_Z8mem_openPKhm: 55| 1.00k|TSK_IMG_INFO *mem_open(const uint8_t *data, size_t size) { 56| 1.00k| IMG_MEM_INFO *inmemory_img = 57| 1.00k| reinterpret_cast(malloc(sizeof(IMG_MEM_INFO))); 58| 1.00k| TSK_IMG_INFO *img; 59| 1.00k| if (inmemory_img == nullptr) { ------------------ | Branch (59:7): [True: 0, False: 1.00k] ------------------ 60| 0| return nullptr; 61| 0| } 62| 1.00k| img = reinterpret_cast(inmemory_img); 63| 1.00k| img->itype = TSK_IMG_TYPE_RAW; 64| 1.00k| img->read = mem_read; 65| 1.00k| img->close = mem_close; 66| 1.00k| img->imgstat = mem_imgstat; 67| 1.00k| img->size = size; 68| 1.00k| img->sector_size = 512; 69| 1.00k| tsk_init_lock(&(img->cache_lock)); 70| 1.00k| inmemory_img->data = data; 71| 1.00k| inmemory_img->size = size; 72| 1.00k| return img; 73| 1.00k|} sleuthkit_mmls_fuzzer.cc:_ZL8mem_readP12TSK_IMG_INFOlPcm: 30| 544| size_t len) { 31| 544| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 32| | // Bounds-checking exists in the real drivers. 33| 544| if (offset > mem_info->size) { ------------------ | Branch (33:7): [True: 0, False: 544] ------------------ 34| 0| return -1; 35| 0| } 36| 544| ssize_t read_len = len; 37| 544| if (offset + len > mem_info->size) { ------------------ | Branch (37:7): [True: 0, False: 544] ------------------ 38| 0| read_len = mem_info->size - offset; 39| 0| } 40| 544| if (memcpy(buf, mem_info->data + offset, read_len) == nullptr) { ------------------ | Branch (40:7): [True: 0, False: 544] ------------------ 41| 0| return -1; 42| 544| } else { 43| 544| return read_len; 44| 544| } 45| 544|} sleuthkit_mmls_fuzzer.cc:_ZL9mem_closeP12TSK_IMG_INFO: 47| 1.00k|static void mem_close(TSK_IMG_INFO *img_info) { 48| 1.00k| IMG_MEM_INFO *mem_info = reinterpret_cast(img_info); 49| 1.00k| tsk_deinit_lock(&(img_info->cache_lock)); 50| 1.00k| free(mem_info); 51| 1.00k|} tsk_malloc: 29| 327k|{ 30| 327k| void *ptr; 31| | 32| 327k| if ((ptr = calloc(len, 1)) == 0) { ------------------ | Branch (32:9): [True: 0, False: 327k] ------------------ 33| 0| tsk_error_reset(); 34| 0| tsk_error_set_errno(TSK_ERR_AUX_MALLOC); ------------------ | | 307| 0|#define TSK_ERR_AUX_MALLOC (TSK_ERR_AUX | 0) | | ------------------ | | | | 298| 0|#define TSK_ERR_AUX 0x01000000 | | ------------------ ------------------ 35| 0| tsk_error_set_errstr("tsk_malloc: %s (%" PRIuSIZE" requested)", strerror(errno), len); 36| 0| } 37| | 38| 327k| return ptr; 39| 327k|} tsk_guess_end_u16: 35| 3.03k|{ 36| | /* try little */ 37| 3.03k| if (tsk_getu16(TSK_LIT_ENDIAN, x) == val) { ------------------ | | 86| 3.03k|#define tsk_getu16(endian, x) \ | | 87| 3.03k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 3.03k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 3.03k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (37:9): [True: 1.06k, False: 1.96k] ------------------ 38| 1.06k| *flag = TSK_LIT_ENDIAN; 39| 1.06k| return 0; 40| 1.06k| } 41| | 42| | /* ok, big now */ 43| 1.96k| if (tsk_getu16(TSK_BIG_ENDIAN, x) == val) { ------------------ | | 86| 1.96k|#define tsk_getu16(endian, x) \ | | 87| 1.96k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [Folded - Ignored] | | ------------------ | | 88| 1.96k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 1.96k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ | Branch (43:9): [True: 8, False: 1.95k] ------------------ 44| 8| *flag = TSK_BIG_ENDIAN; 45| 8| return 0; 46| 8| } 47| | 48| | /* didn't find it */ 49| 1.95k| return 1; 50| 1.96k|} tsk_guess_end_u64: 88| 2.99k|{ 89| | /* try little */ 90| 2.99k| if (tsk_getu64(TSK_LIT_ENDIAN, x) == val) { ------------------ | | 171| 2.99k|#define tsk_getu64(endian, x) \ | | 172| 2.99k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [Folded - Ignored] | | ------------------ | | 173| 2.99k| ((uint64_t) \ | | 174| 2.99k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 2.99k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 2.99k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 2.99k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 2.99k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 2.99k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 2.99k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 2.99k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 2.99k| : \ | | 183| 2.99k| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (90:9): [True: 1.52k, False: 1.46k] ------------------ 91| 1.52k| *flag = TSK_LIT_ENDIAN; 92| 1.52k| return 0; 93| 1.52k| } 94| | 95| | /* ok, big now */ 96| 1.46k| if (tsk_getu64(TSK_BIG_ENDIAN, x) == val) { ------------------ | | 171| 1.46k|#define tsk_getu64(endian, x) \ | | 172| 1.46k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [Folded - Ignored] | | ------------------ | | 173| 1.46k| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1.46k| : \ | | 183| 1.46k| ((uint64_t) \ | | 184| 1.46k| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 1.46k| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 1.46k| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 1.46k| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 1.46k| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 1.46k| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 1.46k| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 1.46k| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (96:9): [True: 124, False: 1.34k] ------------------ 97| 124| *flag = TSK_BIG_ENDIAN; 98| 124| return 0; 99| 124| } 100| | 101| 1.34k| return 1; 102| 1.46k|} tsk_error_get_info: 148| 41.0k|{ 149| 41.0k| TSK_ERROR_INFO *ptr = NULL; 150| 41.0k| (void) pthread_once(&pt_tls_key_once, make_pt_tls_key); 151| 41.0k| if ((ptr = (TSK_ERROR_INFO *) pthread_getspecific(pt_tls_key)) == 0) { ------------------ | Branch (151:9): [True: 1, False: 41.0k] ------------------ 152| | // Under high memory pressure malloc will return NULL. 153| 1| ptr = (TSK_ERROR_INFO *) malloc(sizeof(TSK_ERROR_INFO)); 154| | 155| 1| if( ptr != NULL ) { ------------------ | Branch (155:13): [True: 1, False: 0] ------------------ 156| 1| ptr->t_errno = 0; 157| 1| ptr->errstr[0] = 0; 158| 1| ptr->errstr2[0] = 0; 159| 1| } 160| 1| (void) pthread_setspecific(pt_tls_key, ptr); 161| 1| } 162| 41.0k| return ptr; 163| 41.0k|} tsk_error_set_errno: 308| 11.8k|{ 309| 11.8k| tsk_error_get_info()->t_errno = t_errno; 310| 11.8k|} tsk_error_set_errstr: 332| 8.72k|{ 333| 8.72k| va_list args; 334| 8.72k| va_start(args, format); 335| 8.72k| vsnprintf(tsk_error_get_info()->errstr, TSK_ERROR_STRING_MAX_LENGTH, ------------------ | | 67| 8.72k|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 336| 8.72k| format, args); 337| 8.72k| va_end(args); 338| 8.72k|} tsk_error_set_errstr2: 373| 7.61k|{ 374| 7.61k| va_list args; 375| 7.61k| va_start(args, format); 376| 7.61k| vsnprintf(tsk_error_get_info()->errstr2, TSK_ERROR_STRING_MAX_LENGTH, ------------------ | | 67| 7.61k|#define TSK_ERROR_STRING_MAX_LENGTH 1024 ------------------ 377| 7.61k| format, args); 378| 7.61k| va_end(args); 379| 7.61k|} tsk_error_reset: 444| 12.8k|{ 445| 12.8k| TSK_ERROR_INFO *info = tsk_error_get_info(); 446| | 447| 12.8k| if( info != NULL ) { ------------------ | Branch (447:9): [True: 12.8k, False: 0] ------------------ 448| 12.8k| info->t_errno = 0; 449| 12.8k| info->errstr[0] = 0; 450| 12.8k| info->errstr2[0] = 0; 451| 12.8k| info->errstr_print[0] = 0; 452| 12.8k| } 453| 12.8k|} tsk_error.c:make_pt_tls_key: 142| 1|{ 143| 1| (void) pthread_key_create(&pt_tls_key, free_error_info); 144| 1|} tsk_init_lock: 46| 1.00k|{ 47| 1.00k| pthread_mutexattr_t attr; 48| 1.00k| pthread_mutexattr_init(&attr); 49| | 50| | // Locks on Linux are not recursive (unlike on Windows), so things 51| | // will hang if the current thread tries to take the lock again. 52| | // While debugging, it's sometimes useful to call 53| | // 54| | // pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK_NP); 55| | // 56| | // which will provoke an immediate error rather than a hang. 57| | // 58| | // PTHREAD_MUTEX_ERRORCHECK is not defined by default on Linux, 59| | // but it is portable if you have the right_XOPEN_SOURCE settings. 60| | // However, that macro affects the availability of other features 61| | // like BSD-style u_int types used in afflib. 62| | // PTHREAD_MUTEX_ERRORCHECK -is- available by default on Mac. 63| | // 64| | // PTHREAD_MUTEX_ERRORCHECK_NP is the Linux/gcc non-portable 65| | // equivalent which does not require _XOPEN_SOURCE. 66| | // 67| | // Other interesting attributes are PTHREAD_MUTEX_RECURSIVE (and 68| | // PTHREAD_MUTEX_RECURSIVE_NP). We avoided those out of portability 69| | // concerns with the _XOPEN_SOURCE settings. 70| | 71| 1.00k| int e = pthread_mutex_init(&lock->mutex, &attr); 72| 1.00k| pthread_mutexattr_destroy(&attr); 73| 1.00k| if (e != 0) { ------------------ | Branch (73:9): [True: 0, False: 1.00k] ------------------ 74| 0| fprintf(stderr, "tsk_init_lock: thread_mutex_init failed %d\n", e); 75| 0| assert(0); 76| 0| } 77| 1.00k|} tsk_deinit_lock: 81| 1.00k|{ 82| 1.00k| pthread_mutex_destroy(&lock->mutex); 83| 1.00k|} tsk_take_lock: 87| 88.9k|{ 88| 88.9k| int e = pthread_mutex_lock(&lock->mutex); 89| 88.9k| if (e != 0) { ------------------ | Branch (89:9): [True: 0, False: 88.9k] ------------------ 90| 0| fprintf(stderr, "tsk_take_lock: thread_mutex_lock failed %d\n", e); 91| 0| assert(0); 92| 0| } 93| 88.9k|} tsk_release_lock: 97| 88.9k|{ 98| 88.9k| int e = pthread_mutex_unlock(&lock->mutex); 99| 88.9k| if (e != 0) { ------------------ | Branch (99:9): [True: 0, False: 88.9k] ------------------ 100| 0| fprintf(stderr, 101| 0| "tsk_release_lock: thread_mutex_unlock failed %d\n", e); 102| 0| assert(0); 103| 0| } 104| 88.9k|} tsk_UTF16toUTF8: 150| 138k|{ 151| 138k| TSKConversionResult result = TSKconversionOK; 152| 138k| const UTF16 *source = *sourceStart; 153| 138k| UTF8 *target = *targetStart; 154| | 155| 5.05M| while (source < sourceEnd) { ------------------ | Branch (155:12): [True: 4.91M, False: 136k] ------------------ 156| 4.91M| UTF32 ch; 157| 4.91M| unsigned short bytesToWrite = 0; 158| 4.91M| const UTF32 byteMask = 0xBF; 159| 4.91M| const UTF32 byteMark = 0x80; 160| 4.91M| const UTF16 *oldSource = source; /* In case we have to back up because of target overflow. */ 161| | 162| | // Need at least 2 bytes 163| 4.91M| ch = tsk_getu16(endian, (uint8_t *) source); ------------------ | | 86| 4.91M|#define tsk_getu16(endian, x) \ | | 87| 4.91M|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 4.53M, False: 376k] | | ------------------ | | 88| 4.91M| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 4.91M| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 164| 4.91M| source++; 165| | 166| | /* If we have a surrogate pair, convert to UTF32 first. */ 167| 4.91M| if (ch >= UNI_SUR_HIGH_START && ch <= UNI_SUR_HIGH_END) { ------------------ | | 62| 9.82M|#define UNI_SUR_HIGH_START (UTF32)0xD800 ------------------ if (ch >= UNI_SUR_HIGH_START && ch <= UNI_SUR_HIGH_END) { ------------------ | | 63| 961k|#define UNI_SUR_HIGH_END (UTF32)0xDBFF ------------------ | Branch (167:13): [True: 961k, False: 3.95M] | Branch (167:41): [True: 67.9k, False: 894k] ------------------ 168| | /* If the 16 bits following the high surrogate are in the source buffer... */ 169| 67.9k| if (source < sourceEnd) { ------------------ | Branch (169:17): [True: 65.7k, False: 2.20k] ------------------ 170| | // Need at least 2 bytes 171| 65.7k| UTF32 ch2 = tsk_getu16(endian, (uint8_t *) source); ------------------ | | 86| 65.7k|#define tsk_getu16(endian, x) \ | | 87| 65.7k|(uint16_t)(((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (87:12): [True: 59.9k, False: 5.74k] | | ------------------ | | 88| 65.7k| (((uint8_t *)(x))[0] + (((uint8_t *)(x))[1] << 8)) : \ | | 89| 65.7k| (((uint8_t *)(x))[1] + (((uint8_t *)(x))[0] << 8)) ) ------------------ 172| 65.7k| ++source; 173| | 174| | /* If it's a low surrogate, convert to UTF32. */ 175| 65.7k| if (ch2 >= UNI_SUR_LOW_START && ch2 <= UNI_SUR_LOW_END) { ------------------ | | 64| 131k|#define UNI_SUR_LOW_START (UTF32)0xDC00 ------------------ if (ch2 >= UNI_SUR_LOW_START && ch2 <= UNI_SUR_LOW_END) { ------------------ | | 65| 29.3k|#define UNI_SUR_LOW_END (UTF32)0xDFFF ------------------ | Branch (175:21): [True: 29.3k, False: 36.3k] | Branch (175:49): [True: 4.66k, False: 24.6k] ------------------ 176| 4.66k| ch = ((ch - UNI_SUR_HIGH_START) << halfShift) ------------------ | | 62| 4.66k|#define UNI_SUR_HIGH_START (UTF32)0xD800 ------------------ 177| 4.66k| + (ch2 - UNI_SUR_LOW_START) + halfBase; ------------------ | | 64| 4.66k|#define UNI_SUR_LOW_START (UTF32)0xDC00 ------------------ 178| 4.66k| } 179| 61.0k| else if (flags == TSKstrictConversion) { /* it's an unpaired high surrogate */ ------------------ | Branch (179:26): [True: 0, False: 61.0k] ------------------ 180| 0| result = TSKsourceIllegal; 181| 0| break; 182| 0| } 183| | // replace with another character 184| 61.0k| else { 185| 61.0k| ch = '^'; 186| 61.0k| } 187| 65.7k| } 188| 2.20k| else { /* We don't have the 16 bits following the high surrogate. */ 189| 2.20k| --source; /* return to the high surrogate */ 190| 2.20k| result = TSKsourceExhausted; 191| 2.20k| break; 192| 2.20k| } 193| 67.9k| } 194| | /* UTF-16 surrogate values are illegal in UTF-32 */ 195| 4.84M| else if (ch >= UNI_SUR_LOW_START && ch <= UNI_SUR_LOW_END) { ------------------ | | 64| 9.69M|#define UNI_SUR_LOW_START (UTF32)0xDC00 ------------------ else if (ch >= UNI_SUR_LOW_START && ch <= UNI_SUR_LOW_END) { ------------------ | | 65| 894k|#define UNI_SUR_LOW_END (UTF32)0xDFFF ------------------ | Branch (195:18): [True: 894k, False: 3.95M] | Branch (195:45): [True: 49.4k, False: 844k] ------------------ 196| 49.4k| if (flags == TSKstrictConversion) { ------------------ | Branch (196:17): [True: 0, False: 49.4k] ------------------ 197| 0| --source; /* return to the illegal value itself */ 198| 0| result = TSKsourceIllegal; 199| 0| break; 200| 0| } 201| | // replace with another character 202| 49.4k| else { 203| 49.4k| ch = '^'; 204| 49.4k| } 205| 49.4k| } 206| | 207| | /* Figure out how many bytes the result will require */ 208| 4.91M| if (ch < (UTF32) 0x80) { ------------------ | Branch (208:13): [True: 2.21M, False: 2.69M] ------------------ 209| 2.21M| bytesToWrite = 1; 210| 2.21M| } 211| 2.69M| else if (ch < (UTF32) 0x800) { ------------------ | Branch (211:18): [True: 171k, False: 2.52M] ------------------ 212| 171k| bytesToWrite = 2; 213| 171k| } 214| 2.52M| else if (ch < (UTF32) 0x10000) { ------------------ | Branch (214:18): [True: 2.52M, False: 4.66k] ------------------ 215| 2.52M| bytesToWrite = 3; 216| 2.52M| } 217| 4.66k| else if (ch < (UTF32) 0x110000) { ------------------ | Branch (217:18): [True: 4.66k, False: 0] ------------------ 218| 4.66k| bytesToWrite = 4; 219| 4.66k| } 220| 0| else { 221| 0| bytesToWrite = 3; 222| 0| ch = TSK_UNI_REPLACEMENT_CHAR; ------------------ | | 50| 0|#define TSK_UNI_REPLACEMENT_CHAR (UTF32)0x0000FFFD ------------------ 223| 0| } 224| | 225| 4.91M| target += bytesToWrite; 226| 4.91M| if (target > targetEnd) { ------------------ | Branch (226:13): [True: 0, False: 4.91M] ------------------ 227| 0| source = oldSource; /* Back up source pointer! */ 228| 0| target -= bytesToWrite; 229| 0| result = TSKtargetExhausted; 230| 0| break; 231| 0| } 232| 4.91M| switch (bytesToWrite) { /* note: everything falls through. */ ------------------ | Branch (232:17): [True: 0, False: 4.91M] ------------------ 233| 4.66k| case 4: ------------------ | Branch (233:9): [True: 4.66k, False: 4.90M] ------------------ 234| 4.66k| *--target = (UTF8) ((ch | byteMark) & byteMask); 235| 4.66k| ch >>= 6; 236| 2.52M| case 3: ------------------ | Branch (236:9): [True: 2.52M, False: 2.38M] ------------------ 237| 2.52M| *--target = (UTF8) ((ch | byteMark) & byteMask); 238| 2.52M| ch >>= 6; 239| 2.69M| case 2: ------------------ | Branch (239:9): [True: 171k, False: 4.74M] ------------------ 240| 2.69M| *--target = (UTF8) ((ch | byteMark) & byteMask); 241| 2.69M| ch >>= 6; 242| 4.91M| case 1: ------------------ | Branch (242:9): [True: 2.21M, False: 2.69M] ------------------ 243| 4.91M| *--target = (UTF8) (ch | firstByteMark[bytesToWrite]); 244| 4.91M| } 245| 4.91M| target += bytesToWrite; 246| 4.91M| } 247| 138k| *sourceStart = source; 248| 138k| *targetStart = target; 249| 138k| return result; 250| 138k|} tsk_img_read: 60| 91.9k|{ 61| 91.9k|#define CACHE_AGE 1000 62| 91.9k| ssize_t read_count = 0; 63| 91.9k| int cache_index = 0; 64| 91.9k| int cache_next = 0; // index to lowest age cache (to use next) 65| 91.9k| size_t len2 = 0; 66| | 67| 91.9k| if (a_img_info == NULL) { ------------------ | Branch (67:9): [True: 0, False: 91.9k] ------------------ 68| 0| tsk_error_reset(); 69| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 70| 0| tsk_error_set_errstr("tsk_img_read: a_img_info: NULL"); 71| 0| return -1; 72| 0| } 73| | 74| | // Do not allow a_buf to be NULL. 75| 91.9k| if (a_buf == NULL) { ------------------ | Branch (75:9): [True: 0, False: 91.9k] ------------------ 76| 0| tsk_error_reset(); 77| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 78| 0| tsk_error_set_errstr("tsk_img_read: a_buf: NULL"); 79| 0| return -1; 80| 0| } 81| | 82| | // The function cannot handle negative offsets. 83| 91.9k| if (a_off < 0) { ------------------ | Branch (83:9): [True: 2.93k, False: 88.9k] ------------------ 84| 2.93k| tsk_error_reset(); 85| 2.93k| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 2.93k|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 2.93k|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 86| 2.93k| tsk_error_set_errstr("tsk_img_read: a_off: %" PRIdOFF, a_off); ------------------ | | 269| 2.93k|#define PRIdOFF PRId64 ------------------ 87| 2.93k| return -1; 88| 2.93k| } 89| | 90| | // Protect a_off against overflowing when a_len is added since TSK_OFF_T 91| | // maps to an int64 we prefer it over size_t although likely checking 92| | // for ( a_len > SSIZE_MAX ) is better but the code does not seem to 93| | // use that approach. 94| | 95| 88.9k| if ((TSK_OFF_T) a_len < 0) { ------------------ | Branch (95:9): [True: 0, False: 88.9k] ------------------ 96| 0| tsk_error_reset(); 97| 0| tsk_error_set_errno(TSK_ERR_IMG_ARG); ------------------ | | 320| 0|#define TSK_ERR_IMG_ARG (TSK_ERR_IMG | 9) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 98| 0| tsk_error_set_errstr("tsk_img_read: a_len: %zd", a_len); 99| 0| return -1; 100| 0| } 101| | 102| | /* cache_lock is used for both the cache in IMG_INFO and 103| | * the shared variables in the img type specific INFO structs. 104| | * grab it now so that it is held before any reads. 105| | */ 106| 88.9k| tsk_take_lock(&(a_img_info->cache_lock)); 107| | 108| | // if they ask for more than the cache length, skip the cache 109| 88.9k| if ((a_len + (a_off % 512)) > TSK_IMG_INFO_CACHE_LEN) { ------------------ | | 85| 88.9k|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ | Branch (109:9): [True: 0, False: 88.9k] ------------------ 110| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 111| 0| tsk_release_lock(&(a_img_info->cache_lock)); 112| 0| return read_count; 113| 0| } 114| | 115| | // TODO: why not just return 0 here (and be POSIX compliant)? 116| | // and why not check earlier for this condition? 