------------ | Branch (1411:13): [True: 0, False: 0] ------------------ 1412| 0| tsk_list_free(data.orphan_subdir_list); 1413| 0| data.orphan_subdir_list = NULL; 1414| 0| } 1415| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1416| 0| return TSK_ERR; 1417| 0| } 1418| | 1419| 6| tsk_fs_name_free(data.fs_name); 1420| 6| data.fs_name = NULL; 1421| | 1422| | 1423| 6| if (tsk_verbose) ------------------ | Branch (1423:9): [True: 0, False: 6] ------------------ 1424| 0| fprintf(stderr, 1425| 0| "tsk_fs_dir_find_orphans: De-duping orphan files and directories\n"); 1426| | 1427| | /* do some cleanup on the final list. This cleanup will compare the 1428| | * entries in the root orphan directory with files that can be accessed 1429| | * from subdirectories of the orphan directory. These entries will exist if 1430| | * they were added before their parent directory was added to the orphan directory. */ 1431| 8| for (i = 0; i < a_fs_dir->names_used; i++) { ------------------ | Branch (1431:17): [True: 2, False: 6] ------------------ 1432| 2| if (tsk_list_find(data.orphan_subdir_list, ------------------ | Branch (1432:13): [True: 0, False: 2] ------------------ 1433| 2| a_fs_dir->names[i].meta_addr)) { 1434| | 1435| | // Unclear what should happen in this situation, but it can happen, 1436| | // So skipping over this situation for now. 1437| 0| if (a_fs_dir->names_used == i + 1) { ------------------ | Branch (1437:17): [True: 0, False: 0] ------------------ 1438| 0| continue; 1439| 0| } 1440| 0| if (a_fs_dir->names_used > 1) { ------------------ | Branch (1440:17): [True: 0, False: 0] ------------------ 1441| 0| tsk_fs_name_copy(&a_fs_dir->names[i], 1442| 0| &a_fs_dir->names[a_fs_dir->names_used - 1]); 1443| 0| } 1444| 0| tsk_fs_dir_free_name_internal(&a_fs_dir->names[a_fs_dir->names_used-1]); 1445| 0| a_fs_dir->names_used--; 1446| 0| } 1447| 2| } 1448| | 1449| 6| if (data.orphan_subdir_list) { ------------------ | Branch (1449:9): [True: 0, False: 6] ------------------ 1450| 0| tsk_list_free(data.orphan_subdir_list); 1451| 0| data.orphan_subdir_list = NULL; 1452| 0| } 1453| | 1454| | 1455| | // make copy of this so that we don't need to do it again. 1456| 6| if ((a_fs->orphan_dir = ------------------ | Branch (1456:9): [True: 0, False: 6] ------------------ 1457| 6| tsk_fs_dir_alloc(a_fs, a_fs_dir->addr, 1458| 6| a_fs_dir->names_used)) == NULL) { 1459| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1460| 0| return TSK_ERR; 1461| 0| } 1462| | 1463| 6| if (tsk_fs_dir_copy(a_fs_dir, a_fs->orphan_dir)) { ------------------ | Branch (1463:9): [True: 0, False: 6] ------------------ 1464| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1465| 0| return TSK_ERR; 1466| 0| } 1467| | 1468| | // populate the fake FS_FILE structure in the struct to be returned for the "Orphan Directory" 1469| 6| if (tsk_fs_dir_add_orphan_dir_meta(a_fs, a_fs_dir)) { ------------------ | Branch (1469:9): [True: 0, False: 6] ------------------ 1470| 0| tsk_release_lock(&a_fs->orphan_dir_lock); 1471| 0| return TSK_ERR; 1472| 0| } 1473| | 1474| 6| tsk_release_lock(&a_fs->orphan_dir_lock); 1475| 6| return TSK_OK; 1476| 6|} fs_dir.c:tsk_fs_dir_free_name_internal: 182| 123|{ 183| 123| if (fs_name == NULL) { ------------------ | Branch (183:9): [True: 0, False: 123] ------------------ 184| 0| return; 185| 0| } 186| | 187| 123| if (fs_name->name) { ------------------ | Branch (187:9): [True: 123, False: 0] ------------------ 188| 123| free(fs_name->name); 189| 123| fs_name->name = NULL; 190| 123| fs_name->name_size = 0; 191| 123| } 192| 123| if (fs_name->shrt_name) { ------------------ | Branch (192:9): [True: 7, False: 116] ------------------ 193| 7| free(fs_name->shrt_name); 194| 7| fs_name->shrt_name = NULL; 195| 7| fs_name->shrt_name_size = 0; 196| 7| } 197| 123|} fs_dir.c:tsk_fs_dir_open_meta_internal: 296| 34|{ 297| 34| TSK_FS_DIR *fs_dir = NULL; 298| 34| TSK_RETVAL_ENUM retval; 299| | 300| 34| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG) ------------------ | | 933| 34|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (300:9): [True: 0, False: 34] | Branch (300:27): [True: 0, False: 34] ------------------ 301| 34| || (a_fs->dir_open_meta == NULL)) { ------------------ | Branch (301:12): [True: 0, False: 34] ------------------ 302| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 303| 0| tsk_error_set_errstr 304| 0| ("tsk_fs_dir_open_meta_internal: called with NULL or unallocated structures"); 305| 0| return NULL; 306| 0| } 307| | 308| 34| retval = a_fs->dir_open_meta(a_fs, &fs_dir, a_addr, macro_recursion_depth); 309| 34| if (retval != TSK_OK) { ------------------ | Branch (309:9): [True: 0, False: 34] ------------------ 310| 0| tsk_fs_dir_close(fs_dir); 311| 0| return NULL; 312| 0| } 313| | 314| 34| return fs_dir; 315| 34|} fs_dir.c:tsk_fs_dir_walk_recursive: 654| 23|{ 655| 23| TSK_FS_DIR *fs_dir; 656| 23| TSK_FS_FILE *fs_file; 657| 23| size_t i; 658| 23| int* indexToOrderedIndex = NULL; 659| | 660| | // get the list of entries in the directory 661| 23| if ((fs_dir = tsk_fs_dir_open_meta_internal(a_fs, a_addr, macro_recursion_depth + 1)) == NULL) { ------------------ | Branch (661:9): [True: 0, False: 23] ------------------ 662| 0| return TSK_WALK_ERROR; 663| 0| } 664| | 665| | // If we're in the root folder, sort the files/folders to prioritize user content 666| 23| if (a_addr == a_fs->root_inum) { ------------------ | Branch (666:9): [True: 17, False: 6] ------------------ 667| 17| indexToOrderedIndex = (int *)tsk_malloc(fs_dir->names_used * sizeof(int)); 668| 17| if (indexToOrderedIndex == NULL) { ------------------ | Branch (668:13): [True: 0, False: 17] ------------------ 669| 0| tsk_fs_dir_close(fs_dir); 670| 0| return TSK_WALK_ERROR; 671| 0| } 672| 17| if (TSK_OK != prioritizeDirNames(fs_dir->names, fs_dir->names_used, indexToOrderedIndex)) { ------------------ | Branch (672:13): [True: 0, False: 17] ------------------ 673| 0| tsk_fs_dir_close(fs_dir); 674| 0| return TSK_WALK_ERROR; 675| 0| } 676| 17| } 677| | 678| | /* Allocate a file structure for the callbacks. We 679| | * will allocate fs_meta structures as needed and 680| | * point into the fs_dir structure for the names. */ 681| 23| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) { ------------------ | Branch (681:9): [True: 0, False: 23] ------------------ 682| 0| tsk_fs_dir_close(fs_dir); 683| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (683:13): [True: 0, False: 0] ------------------ 684| 0| free(indexToOrderedIndex); 685| 0| } 686| 0| return TSK_WALK_ERROR; 687| 0| } 688| | 689| 98| for (i = 0; i < fs_dir->names_used; i++) { ------------------ | Branch (689:17): [True: 75, False: 23] ------------------ 690| 75| TSK_WALK_RET_ENUM retval; 691| | 692| | /* Point name to the buffer of names. We need to be 693| | * careful about resetting this before we free fs_file */ 694| 75| if (indexToOrderedIndex != NULL) { ------------------ | Branch (694:13): [True: 73, False: 2] ------------------ 695| | // If we have a priortized list, use it 696| 73| fs_file->name = (TSK_FS_NAME *)& fs_dir->names[indexToOrderedIndex[i]]; 697| 73| } 698| 2| else { 699| 2| fs_file->name = (TSK_FS_NAME *)& fs_dir->names[i]; 700| 2| } 701| | 702| | /* load the fs_meta structure if possible. 703| | * Must have non-zero inode addr or have allocated name (if inode is 0) */ 704| 75| if (((fs_file->name->meta_addr) ------------------ | Branch (704:14): [True: 75, False: 0] ------------------ 705| 75| || (fs_file->name->flags & TSK_FS_NAME_FLAG_ALLOC))) { ------------------ | Branch (705:20): [True: 0, False: 0] ------------------ 706| | 707| | /* Note that the NTFS code behind here has a slight hack to use the 708| | * correct sequence number based on the data in fs_file->name */ 709| 75| if (a_fs->file_add_meta(a_fs, fs_file, ------------------ | Branch (709:17): [True: 0, False: 75] ------------------ 710| 75| fs_file->name->meta_addr)) { 711| 0| if (tsk_verbose) ------------------ | Branch (711:21): [True: 0, False: 0] ------------------ 712| 0| tsk_error_print(stderr); 713| 0| tsk_error_reset(); 714| 0| } 715| 75| } 716| | 717| | // call the action if we have the right flags. 718| 75| if ((fs_file->name->flags & a_flags) == fs_file->name->flags) { ------------------ | Branch (718:13): [True: 53, False: 22] ------------------ 719| | 720| 53| retval = a_action(fs_file, a_dinfo->dirs, a_ptr); 721| 53| if (retval == TSK_WALK_STOP) { ------------------ | Branch (721:17): [True: 0, False: 53] ------------------ 722| 0| tsk_fs_dir_close(fs_dir); 723| 0| fs_file->name = NULL; 724| 0| tsk_fs_file_close(fs_file); 725| | 726| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (726:21): [True: 0, False: 0] ------------------ 727| 0| free(indexToOrderedIndex); 728| 0| } 729| | 730| | /* free the list -- fs_dir_walk has no way 731| | * of knowing that we stopped early w/out error. 