From 8165567c6400ba97731504ebb3ad443c8407a302 Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Mon, 12 Jan 2009 04:28:05 +0000
Subject: [PATCH] HFS Updates
---
tsk3/fs/hfs.c | 11 ++++++-----
tsk3/fs/hfs_dent.c | 1 +
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/tsk3/fs/hfs.c b/tsk3/fs/hfs.c
index 6fe003bb1..ed7486600 100644
--- a/tsk3/fs/hfs.c
+++ b/tsk3/fs/hfs.c
@@ -848,7 +848,7 @@ hfs_ext_find_extent_record(HFS_INFO * hfs, uint32_t cnid,
*
* @param a_fs File system to analyze
* @param a_extents Raw extents to process (in an array of 8)
- * @param a_start_off Starting byte offset of these runs
+ * @param a_start_off Starting block offset of these runs
* @returns NULL on error
*/
static TSK_FS_ATTR_RUN *
@@ -881,7 +881,7 @@ hfs_extents_to_attr(TSK_FS_INFO * a_fs, const hfs_ext_desc * a_extents,
head_run = cur_run;
if (prev_run != NULL)
prev_run->next = cur_run;
- cur_off += (cur_run->len * a_fs->block_size);
+ cur_off += cur_run->len;
prev_run = cur_run;
}
@@ -1119,9 +1119,6 @@ hfs_ext_find_extent_record_attr(HFS_INFO * hfs, uint32_t cnid,
else if ((rec_cnid > cnid) || (key->fork_type[0] != 0))
break;
- // get the starting offset of this extent
- ext_off = tsk_getu32(fs->endian, key->start_block);
-
keylen = tsk_getu16(fs->endian, key->key_len);
if (rec_off+keylen > nodesize) {
tsk_errno = TSK_ERR_FS_GENFS;
@@ -1132,8 +1129,12 @@ hfs_ext_find_extent_record_attr(HFS_INFO * hfs, uint32_t cnid,
return 1;
}
+ // get the starting offset of this extent
+ ext_off = tsk_getu32(fs->endian, key->start_block);
+
// convert the extents to the TSK format
extents = (hfs_extents *) & node[rec_off + keylen];
+
attr_run =
hfs_extents_to_attr(fs, extents->extents, ext_off);
if (attr_run == NULL) {
diff --git a/tsk3/fs/hfs_dent.c b/tsk3/fs/hfs_dent.c
index c40d8eaa6..9deea822c 100644
--- a/tsk3/fs/hfs_dent.c
+++ b/tsk3/fs/hfs_dent.c
@@ -869,6 +869,7 @@ hfs_dir_open_meta(TSK_FS_INFO * fs, TSK_FS_DIR ** a_fs_dir,
return TSK_ERR;
}
}
+ cur_node = tsk_getu32(fs->endian, node_desc->flink);
}
else {
tsk_errno = TSK_ERR_FS_GENFS;
--
GitLab