117| 88.9k| if (a_off >= a_img_info->size) { ------------------ | Branch (117:9): [True: 1.54k, False: 87.4k] ------------------ 118| 1.54k| tsk_release_lock(&(a_img_info->cache_lock)); 119| 1.54k| tsk_error_reset(); 120| 1.54k| tsk_error_set_errno(TSK_ERR_IMG_READ_OFF); ------------------ | | 319| 1.54k|#define TSK_ERR_IMG_READ_OFF (TSK_ERR_IMG | 8) | | ------------------ | | | | 299| 1.54k|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 121| 1.54k| tsk_error_set_errstr("tsk_img_read - %" PRIdOFF, a_off); ------------------ | | 269| 1.54k|#define PRIdOFF PRId64 ------------------ 122| 1.54k| return -1; 123| 1.54k| } 124| | 125| | /* See if the requested length is going to be too long. 126| | * we'll use this length when checking the cache. */ 127| 87.4k| len2 = a_len; 128| | 129| | // Protect against INT64_MAX + INT64_MAX > value 130| 87.4k| if (((TSK_OFF_T) len2 > a_img_info->size) ------------------ | Branch (130:9): [True: 2.96k, False: 84.4k] ------------------ 131| 87.4k| || (a_off >= (a_img_info->size - (TSK_OFF_T)len2))) { ------------------ | Branch (131:12): [True: 5.13k, False: 79.3k] ------------------ 132| 8.10k| len2 = (size_t) (a_img_info->size - a_off); 133| 8.10k| } 134| | 135| | // check if it is in the cache 136| 87.4k| for (cache_index = 0; 137| 2.88M| cache_index < TSK_IMG_INFO_CACHE_NUM; cache_index++) { ------------------ | | 84| 2.88M|#define TSK_IMG_INFO_CACHE_NUM 32 ------------------ | Branch (137:9): [True: 2.79M, False: 87.4k] ------------------ 138| | 139| | // Look into the in-use cache entries 140| 2.79M| if (a_img_info->cache_len[cache_index] > 0) { ------------------ | Branch (140:13): [True: 1.98M, False: 814k] ------------------ 141| | 142| | // the read_count check makes sure we don't go back in after data was read 143| 1.98M| if ((read_count == 0) ------------------ | Branch (143:17): [True: 692k, False: 1.29M] ------------------ 144| 1.98M| && (a_img_info->cache_off[cache_index] <= a_off) ------------------ | Branch (144:20): [True: 216k, False: 476k] ------------------ 145| 1.98M| && (a_img_info->cache_off[cache_index] + ------------------ | Branch (145:20): [True: 86.9k, False: 129k] ------------------ 146| 216k| a_img_info->cache_len[cache_index] >= a_off + len2)) { 147| | 148| | /* 149| | if (tsk_verbose) 150| | fprintf(stderr, 151| | "tsk_img_read: Read found in cache %d\n", cache_index ); 152| | */ 153| | 154| | // We found it... 155| 86.9k| memcpy(a_buf, 156| 86.9k| &a_img_info->cache[cache_index][a_off - 157| 86.9k| a_img_info->cache_off[cache_index]], len2); 158| 86.9k| read_count = (ssize_t) len2; 159| | 160| | // reset its "age" since it was useful 161| 86.9k| a_img_info->cache_age[cache_index] = CACHE_AGE; ------------------ | | 61| 86.9k|#define CACHE_AGE 1000 ------------------ 162| | 163| | // we don't break out of the loop so that we update all ages 164| 86.9k| } 165| 1.89M| else { 166| | /* decrease its "age" since it was not useful. 167| | * We don't let used ones go below 1 so that they are not 168| | * confused with entries that have never been used. */ 169| 1.89M| a_img_info->cache_age[cache_index]--; 170| | 171| | // see if this is the most eligible replacement 172| 1.89M| if ((a_img_info->cache_len[cache_next] > 0) ------------------ | Branch (172:21): [True: 1.43M, False: 464k] ------------------ 173| 1.89M| && (a_img_info->cache_age[cache_index] < ------------------ | Branch (173:24): [True: 356k, False: 1.07M] ------------------ 174| 1.43M| a_img_info->cache_age[cache_next])) 175| 356k| cache_next = cache_index; 176| 1.89M| } 177| 1.98M| } 178| 814k| else { 179| 814k| cache_next = cache_index; 180| 814k| } 181| 2.79M| } 182| | 183| | // if we didn't find it, then load it into the cache_next entry 184| 87.4k| if (read_count == 0) { ------------------ | Branch (184:9): [True: 544, False: 86.9k] ------------------ 185| 544| size_t read_size = 0; 186| | 187| | // round the offset down to a sector boundary 188| 544| a_img_info->cache_off[cache_next] = (a_off / 512) * 512; 189| | 190| | /* 191| | if (tsk_verbose) 192| | fprintf(stderr, 193| | "tsk_img_read: Loading data into cache %d (%" PRIdOFF 194| | ")\n", cache_next, a_img_info->cache_off[cache_next]); 195| | */ 196| | 197| | // Read a full cache block or the remaining data. 198| 544| read_size = TSK_IMG_INFO_CACHE_LEN; ------------------ | | 85| 544|#define TSK_IMG_INFO_CACHE_LEN 65536 ------------------ 199| | 200| 544| if ((a_img_info->cache_off[cache_next] + (TSK_OFF_T)read_size) > ------------------ | Branch (200:13): [True: 357, False: 187] ------------------ 201| 544| a_img_info->size) { 202| 357| read_size = 203| 357| (size_t) (a_img_info->size - 204| 357| a_img_info->cache_off[cache_next]); 205| 357| } 206| | 207| 544| read_count = a_img_info->read(a_img_info, 208| 544| a_img_info->cache_off[cache_next], 209| 544| a_img_info->cache[cache_next], read_size); 210| | 211| | // if no error, then set the variables and copy the data 212| | // Although a read_count of -1 indicates an error, 213| | // since read_count is used in the calculation it may not be negative. 214| | // Also it does not make sense to copy data when the read_count is 0. 215| 544| if (read_count > 0) { ------------------ | Branch (215:13): [True: 544, False: 0] ------------------ 216| | 217| 544| TSK_OFF_T rel_off = 0; 218| 544| a_img_info->cache_age[cache_next] = CACHE_AGE; ------------------ | | 61| 544|#define CACHE_AGE 1000 ------------------ 219| 544| a_img_info->cache_len[cache_next] = read_count; 220| | 221| | // Determine the offset relative to the start of the cached data. 222| 544| rel_off = a_off - a_img_info->cache_off[cache_next]; 223| | 224| | // Make sure we were able to read sufficient data into the cache. 225| 544| if (rel_off > (TSK_OFF_T) read_count) { ------------------ | Branch (225:17): [True: 0, False: 544] ------------------ 226| 0| len2 = 0; 227| 0| } 228| | // Make sure not to copy more than is available in the cache. 229| 544| else if ((rel_off + (TSK_OFF_T) len2) > (TSK_OFF_T) read_count) { ------------------ | Branch (229:22): [True: 0, False: 544] ------------------ 230| 0| len2 = (size_t) (read_count - rel_off); 231| 0| } 232| | // Only copy data when we have something to copy. 233| 544| if (len2 > 0) { ------------------ | Branch (233:17): [True: 544, False: 0] ------------------ 234| 544| memcpy(a_buf, &(a_img_info->cache[cache_next][rel_off]), len2); 235| 544| } 236| 544| read_count = (ssize_t) len2; 237| 544| } 238| 0| else { 239| 0| a_img_info->cache_len[cache_next] = 0; 240| 0| a_img_info->cache_age[cache_next] = 0; 241| 0| a_img_info->cache_off[cache_next] = 0; 242| | 243| | // Something went wrong so let's try skipping the cache 244| 0| read_count = tsk_img_read_no_cache(a_img_info, a_off, a_buf, a_len); 245| 0| } 246| 544| } 247| | 248| 87.4k| tsk_release_lock(&(a_img_info->cache_lock)); 249| 87.4k| return read_count; 250| 88.9k|} tsk_vs_gpt_open: 305| 1.00k|{ 306| 1.00k| TSK_VS_INFO *vs; 307| | 308| | // clean up any errors that are lying around 309| 1.00k| tsk_error_reset(); 310| | 311| 1.00k| if (img_info->sector_size == 0) { ------------------ | Branch (311:9): [True: 0, False: 1.00k] ------------------ 312| 0| tsk_error_reset(); 313| 0| tsk_error_set_errno(TSK_ERR_VS_ARG); ------------------ | | 334| 0|#define TSK_ERR_VS_ARG (TSK_ERR_VS | 7) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 314| 0| tsk_error_set_errstr("tsk_vs_gpt_open: sector size is 0"); 315| 0| return NULL; 316| 0| } 317| | 318| 1.00k| vs = (TSK_VS_INFO *) tsk_malloc(sizeof(*vs)); 319| 1.00k| if (vs == NULL) ------------------ | Branch (319:9): [True: 0, False: 1.00k] ------------------ 320| 0| return NULL; 321| | 322| 1.00k| vs->img_info = img_info; 323| 1.00k| vs->vstype = TSK_VS_TYPE_GPT; 324| 1.00k| vs->tag = TSK_VS_INFO_TAG; ------------------ | | 82| 1.00k|#define TSK_VS_INFO_TAG 0x52301642 ------------------ 325| | 326| | /* If an offset was given, then use that too */ 327| 1.00k| vs->offset = offset; 328| | 329| | /* initialize settings */ 330| 1.00k| vs->part_list = NULL; 331| 1.00k| vs->part_count = 0; 332| 1.00k| vs->endian = 0; 333| 1.00k| vs->block_size = img_info->sector_size; 334| 1.00k| vs->is_backup = 0; 335| | 336| | /* Assign functions */ 337| 1.00k| vs->close = gpt_close; 338| | 339| | /* Load the partitions into the sorted list */ 340| 1.00k| if (gpt_load_table(vs, PRIMARY_TABLE)) { ------------------ | Branch (340:9): [True: 1.00k, False: 1] ------------------ 341| 1.00k| tsk_vs_part_free(vs); 342| 1.00k| int found = 0; 343| 1.00k| if (tsk_verbose) ------------------ | Branch (343:13): [True: 0, False: 1.00k] ------------------ 344| 0| tsk_fprintf(stderr, "gpt_open: Trying other sector sizes\n"); 345| | 346| | /* Before we give up, lets try some other sector sizes */ 347| 1.00k| vs->block_size = 512; 348| 5.99k| while (vs->block_size <= 8192) { ------------------ | Branch (348:16): [True: 4.99k, False: 994] ------------------ 349| 4.99k| if (tsk_verbose) ------------------ | Branch (349:17): [True: 0, False: 4.99k] ------------------ 350| 0| tsk_fprintf(stderr, "gpt_open: Trying sector size: %d\n", 351| 0| vs->block_size); 352| | 353| 4.99k| if (gpt_load_table(vs, PRIMARY_TABLE)) { ------------------ | Branch (353:17): [True: 4.99k, False: 7] ------------------ 354| 4.99k| tsk_vs_part_free(vs); 355| 4.99k| vs->block_size *= 2; 356| 4.99k| continue; 357| 4.99k| } 358| 7| found = 1; 359| 7| break; 360| 4.99k| } 361| | 362| 1.00k| if (found == 0) { ------------------ | Branch (362:13): [True: 994, False: 7] ------------------ 363| | /* Look for the secondary GPT at the end of the image */ 364| 994| if (tsk_verbose) ------------------ | Branch (364:17): [True: 0, False: 994] ------------------ 365| 0| tsk_fprintf(stderr, "gpt_open: Trying secondary table\n"); 366| 994| vs->block_size = img_info->sector_size; 367| 994| vs->is_backup = 1; 368| 994| if(gpt_load_table(vs, SECONDARY_TABLE)){ ------------------ | Branch (368:16): [True: 992, False: 2] ------------------ 369| | 370| | /* Try other sector sizes again */ 371| 992| tsk_vs_part_free(vs); 372| 992| vs->block_size = 512; 373| 5.87k| while (vs->block_size <= 8192) { ------------------ | Branch (373:24): [True: 4.90k, False: 966] ------------------ 374| 4.90k| if (tsk_verbose) ------------------ | Branch (374:25): [True: 0, False: 4.90k] ------------------ 375| 0| tsk_fprintf(stderr, "gpt_open: Trying secondary table sector size: %d\n", 376| 0| vs->block_size); 377| | 378| 4.90k| if (gpt_load_table(vs, SECONDARY_TABLE)) { ------------------ | Branch (378:25): [True: 4.88k, False: 26] ------------------ 379| 4.88k| tsk_vs_part_free(vs); 380| 4.88k| vs->block_size *= 2; 381| 4.88k| continue; 382| 4.88k| } 383| 26| found = 1; 384| 26| break; 385| 4.90k| } 386| | 387| 992| if(found == 0){ ------------------ | Branch (387:20): [True: 966, False: 26] ------------------ 388| 966| gpt_close(vs); 389| 966| return NULL; 390| 966| } 391| 992| } 392| | 393| 994| } 394| 1.00k| } 395| | 396| | 397| | /* fill in the sorted list with the 'unknown' values */ 398| 36| if (tsk_vs_part_unused(vs)) { ------------------ | Branch (398:9): [True: 0, False: 36] ------------------ 399| 0| gpt_close(vs); 400| 0| return NULL; 401| 0| } 402| | 403| 36| return vs; 404| 36|} gpt.c:gpt_close: 297| 1.00k|{ 298| 1.00k| vs->tag = 0; 299| 1.00k| tsk_vs_part_free(vs); 300| 1.00k| free(vs); 301| 1.00k|} gpt.c:gpt_load_table: 26| 11.9k|{ 27| 11.9k| gpt_head *head; 28| 11.9k| gpt_entry *ent; 29| 11.9k| dos_sect *dos_part; 30| 11.9k| unsigned int i, a; 31| 11.9k| uint32_t ent_size; 32| 11.9k| char *safe_str, *head_str, *tab_str, *ent_buf; 33| 11.9k| ssize_t cnt; 34| 11.9k| char *sect_buf; 