I create a SMART image file with FTK, compress with FAST, then use ewfmount.exe to mount this image,some sector read failed,error follow:
libewf_chunk_data_read_from_file_io_pool: invalid chunk data size value out of bounds.
libewf_chunk_data_read_element_data: unable to read chunk data.
libfdata_list_get_element_value: unable to read element data at offset: 31204322 (0x01dc23e2).
libfdata_list_get_element_value_by_index: unable to retrieve element value.
libewf_chunk_table_get_segment_file_chunk_data_by_offset: unable to retrieve chunk: 747787 data from chunk group: 0 in segment file: 0 for offset: 245
03484416 (0x5b4858000).
libewf_chunk_table_get_chunk_data_by_offset: unable to retrieve segment file chunk data for offset: 24503484416 (0x5b4858000).
libewf_internal_handle_read_buffer_from_file_io_pool: unable to retrieve chunk data for offset: 24503484416 (0x5b4858000).
libewf_handle_read_buffer_at_offset: unable to read buffer.
mount_file_entry_read_buffer_at_offset: unable to read buffer at offset: 24503484400 (0x5b4857ff0) from handle.
mount_dokan_ReadFile: unable to read from mount handle.
And the error code here in libewf_chunk_data.c line 1961:
if( ( chunk_data_size == (size64_t) 0 )
|| ( chunk_data_size > (size64_t) chunk_data->allocated_data_size ) )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid chunk data size value out of bounds.",
function );
return( -1 );
}
here the chunk_data_size == 0x8012 and the chunk_data->allocated_data_size == 0x8010
When i realloc chunk_data->data with size of 8012, it read OK!
if( ( chunk_data_size == (size64_t) 0 )
|| ( chunk_data_size > (size64_t) chunk_data->allocated_data_size ) )
{
if ( chunk_data_size > (size64_t) chunk_data->allocated_data_size )
{
new_data = (uint8_t *)memory_reallocate(chunk_data->data, chunk_data_size);
if ( new_data == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: alloc new data failed.",
function );
return (-1);
}
chunk_data->data = new_data;
chunk_data->allocated_data_size = chunk_data_size;
}
else
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: invalid chunk data size value out of bounds.",
function );
return( -1 );
}
}
I create a SMART image file with FTK, compress with FAST, then use ewfmount.exe to mount this image,some sector read failed,error follow:
And the error code here in libewf_chunk_data.c line 1961:
So what happened? and is my change right?