search for: ntreg_value_list

...quot;hivex_value_value: warning: blocklist is not a " + "valid block " + "(db block 0x%zx, blocklist 0x%zx)\n", + data_offset, blocklist_offset); + errno = EINVAL; + free (ret); + return NULL; + } + struct ntreg_value_list *bl = + (struct ntreg_value_list *) ((char *) h->addr + blocklist_offset); + size_t i, off; + for (i=off=0; i < nr_blocks; ++i) { + uint32_t subblock_offset = le32toh (bl->offset[i]); + subblock_offset += 0x1000; + if (!IS_VALID_BLOCK (h, subblock_offset)) { +...

* Richard W.M. Jones: > diff --git a/lib/hivex.c b/lib/hivex.c > index e3c1e05..9351ac5 100644 > --- a/lib/hivex.c > +++ b/lib/hivex.c > @@ -1471,7 +1471,7 @@ hivex_value_value (hive_h *h, hive_value_h value, > if (h->msglvl >= 2) > fprintf (stderr, "hivex_value_value: warning: big data block is not " > "valid

...st is not a " > + "valid block " > + "(db block 0x%zx, blocklist 0x%zx)\n", > + data_offset, blocklist_offset); > + errno = EINVAL; > + free (ret); > + return NULL; > + } > + struct ntreg_value_list *bl = > + (struct ntreg_value_list *) ((char *) h->addr + blocklist_offset); > + size_t i, off; > + for (i=off=0; i < nr_blocks; ++i) { > + uint32_t subblock_offset = le32toh (bl->offset[i]); > + subblock_offset += 0x1000; > + if (!IS_VALID_BLOCK...

...2) + fprintf (stderr, "hivex_value_value: warning: blocklist is not a " + "valid block (db block 0x%zx, blocklist 0x%zx)\n", + data_offset, blocklist_offset); + errno = EINVAL; + free (ret); + return NULL; + } + struct ntreg_value_list *bl = + (struct ntreg_value_list *) ((char *) h->addr + blocklist_offset); + size_t i, off; + for (i = off = 0; i < nr_blocks; ++i) { + size_t subblock_offset = le32toh (bl->offset[i]); + subblock_offset += 0x1000; + if (!IS_VALID_BLOCK (h, subblock_offset)) { +...

This is, hopefully, a full fix for handling of li-records. See: https://bugzilla.redhat.com/show_bug.cgi?id=717583 https://bugzilla.redhat.com/show_bug.cgi?id=987463 Rich.