libyal / libewf

Libewf is a library to access the Expert Witness Compression Format (EWF)
GNU Lesser General Public License v3.0
263 stars 76 forks source link

Can not read some sectors with SMART file #168

Open cofarmer opened 2 years ago

cofarmer commented 2 years ago

I create a SMART image file with FTK, compress with FAST, then use ewfmount.exe to mount this image,some sector read failed,error follow:

libewf_chunk_data_read_from_file_io_pool: invalid chunk data size value out of bounds.
libewf_chunk_data_read_element_data: unable to read chunk data.
libfdata_list_get_element_value: unable to read element data at offset: 31204322 (0x01dc23e2).
libfdata_list_get_element_value_by_index: unable to retrieve element value.
libewf_chunk_table_get_segment_file_chunk_data_by_offset: unable to retrieve chunk: 747787 data from chunk group: 0 in segment file: 0 for offset: 245
03484416 (0x5b4858000).
libewf_chunk_table_get_chunk_data_by_offset: unable to retrieve segment file chunk data for offset: 24503484416 (0x5b4858000).
libewf_internal_handle_read_buffer_from_file_io_pool: unable to retrieve chunk data for offset: 24503484416 (0x5b4858000).
libewf_handle_read_buffer_at_offset: unable to read buffer.
mount_file_entry_read_buffer_at_offset: unable to read buffer at offset: 24503484400 (0x5b4857ff0) from handle.
mount_dokan_ReadFile: unable to read from mount handle.

And the error code here in libewf_chunk_data.c line 1961:

if( ( chunk_data_size == (size64_t) 0 )
     || ( chunk_data_size > (size64_t) chunk_data->allocated_data_size ) )
    {
        libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
             LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid chunk data size value out of bounds.",
             function );
            return( -1 );
    }
here the chunk_data_size == 0x8012 and the chunk_data->allocated_data_size == 0x8010

When i realloc chunk_data->data with size of 8012, it read OK!
if( ( chunk_data_size == (size64_t) 0 )
     || ( chunk_data_size > (size64_t) chunk_data->allocated_data_size ) )
    {
        if ( chunk_data_size > (size64_t) chunk_data->allocated_data_size )
        {
            new_data = (uint8_t *)memory_reallocate(chunk_data->data, chunk_data_size);
            if ( new_data == NULL )
            {
                libcerror_error_set(
                 error,
                 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
                 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
                 "%s: alloc new data failed.",
                 function );
                return (-1);
            }
            chunk_data->data = new_data;
            chunk_data->allocated_data_size = chunk_data_size;
        }
        else
        {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
             LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid chunk data size value out of bounds.",
             function );
            return( -1 );
        }
    }

So what happened? and is my change right?