[sleuthkit-developers] [ sleuthkit-Bugs-2725799 ] ifind on win32 can use wrong endianness

[SourceForge.net <no...@so...>]

Bugs item #2725799, was opened at 2009-04-01 18:13
Message generated for change (Tracker Item Submitted) made by robjoyce
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2725799&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: ifind on win32 can use wrong endianness

Initial Comment:
In tsk3/fs/ifind_lib.c, tsk_fs_ifind_path() has code to translate the TSK_TCHAR path argument to UTF-8 on Windows.  It does so by calling tsk_UTF16toUTF8(fs->endian, ...), but this assumes that the TSK_TCHAR has the same endianness as the filesystem.  The upshot is that ifind fails when searching for a file in a big-endian file system on Windows.  (This is 3.0.1 and the current trunk as well.)

e.g.:
> fls.exe ufs.dd
d/d 7936:    hello
[...]
> ifind.exe -n hello ufs.dd
File not found
> ifind.exe -n . ufs.dd
File not found

So it looks like we need to use some constant/code/#define/whatever for "local endianness" instead of fs->endian.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2725799&group_id=55685