search for: le16toh

...;addr + value); - /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is - * necessary. However we do need to nul-terminate the string. - */ - errno = 0; - size_t len = hivex_value_key_len (h, value); - if (len == 0 && errno != 0) - return NULL; size_t flags = le16toh (vk->flags); + size_t len = le16toh (vk->name_len); + + size_t seg_len = block_len (h, value, NULL); + if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { + SET_ERRNO (EFAULT, "key length is too long (%zu, %zu)", len, seg_len); + return 0; + } if (flags &...

...ey is always plain ASCII, so no conversion to UTF-8 is > - * necessary. However we do need to nul-terminate the string. > - */ > - errno = 0; > - size_t len = hivex_value_key_len (h, value); > - if (len == 0 && errno != 0) > - return NULL; > size_t flags = le16toh (vk->flags); > + size_t len = le16toh (vk->name_len); I think this effectively removes a check. hivex_value_key_len contains this code: size_t seg_len = block_len (h, value, NULL); if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { SET_ERRNO (EFAULT, "key length...

..._h *h, const char* str, size_t len, int utf16); /* util.c */ extern void _hivex_free_strings (char **argv); diff --git a/lib/node.c b/lib/node.c index 36e61c4..21cd127 100644 --- a/lib/node.c +++ b/lib/node.c @@ -90,9 +90,9 @@ hivex_node_name (hive_h *h, hive_node_h node) } size_t flags = le16toh (nk->flags); if (flags & 0x20) { - return _hivex_windows_latin1_to_utf8 (nk->name, len); + return _hivex_recode (h, latin1_to_utf8, nk->name, len, NULL); } else { - return _hivex_windows_utf16_to_utf8 (nk->name, len); + return _hivex_recode (h, utf16le_to_utf8, nk-...

.... */ > struct ntreg_nk_record *parent_nk = > @@ -719,9 +731,9 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) > parent_nk->nr_subkeys = htole32 (nr_subkeys_in_parent_nk); > > /* Update max_subkey_name_len in parent nk. */ > - uint16_t max = le16toh (parent_nk->max_subkey_name_len); > - if (max < strlen (name) * 2) /* *2 because "recoded" in UTF16-LE. */ > - parent_nk->max_subkey_name_len = htole16 (strlen (name) * 2); > + size_t utf16_len = use_utf16 ? recoded_name_len : recoded_name_len * 2; * 2 is probably...

--- lib/hivex-internal.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index f391b98..d7ce339 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -125,7 +125,19 @@ struct ntreg_hbin_block { struct ntreg_nk_record { int32_t seg_len; /* length (always -ve because used) */ char id[2];

...me); /* Inherit parent sk. */ struct ntreg_nk_record *parent_nk = @@ -719,9 +731,9 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) parent_nk->nr_subkeys = htole32 (nr_subkeys_in_parent_nk); /* Update max_subkey_name_len in parent nk. */ - uint16_t max = le16toh (parent_nk->max_subkey_name_len); - if (max < strlen (name) * 2) /* *2 because "recoded" in UTF16-LE. */ - parent_nk->max_subkey_name_len = htole16 (strlen (name) * 2); + size_t utf16_len = use_utf16 ? recoded_name_len : recoded_name_len * 2; + if (le16toh (parent_nk->m...

...t; > /* util.c */ > extern void _hivex_free_strings (char **argv); > diff --git a/lib/node.c b/lib/node.c > index 36e61c4..21cd127 100644 > --- a/lib/node.c > +++ b/lib/node.c > @@ -90,9 +90,9 @@ hivex_node_name (hive_h *h, hive_node_h node) > } > size_t flags = le16toh (nk->flags); > if (flags & 0x20) { > - return _hivex_windows_latin1_to_utf8 (nk->name, len); > + return _hivex_recode (h, latin1_to_utf8, nk->name, len, NULL); > } else { > - return _hivex_windows_utf16_to_utf8 (nk->name, len); > + return _hivex_r...

..._h *h, const char* str, size_t len, int utf16); /* util.c */ extern void _hivex_free_strings (char **argv); diff --git a/lib/node.c b/lib/node.c index 36e61c4..21cd127 100644 --- a/lib/node.c +++ b/lib/node.c @@ -90,9 +90,9 @@ hivex_node_name (hive_h *h, hive_node_h node) } size_t flags = le16toh (nk->flags); if (flags & 0x20) { - return _hivex_windows_latin1_to_utf8 (nk->name, len); + return _hivex_recode (h, latin1_to_utf8, nk->name, len, NULL); } else { - return _hivex_windows_utf16_to_utf8 (nk->name, len); + return _hivex_recode (h, utf16le_to_utf8, nk-...

On Windows, there exist at least two APIs for dealing with the Registry: The Win32 API (RegCreateKeyA, RegCreateKeyW, etc.) works with null-terminated ASCII or UTF-16 strings. The native API (ZwCreateKey, etc.), on the other hand works with UTF-16 strings that are stored as buffers+length and may contain null characters. Malware authors have been relying on the Win32 API's inability to

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.

...s */ + memcpy (&data1, guid_bytes, sizeof (data1)); + memcpy (&data2, guid_bytes + 4, sizeof (data2)); + memcpy (&data3, guid_bytes + 6, sizeof (data3)); + memcpy (&data4, guid_bytes + 8, sizeof (data4)); + + /* ensure proper endianness */ + data1 = le32toh (data1); + data2 = le16toh (data2); + data3 = le16toh (data3); + data4 = be64toh (data4); + + return safe_asprintf (g, + "%08" PRIX32 "-%04" PRIX16 "-%04" PRIX16 "-%04" PRIX64 "-%06" PRIX64, + data1, data2, data3, (data4 >> 48), (data4 << 16...