35| 11.9k| TSK_DADDR_T max_addr = (vs->img_info->size - vs->offset) / vs->block_size; // max sector 36| 11.9k| TSK_DADDR_T gpt_relative_addr; 37| 11.9k| TSK_DADDR_T gpt_absolute_addr; 38| | 39| 11.9k| if(gpt_type == PRIMARY_TABLE){ ------------------ | Branch (39:8): [True: 6.00k, False: 5.90k] ------------------ 40| 6.00k| gpt_relative_addr = GPT_PART_SOFFSET + 1; ------------------ | | 22| 6.00k|#define GPT_PART_SOFFSET 0 ------------------ 41| 6.00k| gpt_absolute_addr = vs->offset / vs->block_size + GPT_PART_SOFFSET + 1; ------------------ | | 22| 6.00k|#define GPT_PART_SOFFSET 0 ------------------ 42| 6.00k| } else { 43| 5.90k| gpt_relative_addr = ((vs->img_info->size - vs->offset) / vs->block_size) - 1; 44| 5.90k| gpt_absolute_addr = (vs->img_info->size / vs->block_size) - 1; 45| 5.90k| } 46| | 47| 11.9k| if (tsk_verbose) ------------------ | Branch (47:9): [True: 0, False: 11.9k] ------------------ 48| 0| tsk_fprintf(stderr, "gpt_load_table: Sector: %" PRIuDADDR "\n", 49| 0| gpt_absolute_addr); 50| | 51| 11.9k| if ((sect_buf = tsk_malloc(vs->block_size)) == NULL) ------------------ | Branch (51:9): [True: 0, False: 11.9k] ------------------ 52| 0| return 1; 53| | 54| 11.9k| if(gpt_type == PRIMARY_TABLE){ ------------------ | Branch (54:8): [True: 6.00k, False: 5.90k] ------------------ 55| 6.00k| TSK_DADDR_T dos_sect_relative_addr = GPT_PART_SOFFSET; ------------------ | | 22| 6.00k|#define GPT_PART_SOFFSET 0 ------------------ 56| 6.00k| TSK_DADDR_T dos_sect_absolute_addr = vs->offset / vs->block_size + GPT_PART_SOFFSET; ------------------ | | 22| 6.00k|#define GPT_PART_SOFFSET 0 ------------------ 57| 6.00k| dos_part = (dos_sect *) sect_buf; 58| | 59| 6.00k| cnt = tsk_vs_read_block 60| 6.00k| (vs, dos_sect_relative_addr, sect_buf, vs->block_size); 61| | /* if -1, then tsk_errno is already set */ 62| 6.00k| if (cnt != vs->block_size) { ------------------ | Branch (62:13): [True: 2.96k, False: 3.03k] ------------------ 63| 2.96k| if (cnt >= 0) { ------------------ | Branch (63:17): [True: 2.96k, False: 0] ------------------ 64| 2.96k| tsk_error_reset(); 65| 2.96k| tsk_error_set_errno(TSK_ERR_VS_READ); ------------------ | | 329| 2.96k|#define TSK_ERR_VS_READ (TSK_ERR_VS | 2) | | ------------------ | | | | 300| 2.96k|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 66| 2.96k| } 67| 2.96k| tsk_error_set_errstr2 68| 2.96k| ("Error reading DOS safety partition table in Sector: %" 69| 2.96k| PRIuDADDR, dos_sect_absolute_addr); ------------------ | | 264| 2.96k|#define PRIuDADDR PRIu64 ------------------ 70| 2.96k| free(sect_buf); 71| 2.96k| return 1; 72| 2.96k| } 73| | 74| | /* Sanity Check */ 75| 3.03k| if (tsk_vs_guessu16(vs, dos_part->magic, DOS_MAGIC)) { ------------------ | | 40| 3.03k| tsk_guess_end_u16(&(vs->endian), (x), (mag)) | | ------------------ | | | Branch (40:5): [True: 1.95k, False: 1.07k] | | ------------------ ------------------ 76| 1.95k| tsk_error_reset(); 77| 1.95k| tsk_error_set_errno(TSK_ERR_VS_MAGIC); ------------------ | | 330| 1.95k|#define TSK_ERR_VS_MAGIC (TSK_ERR_VS | 3) | | ------------------ | | | | 300| 1.95k|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 78| 1.95k| tsk_error_set_errstr 79| 1.95k| ("Missing DOS safety partition (invalid magic) (Sector: %" 80| 1.95k| PRIuDADDR ")", dos_sect_absolute_addr); 81| 1.95k| free(sect_buf); 82| 1.95k| return 1; 83| 1.95k| } 84| | 85| 1.07k| if (dos_part->ptable[0].ptype != GPT_DOS_TYPE) { ------------------ | | 23| 1.07k|#define GPT_DOS_TYPE 0xEE ------------------ | Branch (85:13): [True: 12, False: 1.06k] ------------------ 86| 12| tsk_error_reset(); 87| 12| tsk_error_set_errno(TSK_ERR_VS_MAGIC); ------------------ | | 330| 12|#define TSK_ERR_VS_MAGIC (TSK_ERR_VS | 3) | | ------------------ | | | | 300| 12|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 88| 12| tsk_error_set_errstr 89| 12| ("Missing DOS safety partition (invalid type in table: %d)", 90| 12| dos_part->ptable[0].ptype); 91| 12| free(sect_buf); 92| 12| return 1; 93| 12| } 94| 1.07k| } 95| | 96| | /* Read the GPT header */ 97| 6.96k| head = (gpt_head *) sect_buf; 98| 6.96k| cnt = tsk_vs_read_block 99| 6.96k| (vs, gpt_relative_addr, sect_buf, vs->block_size); 100| 6.96k| if (cnt != vs->block_size) { ------------------ | Branch (100:9): [True: 3.10k, False: 3.86k] ------------------ 101| 3.10k| if (cnt >= 0) { ------------------ | Branch (101:13): [True: 40, False: 3.06k] ------------------ 102| 40| tsk_error_reset(); 103| 40| tsk_error_set_errno(TSK_ERR_VS_READ); ------------------ | | 329| 40|#define TSK_ERR_VS_READ (TSK_ERR_VS | 2) | | ------------------ | | | | 300| 40|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 104| 40| } 105| 3.10k| tsk_error_set_errstr2("GPT Header structure in Sector: %" 106| 3.10k| PRIuDADDR, gpt_absolute_addr); ------------------ | | 264| 3.10k|#define PRIuDADDR PRIu64 ------------------ 107| 3.10k| free(sect_buf); 108| 3.10k| return 1; 109| 3.10k| } 110| | 111| | /* Do the endianness test for the secondary table since the test in the dos safety table was skipped */ 112| 3.86k| if(gpt_type == SECONDARY_TABLE){ ------------------ | Branch (112:8): [True: 2.99k, False: 875] ------------------ 113| 2.99k| if (tsk_vs_guessu64(vs, head->signature, GPT_HEAD_SIG)) { ------------------ | | 46| 2.99k| tsk_guess_end_u64(&(vs->endian), (x), (mag)) | | ------------------ | | | Branch (46:5): [True: 1.34k, False: 1.64k] | | ------------------ ------------------ 114| 1.34k| tsk_error_reset(); 115| 1.34k| tsk_error_set_errno(TSK_ERR_VS_MAGIC); ------------------ | | 330| 1.34k|#define TSK_ERR_VS_MAGIC (TSK_ERR_VS | 3) | | ------------------ | | | | 300| 1.34k|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 116| 1.34k| tsk_error_set_errstr("GPT Header: %" PRIx64, tsk_getu64(vs->endian, ------------------ | | 171| 1.34k|#define tsk_getu64(endian, x) \ | | 172| 1.34k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1.23k, False: 105] | | ------------------ | | 173| 1.34k| ((uint64_t) \ | | 174| 1.23k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1.23k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1.23k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1.23k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1.23k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1.23k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1.23k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1.23k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1.34k| : \ | | 183| 1.34k| ((uint64_t) \ | | 184| 105| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 105| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 105| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 105| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 105| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 105| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 105| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 105| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 117| 1.34k| &head->signature)); 118| 1.34k| free(sect_buf); 119| 1.34k| return 1; 120| 1.34k| } 121| 2.99k| } 122| | 123| 2.52k| if (tsk_getu64(vs->endian, &head->signature) != GPT_HEAD_SIG) { ------------------ | | 171| 2.52k|#define tsk_getu64(endian, x) \ | | 172| 2.52k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 2.39k, False: 127] | | ------------------ | | 173| 2.52k| ((uint64_t) \ | | 174| 2.39k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 2.39k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 2.39k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 2.39k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 2.39k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 2.39k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 2.39k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 2.39k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 2.52k| : \ | | 183| 2.52k| ((uint64_t) \ | | 184| 127| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 127| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 127| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 127| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 127| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 127| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 127| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 127| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ if (tsk_getu64(vs->endian, &head->signature) != GPT_HEAD_SIG) { ------------------ | | 29| 2.52k|#define GPT_HEAD_SIG 0x5452415020494645ULL ------------------ | Branch (123:9): [True: 805, False: 1.71k] ------------------ 124| 805| tsk_error_reset(); 125| 805| tsk_error_set_errno(TSK_ERR_VS_MAGIC); ------------------ | | 330| 805|#define TSK_ERR_VS_MAGIC (TSK_ERR_VS | 3) | | ------------------ | | | | 300| 805|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 126| 805| tsk_error_set_errstr("GPT Header: %" PRIx64, tsk_getu64(vs->endian, ------------------ | | 171| 805|#define tsk_getu64(endian, x) \ | | 172| 805|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 802, False: 3] | | ------------------ | | 173| 805| ((uint64_t) \ | | 174| 802| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 802| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 802| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 802| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 802| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 802| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 802| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 802| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 805| : \ | | 183| 805| ((uint64_t) \ | | 184| 3| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 3| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 3| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 3| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 3| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 3| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 3| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 3| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 127| 805| &head->signature)); 128| 805| free(sect_buf); 129| 805| return 1; 130| 805| } 131| | 132| | // now that we checked the sig, lets make the meta entries 133| 1.71k| if (gpt_type == PRIMARY_TABLE) { ------------------ | Branch (133:9): [True: 70, False: 1.64k] ------------------ 134| 70| if ((safe_str = tsk_malloc(16)) == NULL) { ------------------ | Branch (134:13): [True: 0, False: 70] ------------------ 135| 0| free(sect_buf); 136| 0| return 1; 137| 0| } 138| 70| snprintf(safe_str, 16, "Safety Table"); 139| 70| if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) 0, (TSK_DADDR_T) 1, ------------------ | Branch (139:13): [True: 0, False: 70] ------------------ 140| 70| TSK_VS_PART_FLAG_META, safe_str, -1, -1)) { 141| 0| free(sect_buf); 142| 0| return 1; 143| 0| } 144| 70| } 145| | 146| 1.71k| if ((head_str = tsk_malloc(16)) == NULL) { ------------------ | Branch (146:9): [True: 0, False: 1.71k] ------------------ 147| 0| free(sect_buf); 148| 0| return 1; 149| 0| } 150| | 151| 1.71k| snprintf(head_str, 16, "GPT Header"); 152| 1.71k| if (NULL == tsk_vs_part_add(vs, gpt_relative_addr, ------------------ | Branch (152:9): [True: 0, False: 1.71k] ------------------ 153| 1.71k| (TSK_DADDR_T) ((tsk_getu32(vs->endian, ------------------ | | 119| 1.71k|#define tsk_getu32(endian, x) \ | | 120| 1.71k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1.59k, False: 124] | | ------------------ | | 121| 1.71k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1.59k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1.59k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1.59k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.71k| : \ | | 126| 1.71k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 124| (((uint8_t *)(x))[2] << 8) + \ | | 128| 124| (((uint8_t *)(x))[1] << 16) + \ | | 129| 124| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 154| 1.71k| &head->head_size_b) + (vs->block_size - 155| 1.71k| 1)) / vs->block_size), TSK_VS_PART_FLAG_META, 156| 1.71k| head_str, -1, -1)) { 157| 0| free(sect_buf); 158| 0| return 1; 159| 0| } 160| | 161| | /* Allocate a buffer for each table entry */ 162| 1.71k| ent_size = tsk_getu32(vs->endian, &head->tab_size_b); ------------------ | | 119| 1.71k|#define tsk_getu32(endian, x) \ | | 120| 1.71k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1.59k, False: 124] | | ------------------ | | 121| 1.71k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1.59k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1.59k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1.59k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.71k| : \ | | 126| 1.71k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 124| (((uint8_t *)(x))[2] << 8) + \ | | 128| 124| (((uint8_t *)(x))[1] << 16) + \ | | 129| 124| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 163| 1.71k| if (ent_size < sizeof(gpt_entry)) { ------------------ | Branch (163:9): [True: 0, False: 1.71k] ------------------ 164| 0| tsk_error_reset(); 165| 0| tsk_error_set_errno(TSK_ERR_VS_MAGIC); ------------------ | | 330| 0|#define TSK_ERR_VS_MAGIC (TSK_ERR_VS | 3) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 166| 0| tsk_error_set_errstr("Header reports partition entry size of %" 167| 0| PRIu32 " and not %" PRIuSIZE "", ent_size, sizeof(gpt_entry)); 168| 0| free(sect_buf); 169| 0| return 1; 170| 0| } 171| | 172| 1.71k| if ((tab_str = tsk_malloc(20)) == NULL) { ------------------ | Branch (172:9): [True: 0, False: 1.71k] ------------------ 173| 0| free(sect_buf); 174| 0| return 1; 175| 0| } 176| | 177| 1.71k| snprintf(tab_str, 20, "Partition Table"); 178| 1.71k| if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) tsk_getu64(vs->endian, ------------------ | | 171| 1.71k|#define tsk_getu64(endian, x) \ | | 172| 1.71k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1.59k, False: 124] | | ------------------ | | 173| 1.71k| ((uint64_t) \ | | 174| 1.59k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1.59k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1.59k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1.59k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1.59k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1.59k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1.59k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1.59k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1.71k| : \ | | 183| 1.71k| ((uint64_t) \ | | 184| 124| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 124| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 124| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 124| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 124| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 124| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 124| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 124| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (178:9): [True: 0, False: 1.71k] ------------------ 179| 1.71k| &head->tab_start_lba), 180| 1.71k| (TSK_DADDR_T) ((ent_size * tsk_getu32(vs->endian, ------------------ | | 119| 1.71k|#define tsk_getu32(endian, x) \ | | 120| 1.71k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 1.59k, False: 124] | | ------------------ | | 121| 1.71k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 1.59k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 1.59k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 1.59k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 1.71k| : \ | | 126| 1.71k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 124| (((uint8_t *)(x))[2] << 8) + \ | | 128| 124| (((uint8_t *)(x))[1] << 16) + \ | | 129| 124| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ 181| 1.71k| &head->tab_num_ent) + (vs->block_size - 182| 1.71k| 1)) / vs->block_size), TSK_VS_PART_FLAG_META, 183| 1.71k| tab_str, -1, -1)) { 184| 0| free(sect_buf); 185| 0| return 1; 186| 0| } 187| | 188| | 189| | /* Process the partition table */ 190| 1.71k| if ((ent_buf = tsk_malloc(vs->block_size)) == NULL) { ------------------ | Branch (190:9): [True: 0, False: 1.71k] ------------------ 191| 0| free(sect_buf); 192| 0| return 1; 193| 0| } 194| | 195| 1.71k| i = 0; 196| 78.9k| for (a = 0; i < tsk_getu32(vs->endian, &head->tab_num_ent); a++) { ------------------ | | 119| 78.9k|#define tsk_getu32(endian, x) \ | | 120| 78.9k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 75.7k, False: 3.22k] | | ------------------ | | 121| 78.9k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 75.7k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 75.7k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 75.7k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 78.9k| : \ | | 126| 78.9k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 3.22k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 3.22k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 3.22k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (196:17): [True: 78.9k, False: 36] ------------------ 197| 78.9k| char *name; 198| | 199| | /* Read a sector */ 200| 78.9k| cnt = tsk_vs_read_block(vs, 201| 78.9k| tsk_getu64(vs->endian, &head->tab_start_lba) + a, ------------------ | | 171| 78.9k|#define tsk_getu64(endian, x) \ | | 172| 78.9k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 75.7k, False: 3.22k] | | ------------------ | | 173| 78.9k| ((uint64_t) \ | | 174| 75.7k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 75.7k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 75.7k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 75.7k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 75.7k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 75.7k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 75.7k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 75.7k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 78.9k| : \ | | 183| 78.9k| ((uint64_t) \ | | 184| 3.22k| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 3.22k| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 3.22k| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 3.22k| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 3.22k| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 3.22k| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 3.22k| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 3.22k| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 202| 78.9k| ent_buf, vs->block_size); 203| 78.9k| if (cnt != vs->block_size) { ------------------ | Branch (203:13): [True: 1.54k, False: 77.4k] ------------------ 204| 1.54k| if (cnt >= 0) { ------------------ | Branch (204:17): [True: 132, False: 1.41k] ------------------ 205| 132| tsk_error_reset(); 206| 132| tsk_error_set_errno(TSK_ERR_VS_READ); ------------------ | | 329| 132|#define TSK_ERR_VS_READ (TSK_ERR_VS | 2) | | ------------------ | | | | 300| 132|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 207| 132| } 208| 1.54k| tsk_error_set_errstr2 209| 1.54k| ("Error reading GPT partition table sector : %" PRIuDADDR, ------------------ | | 264| 1.54k|#define PRIuDADDR PRIu64 ------------------ 210| 1.54k| tsk_getu64(vs->endian, &head->tab_start_lba) + a); ------------------ | | 171| 1.54k|#define tsk_getu64(endian, x) \ | | 172| 1.54k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 1.50k, False: 42] | | ------------------ | | 173| 1.54k| ((uint64_t) \ | | 174| 1.50k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 1.50k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 1.50k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 1.50k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 1.50k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 1.50k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 1.50k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 1.50k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 1.54k| : \ | | 183| 1.54k| ((uint64_t) \ | | 184| 42| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 42| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 42| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 42| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 42| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 42| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 42| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 42| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 211| 1.54k| free(ent_buf); 212| 1.54k| free(sect_buf); 213| 1.54k| return 1; 214| 1.54k| } 215| | 216| | /* Process the sector */ 217| 77.4k| ent = (gpt_entry *) ent_buf; 218| 562k| for (; (uintptr_t) ent < (uintptr_t) ent_buf + vs->block_size && ------------------ | Branch (218:16): [True: 485k, False: 77.2k] ------------------ 219| 562k| i < tsk_getu32(vs->endian, &head->tab_num_ent); i++) { ------------------ | | 119| 485k|#define tsk_getu32(endian, x) \ | | 120| 485k|(uint32_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (120:13): [True: 462k, False: 23.6k] | | ------------------ | | 121| 485k| ((((uint8_t *)(x))[0] << 0) + \ | | 122| 462k| (((uint8_t *)(x))[1] << 8) + \ | | 123| 462k| (((uint8_t *)(x))[2] << 16) + \ | | 124| 462k| ((uint32_t)((uint8_t *)(x))[3] << 24) ) \ | | 125| 485k| : \ | | 126| 485k| ((((uint8_t *)(x))[3] << 0) + \ | | 127| 23.6k| (((uint8_t *)(x))[2] << 8) + \ | | 128| 23.6k| (((uint8_t *)(x))[1] << 16) + \ | | 129| 23.6k| ((uint32_t)((uint8_t *)(x))[0] << 24) ) ) ------------------ | Branch (219:13): [True: 485k, False: 11] ------------------ 220| | 221| 485k| UTF16 *name16; 222| 485k| UTF8 *name8; 223| 485k| int retVal; 224| | 225| 485k| if (tsk_verbose) ------------------ | Branch (225:17): [True: 0, False: 485k] ------------------ 226| 0| tsk_fprintf(stderr, 227| 0| "gpt_load: %d Starting Sector: %" PRIu64 228| 0| " End: %" PRIu64 " Flag: %" PRIx64 "\n", i, 229| 0| tsk_getu64(vs->endian, ent->start_lba), ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 230| 0| tsk_getu64(vs->endian, ent->end_lba), ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 231| 0| tsk_getu64(vs->endian, ent->flags)); ------------------ | | 171| 0|#define tsk_getu64(endian, x) \ | | 172| 0|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 0, False: 0] | | ------------------ | | 173| 0| ((uint64_t) \ | | 174| 0| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 0| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 0| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 0| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 0| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 0| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 0| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 0| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 0| : \ | | 183| 0| ((uint64_t) \ | | 184| 0| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 0| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 0| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 0| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 0| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 0| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 0| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 0| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 232| | 233| | 234| 485k| if (tsk_getu64(vs->endian, ent->start_lba) == 0) { ------------------ | | 171| 485k|#define tsk_getu64(endian, x) \ | | 172| 485k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 462k, False: 23.6k] | | ------------------ | | 173| 485k| ((uint64_t) \ | | 174| 462k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 462k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 462k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 462k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 462k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 462k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 462k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 462k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 485k| : \ | | 183| 485k| ((uint64_t) \ | | 184| 23.6k| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 23.6k| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 23.6k| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 23.6k| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 23.6k| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 23.6k| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 23.6k| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 23.6k| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (234:17): [True: 347k, False: 138k] ------------------ 235| 347k| ent++; 236| 347k| continue; 237| 347k| } 238| | 239| | // make sure the first couple are in the image bounds 240| 138k| if ((i < 2) ------------------ | Branch (240:17): [True: 463, False: 138k] ------------------ 241| 138k| && (tsk_getu64(vs->endian, ent->start_lba) > max_addr)) { ------------------ | | 171| 463|#define tsk_getu64(endian, x) \ | | 172| 463|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 356, False: 107] | | ------------------ | | 173| 463| ((uint64_t) \ | | 174| 356| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 356| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 356| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 356| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 356| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 356| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 356| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 356| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 463| : \ | | 183| 463| ((uint64_t) \ | | 184| 107| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 107| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 107| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 107| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 107| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 107| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 107| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 107| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ | Branch (241:20): [True: 138, False: 325] ------------------ 242| 138| tsk_error_reset(); 243| 138| tsk_error_set_errno(TSK_ERR_VS_BLK_NUM); ------------------ | | 333| 138|#define TSK_ERR_VS_BLK_NUM (TSK_ERR_VS | 6) | | ------------------ | | | | 300| 138|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 244| 138| tsk_error_set_errstr 245| 138| ("gpt_load_table: Starting sector too large for image"); 246| 138| free(sect_buf); 247| 138| free(ent_buf); 248| 138| return 1; 249| 138| } 250| | 251| | 252| 138k| if ((name = tsk_malloc(256)) == NULL) { ------------------ | Branch (252:17): [True: 0, False: 138k] ------------------ 253| 0| free(sect_buf); 254| 0| free(ent_buf); 255| 0| return 1; 256| 0| } 257| | 258| 138k| name16 = (UTF16 *) ((uintptr_t) ent->name); 259| 138k| name8 = (UTF8 *) name; 260| | 261| 138k| retVal = 262| 138k| tsk_UTF16toUTF8(vs->endian, (const UTF16 **) &name16, 263| 138k| (UTF16 *) ((uintptr_t) name16 + sizeof(ent->name)), 264| 138k| &name8, 265| 138k| (UTF8 *) ((uintptr_t) name8 + 256), TSKlenientConversion); 266| | 267| 138k| if (retVal != TSKconversionOK) { ------------------ | Branch (267:17): [True: 2.20k, False: 136k] ------------------ 268| 2.20k| if (tsk_verbose) ------------------ | Branch (268:21): [True: 0, False: 2.20k] ------------------ 269| 0| tsk_fprintf(stderr, 270| 0| "gpt_load_table: Error converting name to UTF8: %d\n", 271| 0| retVal); 272| 2.20k| *name = '\0'; 273| 2.20k| } 274| | 275| 138k| if (NULL == tsk_vs_part_add(vs, ------------------ | Branch (275:17): [True: 0, False: 138k] ------------------ 276| 138k| (TSK_DADDR_T) tsk_getu64(vs->endian, ent->start_lba), ------------------ | | 171| 138k|#define tsk_getu64(endian, x) \ | | 172| 138k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 127k, False: 10.6k] | | ------------------ | | 173| 138k| ((uint64_t) \ | | 174| 127k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 127k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 127k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 127k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 127k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 127k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 127k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 127k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 138k| : \ | | 183| 138k| ((uint64_t) \ | | 184| 10.6k| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 10.6k| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 10.6k| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 10.6k| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 10.6k| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 10.6k| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 10.6k| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 10.6k| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 277| 138k| (TSK_DADDR_T) (tsk_getu64(vs->endian, ------------------ | | 171| 138k|#define tsk_getu64(endian, x) \ | | 172| 138k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 127k, False: 10.6k] | | ------------------ | | 173| 138k| ((uint64_t) \ | | 174| 127k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 127k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 127k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 127k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 127k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 127k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 127k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 127k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 138k| : \ | | 183| 138k| ((uint64_t) \ | | 184| 10.6k| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 10.6k| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 10.6k| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 10.6k| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 10.6k| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 10.6k| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 10.6k| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 10.6k| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 278| 138k| ent->end_lba) - tsk_getu64(vs->endian, ------------------ | | 171| 138k|#define tsk_getu64(endian, x) \ | | 172| 138k|(uint64_t)( ((endian) == TSK_LIT_ENDIAN) ? \ | | ------------------ | | | Branch (172:13): [True: 127k, False: 10.6k] | | ------------------ | | 173| 138k| ((uint64_t) \ | | 174| 127k| ((uint64_t)((uint8_t *)(x))[0] << 0) + \ | | 175| 127k| ((uint64_t)((uint8_t *)(x))[1] << 8) + \ | | 176| 127k| ((uint64_t)((uint8_t *)(x))[2] << 16) + \ | | 177| 127k| ((uint64_t)((uint8_t *)(x))[3] << 24) + \ | | 178| 127k| ((uint64_t)((uint8_t *)(x))[4] << 32) + \ | | 179| 127k| ((uint64_t)((uint8_t *)(x))[5] << 40) + \ | | 180| 127k| ((uint64_t)((uint8_t *)(x))[6] << 48) + \ | | 181| 127k| ((uint64_t)((uint8_t *)(x))[7] << 56)) \ | | 182| 138k| : \ | | 183| 