search

libyal / libesedb

Library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
GNU Lesser General Public License v3.0
338 stars 91 forks source link

libesedb_table_get_number_of_records: unable to retrieve number of leaf values from table page tree. #71

Open janstarke opened 1 month ago

janstarke commented 1 month ago

I'm currently handling a PR for a mitigation of said problem: janstarke/ntdsextract2#16

There seems to be a situation in which the first call to libesedb_record_get_number_of_values() fails, while a subsequent call to the same function succeeds. Can you imagine a situation in which this might happen?

Unfortunately, it is not possible to provide the data which causes this behaviour :cry:

joachimmetz commented 1 month ago

Unfortunately, it is not possible to provide the data which causes this behaviour

can you provide debug information instead?

janstarke commented 1 month ago

All I have is the error message:

Error: c-libesedb: libesedb_table_get_number_of_records: unable to retrieve number of leaf values from table page tree.
libesedb_page_tree_get_number_of_leaf_values: invalid number of leaf pages value exceeds maximum.
libesedb_table_get_number_of_records: unable to retrieve number of leaf values from table page tree.

@Darkrael, you have the test data. Could you please provide some more information to @joachimmetz to help him finding the issue?

Regards, Jan

joachimmetz commented 1 month ago

Also what is c-libesedb ? That seems to be generating the warning.

you have the test data. Could you please provide some more information to @joachimmetz to help him finding the issue?

If no such data can be provided this issue cannot be addressed and feel free to close the issue.

janstarke commented 1 month ago

Also what is c-libesedb ? That seems to be generating the warning.

this is simply a static string in rust-libesedb:

https://github.com/sunsetkookaburra/rust-libesedb/blob/6b88c3a440de2de7f1e660c8edc1a6cdcc16e7ec/src/error.rs#L44-L58

rust-libesedb itself is a rust binding for libesedb

However, I agree that the issue should be closed if we don't get more information to debug the issue

Darkrael commented 1 month ago

Unfortunately, it is not possible to provide the data which causes this behaviour

can you provide debug information instead?

Hey, are you talking about these building flags: https://github.com/libyal/libesedb/wiki/Building#verbose-and-debug-output? If so i can try them. I will get back to you in the coming week when i find the time

Darkrael commented 1 month ago

@joachimmetz I've sent you an e-mail to the mail in your profile with some debug files. I hope it helps