search for: hivex_value_key_len

...uot;, "\ diff --git a/lib/hivex.c b/lib/hivex.c index 4b9fcf0..61177d3 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -1189,8 +1189,8 @@ hivex_node_get_value (hive_h *h, hive_node_h node, const char *key) return ret; } -char * -hivex_value_key (hive_h *h, hive_value_h value) +size_t +hivex_value_key_len (hive_h *h, hive_value_h value) { if (!IS_VALID_BLOCK (h, value) || !BLOCK_ID_EQ (h, value, "vk")) { errno = EINVAL; @@ -1199,23 +1199,38 @@ hivex_value_key (hive_h *h, hive_value_h value) struct ntreg_vk_record *vk = (struct ntreg_vk_record *) (h->addr + value); - /*...

...ct ntreg_vk_record *vk = > (struct ntreg_vk_record *) ((char *) h->addr + value); > > - /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is > - * necessary. However we do need to nul-terminate the string. > - */ > - errno = 0; > - size_t len = hivex_value_key_len (h, value); > - if (len == 0 && errno != 0) > - return NULL; > size_t flags = le16toh (vk->flags); > + size_t len = le16toh (vk->name_len); I think this effectively removes a check. hivex_value_key_len contains this code: size_t seg_len = block_len (h, value,...

...errno = EFAULT; + return 0; + } + return ret; +} + char * hivex_node_name (hive_h *h, hive_node_h node) { @@ -1190,6 +1214,15 @@ hivex_node_get_value (hive_h *h, hive_node_h node, const char *key) } size_t +hivex_value_struct_length (hive_h *h, hive_value_h value) { + size_t key_len = hivex_value_key_len (h, value); + if (errno) + return 0; + /* -1 to avoid double-counting the first name character */ + return key_len + sizeof (struct ntreg_vk_record) - 1; +} + +size_t hivex_value_key_len (hive_h *h, hive_value_h value) { if (!IS_VALID_BLOCK (h, value) || !BLOCK_ID_EQ (h, value, "vk&...

...e_h *h, hive_value_h value) struct ntreg_vk_record *vk = (struct ntreg_vk_record *) ((char *) h->addr + value); - /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is - * necessary. However we do need to nul-terminate the string. - */ - errno = 0; - size_t len = hivex_value_key_len (h, value); - if (len == 0 && errno != 0) - return NULL; size_t flags = le16toh (vk->flags); + size_t len = le16toh (vk->name_len); + + size_t seg_len = block_len (h, value, NULL); + if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { + SET_ERRNO (EFAULT, "...

...node_name (hive_h *h, hive_node_h node) { @@ -1189,8 +1213,17 @@ hivex_node_get_value (hive_h *h, hive_node_h node, const char *key) return ret; } -char * -hivex_value_key (hive_h *h, hive_value_h value) +size_t +hivex_value_struct_length (hive_h *h, hive_value_h value) { + size_t key_len = hivex_value_key_len (h, value); + if (errno) + return 0; + /* -1 to avoid double-counting the first name character */ + return key_len + sizeof (struct ntreg_vk_record) - 1; +} + +size_t +hivex_value_key_len (hive_h *h, hive_value_h value) { if (!IS_VALID_BLOCK (h, value) || !BLOCK_ID_EQ (h, value, "vk&...

...e_h *h, hive_value_h value) struct ntreg_vk_record *vk = (struct ntreg_vk_record *) ((char *) h->addr + value); - /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is - * necessary. However we do need to nul-terminate the string. - */ - errno = 0; - size_t len = hivex_value_key_len (h, value); - if (len == 0 && errno != 0) - return NULL; size_t flags = le16toh (vk->flags); + size_t len = le16toh (vk->name_len); if (flags & 0x01) { return _hivex_windows_latin1_to_utf8 (vk->name, len); } else { -- 1.8.5.2

Hi, Here is one trivial initialization fix and another patch to convert a huge macro to an inline function. The result of the expansion would show up in an assertion which triggered a -Woverlength-strings warning. Peter Wu (2): Fix garbage return value on error Fix overly long assertion string lib/hivex-internal.h | 28 ++++++++++++++++------------ lib/node.c | 18

--- images/README | 14 ++++++++++++ images/mkzero/Makefile | 9 ++++++++ images/mkzero/mkzero.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ images/special | Bin 0 -> 8192 bytes 4 files changed, 82 insertions(+) create mode 100644 images/mkzero/Makefile create mode 100644 images/mkzero/mkzero.c create mode 100644 images/special diff --git a/images/README

...t = 0; - char *buf = _hivex_recode(encoding, str, len, "UTF-8", &ret); + char *buf = _hivex_recode (h, t, str, len, &ret); free(buf); return ret; } diff --git a/lib/value.c b/lib/value.c index 2dfe006..3257b53 100644 --- a/lib/value.c +++ b/lib/value.c @@ -209,7 +209,7 @@ hivex_value_key_len (hive_h *h, hive_value_h value) SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); return 0; } - return _hivex_utf8_strlen (vk->name, len, ! (le16toh (vk->flags) & 0x01)); + return _hivex_utf8_strlen (h, vk->name, len, ! (le16toh (vk->fla...

--- lib/hivex-internal.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index f391b98..d7ce339 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -125,7 +125,19 @@ struct ntreg_hbin_block { struct ntreg_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2];

...str, len, "UTF-8", &ret); > + char *buf = _hivex_recode (h, t, str, len, &ret); > free(buf); > return ret; > } > diff --git a/lib/value.c b/lib/value.c > index 2dfe006..3257b53 100644 > --- a/lib/value.c > +++ b/lib/value.c > @@ -209,7 +209,7 @@ hivex_value_key_len (hive_h *h, hive_value_h value) > SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); > return 0; > } > - return _hivex_utf8_strlen (vk->name, len, ! (le16toh (vk->flags) & 0x01)); > + return _hivex_utf8_strlen (h, vk->name, le...

...t = 0; - char *buf = _hivex_recode(encoding, str, len, "UTF-8", &ret); + char *buf = _hivex_recode (h, t, str, len, &ret); free(buf); return ret; } diff --git a/lib/value.c b/lib/value.c index 2dfe006..3257b53 100644 --- a/lib/value.c +++ b/lib/value.c @@ -209,7 +209,7 @@ hivex_value_key_len (hive_h *h, hive_value_h value) SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); return 0; } - return _hivex_utf8_strlen (vk->name, len, ! (le16toh (vk->flags) & 0x01)); + return _hivex_utf8_strlen (h, vk->name, len, ! (le16toh (vk->fla...

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.