138k| ((uint64_t) \ | | 184| 10.6k| ((uint64_t)((uint8_t *)(x))[7] << 0) + \ | | 185| 10.6k| ((uint64_t)((uint8_t *)(x))[6] << 8) + \ | | 186| 10.6k| ((uint64_t)((uint8_t *)(x))[5] << 16) + \ | | 187| 10.6k| ((uint64_t)((uint8_t *)(x))[4] << 24) + \ | | 188| 10.6k| ((uint64_t)((uint8_t *)(x))[3] << 32) + \ | | 189| 10.6k| ((uint64_t)((uint8_t *)(x))[2] << 40) + \ | | 190| 10.6k| ((uint64_t)((uint8_t *)(x))[1] << 48) + \ | | 191| 10.6k| ((uint64_t)((uint8_t *)(x))[0] << 56)) ) ------------------ 279| 138k| ent->start_lba) + 1), TSK_VS_PART_FLAG_ALLOC, 280| 138k| name, -1, i)) { 281| 0| free(sect_buf); 282| 0| free(ent_buf); 283| 0| return 1; 284| 0| } 285| | 286| 138k| ent++; 287| 138k| } 288| 77.4k| } 289| | 290| 36| free(sect_buf); 291| 36| free(ent_buf); 292| 36| return 0; 293| 1.71k|} tsk_vs_read_block: 33| 91.9k|{ 34| 91.9k| if (a_len % a_vs->block_size) { ------------------ | Branch (34:9): [True: 0, False: 91.9k] ------------------ 35| 0| tsk_error_reset(); 36| 0| tsk_error_set_errno(TSK_ERR_VS_READ); ------------------ | | 329| 0|#define TSK_ERR_VS_READ (TSK_ERR_VS | 2) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 37| 0| tsk_error_set_errstr("tsk_vs_read_block: length %" PRIuSIZE "" 38| 0| " not a multiple of %d", a_len, a_vs->block_size); 39| 0| return -1; 40| 0| } 41| | 42| 91.9k| return tsk_img_read(a_vs->img_info, 43| 91.9k| a_vs->offset + (TSK_OFF_T) (a_addr * a_vs->block_size), 44| 91.9k| a_buf, a_len); 45| 91.9k|} tsk_vs_open: 37| 1.00k|{ 38| 1.00k| if (img_info == NULL) { ------------------ | Branch (38:9): [True: 0, False: 1.00k] ------------------ 39| | /* Opening the image file(s) failed, if attempted. */ 40| 0| tsk_error_reset(); 41| 0| tsk_error_set_errno(TSK_ERR_IMG_NOFILE); ------------------ | | 311| 0|#define TSK_ERR_IMG_NOFILE (TSK_ERR_IMG | 0) | | ------------------ | | | | 299| 0|#define TSK_ERR_IMG 0x02000000 | | ------------------ ------------------ 42| 0| tsk_error_set_errstr("mm_open"); 43| 0| return NULL; 44| 0| } 45| | 46| 1.00k| if (img_info->itype == TSK_IMG_TYPE_LOGICAL) { ------------------ | Branch (46:6): [True: 0, False: 1.00k] ------------------ 47| 0| tsk_error_reset(); 48| 0| tsk_error_set_errno(TSK_ERR_VS_UNSUPTYPE); ------------------ | | 328| 0|#define TSK_ERR_VS_UNSUPTYPE (TSK_ERR_VS | 1) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 49| 0| tsk_error_set_errstr("Logical image type can not have a volume system"); 50| 0| return NULL; 51| 0| } 52| | 53| | /* Autodetect mode 54| | * We need to try all of them in case there are multiple 55| | * installations 56| | * 57| | * NOte that errors that are encountered during the testing process 58| | * will not be reported 59| | */ 60| 1.00k| if (type == TSK_VS_TYPE_DETECT) { ------------------ | Branch (60:9): [True: 0, False: 1.00k] ------------------ 61| 0| TSK_VS_INFO *vs, *prev_vs = NULL; 62| 0| char *prev_type = NULL; 63| | 64| 0| if ((vs = tsk_vs_dos_open(img_info, offset, 1)) != NULL) { ------------------ | Branch (64:13): [True: 0, False: 0] ------------------ 65| 0| prev_type = "DOS"; 66| 0| prev_vs = vs; 67| 0| } 68| 0| else { 69| 0| tsk_error_reset(); 70| 0| } 71| | 72| 0| if ((vs = tsk_vs_bsd_open(img_info, offset)) != NULL) { ------------------ | Branch (72:13): [True: 0, False: 0] ------------------ 73| | // if (prev_type == NULL) { 74| | // In this case, BSD takes priority because BSD partitions start off with 75| | // the DOS magic value in the first sector with the boot code. 76| 0| prev_type = "BSD"; 77| 0| prev_vs = vs; 78| | /* 79| | } 80| | else { 81| | prev_vs->close(prev_vs); 82| | vs->close(vs); 83| | tsk_error_reset(); 84| | tsk_error_set_errno(TSK_ERR_VS_UNKTYPE); 85| | tsk_error_set_errstr( 86| | "BSD or %s at %" PRIuDADDR, prev_type, offset); 87| | tsk_errstr2[0] = '\0'; 88| | return NULL; 89| | } 90| | */ 91| 0| } 92| 0| else { 93| 0| tsk_error_reset(); 94| 0| } 95| | 96| 0| if ((vs = tsk_vs_gpt_open(img_info, offset)) != NULL) { ------------------ | Branch (96:13): [True: 0, False: 0] ------------------ 97| | 98| 0| if ((prev_type != NULL) && (strcmp(prev_type, "DOS") == 0) && (vs->is_backup)) { ------------------ | Branch (98:17): [True: 0, False: 0] | Branch (98:40): [True: 0, False: 0] | Branch (98:75): [True: 0, False: 0] ------------------ 99| | /* In this case we've found a DOS partition and a backup GPT partition. 100| | * The DOS partition takes priority in this case (and are already in prev_type and prev_vs) */ 101| 0| vs->close(vs); 102| 0| if (tsk_verbose) ------------------ | Branch (102:21): [True: 0, False: 0] ------------------ 103| 0| tsk_fprintf(stderr, 104| 0| "mm_open: Ignoring secondary GPT Partition\n"); 105| 0| } 106| 0| else { 107| 0| if (prev_type != NULL) { ------------------ | Branch (107:21): [True: 0, False: 0] ------------------ 108| | 109| | /* GPT drives have a DOS Safety partition table. 110| | * Test to see if the GPT has a safety partiiton 111| | * and then we can igore the DOS */ 112| 0| if (strcmp(prev_type, "DOS") == 0) { ------------------ | Branch (112:25): [True: 0, False: 0] ------------------ 113| 0| TSK_VS_PART_INFO *tmp_set; 114| 0| for (tmp_set = prev_vs->part_list; tmp_set; ------------------ | Branch (114:60): [True: 0, False: 0] ------------------ 115| 0| tmp_set = tmp_set->next) { 116| 0| if ((tmp_set->desc) ------------------ | Branch (116:33): [True: 0, False: 0] ------------------ 117| 0| && (strncmp(tmp_set->desc, "GPT Safety", ------------------ | Branch (117:36): [True: 0, False: 0] ------------------ 118| 0| 10) == 0) 119| 0| && (tmp_set->start <= 63)) { ------------------ | Branch (119:36): [True: 0, False: 0] ------------------ 120| | 121| 0| if (tsk_verbose) ------------------ | Branch (121:37): [True: 0, False: 0] ------------------ 122| 0| tsk_fprintf(stderr, 123| 0| "mm_open: Ignoring DOS Safety GPT Partition\n"); 124| 0| prev_type = NULL; 125| 0| prev_vs->close(prev_vs); 126| 0| prev_vs = NULL; 127| 0| break; 128| 0| } 129| 0| } 130| 0| } 131| | 132| | /* If we never found the safety, then we have a conflict. */ 133| 0| if (prev_type != NULL) { ------------------ | Branch (133:25): [True: 0, False: 0] ------------------ 134| 0| prev_vs->close(prev_vs); 135| 0| vs->close(vs); 136| 0| tsk_error_reset(); 137| 0| tsk_error_set_errno(TSK_ERR_VS_MULTTYPE); ------------------ | | 336| 0|#define TSK_ERR_VS_MULTTYPE (TSK_ERR_VS | 9) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 138| 0| tsk_error_set_errstr("GPT or %s at %" PRIuDADDR, prev_type, ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 139| 0| offset); 140| 0| return NULL; 141| 0| } 142| 0| } 143| 0| prev_type = "GPT"; 144| 0| prev_vs = vs; 145| 0| } 146| 0| } 147| 0| else { 148| 0| tsk_error_reset(); 149| 0| } 150| | 151| 0| if ((vs = tsk_vs_sun_open(img_info, offset)) != NULL) { ------------------ | Branch (151:13): [True: 0, False: 0] ------------------ 152| 0| if (prev_type == NULL) { ------------------ | Branch (152:17): [True: 0, False: 0] ------------------ 153| 0| prev_type = "Sun"; 154| 0| prev_vs = vs; 155| 0| } 156| 0| else { 157| 0| prev_vs->close(prev_vs); 158| 0| vs->close(vs); 159| 0| tsk_error_reset(); 160| 0| tsk_error_set_errno(TSK_ERR_VS_MULTTYPE); ------------------ | | 336| 0|#define TSK_ERR_VS_MULTTYPE (TSK_ERR_VS | 9) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 161| 0| tsk_error_set_errstr("Sun or %s at %" PRIuDADDR, prev_type, ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 162| 0| offset); 163| 0| return NULL; 164| 0| } 165| 0| } 166| 0| else { 167| 0| tsk_error_reset(); 168| 0| } 169| | 170| 0| if ((vs = tsk_vs_mac_open(img_info, offset)) != NULL) { ------------------ | Branch (170:13): [True: 0, False: 0] ------------------ 171| 0| if (prev_type == NULL) { ------------------ | Branch (171:17): [True: 0, False: 0] ------------------ 172| 0| prev_type = "Mac"; 173| 0| prev_vs = vs; 174| 0| } 175| 0| else { 176| 0| prev_vs->close(prev_vs); 177| 0| vs->close(vs); 178| 0| tsk_error_reset(); 179| 0| tsk_error_set_errno(TSK_ERR_VS_MULTTYPE); ------------------ | | 336| 0|#define TSK_ERR_VS_MULTTYPE (TSK_ERR_VS | 9) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 180| 0| tsk_error_set_errstr("Mac or %s at %" PRIuDADDR, prev_type, ------------------ | | 264| 0|#define PRIuDADDR PRIu64 ------------------ 181| 0| offset); 182| 0| return NULL; 183| 0| } 184| 0| } 185| 0| else { 186| 0| tsk_error_reset(); 187| 0| } 188| | 189| 0| if (prev_vs == NULL) { ------------------ | Branch (189:13): [True: 0, False: 0] ------------------ 190| 0| tsk_error_reset(); 191| | 192| | // Check whether the volume system appears to be encrypted. 193| | // Note that detectDiskEncryption does not do an entropy calculation - high entropy 194| | // files will be reported by tsk_fs_open_img(). 195| 0| encryption_detected_result* result = detectDiskEncryption(img_info, offset); 196| 0| if (result != NULL) { ------------------ | Branch (196:17): [True: 0, False: 0] ------------------ 197| 0| if (result->encryptionType == ENCRYPTION_DETECTED_SIGNATURE) { ------------------ | Branch (197:21): [True: 0, False: 0] ------------------ 198| 0| tsk_error_set_errno(TSK_ERR_VS_ENCRYPTED); ------------------ | | 335| 0|#define TSK_ERR_VS_ENCRYPTED (TSK_ERR_VS | 8) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 199| 0| tsk_error_set_errstr("%s", result->desc); 200| 0| } 201| 0| free(result); 202| 0| result = NULL; 203| 0| } 204| 0| else { 205| 0| tsk_error_set_errno(TSK_ERR_VS_UNKTYPE); ------------------ | | 327| 0|#define TSK_ERR_VS_UNKTYPE (TSK_ERR_VS | 0) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 206| 0| } 207| 0| return NULL; 208| 0| } 209| | 210| 0| return prev_vs; 211| 0| } 212| | 213| | // Not autodetect 214| 1.00k| else { 215| | 216| 1.00k| switch (type) { 217| 0| case TSK_VS_TYPE_DOS: ------------------ | Branch (217:9): [True: 0, False: 1.00k] ------------------ 218| 0| return tsk_vs_dos_open(img_info, offset, 0); 219| 0| case TSK_VS_TYPE_MAC: ------------------ | Branch (219:9): [True: 0, False: 1.00k] ------------------ 220| 0| return tsk_vs_mac_open(img_info, offset); 221| 0| case TSK_VS_TYPE_BSD: ------------------ | Branch (221:9): [True: 0, False: 1.00k] ------------------ 222| 0| return tsk_vs_bsd_open(img_info, offset); 223| 0| case TSK_VS_TYPE_SUN: ------------------ | Branch (223:9): [True: 0, False: 1.00k] ------------------ 