Skip to content

Fix recovered offset allocation range check #162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
calculatetech wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix recovered offset allocation range check #162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e198d23
Fixed recovered index allocation range check
calculatetech Jul 23, 2026
101d631
tests: link libcdata in offsets index test
calculatetech Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 66 additions & 26 deletions libpff/libpff_recover.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1415,6 +1415,7 @@ int libpff_recover_check_descriptors_index_for_recovered_value(
return( result );
}


/* Recovers descriptors index values
* Returns 1 if successful or -1 on error
*/
Expand Down Expand Up @@ -3042,18 +3043,15 @@ int libpff_recover_index_values(
uint8_t recovery_flags,
libcerror_error_t **error )
{
libpff_index_node_t *index_node = NULL;
libpff_index_value_t *index_value = NULL;
uint8_t *node_entry_data = NULL;
static char *function = "libpff_recover_index_values";
const char *index_string = NULL;
off64_t index_value_file_offset = 0;
uint64_t index_value_identifier = 0;
uint32_t maximum_data_block_data_size = 0;
uint16_t index_value_data_size = 0;
uint8_t entry_index = 0;
int recoverable = 0;
int result = 0;
libpff_index_node_t *index_node = NULL;
libpff_index_value_t *index_value = NULL;
uint8_t *node_entry_data = NULL;
static char *function = "libpff_recover_index_values";
const char *index_string = NULL;
uint32_t maximum_data_block_data_size = 0;
uint8_t entry_index = 0;
int recoverable = 0;
int result = 0;

if( io_handle == NULL )
{
Expand Down Expand Up @@ -3314,10 +3312,9 @@ int libpff_recover_index_values(
if( ( index_node->type == LIBPFF_INDEX_TYPE_OFFSET )
&& ( ( recovery_flags & LIBPFF_RECOVERY_FLAG_IGNORE_ALLOCATION_DATA ) == 0 ) )
{
result = libcdata_range_list_range_is_present(
result = libpff_recover_index_value_range_is_unallocated(
unallocated_data_block_list,
(uint64_t) index_value_file_offset,
(uint64_t) index_value_data_size,
index_value,
error );

if( result == -1 )
Expand All @@ -3341,10 +3338,10 @@ int libpff_recover_index_values(
function,
index_string,
entry_index,
index_value_identifier,
index_value_file_offset,
index_value_file_offset + index_value_data_size,
index_value_data_size );
index_value->identifier,
index_value->file_offset,
index_value->file_offset + index_value->data_size,
index_value->data_size );
}
#endif
recoverable = 0;
Expand All @@ -3357,10 +3354,10 @@ int libpff_recover_index_values(
function,
index_string,
entry_index,
index_value_identifier,
index_value_file_offset,
index_value_file_offset + index_value_data_size,
index_value_data_size );
index_value->identifier,
index_value->file_offset,
index_value->file_offset + index_value->data_size,
index_value->data_size );
}
#endif
}
Expand All @@ -3377,7 +3374,7 @@ int libpff_recover_index_values(
function,
index_string,
entry_index,
index_value_identifier );
index_value->identifier );
}
#endif
if( index_node->type == LIBPFF_INDEX_TYPE_DESCRIPTOR )
Expand All @@ -3403,7 +3400,7 @@ int libpff_recover_index_values(
"%s: unable to insert recovered %s index value: %" PRIu64 " list.",
function,
index_string,
index_value_identifier );
index_value->identifier );

goto on_error;
}
Expand Down Expand Up @@ -3466,6 +3463,50 @@ int libpff_recover_index_values(
return( -1 );
}

/* Determines if the data range referenced by an offsets index value is
* unallocated.
* Returns 1 if unallocated, 0 if allocated or -1 on error.
*/
int libpff_recover_index_value_range_is_unallocated(
libcdata_range_list_t *unallocated_data_block_list,
libpff_index_value_t *index_value,
libcerror_error_t **error )
{
static char *function = "libpff_recover_index_value_range_is_unallocated";

if( unallocated_data_block_list == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid unallocated data block list.",
function );

return( -1 );
}
if( index_value == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid index value.",
function );

return( -1 );
}
if( index_value->file_offset < 0 )
{
return( 0 );
}
return( libcdata_range_list_range_is_present(
unallocated_data_block_list,
(uint64_t) index_value->file_offset,
(uint64_t) index_value->data_size,
error ) );
}

/* Reads the index value data
* Returns 1 if successful, returns 0 if not or -1 on error
*/
Expand Down Expand Up @@ -4240,4 +4281,3 @@ int libpff_recover_analyze_local_descriptors(
#endif
return( result );
}