...TIN1") extern size_t _hivex_utf16_string_len_in_bytes_max (const char *str, size_t len); /* util.c */ diff --git a/lib/node.c b/lib/node.c index fda4592..fcd7442 100644 --- a/lib/node.c +++ b/lib/node.c @@ -90,12 +90,7 @@ hivex_node_name (hive_h *h, hive_node_h node) } size_t flags = le16toh (nk->flags); if (flags & 0x20) { - char *ret = malloc (len + 1); - if (ret == NULL) - return NULL; - memcpy (ret, nk->name, len); - ret[len] = '\0'; - return ret; + return _hivex_windows_latin1_to_utf8 (nk->name, len); } else { return _hivex_wi...

...;addr + value); - /* AFAIK the key is always plain ASCII, so no conversion to UTF-8 is - * necessary. However we do need to nul-terminate the string. - */ - errno = 0; - size_t len = hivex_value_key_len (h, value); - if (len == 0 && errno != 0) - return NULL; size_t flags = le16toh (vk->flags); + size_t len = le16toh (vk->name_len); if (flags & 0x01) { return _hivex_windows_latin1_to_utf8 (vk->name, len); } else { -- 1.8.5.2

--- lib/hivex-internal.h | 8 +++++--- lib/utf16.c | 11 +++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/lib/hivex-internal.h b/lib/hivex-internal.h index 4135f58..64fd49a 100644 --- a/lib/hivex-internal.h +++ b/lib/hivex-internal.h @@ -268,11 +268,13 @@ extern size_t * _hivex_return_offset_list (offset_list *list); extern void _hivex_print_offset_list

...ey is always plain ASCII, so no conversion to UTF-8 is - * necessary. However we do need to nul-terminate the string. - */ - /* vk->name_len is unsigned, 16 bit, so this is safe ... However * we have to make sure the length doesn't exceed the block length. */ - size_t len = le16toh (vk->name_len); + size_t ret = le16toh (vk->name_len); size_t seg_len = block_len (h, value, NULL); - if (sizeof (struct ntreg_vk_record) + len - 1 > seg_len) { + if (sizeof (struct ntreg_vk_record) + ret - 1 > seg_len) { if (h->msglvl >= 2) - fprintf (stderr, &quo...

...me); /* Inherit parent sk. */ struct ntreg_nk_record *parent_nk = @@ -719,9 +731,9 @@ hivex_node_add_child (hive_h *h, hive_node_h parent, const char *name) parent_nk->nr_subkeys = htole32 (nr_subkeys_in_parent_nk); /* Update max_subkey_name_len in parent nk. */ - uint16_t max = le16toh (parent_nk->max_subkey_name_len); - if (max < strlen (name) * 2) /* *2 because "recoded" in UTF16-LE. */ - parent_nk->max_subkey_name_len = htole16 (strlen (name) * 2); + size_t utf16_len = use_utf16 ? recoded_name_len : recoded_name_len * 2; + if (le16toh (parent_nk->m...

...ret; } +size_t +hivex_node_struct_length (hive_h *h, hive_node_h node) +{ + if (!IS_VALID_BLOCK (h, node) || !BLOCK_ID_EQ (h, node, "nk")) { + errno = EINVAL; + return 0; + } + + struct ntreg_nk_record *nk = (struct ntreg_nk_record *) (h->addr + node); + size_t name_len = le16toh (nk->name_len); + /* -1 to avoid double-counting the first name character */ + size_t ret = name_len + sizeof (struct ntreg_nk_record) - 1; + int used; + size_t seg_len = block_len (h, node, &used); + if (ret > seg_len) { + if (h->msglvl >= 2) + fprintf (stderr, "h...

...log("%s %s %d not found\n", mic->name, __func__, type); > + assert(0); > + return NULL; > +} > + > +/* See comments in vhost.c for explanation of next_desc() */ > +static unsigned next_desc(struct vring_desc *desc) > +{ > + unsigned int next; > + > + if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) > + return -1U; > + next = le16toh(desc->next); > + return next; > +} > + > +/* Sum up all the IOVEC length */ > +static ssize_t > +sum_iovec_len(struct mic_copy_desc *copy) > +{ > + ssize_t sum = 0; > + int i; > + &g...

...log("%s %s %d not found\n", mic->name, __func__, type); > + assert(0); > + return NULL; > +} > + > +/* See comments in vhost.c for explanation of next_desc() */ > +static unsigned next_desc(struct vring_desc *desc) > +{ > + unsigned int next; > + > + if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) > + return -1U; > + next = le16toh(desc->next); > + return next; > +} > + > +/* Sum up all the IOVEC length */ > +static ssize_t > +sum_iovec_len(struct mic_copy_desc *copy) > +{ > + ssize_t sum = 0; > + int i; > + &g...

...s */ + memcpy (&data1, guid_bytes, sizeof (data1)); + memcpy (&data2, guid_bytes + 4, sizeof (data2)); + memcpy (&data3, guid_bytes + 6, sizeof (data3)); + memcpy (&data4, guid_bytes + 8, sizeof (data4)); + + /* ensure proper endianness */ + data1 = le32toh (data1); + data2 = le16toh (data2); + data3 = le16toh (data3); + data4 = be64toh (data4); + + return safe_asprintf (g, + "%08" PRIX32 "-%04" PRIX16 "-%04" PRIX16 "-%04" PRIX64 "-%012" PRIX64, + data1, data2, data3, data4 >> 48, data4 & 0xfffff...