224| 0| return tsk_vs_sun_open(img_info, offset); 225| 1.00k| case TSK_VS_TYPE_GPT: ------------------ | Branch (225:9): [True: 1.00k, False: 0] ------------------ 226| 1.00k| return tsk_vs_gpt_open(img_info, offset); 227| 0| case TSK_VS_TYPE_APFS: // Not supported yet ------------------ | Branch (227:9): [True: 0, False: 1.00k] ------------------ 228| 0| case TSK_VS_TYPE_UNSUPP: ------------------ | Branch (228:9): [True: 0, False: 1.00k] ------------------ 229| 0| default: ------------------ | Branch (229:9): [True: 0, False: 1.00k] ------------------ 230| 0| tsk_error_reset(); 231| 0| tsk_error_set_errno(TSK_ERR_VS_UNSUPTYPE); ------------------ | | 328| 0|#define TSK_ERR_VS_UNSUPTYPE (TSK_ERR_VS | 1) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 232| 0| tsk_error_set_errstr("%d", type); 233| 0| return NULL; 234| 1.00k| } 235| 1.00k| } 236| 1.00k|} tsk_vs_close: 245| 36|{ 246| 36| if (a_vs == NULL) { ------------------ | Branch (246:9): [True: 0, False: 36] ------------------ 247| 0| return; 248| 0| } 249| 36| a_vs->close((TSK_VS_INFO *) a_vs); 250| 36|} tsk_vs_part_add: 32| 156k|{ 33| 156k| TSK_VS_PART_INFO *part; 34| 156k| TSK_VS_PART_INFO *cur_part; 35| | 36| 156k| if ((part = ------------------ | Branch (36:9): [True: 0, False: 156k] ------------------ 37| 156k| (TSK_VS_PART_INFO *) tsk_malloc(sizeof(TSK_VS_PART_INFO))) == 38| 156k| NULL) { 39| 0| return NULL; 40| 0| } 41| | 42| | /* set the values */ 43| 156k| part->next = NULL; 44| 156k| part->prev = NULL; 45| 156k| part->start = a_start; 46| 156k| part->len = len; 47| 156k| part->desc = desc; 48| 156k| part->table_num = table; 49| 156k| part->slot_num = slot; 50| 156k| part->flags = type; 51| 156k| part->vs = a_vs; 52| 156k| part->addr = 0; 53| 156k| part->tag = TSK_VS_PART_INFO_TAG; ------------------ | | 118| 156k|#define TSK_VS_PART_INFO_TAG 0x40121253 ------------------ 54| | 55| | /* is this the first entry in the list */ 56| 156k| if (a_vs->part_list == NULL) { ------------------ | Branch (56:9): [True: 1.71k, False: 154k] ------------------ 57| 1.71k| a_vs->part_list = part; 58| 1.71k| a_vs->part_count = 1; 59| 1.71k| return part; 60| 1.71k| } 61| | 62| | /* Cycle through to find the correct place to put it into */ 63| 119M| for (cur_part = a_vs->part_list; cur_part != NULL; ------------------ | Branch (63:38): [True: 119M, False: 0] ------------------ 64| 119M| cur_part = cur_part->next) { 65| | /* The one to add starts before this partition */ 66| 119M| if (cur_part->start > part->start) { ------------------ | Branch (66:13): [True: 262, False: 119M] ------------------ 67| 262| part->next = cur_part; 68| 262| part->prev = cur_part->prev; 69| 262| if (part->prev) ------------------ | Branch (69:17): [True: 0, False: 262] ------------------ 70| 0| part->prev->next = part; 71| 262| cur_part->prev = part; 72| | 73| | /* If we are now the head update a_vs */ 74| 262| if (part->prev == NULL) ------------------ | Branch (74:17): [True: 262, False: 0] ------------------ 75| 262| a_vs->part_list = part; 76| | 77| | /* update the count and address numbers */ 78| 262| a_vs->part_count++; 79| 262| part->addr = cur_part->addr; 80| 7.41k| for (; cur_part != NULL; cur_part = cur_part->next) ------------------ | Branch (80:20): [True: 7.15k, False: 262] ------------------ 81| 7.15k| cur_part->addr++; 82| | 83| 262| return part; 84| 262| } 85| | 86| | /* the one to add is bigger then current and the list is done */ 87| 119M| else if (cur_part->next == NULL) { ------------------ | Branch (87:18): [True: 13.0k, False: 119M] ------------------ 88| 13.0k| cur_part->next = part; 89| 13.0k| part->prev = cur_part; 90| | 91| | /* Update partition counts and addresses */ 92| 13.0k| a_vs->part_count++; 93| 13.0k| part->addr = cur_part->addr + 1; 94| 13.0k| return part; 95| 13.0k| } 96| | 97| | /* The one to add fits in between this and the next */ 98| 119M| else if (cur_part->next->start > part->start) { ------------------ | Branch (98:18): [True: 141k, False: 119M] ------------------ 99| 141k| part->prev = cur_part; 100| 141k| part->next = cur_part->next; 101| 141k| cur_part->next->prev = part; 102| 141k| cur_part->next = part; 103| | 104| | /* Update partition counts and addresses */ 105| 141k| a_vs->part_count++; 106| 141k| part->addr = cur_part->addr + 1; 107| 136M| for (cur_part = part->next; cur_part != NULL; ------------------ | Branch (107:41): [True: 136M, False: 141k] ------------------ 108| 136M| cur_part = cur_part->next) 109| 136M| cur_part->addr++; 110| 141k| return part; 111| 141k| } 112| 119M| } 113| 0| return NULL; 114| 154k|} tsk_vs_part_unused: 125| 36|{ 126| 36| TSK_VS_PART_INFO *part = a_vs->part_list; 127| 36| TSK_DADDR_T prev_end = 0; 128| | 129| | /* prev_ent is set to where the previous entry stopped plus 1 */ 130| 26.1k| for (part = a_vs->part_list; part != NULL; part = part->next) { ------------------ | Branch (130:34): [True: 26.0k, False: 36] ------------------ 131| | 132| | // ignore the META volume 133| 26.0k| if (part->flags & TSK_VS_PART_FLAG_META) ------------------ | Branch (133:13): [True: 80, False: 25.9k] ------------------ 134| 80| continue; 135| | 136| | // there is space before current and previous volume 137| 25.9k| if (part->start > prev_end) { ------------------ | Branch (137:13): [True: 14.4k, False: 11.5k] ------------------ 138| 14.4k| char *str; 139| 14.4k| if ((str = tsk_malloc(12)) == NULL) ------------------ | Branch (139:17): [True: 0, False: 14.4k] ------------------ 140| 0| return 1; 141| | 142| 14.4k| snprintf(str, 12, "Unallocated"); 143| 14.4k| if (NULL == tsk_vs_part_add(a_vs, prev_end, ------------------ | Branch (143:17): [True: 0, False: 14.4k] ------------------ 144| 14.4k| part->start - prev_end, TSK_VS_PART_FLAG_UNALLOC, str, 145| 14.4k| -1, -1)) { 146| 0| free(str); 147| 0| return 1; 148| 0| } 149| 14.4k| } 150| | 151| 25.9k| prev_end = part->start + part->len; 152| 25.9k| } 153| | 154| | /* Is there unallocated space at the end? */ 155| 36| if (prev_end < (TSK_DADDR_T) (a_vs->img_info->size / a_vs->block_size)) { ------------------ | Branch (155:9): [True: 3, False: 33] ------------------ 156| 3| char *str; 157| 3| if ((str = tsk_malloc(12)) == NULL) ------------------ | Branch (157:13): [True: 0, False: 3] ------------------ 158| 0| return 1; 159| | 160| 3| snprintf(str, 12, "Unallocated"); 161| 3| if (NULL == tsk_vs_part_add(a_vs, prev_end, ------------------ | Branch (161:13): [True: 0, False: 3] ------------------ 162| 3| a_vs->img_info->size / a_vs->block_size - prev_end, 163| 3| TSK_VS_PART_FLAG_UNALLOC, str, -1, -1)) { 164| 0| free(str); 165| 0| return 1; 166| 0| } 167| 3| } 168| | 169| 36| return 0; 170| 36|} tsk_vs_part_free: 177| 12.8k|{ 178| 12.8k| TSK_VS_PART_INFO *part = a_vs->part_list; 179| 12.8k| TSK_VS_PART_INFO *part2; 180| | 181| 169k| while (part) { ------------------ | Branch (181:12): [True: 156k, False: 12.8k] ------------------ 182| 156k| free(part->desc); 183| 156k| part->tag = 0; 184| 156k| part2 = part->next; 185| 156k| free(part); 186| 156k| part = part2; 187| 156k| } 188| 12.8k| a_vs->part_list = NULL; 189| 12.8k|} tsk_vs_part_walk: 244| 36|{ 245| 36| TSK_VS_PART_INFO *part; 246| | 247| 36| if (a_start >= a_vs->part_count) { ------------------ | Branch (247:9): [True: 0, False: 36] ------------------ 248| 0| tsk_error_reset(); 249| 0| tsk_error_set_errno(TSK_ERR_VS_WALK_RNG); ------------------ | | 331| 0|#define TSK_ERR_VS_WALK_RNG (TSK_ERR_VS | 4) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 250| 0| tsk_error_set_errstr 251| 0| ("tsk_vs_part_walk: Start partition too large: %" PRIuPNUM "", 252| 0| a_start); 253| 0| return 1; 254| 0| } 255| | 256| 36| if (a_last >= a_vs->part_count) { ------------------ | Branch (256:9): [True: 0, False: 36] ------------------ 257| 0| tsk_error_reset(); 258| 0| tsk_error_set_errno(TSK_ERR_VS_WALK_RNG); ------------------ | | 331| 0|#define TSK_ERR_VS_WALK_RNG (TSK_ERR_VS | 4) | | ------------------ | | | | 300| 0|#define TSK_ERR_VS 0x04000000 | | ------------------ ------------------ 259| 0| tsk_error_set_errstr("tsk_vs_part_walk: End partition too large: %" 260| 0| PRIuPNUM "", a_last); 261| 0| return 1; 262| 0| } 263| | 264| 36| if (a_flags == 0) { ------------------ | Branch (264:9): [True: 0, False: 36] ------------------ 265| 0| a_flags |= 266| 0| (TSK_VS_PART_FLAG_ALLOC | TSK_VS_PART_FLAG_UNALLOC | 267| 0| TSK_VS_PART_FLAG_META); 268| 0| } 269| | 270| 40.5k| for (part = a_vs->part_list; part != NULL; part = part->next) { ------------------ | Branch (270:34): [True: 40.5k, False: 0] ------------------ 271| 40.5k| if ((part->addr >= a_start) && ((part->flags & a_flags) != 0)) { ------------------ | Branch (271:13): [True: 40.5k, False: 0] | Branch (271:40): [True: 40.5k, False: 0] ------------------ 272| 40.5k| switch (a_action(a_vs, part, a_ptr)) { ------------------ | Branch (272:21): [True: 0, False: 40.5k] ------------------ 273| 40.5k| case TSK_WALK_CONT: break; ------------------ | Branch (273:13): [True: 40.5k, False: 0] ------------------ 274| 0| case TSK_WALK_STOP: return 0; ------------------ | Branch (274:13): [True: 0, False: 40.5k] ------------------ 275| 0| case TSK_WALK_ERROR: return 1; ------------------ | Branch (275:13): [True: 0, False: 40.5k] ------------------ 276| 40.5k| } 277| 40.5k| } 278| | 279| 40.5k| if (part->addr >= a_last) ------------------ | Branch (279:13): [True: 36, False: 40.4k] ------------------ 280| 36| break; 281| 40.5k| } 282| 36| return 0; 283| 36|} LLVMFuzzerTestOneInput: 30| 1.00k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 31| 1.00k| TSK_IMG_INFO *img; 32| 1.00k| TSK_VS_INFO *vs; 33| | 34| 1.00k| img = mem_open(data, size); 35| 1.00k| if (img == nullptr) ------------------ | Branch (35:7): [True: 0, False: 1.00k] ------------------ 36| 0| return 0; 37| | 38| 1.00k| vs = tsk_vs_open(img, 0, VSTYPE); 39| 1.00k| if (vs != nullptr) { ------------------ | Branch (39:7): [True: 36, False: 966] ------------------ 40| 36| tsk_vs_part_walk(vs, 0, vs->part_count - 1, TSK_VS_PART_FLAG_ALL, part_act, 41| 36| nullptr); 42| | 43| 36| tsk_vs_close(vs); 44| 36| } 45| | 46| 1.00k| img->close(img); 47| 1.00k| return 0; 48| 1.00k|} sleuthkit_mmls_fuzzer.cc:_ZL8part_actP11TSK_VS_INFOPK16TSK_VS_PART_INFOPv: 26| 40.5k| void *ptr) { 27| 40.5k| return TSK_WALK_CONT; 28| 40.5k|}