732| | */ 733| 0| if (a_dinfo->save_inum_named) { ------------------ | Branch (733:21): [True: 0, False: 0] ------------------ 734| 0| tsk_list_free(a_dinfo->list_inum_named); 735| 0| a_dinfo->list_inum_named = NULL; 736| 0| a_dinfo->save_inum_named = 0; 737| 0| } 738| 0| return TSK_WALK_STOP; 739| 0| } 740| 53| else if (retval == TSK_WALK_ERROR) { ------------------ | Branch (740:22): [True: 0, False: 53] ------------------ 741| 0| tsk_fs_dir_close(fs_dir); 742| 0| fs_file->name = NULL; 743| 0| tsk_fs_file_close(fs_file); 744| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (744:21): [True: 0, False: 0] ------------------ 745| 0| free(indexToOrderedIndex); 746| 0| } 747| 0| return TSK_WALK_ERROR; 748| 0| } 749| 53| } 750| | 751| | // save the inode info for orphan finding - if requested 752| 75| if ((a_dinfo->save_inum_named) && (fs_file->meta) ------------------ | Branch (752:13): [True: 68, False: 7] | Branch (752:43): [True: 68, False: 0] ------------------ 753| 75| && (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)) { ------------------ | Branch (753:16): [True: 1, False: 67] ------------------ 754| | 755| 1| if (tsk_list_add(&a_dinfo->list_inum_named, ------------------ | Branch (755:17): [True: 0, False: 1] ------------------ 756| 1| fs_file->meta->addr)) { 757| | 758| | // if there is an error, then clear the list 759| 0| tsk_list_free(a_dinfo->list_inum_named); 760| 0| a_dinfo->list_inum_named = NULL; 761| 0| a_dinfo->save_inum_named = 0; 762| 0| } 763| 1| } 764| | 765| | 766| | /* Optimization. If we are about to recurse into the 767| | * orphan directory and we are the last item in the 768| | * directory and the flag has been set to save inum_named, 769| | * then save inum_named now to FS_INFO so that we can use 770| | * it for the orphan folder. Otherwise, we do a full 771| | * inode walk again for nothing. */ 772| 75| if ((fs_file->name->meta_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) && ------------------ | | 530| 75| (fs_info->last_inum) ------------------ | Branch (772:13): [True: 17, False: 58] ------------------ 773| 75| (i == fs_dir->names_used-1) && ------------------ | Branch (773:13): [True: 17, False: 0] ------------------ 774| 75| (a_dinfo->save_inum_named == 1)) { ------------------ | Branch (774:13): [True: 16, False: 1] ------------------ 775| 16| save_inum_named(a_fs, a_dinfo); 776| 16| a_dinfo->save_inum_named = 0; 777| 16| } 778| | 779| | /* Recurse into a directory if: 780| | * - Both dir entry and inode have DIR type (or name is undefined) 781| | * - Recurse flag is set 782| | * - dir entry is allocated OR both are unallocated 783| | * - not one of the '.' or '..' entries 784| | * - A Non-Orphan Dir or the Orphan Dir with the NOORPHAN flag not set. 785| | */ 786| 75| if ((TSK_FS_IS_DIR_NAME(fs_file->name->type) ------------------ | | 592| 150| ((x == TSK_FS_NAME_TYPE_DIR) || (x == TSK_FS_NAME_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (592:6): [True: 0, False: 75] | | | Branch (592:37): [True: 17, False: 58] | | ------------------ ------------------ 787| 75| || (fs_file->name->type == TSK_FS_NAME_TYPE_UNDEF)) ------------------ | Branch (787:20): [True: 2, False: 56] ------------------ 788| 75| && (fs_file->meta) ------------------ | Branch (788:16): [True: 19, False: 0] ------------------ 789| 75| && (TSK_FS_IS_DIR_META(fs_file->meta->type)) ------------------ | | 414| 19|#define TSK_FS_IS_DIR_META(x) ((x == TSK_FS_META_TYPE_DIR) || (x == TSK_FS_META_TYPE_VIRT_DIR)) | | ------------------ | | | Branch (414:32): [True: 0, False: 19] | | | Branch (414:63): [True: 17, False: 2] | | ------------------ ------------------ 790| 75| && (a_flags & TSK_FS_DIR_WALK_FLAG_RECURSE) ------------------ | Branch (790:16): [True: 17, False: 0] ------------------ 791| 75| && ((fs_file->name->flags & TSK_FS_NAME_FLAG_ALLOC) ------------------ | Branch (791:17): [True: 17, False: 0] ------------------ 792| 17| || ((fs_file->name->flags & TSK_FS_NAME_FLAG_UNALLOC) ------------------ | Branch (792:21): [True: 0, False: 0] ------------------ 793| 0| && (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)) ------------------ | Branch (793:24): [True: 0, False: 0] ------------------ 794| 17| ) 795| 75| && (!TSK_FS_ISDOT(fs_file->name->name)) ------------------ | | 1179| 17|#define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \ | | ------------------ | | | Branch (1179:30): [True: 0, False: 17] | | ------------------ | | 1180| 17| ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) | | ------------------ | | | Branch (1180:8): [True: 0, False: 0] | | | Branch (1180:27): [True: 0, False: 0] | | | Branch (1180:48): [True: 0, False: 0] | | ------------------ ------------------ | Branch (795:16): [True: 17, False: 0] ------------------ 796| 75| && ((fs_file->name->meta_addr != TSK_FS_ORPHANDIR_INUM(a_fs)) ------------------ | | 530| 17| (fs_info->last_inum) ------------------ | Branch (796:17): [True: 0, False: 17] ------------------ 797| 17| || ((a_flags & TSK_FS_DIR_WALK_FLAG_NOORPHAN) == 0)) ------------------ | Branch (797:20): [True: 6, False: 11] ------------------ 798| 75| ) { 799| | 800| | /* Make sure we do not get into an infinite loop */ 801| 6| if (0 == tsk_stack_find(a_dinfo->stack_seen, ------------------ | Branch (801:17): [True: 6, False: 0] ------------------ 802| 6| fs_file->name->meta_addr)) { 803| 6| int depth_added = 0; 804| 6| uint8_t save_bak = 0; 805| | 806| 6| if (tsk_stack_push(a_dinfo->stack_seen, ------------------ | Branch (806:21): [True: 0, False: 6] ------------------ 807| 6| fs_file->name->meta_addr)) { 808| 0| tsk_fs_dir_close(fs_dir); 809| 0| fs_file->name = NULL; 810| 0| tsk_fs_file_close(fs_file); 811| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (811:25): [True: 0, False: 0] ------------------ 812| 0| free(indexToOrderedIndex); 813| 0| } 814| 0| return TSK_WALK_ERROR; 815| 0| } 816| | 817| | /* If we've exceeded the max depth or max length, don't 818| | * recurse any further into this directory 819| | * NOTE: We have two concepts of recursion detection in 820| | * here. This one is based on within a top-level call 821| | * to dir_walk. The macro_recursion_depth value allows 822| | * us to detect when file systems need to call dir_walk 823| | * to resolve things and they get into an infinite loop. 824| | * Perhaps they can be unified some day. 825| | */ 826| 6| if ((a_dinfo->depth >= MAX_DEPTH) || ------------------ | | 521| 6|#define MAX_DEPTH 128 ------------------ | Branch (826:21): [True: 0, False: 6] ------------------ 827| 6| (DIR_STRSZ <= ------------------ | | 522| 6|#define DIR_STRSZ 4096 ------------------ | Branch (827:21): [True: 0, False: 6] ------------------ 828| 6| strlen(a_dinfo->dirs) + 829| 6| strlen(fs_file->name->name))) { 830| 0| if (tsk_verbose) { ------------------ | Branch (830:25): [True: 0, False: 0] ------------------ 831| 0| tsk_fprintf(stdout, 832| 0| "tsk_fs_dir_walk_recursive: directory : %" 833| 0| PRIuINUM " exceeded max length / depth\n", fs_file->name->meta_addr); 834| 0| } 835| | 836| 0| tsk_fs_dir_close(fs_dir); 837| 0| fs_file->name = NULL; 838| 0| tsk_fs_file_close(fs_file); 839| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (839:25): [True: 0, False: 0] ------------------ 840| 0| free(indexToOrderedIndex); 841| 0| } 842| 0| return TSK_WALK_ERROR; 843| 0| } 844| | 845| 6| a_dinfo->didx[a_dinfo->depth] = 846| 6| &a_dinfo->dirs[strlen(a_dinfo->dirs)]; 847| 6| strncpy(a_dinfo->didx[a_dinfo->depth], 848| 6| fs_file->name->name, 849| 6| DIR_STRSZ - strlen(a_dinfo->dirs)); ------------------ | | 522| 6|#define DIR_STRSZ 4096 ------------------ 850| 6| strncat(a_dinfo->dirs, "/", DIR_STRSZ - strlen(a_dinfo->dirs) - 1); ------------------ | | 522| 6|#define DIR_STRSZ 4096 ------------------ 851| 6| depth_added = 1; 852| 6| a_dinfo->depth++; 853| | 854| | /* We do not want to save info about named unalloc files 855| | * when we go into the Orphan directory (because then we have 856| | * no orphans). So, disable it for this recursion. 