6 changes: 5 additions & 1 deletion libpff/libpff_recover.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,11 @@ int libpff_recover_index_values(
uint8_t recovery_flags,
libcerror_error_t **error );

int libpff_recover_index_value_range_is_unallocated(
libcdata_range_list_t *unallocated_data_block_list,
libpff_index_value_t *index_value,
libcerror_error_t **error );

int libpff_recover_index_value_read_data(
libpff_index_value_t *index_value,
libpff_io_handle_t *io_handle,
Expand Down Expand Up @@ -160,4 +165,3 @@ int libpff_recover_analyze_local_descriptors(
#endif

#endif /* !defined( _LIBPFF_RECOVER_H ) */

3 changes: 2 additions & 1 deletion tests/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -641,6 +641,7 @@ pff_test_notify_LDADD = \
@LIBCERROR_LIBADD@

pff_test_offsets_index_SOURCES = \
pff_test_libcdata.h \
pff_test_libcerror.h \
pff_test_libpff.h \
pff_test_macros.h \
Expand All @@ -649,6 +650,7 @@ pff_test_offsets_index_SOURCES = \
pff_test_unused.h

pff_test_offsets_index_LDADD = \
@LIBCDATA_LIBADD@ \
../libpff/libpff.la \
@LIBCERROR_LIBADD@

Expand Down Expand Up @@ -919,4 +921,3 @@ DISTCLEANFILES = \
atconfig \
Makefile \
Makefile.in

143 changes: 142 additions & 1 deletion tests/pff_test_offsets_index.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
#include <stdlib.h>
#endif

#include "pff_test_libcdata.h"
#include "pff_test_libcerror.h"
#include "pff_test_libpff.h"
#include "pff_test_macros.h"
Expand All @@ -36,6 +37,7 @@
#include "../libpff/libpff_index_value.h"
#include "../libpff/libpff_io_handle.h"
#include "../libpff/libpff_offsets_index.h"
#include "../libpff/libpff_recover.h"

#if defined( __GNUC__ ) && !defined( LIBPFF_DLL_IMPORT )

Expand Down Expand Up @@ -440,6 +442,142 @@ PFF_TEST_FPRINT_ERROR( error );
return( 0 );
}

/* Tests recovered offset index allocation range validation.
* Returns 1 if successful or 0 if not.
*/
int pff_test_recover_index_value_range_is_unallocated(
void )
{
libcdata_range_list_t *unallocated_data_block_list = NULL;
libcerror_error_t *error = NULL;
libpff_index_value_t *index_value = NULL;
int result = 0;

result = libcdata_range_list_initialize(
&unallocated_data_block_list,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
1 );

result = libcdata_range_list_insert_range(
unallocated_data_block_list,
4096,
8192,
NULL,
NULL,
NULL,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
1 );

result = libpff_index_value_initialize(
&index_value,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
1 );

index_value->file_offset = 4096;
index_value->data_size = 512;

result = libpff_recover_index_value_range_is_unallocated(
unallocated_data_block_list,
index_value,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
1 );

PFF_TEST_ASSERT_IS_NULL(
"error",
error );

index_value->file_offset = 12288;

result = libpff_recover_index_value_range_is_unallocated(
unallocated_data_block_list,
index_value,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
0 );

result = libpff_recover_index_value_range_is_unallocated(
NULL,
index_value,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
-1 );

PFF_TEST_ASSERT_IS_NOT_NULL(
"error",
error );

libcerror_error_free(
&error );

result = libpff_index_value_free(
&index_value,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
1 );

result = libcdata_range_list_free(
&unallocated_data_block_list,
NULL,
&error );

PFF_TEST_ASSERT_EQUAL_INT(
"result",
result,
1 );

PFF_TEST_ASSERT_IS_NULL(
"error",
error );

return( 1 );

on_error:
if( error != NULL )
{
libcerror_error_free(
&error );
}
if( index_value != NULL )
{
libpff_index_value_free(
&index_value,
NULL );
}
if( unallocated_data_block_list != NULL )
{
libcdata_range_list_free(
&unallocated_data_block_list,
NULL,
NULL );
}
return( 0 );
}

#endif /* defined( __GNUC__ ) && !defined( LIBPFF_DLL_IMPORT ) */

/* The main program
Expand Down Expand Up @@ -471,6 +609,10 @@ int main(
"libpff_offsets_index_get_index_value_by_identifier",
pff_test_offsets_index_get_index_value_by_identifier );

PFF_TEST_RUN(
"libpff_recover_index_value_range_is_unallocated",
pff_test_recover_index_value_range_is_unallocated );

#endif /* defined( __GNUC__ ) && !defined( LIBPFF_DLL_IMPORT ) */

return( EXIT_SUCCESS );
Expand All @@ -482,4 +624,3 @@ int main(

#endif /* defined( __GNUC__ ) && !defined( LIBPFF_DLL_IMPORT ) */
}