search for: check_child_is_nk_block

...k = 1; > + } else { > + DEBUG(2, As before, space before parens in function and macro calls. > @@ -408,7 +407,7 @@ _get_children (hive_h *h, hive_node_h blkoff, > hive_node_h subkey = le32toh (lf->keys[i].offset); > subkey += 0x1000; > if (check_child_is_nk_block (h, subkey, flags) == -1) > - return -1; > + continue; I think this deserves a debug message. There is also a further call to check_child_is_nk_block in this function, but if that fails it still returns. Why is that case different? Rich. > if (_hivex_add_to_offset...

...sion) and other "corrupted" and irrelevant keys might prevent one from doing so. Changes in v2: * fixed code formatting * added more debug statements * do not depend on bad_root_block variable, instead report error and exit if root block is corrupted * handle the missed case where check_child_is_nk_block was still returning instead of skipping faulty block with debug message Regards, Dawid Zamirski (2): lib: change how hbin sections are read. lib: allow to walk registry with corrupted blocks lib/handle.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++--------- lib/node.c | 21 ++++...

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

Hello, The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be

The following patches address issues when dealing with hives that have corrupted data in them but are otherwise readable/writable. Those were found on some rather rare Windows installations that seem to work fine but current hivex fails to even open. Those patches change hivex to simply log and ignore such "corrupted" regions instead of aborting because the caller might be looking at

...%zu " + "is not equal to number of children read %zu", + nr_subkeys_in_nk, nr_children); } out: @@ -408,7 +407,7 @@ _get_children (hive_h *h, hive_node_h blkoff, hive_node_h subkey = le32toh (lf->keys[i].offset); subkey += 0x1000; if (check_child_is_nk_block (h, subkey, flags) == -1) - return -1; + continue; if (_hivex_add_to_offset_list (children, subkey) == -1) return -1; } -- 2.9.3

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.