857| | */ 858| 6| if (fs_file->name->meta_addr == ------------------ | Branch (858:21): [True: 6, False: 0] ------------------ 859| 6| TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 6| (fs_info->last_inum) ------------------ 860| 6| save_bak = a_dinfo->save_inum_named; 861| 6| a_dinfo->save_inum_named = 0; 862| 6| } 863| 6| retval = tsk_fs_dir_walk_recursive(a_fs, 864| 6| a_dinfo, fs_file->name->meta_addr, a_flags, 865| 6| a_action, a_ptr, macro_recursion_depth + 1); 866| 6| if (retval == TSK_WALK_ERROR) { ------------------ | Branch (866:21): [True: 0, False: 6] ------------------ 867| | /* In most cases we want to continue if a directory 868| | * did not load, but if we ran out 869| | * of memory we should stop */ 870| 0| if (tsk_error_get_errno() & TSK_ERR_AUX) { ------------------ | | 298| 0|#define TSK_ERR_AUX 0x01000000 ------------------ | Branch (870:25): [True: 0, False: 0] ------------------ 871| 0| tsk_fs_dir_close(fs_dir); 872| 0| fs_file->name = NULL; 873| 0| tsk_fs_file_close(fs_file); 874| | 875| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (875:29): [True: 0, False: 0] ------------------ 876| 0| free(indexToOrderedIndex); 877| 0| } 878| 0| return TSK_WALK_ERROR; 879| 0| } 880| | 881| 0| if (tsk_verbose) { ------------------ | Branch (881:25): [True: 0, False: 0] ------------------ 882| 0| tsk_fprintf(stderr, 883| 0| "tsk_fs_dir_walk_recursive: error reading directory: %" 884| 0| PRIuINUM "\n", fs_file->name->meta_addr); 885| 0| tsk_error_print(stderr); 886| 0| } 887| | 888| 0| tsk_error_reset(); 889| 0| } 890| 6| else if (retval == TSK_WALK_STOP) { ------------------ | Branch (890:26): [True: 0, False: 6] ------------------ 891| 0| tsk_fs_dir_close(fs_dir); 892| 0| fs_file->name = NULL; 893| 0| tsk_fs_file_close(fs_file); 894| | 895| 0| if (indexToOrderedIndex != NULL) { ------------------ | Branch (895:25): [True: 0, False: 0] ------------------ 896| 0| free(indexToOrderedIndex); 897| 0| } 898| 0| return TSK_WALK_STOP; 899| 0| } 900| | 901| | // reset the save status 902| 6| if (fs_file->name->meta_addr == ------------------ | Branch (902:21): [True: 6, False: 0] ------------------ 903| 6| TSK_FS_ORPHANDIR_INUM(a_fs)) { ------------------ | | 530| 6| (fs_info->last_inum) ------------------ 904| 6| a_dinfo->save_inum_named = save_bak; 905| 6| } 906| | 907| 6| tsk_stack_pop(a_dinfo->stack_seen); 908| 6| a_dinfo->depth--; 909| 6| if (depth_added) ------------------ | Branch (909:21): [True: 6, False: 0] ------------------ 910| 6| *a_dinfo->didx[a_dinfo->depth] = '\0'; 911| 6| } 912| 0| else { 913| 0| if (tsk_verbose) ------------------ | Branch (913:21): [True: 0, False: 0] ------------------ 914| 0| fprintf(stderr, 915| 0| "tsk_fs_dir_walk_recursive: Loop detected with address %" 916| 0| PRIuINUM, fs_file->name->meta_addr); ------------------ | | 252| 0|#define PRIuINUM PRIu64 ------------------ 917| 0| } 918| 6| } 919| | 920| | // remove the pointer to name buffer 921| 75| fs_file->name = NULL; 922| | 923| | // free the metadata if we allocated it 924| 75| if (fs_file->meta) { ------------------ | Branch (924:13): [True: 75, False: 0] ------------------ 925| 75| tsk_fs_meta_close(fs_file->meta); 926| 75| fs_file->meta = NULL; 927| 75| } 928| 75| } 929| | 930| 23| tsk_fs_dir_close(fs_dir); 931| 23| fs_file->name = NULL; 932| 23| tsk_fs_file_close(fs_file); 933| | 934| 23| if (indexToOrderedIndex != NULL) { ------------------ | Branch (934:9): [True: 17, False: 6] ------------------ 935| 17| free(indexToOrderedIndex); 936| 17| } 937| 23| return TSK_WALK_CONT; 938| 23|} fs_dir.c:prioritizeDirNames: 583| 17|prioritizeDirNames(TSK_FS_NAME * names, size_t count, int * indexToOrderedIndex) { 584| 17| const int HIGH = 0; 585| 17| const int MED = 1; 586| 17| const int LOW = 2; 587| 17| const int LAST = 3; 588| 17| int * scores; 589| 17| int currentScore; 590| 17| size_t i; 591| | 592| 17| scores = (int *)tsk_malloc(count * sizeof(int)); 593| 17| if (scores == NULL) { ------------------ | Branch (593:9): [True: 0, False: 17] ------------------ 594| 0| return TSK_ERR; 595| 0| } 596| | 597| | // Default level is medium for any files/folders that do not match one of the patterns below. 598| | // This includes the Program Files and Applications folders. 599| 90| for (i = 0; i < count; i++) { ------------------ | Branch (599:17): [True: 73, False: 17] ------------------ 600| 73| scores[i] = MED; 601| 73| } 602| | 603| | // Get the score for each name. Currnetly all patterns match the beginning of the name. 604| 90| for (i = 0; i < count; i++) { ------------------ | Branch (604:17): [True: 73, False: 17] ------------------ 605| 73| TSK_FS_NAME* name = &(names[i]); 606| 73| if (name->name != NULL) { ------------------ | Branch (606:13): [True: 73, False: 0] ------------------ 607| 73| if (0 == strncasecmp(name->name, "Users", strlen("Users"))) { ------------------ | Branch (607:17): [True: 0, False: 73] ------------------ 608| 0| scores[i] = HIGH; 609| 0| } 610| 73| else if (0 == strncasecmp(name->name, "Documents and Settings", strlen("Documents and Settings"))) { ------------------ | Branch (610:22): [True: 0, False: 73] ------------------ 611| 0| scores[i] = HIGH; 612| 0| } 613| 73| else if (0 == strncasecmp(name->name, "home", strlen("home"))) { ------------------ | Branch (613:22): [True: 0, False: 73] ------------------ 614| 0| scores[i] = HIGH; 615| 0| } 616| 73| else if (0 == strncasecmp(name->name, "ProgramData", strlen("ProgramData"))) { ------------------ | Branch (616:22): [True: 0, False: 73] ------------------ 617| 0| scores[i] = HIGH; 618| 0| } 619| 73| else if (0 == strncasecmp(name->name, "Windows", strlen("Windows"))) { ------------------ | Branch (619:22): [True: 0, False: 73] ------------------ 620| 0| scores[i] = LOW; 621| 0| } 622| 73| else if (0 == strncasecmp(name->name, "$Orphan", strlen("$Orphan"))) { ------------------ | Branch (622:22): [True: 17, False: 56] ------------------ 623| 17| scores[i] = LOW; 624| 17| } 625| 56| else if (0 == strncasecmp(name->name, "pagefile", strlen("pagefile"))) { ------------------ | Branch (625:22): [True: 0, False: 56] ------------------ 626| 0| scores[i] = LAST; 627| 0| } 628| 56| else if (0 == strncasecmp(name->name, "hiberfil", strlen("hiberfil"))) { ------------------ | Branch (628:22): [True: 0, False: 56] ------------------ 629| 0| scores[i] = LAST; 630| 0| } 631| 73| } 632| 73| } 633| | 634| | // Order the name entries based on the scores 635| 17| int orderedIndex = 0; 636| 85| for (currentScore = HIGH; currentScore <= LAST; currentScore++) { ------------------ | Branch (636:31): [True: 68, False: 17] ------------------ 637| 360| for (i = 0; i < count; i++) { ------------------ | Branch (637:21): [True: 292, False: 68] ------------------ 638| 292| if (scores[i] == currentScore) { ------------------ | Branch (638:17): [True: 73, False: 219] ------------------ 639| 73| indexToOrderedIndex[orderedIndex] = i; 640| 73| orderedIndex++; 641| 73| } 642| 292| } 643| 68| } 644| 17| free(scores); 645| 17| return TSK_OK; 646| 17|} fs_dir.c:save_inum_named: 561| 16|save_inum_named(TSK_FS_INFO *a_fs, DENT_DINFO *dinfo) { 562| | 563| | /* We finished the dir walk successfully, so reassign 564| | * ownership of the dinfo's list_inum_named to the shared 565| | * list_inum_named in TSK_FS_INFO, under a lock, if 566| | * another thread hasn't already done so. 567| | */ 568| 16| tsk_take_lock(&a_fs->list_inum_named_lock); 569| 16| if (a_fs->list_inum_named == NULL) { ------------------ | Branch (569:9): [True: 16, False: 0] ------------------ 570| 16| a_fs->list_inum_named = dinfo->list_inum_named; 571| 16| } 572| 0| else { 573| 0| tsk_list_free(dinfo->list_inum_named); 574| 0| } 575| 16| dinfo->list_inum_named = NULL; 576| 16| tsk_release_lock(&a_fs->list_inum_named_lock); 577| 16|} fs_dir.c:tsk_fs_dir_copy: 123| 6|{ 124| 6| size_t i; 125| | 126| 6| a_dst_dir->names_used = 0; 127| | 128| | // make sure we got the room 129| 6| if (a_src_dir->names_used > a_dst_dir->names_alloc) { ------------------ | Branch (129:9): [True: 0, False: 6] ------------------ 130| 0| if (tsk_fs_dir_realloc(a_dst_dir, a_src_dir->names_used)) ------------------ | Branch (130:13): [True: 0, False: 0] ------------------ 131| 0| return 1; 132| 0| } 133| | 134| 8| for (i = 0; i < a_src_dir->names_used; i++) { ------------------ | Branch (134:17): [True: 2, False: 6] ------------------ 135| 2| if (tsk_fs_name_copy(&a_dst_dir->names[i], &a_src_dir->names[i])) ------------------ | Branch (135:13): [True: 0, False: 2] ------------------ 136| 0| return 1; 137| 2| } 138| | 139| 6| a_dst_dir->names_used = a_src_dir->names_used; 140| 6| a_dst_dir->addr = a_src_dir->addr; 141| 6| a_dst_dir->seq = a_src_dir->seq; 142| 6| return 0; 143| 6|} fs_dir.c:tsk_fs_dir_add_orphan_dir_meta: 1332| 6|{ 1333| | // populate the fake FS_FILE structure for the "Orphan Directory" 1334| 6| if ((a_fs_dir->fs_file = tsk_fs_file_alloc(a_fs)) == NULL) { ------------------ | Branch (1334:9): [True: 0, False: 6] ------------------ 1335| 0| return 1; 1336| 0| } 1337| | 1338| 6| if ((a_fs_dir->fs_file->meta = ------------------ | Branch (1338:9): [True: 0, False: 6] ------------------ 1339| 6| tsk_fs_meta_alloc(sizeof(TSK_DADDR_T))) == NULL) { 1340| 0| return 1; 1341| 0| } 1342| | 1343| 6| if (tsk_fs_dir_make_orphan_dir_meta(a_fs, a_fs_dir->fs_file->meta)) { ------------------ | Branch (1343:9): [True: 0, False: 6] ------------------ 1344| 0| return 1; 1345| 0| } 1346| 6| return 0; 1347| 6|} fs_dir.c:find_orphan_meta_walk_cb: 1251| 3|{ 1252| 3| FIND_ORPHAN_DATA *data = (FIND_ORPHAN_DATA *) a_ptr; 1253| 3| TSK_FS_INFO *fs = a_fs_file->fs_info; 1254| | 1255| | /* We want only orphans, then check if this 1256| | * inode is in the seen list 1257| | */ 1258| 3| tsk_take_lock(&fs->list_inum_named_lock); 1259| 3| if ((fs->list_inum_named) ------------------ | Branch (1259:9): [True: 3, False: 0] ------------------ 1260| 3| && (tsk_list_find(fs->list_inum_named, a_fs_file->meta->addr))) { ------------------ | Branch (1260:12): [True: 1, False: 2] ------------------ 1261| 1| tsk_release_lock(&fs->list_inum_named_lock); 1262| 1| return TSK_WALK_CONT; 1263| 1| } 1264| 2| tsk_release_lock(&fs->list_inum_named_lock); 1265| | 1266| | // check if we have already added it as an orphan (in a subdirectory) 1267| 2| if (tsk_list_find(data->orphan_subdir_list, a_fs_file->meta->addr)) { ------------------ | Branch (1267:9): [True: 0, False: 2] ------------------ 1268| 0| return TSK_WALK_CONT; 1269| 0| } 1270| | 1271| | // use their name if they have one 1272| 2| if (a_fs_file->meta->name2 != NULL && ------------------ | Branch (1272:9): [True: 2, False: 0] ------------------ 1273| 2| strlen(a_fs_file->meta->name2->name) > 0) { ------------------ | Branch (1273:9): [True: 0, False: 2] ------------------ 1274| 0| strncpy(data->fs_name->name, a_fs_file->meta->name2->name, 1275| 0| data->fs_name->name_size); 1276| 0| } 1277| 2| else { 1278| 2| snprintf(data->fs_name->name, data->fs_name->name_size, 1279| 2| "OrphanFile-%" PRIuINUM, a_fs_file->meta->addr); ------------------ | | 252| 2|#define PRIuINUM PRIu64 ------------------ 1280| 2| } 1281| 2| data->fs_name->meta_addr = a_fs_file->meta->addr; 1282| | /* unalloc MFT entries have their sequence number incremented 1283| | * when they are unallocated. Decrement it in the file name so 1284| | * that it matches the typical situation where the name is one 1285| | * less. */ 1286| 2| data->fs_name->meta_seq = a_fs_file->meta->seq - 1; 1287| 2| data->fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC; 1288| 2| data->fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 1289| | 1290| 2| if (tsk_fs_dir_add(data->fs_dir, data->fs_name)) ------------------ | Branch (1290:9): [True: 0, False: 2] ------------------ 1291| 0| return TSK_WALK_ERROR; 1292| | 1293| | /* FAT file systems spend a lot of time hunting for parent 1294| | * directory addresses, so we put this code in here to save 1295| | * the info when we have it. */ 1296| 2| if (TSK_FS_TYPE_ISFAT(fs->ftype)) { ------------------ | | 843| 2| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:5): [True: 2, False: 0] | | | Branch (843:6): [True: 2, False: 0] | | ------------------ ------------------ 1297| 2| if (fatfs_dir_buf_add((FATFS_INFO *) fs, ------------------ | Branch (1297:13): [True: 0, False: 2] ------------------ 1298| 2| TSK_FS_ORPHANDIR_INUM(fs), a_fs_file->meta->addr)) ------------------ | | 530| 2| (fs_info->last_inum) ------------------ 1299| 0| return TSK_WALK_ERROR; 1300| 2| } 1301| | 1302| | /* Go into directories to mark their contents as "seen" */ 1303| 2| if (a_fs_file->meta->type == TSK_FS_META_TYPE_DIR) { ------------------ | Branch (1303:9): [True: 0, False: 2] ------------------ 1304| | 1305| 0| if (tsk_verbose) ------------------ | Branch (1305:13): [True: 0, False: 0] ------------------ 1306| 0| fprintf(stderr, 1307| 0| "find_orphan_meta_walk_cb: Going into directory %" PRIuINUM 1308| 0| " to mark contents as seen\n", a_fs_file->meta->addr); 1309| | 1310| 0| if (tsk_fs_dir_walk_internal(fs, a_fs_file->meta->addr, ------------------ | Branch (1310:13): [True: 0, False: 0] ------------------ 1311| 0| TSK_FS_DIR_WALK_FLAG_UNALLOC | TSK_FS_DIR_WALK_FLAG_RECURSE 1312| 0| | TSK_FS_DIR_WALK_FLAG_NOORPHAN, load_orphan_dir_walk_cb, 1313| 0| data, 0)) { 1314| 0| tsk_error_errstr2_concat 1315| 0| (" - find_orphan_meta_walk_cb: identifying inodes allocated by file names"); 1316| 0| return TSK_WALK_ERROR; 1317| 0| } 1318| 0| } 1319| | 1320| 2| return TSK_WALK_CONT; 1321| 2|} tsk_fs_file_alloc: 28| 63|{ 29| 63| TSK_FS_FILE *fs_file; 30| | 31| 63| fs_file = (TSK_FS_FILE *) tsk_malloc(sizeof(TSK_FS_FILE)); 32| 63| if (fs_file == NULL) ------------------ | Branch (32:9): [True: 0, False: 63] ------------------ 33| 0| return NULL; 34| 63| fs_file->fs_info = a_fs; 35| 63| fs_file->tag = TSK_FS_FILE_TAG; ------------------ | | 687| 63|#define TSK_FS_FILE_TAG 0x11212212 ------------------ 36| 63| return fs_file; 37| 63|} tsk_fs_file_close: 61| 63|{ 62| 63| if ((a_fs_file == NULL) || (a_fs_file->tag != TSK_FS_FILE_TAG)) ------------------ | | 687| 63|#define TSK_FS_FILE_TAG 0x11212212 ------------------ | Branch (62:9): [True: 0, False: 63] | Branch (62:32): [True: 0, False: 63] ------------------ 63| 0| return; 64| | 65| 63| a_fs_file->tag = 0; 66| | 67| 63| if (a_fs_file->meta) { ------------------ | Branch (67:9): [True: 40, False: 23] ------------------ 68| 40| tsk_fs_meta_close(a_fs_file->meta); 69| 40| a_fs_file->meta = NULL; 70| 40| } 71| 63| if (a_fs_file->name) { ------------------ | Branch (71:9): [True: 0, False: 63] ------------------ 72| 0| tsk_fs_name_free(a_fs_file->name); 73| 0| a_fs_file->name = NULL; 74| 0| } 75| | 76| 63| free(a_fs_file); 77| 63|} tsk_fs_file_open_meta: 101| 28|{ 102| 28| TSK_FS_FILE *fs_file; 103| | 104| 28| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) { ------------------ | | 933| 28|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (104:9): [True: 0, False: 28] | Branch (104:27): [True: 0, False: 28] ------------------ 105| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 106| 0| tsk_error_set_errstr 107| 0| ("tsk_fs_file_open_meta: called with NULL or unallocated structures"); 108| 0| return NULL; 109| 0| } 110| | 111| 28| fs_file = a_fs_file; 112| 28| if (fs_file == NULL) { ------------------ | Branch (112:9): [True: 28, False: 0] ------------------ 113| 28| if ((fs_file = tsk_fs_file_alloc(a_fs)) == NULL) ------------------ | Branch (113:13): [True: 0, False: 28] ------------------ 114| 0| return NULL; 115| 28| } 116| 0| else { 117| | /* if the structure passed has a name structure, free it 118| | * because we won't use it. */ 119| 0| if (fs_file->name) { ------------------ | Branch (119:13): [True: 0, False: 0] ------------------ 120| 0| tsk_fs_name_free(fs_file->name); 121| 0| fs_file->name = NULL; 122| 0| } 123| | 124| | // reset the rest of it 125| 0| tsk_fs_file_reset(fs_file); 126| 0| } 127| | 128| 28| if (a_fs->file_add_meta(a_fs, fs_file, a_addr)) { ------------------ | Branch (128:9): [True: 0, False: 28] ------------------ 129| 0| if (a_fs_file == NULL) ------------------ | Branch (129:13): [True: 0, False: 0] ------------------ 130| 0| tsk_fs_file_close(fs_file); 131| 0| return NULL; 132| 0| } 133| | 134| 28| return fs_file; 135| 28|} tsk_fs_file_attr_get: 283| 40|{ 284| 40| TSK_FS_ATTR_TYPE_ENUM type; 285| 40| TSK_FS_INFO *fs; 286| | 287| 40| if (tsk_fs_file_attr_check(a_fs_file, "tsk_fs_file_attr_get")) ------------------ | Branch (287:9): [True: 0, False: 40] ------------------ 288| 0| return NULL; 289| | 290| | // since they did not give us a type, get the default for the file 291| 40| fs = a_fs_file->fs_info; 292| 40| type = fs->get_default_attr_type(a_fs_file); 293| | 294| 40| return tsk_fs_attrlist_get(a_fs_file->meta->attr, type); 295| 40|} tsk_fs_file_walk: 424| 40|{ 425| 40| const TSK_FS_ATTR *fs_attr; 426| | 427| | // clean up any error messages that are lying around 428| 40| tsk_error_reset(); 429| | 430| | // check the FS_INFO, FS_FILE structures 431| 40| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL) ------------------ | Branch (431:9): [True: 0, False: 40] | Branch (431:32): [True: 0, False: 40] ------------------ 432| 40| || (a_fs_file->fs_info == NULL)) { ------------------ | Branch (432:12): [True: 0, False: 40] ------------------ 433| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 434| 0| tsk_error_set_errstr 435| 0| ("tsk_fs_file_walk: called with NULL pointers"); 436| 0| return 1; 437| 0| } 438| 40| else if ((a_fs_file->fs_info->tag != TSK_FS_INFO_TAG) ------------------ | | 933| 40|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (438:14): [True: 0, False: 40] ------------------ 439| 40| || (a_fs_file->meta->tag != TSK_FS_META_TAG)) { ------------------ | | 445| 40|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (439:12): [True: 0, False: 40] ------------------ 440| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 441| 0| tsk_error_set_errstr 442| 0| ("tsk_fs_file_walk: called with unallocated structures"); 443| 0| return 1; 444| 0| } 445| | 446| 40| if (tsk_verbose) ------------------ | Branch (446:9): [True: 0, False: 40] ------------------ 447| 0| tsk_fprintf(stderr, 448| 0| "tsk_fs_file_walk: Processing file %" PRIuINUM "\n", 449| 0| a_fs_file->meta->addr); 450| | 451| 40| if ((fs_attr = tsk_fs_file_attr_get(a_fs_file)) == NULL) ------------------ | Branch (451:9): [True: 0, False: 40] ------------------ 452| 0| return 1; 453| | 454| 40| return tsk_fs_attr_walk(fs_attr, a_flags, a_action, a_ptr); 455| 40|} fs_file.c:tsk_fs_file_attr_check: 209| 40|{ 210| 40| TSK_FS_INFO *fs; 211| | // check the FS_INFO, FS_FILE structures 212| 40| if ((a_fs_file == NULL) || (a_fs_file->meta == NULL) ------------------ | Branch (212:9): [True: 0, False: 40] | Branch (212:32): [True: 0, False: 40] ------------------ 213| 40| || (a_fs_file->fs_info == NULL)) { ------------------ | Branch (213:12): [True: 0, False: 40] ------------------ 214| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 215| 0| tsk_error_set_errstr("%s: called with NULL pointers", a_func); 216| 0| return 1; 217| 0| } 218| 40| else if (a_fs_file->meta->tag != TSK_FS_META_TAG) { ------------------ | | 445| 40|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (218:14): [True: 0, False: 40] ------------------ 219| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 