diff --git a/tsk/fs/ext2fs.c b/tsk/fs/ext2fs.c index b547605622583e1ee701df20fcbab882ccc86bd2..aecae12c05f0d91875dd3ffeba12fb74c10e9535 100755 --- a/tsk/fs/ext2fs.c +++ b/tsk/fs/ext2fs.c @@ -1412,11 +1412,22 @@ ext2fs_make_data_run_extent(TSK_FS_INFO * fs_info, TSK_FS_ATTR * fs_attr, } data_run->offset = tsk_getu32(fs_info->endian, extent->ee_block); - data_run->addr = - (((uint32_t) tsk_getu16(fs_info->endian, + + // Check if the extent is initialized or uninitialized + if (tsk_getu16(fs_info->endian, extent->ee_len) <= EXT2_MAX_INIT_EXTENT_LENGTH) { + // Extent is initalized - process normally + data_run->addr = + (((uint32_t)tsk_getu16(fs_info->endian, extent->ee_start_hi)) << 16) | tsk_getu32(fs_info->endian, - extent->ee_start_lo); - data_run->len = tsk_getu16(fs_info->endian, extent->ee_len); + extent->ee_start_lo); + data_run->len = tsk_getu16(fs_info->endian, extent->ee_len); + } + else { + // Extent is uninitialized - make a sparse run + data_run->len = tsk_getu16(fs_info->endian, extent->ee_len) - EXT2_MAX_INIT_EXTENT_LENGTH; + data_run->addr = 0; + data_run->flags = TSK_FS_ATTR_RUN_FLAG_SPARSE; + } // save the run if (tsk_fs_attr_add_run(fs_info, fs_attr, data_run)) { diff --git a/tsk/fs/tsk_ext2fs.h b/tsk/fs/tsk_ext2fs.h index 195e3bdad6b0d0c489bc618a2031b52d53caaf53..382a9a5312f323046ca256c45484e3895e379a73 100644 --- a/tsk/fs/tsk_ext2fs.h +++ b/tsk/fs/tsk_ext2fs.h @@ -365,6 +365,8 @@ extern "C" { uint8_t eh_generation[4]; /* u32 */ } ext2fs_extent_header; +#define EXT2_MAX_INIT_EXTENT_LENGTH 0x8000 /* Maximum length of an initialized extent */ + /* MODE - Note that values are in octal format */ #define EXT2_IN_FMT 0170000 #define EXT2_IN_SOCK 0140000