search for: ntreg_db_block

...__attribute__((__packed__)); +struct ntreg_db_record { + int32_t seg_len; /* length (always -ve because used) */ + char id[2]; /* "db" */ + uint16_t nr_blocks; + uint32_t blocklist_offset; + uint32_t unknown1; +} __attribute__((__packed__)); + +struct ntreg_db_block { + int32_t seg_len; + char data[1]; +} __attribute__((__packed__)); + static uint32_t header_checksum (const hive_h *h) { @@ -1418,22 +1431,60 @@ hivex_value_value (hive_h *h, hive_value_h value, * instead. */ size_t blen = block_len (h, data_offset, NULL); - if (len > blen - 4...

...x%zx, block list 0x%zx, data block 0x%zx)\ > - data_offset, blocklist_offset, subblock_offset); > + data_offset, blocklist_offset, (size_t) subblock_offset); > } > int32_t seg_len = block_len(h, subblock_offset, NULL); > struct ntreg_db_block *subblock = > > to make it compile without warnings. Yeah, so I'll just make subblock_offset a size_t, like all the other offset values. > With that addition, * ACK *. I'll post a slightly updated version, with better error messages, just to be sure. Cheers, -Hilko

...treg_db_record { > + int32_t seg_len; /* length (always -ve because used) */ > + char id[2]; /* "db" */ > + uint16_t nr_blocks; > + uint32_t blocklist_offset; > + uint32_t unknown1; > +} __attribute__((__packed__)); > + > +struct ntreg_db_block { > + int32_t seg_len; > + char data[1]; > +} __attribute__((__packed__)); > + > static uint32_t > header_checksum (const hive_h *h) > { > @@ -1418,22 +1431,60 @@ hivex_value_value (hive_h *h, hive_value_h value, > * instead. > */ > size_t blen = blo...

...__attribute__((__packed__)); +struct ntreg_db_record { + int32_t seg_len; /* length (always -ve because used) */ + char id[2]; /* "db" */ + uint16_t nr_blocks; + uint32_t blocklist_offset; + uint32_t unknown1; +} __attribute__((__packed__)); + +struct ntreg_db_block { + int32_t seg_len; + char data[1]; +} __attribute__((__packed__)); + static uint32_t header_checksum (const hive_h *h) { @@ -1418,22 +1431,70 @@ hivex_value_value (hive_h *h, hive_value_h value, * instead. */ size_t blen = block_len (h, data_offset, NULL); - if (len > blen - 4...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.