220| 0| tsk_error_set_errstr("%s: called with unallocated structures", 221| 0| a_func); 222| 0| return 1; 223| 0| } 224| 40| fs = a_fs_file->fs_info; 225| | 226| | // If the attributes haven't been loaded, then load them. 227| 40| if (a_fs_file->meta->attr_state == TSK_FS_META_ATTR_ERROR) { ------------------ | Branch (227:9): [True: 0, False: 40] ------------------ 228| 0| tsk_error_set_errno(TSK_ERR_FS_INODE_COR); ------------------ | | 354| 0|#define TSK_ERR_FS_INODE_COR (TSK_ERR_FS | 9) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 229| 0| tsk_error_set_errstr("%s: called for file with corrupt data", 230| 0| a_func); 231| 0| return 1; 232| 0| } 233| 40| else if ((a_fs_file->meta->attr_state != TSK_FS_META_ATTR_STUDIED) ------------------ | Branch (233:14): [True: 40, False: 0] ------------------ 234| 40| || (a_fs_file->meta->attr == NULL)) { ------------------ | Branch (234:12): [True: 0, False: 0] ------------------ 235| 40| if (fs->load_attrs(a_fs_file)) { ------------------ | Branch (235:13): [True: 0, False: 40] ------------------ 236| 0| return 1; 237| 0| } 238| 40| } 239| 40| return 0; 240| 40|} tsk_fs_meta_alloc: 38| 115|{ 39| 115| TSK_FS_META *fs_meta; 40| | 41| 115| if ((fs_meta = ------------------ | Branch (41:9): [True: 0, False: 115] ------------------ 42| 115| (TSK_FS_META *) tsk_malloc(sizeof(TSK_FS_META))) == NULL) 43| 0| return NULL; 44| | 45| 115| fs_meta->attr_state = TSK_FS_META_ATTR_EMPTY; 46| | 47| 115| if (a_buf_len > 0) { ------------------ | Branch (47:9): [True: 115, False: 0] ------------------ 48| 115| if ((fs_meta->content_ptr = tsk_malloc(a_buf_len)) == NULL) { ------------------ | Branch (48:13): [True: 0, False: 115] ------------------ 49| 0| free(fs_meta); 50| 0| return NULL; 51| 0| } 52| 115| fs_meta->content_len = a_buf_len; 53| 115| fs_meta->reset_content = NULL; 54| 115| } 55| | 56| | // assign the id so we know the structure is still alloc 57| 115| fs_meta->tag = TSK_FS_META_TAG; ------------------ | | 445| 115|#define TSK_FS_META_TAG 0x13524635 ------------------ 58| | 59| 115| return fs_meta; 60| 115|} tsk_fs_meta_close: 99| 115|{ 100| 115| TSK_FS_META_NAME_LIST *fs_name, *fs_name2; 101| | 102| 115| if ((!fs_meta) || (fs_meta->tag != TSK_FS_META_TAG)) ------------------ | | 445| 115|#define TSK_FS_META_TAG 0x13524635 ------------------ | Branch (102:9): [True: 0, False: 115] | Branch (102:23): [True: 0, False: 115] ------------------ 103| 0| return; 104| | 105| | // clear the tag so we know the structure isn't alloc 106| 115| fs_meta->tag = 0; 107| | 108| 115| if (fs_meta->content_ptr) { ------------------ | Branch (108:9): [True: 115, False: 0] ------------------ 109| 115| if (fs_meta->reset_content) { ------------------ | Branch (109:13): [True: 0, False: 115] ------------------ 110| 0| fs_meta->reset_content(fs_meta->content_ptr); 111| 0| } 112| | 113| 115| free((char *) fs_meta->content_ptr); 114| 115| } 115| | 116| 115| fs_meta->content_ptr = NULL; 117| 115| fs_meta->content_len = 0; 118| | 119| 115| if (fs_meta->attr) ------------------ | Branch (119:9): [True: 40, False: 75] ------------------ 120| 40| tsk_fs_attrlist_free(fs_meta->attr); 121| 115| fs_meta->attr = NULL; 122| | 123| 115| free(fs_meta->link); 124| 115| fs_meta->link = NULL; 125| | 126| 115| fs_name = fs_meta->name2; 127| 230| while (fs_name) { ------------------ | Branch (127:12): [True: 115, False: 115] ------------------ 128| 115| fs_name2 = fs_name->next; 129| 115| fs_name->next = NULL; 130| 115| free(fs_name); 131| 115| fs_name = fs_name2; 132| 115| } 133| | 134| 115| free(fs_meta); 135| 115|} tsk_fs_meta_walk: 210| 6|{ 211| 6| if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG)) ------------------ | | 933| 6|#define TSK_FS_INFO_TAG 0x10101010 ------------------ | Branch (211:9): [True: 0, False: 6] | Branch (211:27): [True: 0, False: 6] ------------------ 212| 0| return 1; 213| | 214| 6| return a_fs->inode_walk(a_fs, a_start, a_end, a_flags, a_cb, a_ptr); 215| 6|} tsk_fs_read: 91| 19|{ 92| 19| return tsk_fs_read_decrypt(a_fs, a_off, a_buf, a_len, 0); 93| 19|} tsk_fs_read_decrypt: 107| 19|{ 108| | // do a sanity check on the read bounds, but only if the block 109| | // value has been set. 110| | // note that this could prevent us from viewing the FS slack... 111| 19| if ((a_fs->last_block_act > 0) ------------------ | Branch (111:9): [True: 13, False: 6] ------------------ 112| 19| && ((TSK_DADDR_T) a_off >= ------------------ | Branch (112:12): [True: 0, False: 13] ------------------ 113| 13| ((a_fs->last_block_act + 1) * a_fs->block_size))) { 114| 0| tsk_error_reset(); 115| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 116| 0| if ((TSK_DADDR_T) a_off < ------------------ | Branch (116:13): [True: 0, False: 0] ------------------ 117| 0| ((a_fs->last_block + 1) * a_fs->block_size)) 118| 0| tsk_error_set_errstr 119| 0| ("tsk_fs_read: Offset missing in partial image: %" 120| 0| PRIuDADDR ")", a_off); 121| 0| else 122| 0| tsk_error_set_errstr 123| 0| ("tsk_fs_read: Offset is too large for image: %" PRIuDADDR 124| 0| ")", a_off); 125| 0| return -1; 126| 0| } 127| | 128| | // We need different logic for encrypted file systems 129| 19| if ((a_fs->flags & TSK_FS_INFO_FLAG_ENCRYPTED) && a_fs->block_size) { ------------------ | Branch (129:9): [True: 0, False: 19] | Branch (129:55): [True: 0, False: 0] ------------------ 130| | // If we're reading on block boundaries and a multiple of block 131| | // sizes, we can just decrypt directly to the buffer. 132| 0| if ((a_off % a_fs->block_size == 0) && (a_len % a_fs->block_size == 0)) { ------------------ | Branch (132:13): [True: 0, False: 0] | Branch (132:48): [True: 0, False: 0] ------------------ 133| 0| return tsk_fs_read_block_decrypt(a_fs, a_off / a_fs->block_size, a_buf, a_len, crypto_id); 134| 0| } 135| | 136| | // Since we can only decrypt on block boundaries, we'll need to 137| | // decrypt the blocks and then copy to the output buffer. 138| | 139| | // Starting address needs to be aligned by block size; 140| 0| TSK_OFF_T bit_magic = a_fs->block_size - 1; 141| 0| TSK_OFF_T start = a_off & ~bit_magic; 142| | 143| | // Ending address needs to be rounded up to the nearest 144| | // block boundary. 145| 0| TSK_OFF_T end = (a_off + a_len + bit_magic) & ~bit_magic; 146| 0| TSK_OFF_T len = end - start; 147| | 148| | // Decrypt the blocks to a temp buffer 149| 0| char * temp_buffer = tsk_malloc(len); 150| 0| if (temp_buffer == NULL) { ------------------ | Branch (150:13): [True: 0, False: 0] ------------------ 151| 0| return -1; 152| 0| } 153| | 154| 0| if (tsk_fs_read_block_decrypt(a_fs, start / a_fs->block_size, temp_buffer, ------------------ | Branch (154:13): [True: 0, False: 0] ------------------ 155| 0| len, crypto_id) != len) { 156| 0| free(temp_buffer); 157| 0| return -1; 158| 0| } 159| | 160| | // Copy the decrypted data 161| 0| memcpy(a_buf, temp_buffer + a_off - start, a_len); 162| | 163| 0| free(temp_buffer); 164| | 165| 0| return a_len; 166| 0| } 167| | 168| 19| if (((a_fs->block_pre_size) || (a_fs->block_post_size)) ------------------ | Branch (168:10): [True: 0, False: 19] | Branch (168:36): [True: 0, False: 19] ------------------ 169| 19| && (a_fs->block_size)) { ------------------ | Branch (169:12): [True: 0, False: 0] ------------------ 170| 0| return fs_prepost_read(a_fs, a_off, a_buf, a_len); 171| 0| } 172| 19| else { 173| 19| return tsk_img_read(a_fs->img_info, a_off + a_fs->offset, a_buf, 174| 19| a_len); 175| 19| } 176| 19|} tsk_fs_read_block: 193| 3.62k|{ 194| 3.62k| return tsk_fs_read_block_decrypt(a_fs, a_addr, a_buf, a_len, 0); 195| 3.62k|} tsk_fs_read_block_decrypt: 213| 4.39k|{ 214| 4.39k| if (a_len % a_fs->block_size) { ------------------ | Branch (214:9): [True: 0, False: 4.39k] ------------------ 215| 0| tsk_error_reset(); 216| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 217| 0| tsk_error_set_errstr("tsk_fs_read_block: length %" PRIuSIZE "" 218| 0| " not a multiple of %d", a_len, a_fs->block_size); 219| 0| return -1; 220| 0| } 221| | 222| 4.39k| if (a_addr > a_fs->last_block_act) { ------------------ | Branch (222:9): [True: 0, False: 4.39k] ------------------ 223| 0| tsk_error_reset(); 224| 0| tsk_error_set_errno(TSK_ERR_FS_READ); ------------------ | | 349| 0|#define TSK_ERR_FS_READ (TSK_ERR_FS | 4) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 225| 0| if (a_addr <= a_fs->last_block) ------------------ | Branch (225:13): [True: 0, False: 0] ------------------ 226| 0| tsk_error_set_errstr 227| 0| ("tsk_fs_read_block: Address missing in partial image: %" 228| 0| PRIuDADDR ")", a_addr); 229| 0| else 230| 0| tsk_error_set_errstr 231| 0| ("tsk_fs_read_block: Address is too large for image: %" 232| 0| PRIuDADDR ")", a_addr); 233| 0| return -1; 234| 0| } 235| | 236| 4.39k| ssize_t ret_len; 237| | 238| 4.39k| if ((a_fs->block_pre_size == 0) && (a_fs->block_post_size == 0)) { ------------------ | Branch (238:9): [True: 4.39k, False: 0] | Branch (238:40): [True: 4.39k, False: 0] ------------------ 239| 4.39k| TSK_OFF_T off = 240| 4.39k| a_fs->offset + (TSK_OFF_T) (a_addr) * a_fs->block_size; 