Re: [Linux-NTFS-Dev] ntfs_attr_lookup() bug

[Richard R. <nt...@fl...>]

Hi Anton,

First off, CONGRATULATIONS!  We wondered when you'd tell your "extended
family".  Please pass on my best wishes to Collette and smiles and
gurgles to Hattie :-)

> I noticed your changeset in ntfsprogs/utils.c which describes a bug in
> ntfs_attr_lookup().

Yes.  Whilst tweaking ntfscluster I found that ntfs_attr_lookup managed
to get me in an infinite loop.  For now, I've put a check in the utils
code[1], but the problem is the reinit search ctx[2].  Removing that
line fixes my problem, but I can't (have had no time to) prove that it
doesn't break something else.

[1] utils.c utils_inode_get_name

        while ((rec = find_attribute (AT_FILE_NAME, ctx))) {
                if (rec == oldrec)
                        break;          // infinite loop!
                oldrec = rec;

[2] attrib.c ntfs_external_attr_find

not_found:
        /*
         * Seek to the end of the base mft record, i.e. when we return false,
         * ctx->mrec and ctx->attr indicate where the attribute should be
         * inserted into the attribute record.
         * And of course ctx->al_entry points to the end of the attribute
         * list inside ctx->base_ntfs_ino->attr_list.
         *
         * FIXME: Do we really want to do this here? Think about it... (AIA)
         */
        ntfs_attr_reinit_search_ctx(ctx);

I'm still hoping to enumerate all the different patterns of attributes
in FILE records that could occur, all the methods of searching (as I did
for the attr merging), so I could build a test rig.

> Do you have an example mft record where this
> happens?  If yes, can I have a copy?

The bug occurs if you have two FILE records, an attribute list, and an
attribute which only occurs in the first record (not 0x20).  Search for
this record and ntfs_attr_lookup keeps returning it, and keeps returning
zero.

I've got a couple of vmware disks that can trigger the problem, but
they're a gig a piece.  I'll see what I can do to cut out the bits you
want.

As I'm the only one using ntfs_attr_lookup in this manner and the only
one using utils_inode_get_name, there's no problem if you want to
release a new ntfsprogs.

Cheers,
  Rich