Work at SourceForge, help us to make it a better place! We have an immediate need for a Support Technician in our San Francisco or Denver office.

Close

#192 SegFault in v3.2.3 addressing image segments with wiild card

open
nobody
None
5
2011-11-15
2011-11-15
John Lehr
No

J. Metz libewf2 patch applied:

$ mmls -V image_118871.E??
The Sleuth Kit ver 3.2.3

$ mmls image_118871.E??
Segmentation fault

$ mmls -v image_118871.E??
tsk_img_open: Type: 0 NumImg: 10 Img1: image_118871.E01
Error opening AFF/AFD/AFM file
aff_open: Success
Segmentation fault

$ mmls -v image_118871.E01
tsk_img_open: Type: 0 NumImg: 1 Img1: image_118871.E01
Error opening AFF/AFD/AFM file
aff_open: Success
tsk_img_findFiles: image_118871.E01 found
tsk_img_findFiles: image_118871.E02 found
tsk_img_findFiles: image_118871.E03 found
tsk_img_findFiles: image_118871.E04 found
tsk_img_findFiles: image_118871.E05 found
tsk_img_findFiles: image_118871.E06 found
tsk_img_findFiles: image_118871.E07 found
tsk_img_findFiles: image_118871.E08 found
tsk_img_findFiles: image_118871.E09 found
tsk_img_findFiles: image_118871.E10 found
tsk_img_findFiles: 10 total images found
tsk_img_findFiles: image_118871.E01 found
tsk_img_findFiles: image_118871.E02 found
tsk_img_findFiles: image_118871.E03 found
tsk_img_findFiles: image_118871.E04 found
tsk_img_findFiles: image_118871.E05 found
tsk_img_findFiles: image_118871.E06 found
tsk_img_findFiles: image_118871.E07 found
tsk_img_findFiles: image_118871.E08 found
tsk_img_findFiles: image_118871.E09 found
tsk_img_findFiles: image_118871.E10 found
dos_load_prim: Table Sector: 0
ewf_read: byte offset: 0 len: 65536
dos_load_prim_table: Testing FAT/NTFS conditions
load_pri:0:0 Start: 2048 Size: 29360128 Type: 39
load_pri:0:1 Start: 29362176 Size: 204800 Type: 7
load_pri:0:2 Start: 29566976 Size: 595572736 Type: 7
load_pri:0:3 Start: 0 Size: 0 Type: 0
bsd_load_table: Table Sector: 1
gpt_load_table: Sector: 0
sun_load_table: Trying sector: 0
sun_load_table: Trying sector: 1
mac_load_table: Sector: 1
mac_load: Missing initial magic value
mac_open: Trying 4096-byte sector size instead of 512-byte
mac_load_table: Sector: 1
mac_load: Missing initial magic value
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

Slot Start End Length Description
00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000000 0000002047 0000002048 Unallocated
02: 00:00 0000002048 0029362175 0029360128 Unknown Type (0x27)
03: 00:01 0029362176 0029566975 0000204800 NTFS (0x07)
04: 00:02 0029566976 0625139711 0595572736 NTFS (0x07)
05: ----- 0625139712 0625142447 0000002736 Unallocated

Discussion

  • Joachim Metz
    Joachim Metz
    2011-11-16

    It's a bug in my patch, I've updated the version on the libewf site.