241| 4.39k| ret_len = tsk_img_read(a_fs->img_info, off, a_buf, a_len); 242| 4.39k| } 243| 0| else { 244| 0| TSK_OFF_T off = (TSK_OFF_T) (a_addr) * a_fs->block_size; 245| 0| ret_len = fs_prepost_read(a_fs, off, a_buf, a_len); 246| 0| } 247| | 248| 4.39k| if ((a_fs->flags & TSK_FS_INFO_FLAG_ENCRYPTED) ------------------ | Branch (248:9): [True: 0, False: 4.39k] ------------------ 249| 4.39k| && ret_len > 0 ------------------ | Branch (249:12): [True: 0, False: 0] ------------------ 250| 4.39k| && a_fs->decrypt_block) { ------------------ | Branch (250:12): [True: 0, False: 0] ------------------ 251| 0| TSK_DADDR_T i; 252| 0| for (i = 0; i < a_len / a_fs->block_size; i++) { ------------------ | Branch (252:21): [True: 0, False: 0] ------------------ 253| 0| a_fs->decrypt_block(a_fs, crypto_id + i, 254| 0| a_buf + (a_fs->block_size * i)); 255| 0| } 256| 0| } 257| | 258| 4.39k| return ret_len; 259| 4.39k|} tsk_fs_name_alloc: 44| 62|{ 45| 62| TSK_FS_NAME *fs_name; 46| 62| fs_name = (TSK_FS_NAME *) tsk_malloc(sizeof(*fs_name)); 47| 62| if (fs_name == NULL) ------------------ | Branch (47:9): [True: 0, False: 62] ------------------ 48| 0| return NULL; 49| | 50| 62| fs_name->name = (char *) tsk_malloc(norm_namelen + 1); 51| 62| if (fs_name->name == NULL) { ------------------ | Branch (51:9): [True: 0, False: 62] ------------------ 52| 0| free(fs_name); 53| 0| return NULL; 54| 0| } 55| 62| fs_name->name_size = norm_namelen; 56| | 57| 62| fs_name->flags = 0; 58| | 59| 62| fs_name->shrt_name_size = shrt_namelen; 60| 62| if (shrt_namelen == 0) { ------------------ | Branch (60:9): [True: 34, False: 28] ------------------ 61| 34| fs_name->shrt_name = NULL; 62| 34| } 63| 28| else { 64| 28| fs_name->shrt_name = (char *) tsk_malloc(shrt_namelen + 1); 65| 28| if (fs_name->shrt_name == NULL) { ------------------ | Branch (65:13): [True: 0, False: 28] ------------------ 66| 0| free(fs_name->name); 67| 0| free(fs_name); 68| 0| return NULL; 69| 0| } 70| 28| } 71| | 72| 62| fs_name->type = TSK_FS_NAME_TYPE_UNDEF; 73| 62| fs_name->tag = TSK_FS_NAME_TAG; ------------------ | | 594| 62|#define TSK_FS_NAME_TAG 0x23147869 ------------------ 74| 62| return fs_name; 75| 62|} tsk_fs_name_free: 130| 62|{ 131| 62| if ((!fs_name) || (fs_name->tag != TSK_FS_NAME_TAG)) ------------------ | | 594| 62|#define TSK_FS_NAME_TAG 0x23147869 ------------------ | Branch (131:9): [True: 0, False: 62] | Branch (131:23): [True: 0, False: 62] ------------------ 132| 0| return; 133| | 134| 62| free(fs_name->name); 135| 62| fs_name->name = NULL; 136| | 137| 62| free(fs_name->shrt_name); 138| 62| fs_name->shrt_name = NULL; 139| | 140| 62| free(fs_name); 141| 62|} tsk_fs_name_copy: 153| 123|{ 154| 123| if ((a_fs_name_to == NULL) || (a_fs_name_from == NULL)) ------------------ | Branch (154:9): [True: 0, False: 123] | Branch (154:35): [True: 0, False: 123] ------------------ 155| 0| return 1; 156| | 157| | /* If the source has a full name, copy it */ 158| 123| if (a_fs_name_from->name) { ------------------ | Branch (158:9): [True: 123, False: 0] ------------------ 159| 123| size_t name_len = strlen(a_fs_name_from->name); 160| | 161| | // make sure there is enough space 162| 123| if (name_len >= a_fs_name_to->name_size) { ------------------ | Branch (162:13): [True: 123, False: 0] ------------------ 163| 123| char * to_name = 164| 123| (char *) tsk_realloc(a_fs_name_to->name, 165| 123| name_len + 16); 166| 123| if (to_name == NULL) ------------------ | Branch (166:17): [True: 0, False: 123] ------------------ 167| 0| return 1; 168| | 169| 123| a_fs_name_to->name = to_name; 170| 123| a_fs_name_to->name_size = name_len + 16; 171| 123| } 172| 123| strncpy(a_fs_name_to->name, a_fs_name_from->name, 173| 123| name_len); 174| 123| a_fs_name_to->name[name_len] = 0; 175| 123| } 176| 0| else { 177| 0| if (a_fs_name_to->name_size > 0) ------------------ | Branch (177:13): [True: 0, False: 0] ------------------ 178| 0| a_fs_name_to->name[0] = '\0'; 179| 0| else 180| 0| a_fs_name_to->name = NULL; 181| 0| } 182| | 183| | // copy the short name, if one exists 184| 123| if (a_fs_name_from->shrt_name) { ------------------ | Branch (184:9): [True: 7, False: 116] ------------------ 185| 7| if (strlen(a_fs_name_from->shrt_name) >= ------------------ | Branch (185:13): [True: 7, False: 0] ------------------ 186| 7| a_fs_name_to->shrt_name_size) { 187| 7| a_fs_name_to->shrt_name_size = 188| 7| strlen(a_fs_name_from->shrt_name) + 16; 189| 7| a_fs_name_to->shrt_name = 190| 7| (char *) tsk_realloc(a_fs_name_to->shrt_name, 191| 7| a_fs_name_to->shrt_name_size); 192| 7| if (a_fs_name_to->shrt_name == NULL) ------------------ | Branch (192:17): [True: 0, False: 7] ------------------ 193| 0| return 1; 194| 7| } 195| 7| strncpy(a_fs_name_to->shrt_name, a_fs_name_from->shrt_name, 196| 7| a_fs_name_to->shrt_name_size); 197| 7| } 198| 116| else { 199| 116| if (a_fs_name_to->shrt_name_size > 0) ------------------ | Branch (199:13): [True: 0, False: 116] ------------------ 200| 0| a_fs_name_to->shrt_name[0] = '\0'; 201| 116| else 202| 116| a_fs_name_to->shrt_name = NULL; 203| 116| } 204| | 205| 123| a_fs_name_to->meta_addr = a_fs_name_from->meta_addr; 206| 123| a_fs_name_to->meta_seq = a_fs_name_from->meta_seq; 207| 123| a_fs_name_to->par_addr = a_fs_name_from->par_addr; 208| 123| a_fs_name_to->par_seq = a_fs_name_from->par_seq; 209| 123| a_fs_name_to->type = a_fs_name_from->type; 210| 123| a_fs_name_to->flags = a_fs_name_from->flags; 211| 123| a_fs_name_to->date_added = a_fs_name_from->date_added; 212| | 213| 123| return 0; 214| 123|} tsk_fs_open_img: 108| 6|{ 109| 6| return tsk_fs_open_img_decrypt(a_img_info, a_offset, a_ftype, ""); 110| 6|} tsk_fs_open_img_decrypt: 128| 6|{ 129| 6| TSK_FS_INFO *fs_info; 130| | 131| 6| const struct { 132| 6| char* name; 133| 6| TSK_FS_INFO* (*open)(TSK_IMG_INFO*, TSK_OFF_T, 134| 6| TSK_FS_TYPE_ENUM, uint8_t); 135| | // This type should be the _DETECT version because it used 136| | // during autodetection 137| 6| TSK_FS_TYPE_ENUM type; 138| 6| } FS_OPENERS[] = { 139| 6| { "NTFS", ntfs_open, TSK_FS_TYPE_NTFS_DETECT }, 140| 6| { "FAT", fatfs_open, TSK_FS_TYPE_FAT_DETECT }, 141| 6| { "EXT2/3/4", ext2fs_open, TSK_FS_TYPE_EXT_DETECT }, 142| 6| { "UFS", ffs_open, TSK_FS_TYPE_FFS_DETECT }, 143| 6| { "YAFFS2", yaffs2_open, TSK_FS_TYPE_YAFFS2_DETECT }, 144| 6|#if TSK_USE_HFS 145| 6| { "HFS", hfs_open, TSK_FS_TYPE_HFS_DETECT }, 146| 6|#endif 147| 6| { "ISO9660", iso9660_open, TSK_FS_TYPE_ISO9660_DETECT }, 148| 6| { "APFS", apfs_open_auto_detect, TSK_FS_TYPE_APFS_DETECT } 149| 6| }; 150| 6| if (a_img_info == NULL) { ------------------ | Branch (150:9): [True: 0, False: 6] ------------------ 151| 0| tsk_error_reset(); 152| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 153| 0| tsk_error_set_errstr("tsk_fs_open_img: Null image handle"); 154| 0| return NULL; 155| 0| } 156| | 157| | /* If the image is type IMG_DIR_INFO, then the file system is 158| | * automatically the logical directory file system type. It is an 159| | * error to try to use any other file system type in that case. 160| | */ 161| 6| if (a_img_info->itype == TSK_IMG_TYPE_LOGICAL) { ------------------ | Branch (161:6): [True: 0, False: 6] ------------------ 162| 0| if (!(a_ftype == TSK_FS_TYPE_DETECT || a_ftype == TSK_FS_TYPE_LOGICAL)) { ------------------ | Branch (162:9): [True: 0, False: 0] | Branch (162:42): [True: 0, False: 0] ------------------ 163| 0| tsk_error_reset(); 164| 0| tsk_error_set_errno(TSK_ERR_FS_ARG); ------------------ | | 351| 0|#define TSK_ERR_FS_ARG (TSK_ERR_FS | 6) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 165| 0| tsk_error_set_errstr("tsk_fs_open_img: Incompatable file system type given for logical file image"); 166| 0| return NULL; 167| 0| } 168| | 169| 0| return logical_fs_open(a_img_info); 170| 0| } 171| | 172| | /* We will try different file systems ... 