Merge branch 'develop' of github.com:sleuthkit/sleuthkit into develop

rejistry++/src/VKRecord.cpp

@@ -34,6 +34,7 @@
 namespace Rejistry {
 
     const std::string VKRecord::MAGIC = "vk";
+    const std::wstring VKRecord::DEFAULT_VALUE_NAME = L"(Default)";
 
     VKRecord::VKRecord(RegistryByteBuffer * buf, uint32_t offset) : Record(buf, offset) {
         if (!(getMagic() == MAGIC)) {
@@ -41,6 +42,9 @@ namespace Rejistry {
         }
     }
 
+    VKRecord::VKRecord(const VKRecord& sourceRecord) : Record(sourceRecord._buf, sourceRecord._offset) {        
+    }
+
     bool VKRecord::hasName() const {
         return (getWord(NAME_LENGTH_OFFSET) != 0x0);
     }
@@ -51,7 +55,7 @@ namespace Rejistry {
 
     std::wstring VKRecord::getName() const {
         if (! hasName()) {
-            return L"";
+            return VKRecord::DEFAULT_VALUE_NAME;
         }
 
         uint32_t nameLength = getWord(NAME_LENGTH_OFFSET);

rejistry++/src/VKRecord.h

@@ -43,6 +43,8 @@ namespace Rejistry {
      */
     class VKRecord : public Record {
     public:
+        static const std::wstring DEFAULT_VALUE_NAME;
+
         typedef VKRecord * VKRecordPtr;
         typedef std::vector< VKRecordPtr > VKRecordPtrList;
 
@@ -81,7 +83,7 @@ namespace Rejistry {
         };
 
         VKRecord(RegistryByteBuffer * buf, uint32_t offset);
-
+        VKRecord(const VKRecord &);
         virtual ~VKRecord() {}
     
         /**

rejistry++/src/ValueListRecord.cpp

@@ -61,7 +61,10 @@ namespace Rejistry {
         VKRecord::VKRecordPtrList::iterator it = recordList.begin();
 
         for (; it != recordList.end(); ++it) {
-            if (_wcsicmp(name.c_str(), (*it)->getName().c_str()) == 0) {
+            // If we have a name match or we are searching for the "default" entry
+            // (which matches a record with no name) we are done.
+            if ((!(*it)->hasName() && name == VKRecord::DEFAULT_VALUE_NAME) ||
+                (_wcsicmp(name.c_str(), (*it)->getName().c_str()) == 0)) {
                 // Create a copy of the record to return as the records
                 // in the list will be deleted.
                 foundRecord = new VKRecord(*(*it));