[sleuthkit-developers] [ sleuthkit-Bugs-2725799 ] ifind on win32 can use wrong endianness

[SourceForge.net <no...@so...>]

Bugs item #2725799, was opened at 2009-04-01 17:13
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2725799&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: ifind on win32 can use wrong endianness

Initial Comment:
In tsk3/fs/ifind_lib.c, tsk_fs_ifind_path() has code to translate the TSK_TCHAR path argument to UTF-8 on Windows.  It does so by calling tsk_UTF16toUTF8(fs->endian, ...), but this assumes that the TSK_TCHAR has the same endianness as the filesystem.  The upshot is that ifind fails when searching for a file in a big-endian file system on Windows.  (This is 3.0.1 and the current trunk as well.)

e.g.:
> fls.exe ufs.dd
d/d 7936:    hello
[...]
> ifind.exe -n hello ufs.dd
File not found
> ifind.exe -n . ufs.dd
File not found

So it looks like we need to use some constant/code/#define/whatever for "local endianness" instead of fs->endian.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-04-11 23:20

Message:
Checked into trunk.  Made new unicode conversion method.

Sending        CHANGES.txt
Sending        tsk3/base/tsk_base_i.h
Sending        tsk3/base/tsk_unicode.c
Sending        tsk3/fs/fls_lib.c
Sending        tsk3/fs/ifind_lib.c
Sending        tsk3/img/img_open.c
Transmitting file data ......
Committed revision 75.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2725799&group_id=55685