173| | * We need to try all of them in case more than one matches 174| | */ 175| 6| if (a_ftype == TSK_FS_TYPE_DETECT) { ------------------ | Branch (175:9): [True: 0, False: 6] ------------------ 176| 0| unsigned long i; 177| 0| const char *name_first = ""; 178| 0| TSK_FS_INFO *fs_first = NULL; 179| | 180| 0| if (tsk_verbose) ------------------ | Branch (180:13): [True: 0, False: 0] ------------------ 181| 0| tsk_fprintf(stderr, 182| 0| "fsopen: Auto detection mode at offset %" PRIdOFF "\n", 183| 0| a_offset); 184| | 185| 0| for (i = 0; i < sizeof(FS_OPENERS)/sizeof(FS_OPENERS[0]); ++i) { ------------------ | Branch (185:21): [True: 0, False: 0] ------------------ 186| 0| if ((fs_info = FS_OPENERS[i].open( ------------------ | Branch (186:17): [True: 0, False: 0] ------------------ 187| 0| a_img_info, a_offset, FS_OPENERS[i].type, 1)) != NULL) { 188| | // fs opens as type i 189| 0| if (fs_first == NULL) { ------------------ | Branch (189:21): [True: 0, False: 0] ------------------ 190| | // first success opening fs 191| 0| name_first = FS_OPENERS[i].name; 192| 0| fs_first = fs_info; 193| 0| } 194| 0| else { 195| | // second success opening fs, which means we 196| | // cannot autodetect the fs type and must give up 197| 0| fs_first->close(fs_first); 198| 0| fs_info->close(fs_info); 199| 0| tsk_error_reset(); 200| 0| tsk_error_set_errno(TSK_ERR_FS_MULTTYPE); ------------------ | | 365| 0|#define TSK_ERR_FS_MULTTYPE (TSK_ERR_FS | 20) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 201| 0| tsk_error_set_errstr( 202| 0| "%s or %s", FS_OPENERS[i].name, name_first); 203| 0| return NULL; 204| 0| } 205| 0| } 206| 0| else { 207| | // fs does not open as type i 208| 0| tsk_error_reset(); 209| 0| } 210| 0| } 211| | 212| 0| if (fs_first == NULL) { ------------------ | Branch (212:13): [True: 0, False: 0] ------------------ 213| 0| tsk_error_reset(); 214| | 215| | // If we're still at the start of the image and haven't identified any volume systems or file 216| | // systems, check if the image type is a known unsupported type. 217| 0| int unsupportedSignatureFound = 0; 218| 0| if (a_offset == 0) { ------------------ | Branch (218:17): [True: 0, False: 0] ------------------ 219| 0| char * imageType = detectUnsupportedImageType(a_img_info); 220| 0| if (imageType != NULL) { ------------------ | Branch (220:21): [True: 0, False: 0] ------------------ 221| 0| unsupportedSignatureFound = 1; 222| 0| tsk_error_reset(); 223| 0| tsk_error_set_errno(TSK_ERR_IMG_UNSUPTYPE); ------------------ | | 314| 0|#define TSK_ERR_IMG_UNSUPTYPE (TSK_ERR_IMG | 3) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 224| 0| tsk_error_set_errstr("%s", imageType); 225| 0| free(imageType); 226| 0| } 227| 0| } 228| | 229| 0| if (!unsupportedSignatureFound) { ------------------ | Branch (229:17): [True: 0, False: 0] ------------------ 230| | // Check if the file system appears to be encrypted 231| 0| encryption_detected_result* result = detectVolumeEncryption(a_img_info, a_offset); 232| 0| if (result != NULL) { ------------------ | Branch (232:21): [True: 0, False: 0] ------------------ 233| 0| if (result->encryptionType == ENCRYPTION_DETECTED_SIGNATURE) { ------------------ | Branch (233:25): [True: 0, False: 0] ------------------ 234| 0| tsk_error_set_errno(TSK_ERR_FS_ENCRYPTED); ------------------ | | 363| 0|#define TSK_ERR_FS_ENCRYPTED (TSK_ERR_FS | 18) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 235| 0| tsk_error_set_errstr("%s", result->desc); 236| 0| } 237| 0| else if (result->encryptionType == ENCRYPTION_DETECTED_ENTROPY) { ------------------ | Branch (237:30): [True: 0, False: 0] ------------------ 238| 0| tsk_error_set_errno(TSK_ERR_FS_POSSIBLY_ENCRYPTED); ------------------ | | 364| 0|#define TSK_ERR_FS_POSSIBLY_ENCRYPTED (TSK_ERR_FS | 19) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 239| 0| tsk_error_set_errstr("%s", result->desc); 240| 0| } 241| 0| else { 242| 0| tsk_error_set_errno(TSK_ERR_FS_UNKTYPE); ------------------ | | 345| 0|#define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 243| 0| } 244| 0| free(result); 245| 0| result = NULL; 246| 0| } 247| 0| else { 248| 0| tsk_error_set_errno(TSK_ERR_FS_UNKTYPE); ------------------ | | 345| 0|#define TSK_ERR_FS_UNKTYPE (TSK_ERR_FS | 0) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 249| 0| } 250| 0| } 251| 0| } 252| 0| return fs_first; 253| 0| } 254| 6| else if (TSK_FS_TYPE_ISNTFS(a_ftype)) { ------------------ | | 836| 6| (((ftype) & TSK_FS_TYPE_NTFS_DETECT)?1:0) | | ------------------ | | | Branch (836:5): [True: 0, False: 6] | | | Branch (836:6): [True: 0, False: 6] | | ------------------ ------------------ 255| 0| return ntfs_open(a_img_info, a_offset, a_ftype, 0); 256| 0| } 257| 6| else if (TSK_FS_TYPE_ISFAT(a_ftype)) { ------------------ | | 843| 6| (((ftype) & TSK_FS_TYPE_FAT_DETECT)?1:0) | | ------------------ | | | Branch (843:5): [True: 6, False: 0] | | | Branch (843:6): [True: 6, False: 0] | | ------------------ ------------------ 258| 6| return fatfs_open(a_img_info, a_offset, a_ftype, 0); 259| 6| } 260| 0| else if (TSK_FS_TYPE_ISFFS(a_ftype)) { ------------------ | | 850| 0| (((ftype) & TSK_FS_TYPE_FFS_DETECT)?1:0) | | ------------------ | | | Branch (850:5): [True: 0, False: 0] | | | Branch (850:6): [True: 0, False: 0] | | ------------------ ------------------ 261| 0| return ffs_open(a_img_info, a_offset, a_ftype, 0); 262| 0| } 263| 0| else if (TSK_FS_TYPE_ISEXT(a_ftype)) { ------------------ | | 857| 0| (((ftype) & TSK_FS_TYPE_EXT_DETECT)?1:0) | | ------------------ | | | Branch (857:5): [True: 0, False: 0] | | | Branch (857:6): [True: 0, False: 0] | | ------------------ ------------------ 264| 0| return ext2fs_open(a_img_info, a_offset, a_ftype, 0); 265| 0| } 266| 0| else if (TSK_FS_TYPE_ISHFS(a_ftype)) { ------------------ | | 871| 0| (((ftype) & TSK_FS_TYPE_HFS_DETECT)?1:0) | | ------------------ | | | Branch (871:5): [True: 0, False: 0] | | | Branch (871:6): [True: 0, False: 0] | | ------------------ ------------------ 267| 0| return hfs_open(a_img_info, a_offset, a_ftype, 0); 268| 0| } 269| 0| else if (TSK_FS_TYPE_ISISO9660(a_ftype)) { ------------------ | | 864| 0| (((ftype) & TSK_FS_TYPE_ISO9660_DETECT)?1:0) | | ------------------ | | | Branch (864:5): [True: 0, False: 0] | | | Branch (864:6): [True: 0, False: 0] | | ------------------ ------------------ 270| 0| return iso9660_open(a_img_info, a_offset, a_ftype, 0); 271| 0| } 272| 0| else if (TSK_FS_TYPE_ISRAW(a_ftype)) { ------------------ | | 899| 0| (((ftype) & TSK_FS_TYPE_RAW_DETECT)?1:0) | | ------------------ | | | Branch (899:5): [True: 0, False: 0] | | | Branch (899:6): [True: 0, False: 0] | | ------------------ ------------------ 273| 0| return rawfs_open(a_img_info, a_offset); 274| 0| } 275| 0| else if (TSK_FS_TYPE_ISSWAP(a_ftype)) { ------------------ | | 878| 0| (((ftype) & TSK_FS_TYPE_SWAP_DETECT)?1:0) | | ------------------ | | | Branch (878:5): [True: 0, False: 0] | | | Branch (878:6): [True: 0, False: 0] | | ------------------ ------------------ 276| 0| return swapfs_open(a_img_info, a_offset); 277| 0| } 278| 0| else if (TSK_FS_TYPE_ISYAFFS2(a_ftype)) { ------------------ | | 885| 0| (((ftype) & TSK_FS_TYPE_YAFFS2_DETECT)?1:0) | | ------------------ | | | Branch (885:5): [True: 0, False: 0] | | | Branch (885:6): [True: 0, False: 0] | | ------------------ ------------------ 279| 0| return yaffs2_open(a_img_info, a_offset, a_ftype, 0); 280| 0| } 281| 0| else if (TSK_FS_TYPE_ISAPFS(a_ftype)) { ------------------ | | 906| 0| (((ftype) & TSK_FS_TYPE_APFS_DETECT)?1:0) | | ------------------ | | | Branch (906:5): [True: 0, False: 0] | | | Branch (906:6): [True: 0, False: 0] | | ------------------ ------------------ 282| 0| return apfs_open(a_img_info, a_offset, a_ftype, a_pass); 283| 0| } 284| 0| tsk_error_reset(); 285| 0| tsk_error_set_errno(TSK_ERR_FS_UNSUPTYPE); ------------------ | | 346| 0|#define TSK_ERR_FS_UNSUPTYPE (TSK_ERR_FS | 1) | | ------------------ | | | | 301| 0|#define TSK_ERR_FS 0x08000000 | | ------------------ ------------------ 286| 0| tsk_error_set_errstr("%X", (int) a_ftype); 287| 0| return NULL; 288| 6|} tsk_fs_malloc: 311| 6|{ 312| 6| TSK_FS_INFO *fs_info; 313| 6| if ((fs_info = (TSK_FS_INFO *) tsk_malloc(a_len)) == NULL) ------------------ | Branch (313:9): [True: 0, False: 6] ------------------ 314| 0| return NULL; 315| 6| tsk_init_lock(&fs_info->list_inum_named_lock); 316| 6| tsk_init_lock(&fs_info->orphan_dir_lock); 317| | 318| 6| fs_info->list_inum_named = NULL; 319| | 320| 6| return fs_info; 321| 6|} tsk_fs_free: 328| 6|{ 329| 6| if (a_fs_info->list_inum_named) { ------------------ | Branch (329:9): [True: 1, False: 5] ------------------ 330| 1| tsk_list_free(a_fs_info->list_inum_named); 331| 1| a_fs_info->list_inum_named = NULL; 332| 1| } 333| | 334| | /* we should probably get the lock, but we're 335| | * about to kill the entire object so there are 336| | * bigger problems if another thread is still 337| | * using the fs */ 338| 6| if (a_fs_info->orphan_dir) { ------------------ | Branch (338:9): [True: 6, False: 0] ------------------ 339| 6| tsk_fs_dir_close(a_fs_info->orphan_dir); 340| 6| a_fs_info->orphan_dir = NULL; 341| 6| } 342| | 343| | 344| 6| tsk_deinit_lock(&a_fs_info->list_inum_named_lock); 345| 6| tsk_deinit_lock(&a_fs_info->orphan_dir_lock); 346| | 347| 6| free(a_fs_info); 348| 6|} tsk_img_read: 60| 4.41k|{ 61| 4.41k|#define CACHE_AGE 1000 62| 4.41k| ssize_t read_count = 0; 63| 4.41k| int cache_index = 0; 64| 4.41k| int cache_next = 0; // index to lowest age cache (to use next) 65| 4.41k| size_t len2 = 0; 66| | 67| 4.41k| if (a_img_info == NULL) { ------------------ | Branch (67:9): [True: 0, False: 4.41k] ------------------ 68| 0| tsk_error_reset(); 69| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 70| 0| tsk_error_set_errstr("tsk_img_read: a_img_info: NULL"); 71| 0| return -1; 72| 0| } 73| | 74| | // Do not allow a_buf to be NULL. 75| 4.41k| if (a_buf == NULL) { ------------------ | Branch (75:9): [True: 0, False: 4.41k] ------------------ 76| 0| tsk_error_reset(); 77| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 78| 0| tsk_error_set_errstr("tsk_img_read: a_buf: NULL"); 79| 0| return -1; 80| 0| } 81| | 82| | // The function cannot handle negative offsets. 