sleuthkit-developers

[sleuthkit-developers] Fls core dumped

[Jaime C. <jc...@id...>]

I was testing usbkey with one FAT16 partition that contained active and=20
deleted directories and files.

I run the fls command against the FAT16 partition and it segmented fault

+ r/r 73217:    D3X100K.txt
+ r/r 73218:    D3Y1M-E.txt
d/d * 5:        _IR004
d/d 6: =20
OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO=
OOOOOOOOOOOOOOOOOOOOOOOOOOOO=20

Segmentation fault (core dumped)

gdb output:

#0  0x08063af5 in fatfs_dent_parse_block (fatfs=3D0x807e048, buf=3D0x807f=
038=20
"=E5IR002     \020", len=3D512, addr=3D384, flags=3D7, fs_dent=3D0x808406=
8,
    action=3D0x8070335 <print_dent_act>, ptr=3D0x0) at fatfs_dent.c:464

I can see that buf address has junk in it (buf=3D0x807f038 "=E5IR002     =
\020")

Jimmy

Re: [sleuthkit-developers] Fls core dumped

[Brian C. <ca...@sl...>]

Did you change the code associated with the short and long file names?  =20=

The crash is in the code looking for the short name and I remember you =20=

wanted to get rid of them....   If you didn't then I have a new version =20=

that checks a return value (which it should have before) and prevents a =20=

crash.

brian


On May 16, 2005, at 5:21 PM, Jaime Chang wrote:

> I was testing usbkey with one FAT16 partition that contained active =20=

> and deleted directories and files.
>
> I run the fls command against the FAT16 partition and it segmented =20
> fault
>
> + r/r 73217:    D3X100K.txt
> + r/r 73218:    D3Y1M-E.txt
> d/d * 5:        _IR004
> d/d 6:  =20
> =
OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO=20=

> OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO
> Segmentation fault (core dumped)
>
> gdb output:
>
> #0  0x08063af5 in fatfs_dent_parse_block (fatfs=3D0x807e048, =20
> buf=3D0x807f038 "=E5IR002     \020", len=3D512, addr=3D384, flags=3D7, =
=20
> fs_dent=3D0x8084068,
>    action=3D0x8070335 <print_dent_act>, ptr=3D0x0) at fatfs_dent.c:464
>
> I can see that buf address has junk in it (buf=3D0x807f038 "=E5IR002   =
  =20
> \020")

Re: [sleuthkit-developers] Fls core dumped

[Jaime C. <jc...@id...>]

On 05/17/05 00:57, Brian Carrier wrote:

> Did you change the code associated with the short and long file 
> names?   The crash is in the code looking for the short name and I 
> remember you  wanted to get rid of them....   If you didn't then I 
> have a new version  that checks a return value (which it should have 
> before) and prevents a  crash.

No, actually I untar a fresh copy of the TSK 2.01 just to double check 
that this wasn't cause by the changes I made.

jimmy

Re: [sleuthkit-developers] Fls core dumped

[Brian C. <ca...@sl...>]

On May 17, 2005, at 8:08 AM, Jaime Chang wrote:

> On 05/17/05 00:57, Brian Carrier wrote:
>
>> Did you change the code associated with the short and long file 
>> names?   The crash is in the code looking for the short name and I 
>> remember you  wanted to get rid of them....   If you didn't then I 
>> have a new version  that checks a return value (which it should have 
>> before) and prevents a  crash.
>
> No, actually I untar a fresh copy of the TSK 2.01 just to double check 
> that this wasn't cause by the changes I made.

Hmm, try this version of src/fstools/fatfs_dent.c at:

http://sleuthkit.sf.net/sleuthkit/fatfs_dent.c

Can you also send me the output of 'icat IMG.DD 2 | xxd' so that I can 
see the directory entry that is causing problems.  Was this file 
deleted using Debian (or whichever distro that shows the ils vs fls 
issue)?

thanks,
brian