83| 4.41k| if (a_off < 0) { ------------------ | Branch (83:9): [True: 0, False: 4.41k] ------------------ 84| 0| tsk_error_reset(); 85| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 86| 0| tsk_error_set_errstr("tsk_img_read: a_off: %" PRIdOFF, a_off); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 87| 0| return -1; 88| 0| } 89| | 90| | // Protect a_off against overflowing when a_len is added since TSK_OFF_T 91| | // maps to an int64 we prefer it over size_t although likely checking 92| | // for ( a_len > SSIZE_MAX ) is better but the code does not seem to 93| | // use that approach. 94| | 95| 4.41k| if ((TSK_OFF_T) a_len < 0) { ------------------ | Branch (95:9): [True: 0, False: 4.41k] ------------------ 96| 0| tsk_error_reset(); 97| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 98| 0| tsk_error_set_errstr("tsk_img_read: a_len: %zd", a_len); 99| 0| return -1; 100| 0| } 101| | 102| | /* cache_lock is used for both the cache in IMG_INFO and 103| | * the shared variables in the img type specific INFO structs. 104| | * grab it now so that it is held before any reads. 105| | */ 106| 4.41k| tsk_take_lock(&(a_img_info->cache_lock)); 107| | 108| | // if they ask for more than the cache length, skip the cache 109| 4.41k| if ((a_len + (a_off % 512)) > TSK_IMG_INFO_CACHE_LEN) { ------------------ | | 85| 4.41k|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ | Branch (109:9): [True: 0, False: 4.41k] ------------------ 110| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 111| 0| tsk_release_lock(&(a_img_info->cache_lock)); 112| 0| return read_count; 113| 0| } 114| | 115| | // TODO: why not just return 0 here (and be POSIX compliant)? 116| | // and why not check earlier for this condition? 117| 4.41k| if (a_off >= a_img_info->size) { ------------------ | Branch (117:9): [True: 0, False: 4.41k] ------------------ 118| 0| tsk_release_lock(&(a_img_info->cache_lock)); 119| 0| tsk_error_reset(); 120| 0| tsk_error_set_errno(TSK_ERR_IMG_READ_OFF); ------------------ | | 319| 0|#define TSK_ERR_IMG_READ_OFF (TSK_ERR_IMG | 8) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 121| 0| tsk_error_set_errstr("tsk_img_read - %" PRIdOFF, a_off); ------------------ | | 269| 0|#define PRIdOFF PRId64 ------------------ 122| 0| return -1; 123| 0| } 124| | 125| | /* See if the requested length is going to be too long. 126| | * we'll use this length when checking the cache. */ 127| 4.41k| len2 = a_len; 128| | 129| | // Protect against INT64_MAX + INT64_MAX > value 130| 4.41k| if (((TSK_OFF_T) len2 > a_img_info->size) ------------------ | Branch (130:9): [True: 0, False: 4.41k] ------------------ 131| 4.41k| || (a_off >= (a_img_info->size - (TSK_OFF_T)len2))) { ------------------ | Branch (131:12): [True: 6, False: 4.40k] ------------------ 132| 6| len2 = (size_t) (a_img_info->size - a_off); 133| 6| } 134| | 135| | // check if it is in the cache 136| 4.41k| for (cache_index = 0; 137| 145k| cache_index < TSK_IMG_INFO_CACHE_NUM; cache_index++) { ------------------ | | 84| 145k|#define TSK_IMG_INFO_CACHE_NUM 32 ------------------ | Branch (137:9): [True: 141k, False: 4.41k] ------------------ 138| | 139| | // Look into the in-use cache entries 140| 141k| if (a_img_info->cache_len[cache_index] > 0) { ------------------ | Branch (140:13): [True: 42.2k, False: 98.8k] ------------------ 141| | 142| | // the read_count check makes sure we don't go back in after data was read 143| 42.2k| if ((read_count == 0) ------------------ | Branch (143:17): [True: 19.2k, False: 23.0k] ------------------ 144| 42.2k| && (a_img_info->cache_off[cache_index] <= a_off) ------------------ | Branch (144:20): [True: 4.79k, False: 14.4k] ------------------ 145| 42.2k| && (a_img_info->cache_off[cache_index] + ------------------ | Branch (145:20): [True: 4.35k, False: 444] ------------------ 146| 4.79k| a_img_info->cache_len[cache_index] >= a_off + len2)) { 147| | 148| | /* 149| | if (tsk_verbose) 150| | fprintf(stderr, 151| | "tsk_img_read: Read found in cache %d\n", cache_index ); 152| | */ 153| | 154| | // We found it... 155| 4.35k| memcpy(a_buf, 156| 4.35k| &a_img_info->cache[cache_index][a_off - 157| 4.35k| a_img_info->cache_off[cache_index]], len2); 158| 4.35k| read_count = (ssize_t) len2; 159| | 160| | // reset its "age" since it was useful 161| 4.35k| a_img_info->cache_age[cache_index] = CACHE_AGE; ------------------ | | 61| 4.35k|#define CACHE_AGE 1000 ------------------ 162| | 163| | // we don't break out of the loop so that we update all ages 164| 4.35k| } 165| 37.9k| else { 166| | /* decrease its "age" since it was not useful. 167| | * We don't let used ones go below 1 so that they are not 168| | * confused with entries that have never been used. */ 169| 37.9k| a_img_info->cache_age[cache_index]--; 170| | 171| | // see if this is the most eligible replacement 172| 37.9k| if ((a_img_info->cache_len[cache_next] > 0) ------------------ | Branch (172:21): [True: 0, False: 37.9k] ------------------ 173| 37.9k| && (a_img_info->cache_age[cache_index] < ------------------ | Branch (173:24): [True: 0, False: 0] ------------------ 174| 0| a_img_info->cache_age[cache_next])) 175| 0| cache_next = cache_index; 176| 37.9k| } 177| 42.2k| } 178| 98.8k| else { 179| 98.8k| cache_next = cache_index; 180| 98.8k| } 181| 141k| } 182| | 183| | // if we didn't find it, then load it into the cache_next entry 184| 4.41k| if (read_count == 0) { ------------------ | Branch (184:9): [True: 60, False: 4.35k] ------------------ 185| 60| size_t read_size = 0; 186| | 187| | // round the offset down to a sector boundary 188| 60| a_img_info->cache_off[cache_next] = (a_off / 512) * 512; 189| | 190| | /* 191| | if (tsk_verbose) 192| | fprintf(stderr, 193| | "tsk_img_read: Loading data into cache %d (%" PRIdOFF 194| | ")\n", cache_next, a_img_info->cache_off[cache_next]); 195| | */ 196| | 197| | // Read a full cache block or the remaining data. 198| 60| read_size = TSK_IMG_INFO_CACHE_LEN; ------------------ | | 85| 60|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ 199| | 200| 60| if ((a_img_info->cache_off[cache_next] + (TSK_OFF_T)read_size) > ------------------ | Branch (200:13): [True: 4, False: 56] ------------------ 201| 60| a_img_info->size) { 202| 4| read_size = 203| 4| (size_t) (a_img_info->size - 204| 4| a_img_info->cache_off[cache_next]); 205| 4| } 206| | 207| 60| read_count = a_img_info->read(a_img_info, 208| 60| a_img_info->cache_off[cache_next], 209| 60| a_img_info->cache[cache_next], read_size); 210| | 211| | // if no error, then set the variables and copy the data 212| | // Although a read_count of -1 indicates an error, 213| | // since read_count is used in the calculation it may not be negative. 214| | // Also it does not make sense to copy data when the read_count is 0. 215| 60| if (read_count > 0) { ------------------ | Branch (215:13): [True: 60, False: 0] ------------------ 216| | 217| 60| TSK_OFF_T rel_off = 0; 218| 60| a_img_info->cache_age[cache_next] = CACHE_AGE; ------------------ | | 61| 60|#define CACHE_AGE 1000 ------------------ 219| 60| a_img_info->cache_len[cache_next] = read_count; 220| | 221| | // Determine the offset relative to the start of the cached data. 222| 60| rel_off = a_off - a_img_info->cache_off[cache_next]; 223| | 224| | // Make sure we were able to read sufficient data into the cache. 225| 60| if (rel_off > (TSK_OFF_T) read_count) { ------------------ | Branch (225:17): [True: 0, False: 60] ------------------ 226| 0| len2 = 0; 227| 0| } 228| | // Make sure not to copy more than is available in the cache. 229| 60| else if ((rel_off + (TSK_OFF_T) len2) > (TSK_OFF_T) read_count) { ------------------ | Branch (229:22): [True: 0, False: 60] ------------------ 230| 0| len2 = (size_t) (read_count - rel_off); 231| 0| } 232| | // Only copy data when we have something to copy. 233| 60| if (len2 > 0) { ------------------ | Branch (233:17): [True: 60, False: 0] ------------------ 234| 60| memcpy(a_buf, &(a_img_info->cache[cache_next][rel_off]), len2); 235| 60| } 236| 60| read_count = (ssize_t) len2; 237| 60| } 238| 0| else { 239| 0| a_img_info->cache_len[cache_next] = 0; 240| 0| a_img_info->cache_age[cache_next] = 0; 241| 0| a_img_info->cache_off[cache_next] = 0; 242| | 243| | // Something went wrong so let's try skipping the cache 244| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 245| 0| } 246| 60| } 247| | 248| 4.41k| tsk_release_lock(&(a_img_info->cache_lock)); 249| 4.41k| return read_count; 250| 4.41k|} LLVMFuzzerTestOneInput: 25| 6|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 26| 6| TSK_IMG_INFO *img; 27| 6| TSK_FS_INFO *fs; 28| | 29| 6| img = mem_open(data, size); 30| 6| if (img == nullptr) ------------------ | Branch (30:7): [True: 0, False: 6] ------------------ 31| 0| return 0; 32| | 33| 6| fs = tsk_fs_open_img(img, 0, FSTYPE); 34| 6| if (fs != nullptr) { ------------------ | Branch (34:7): [True: 6, False: 0] ------------------ 35| 6| tsk_fs_fls(fs, TSK_FS_FLS_FULL, fs->root_inum, TSK_FS_DIR_WALK_FLAG_RECURSE, 36| 6| nullptr, 0); 37| | 38| 6| fs->close(fs); 39| 6| } 40| | 41| 6| img->close(img); 42| 6| return 0; 43| 6|}