Changed ltree to use line reader

.gitignore

@@ -140,6 +140,7 @@ stamp-h[1-9]
 /tests/ewf_test_analytical_data
 /tests/ewf_test_attribute
 /tests/ewf_test_bit_stream
+/tests/ewf_test_buffer_data_handle
 /tests/ewf_test_case_data
 /tests/ewf_test_case_data_section
 /tests/ewf_test_checksum
@@ -172,13 +173,15 @@ stamp-h[1-9]
 /tests/ewf_test_lef_permission
 /tests/ewf_test_lef_source
 /tests/ewf_test_lef_subject
+/tests/ewf_test_line_reader
 /tests/ewf_test_ltree_section
 /tests/ewf_test_md5_hash_section
 /tests/ewf_test_media_values
 /tests/ewf_test_notify
 /tests/ewf_test_permission_group
 /tests/ewf_test_read_io_handle
 /tests/ewf_test_restart_data
+/tests/ewf_test_section_data_handle
 /tests/ewf_test_section_descriptor
 /tests/ewf_test_sector_range
 /tests/ewf_test_sector_range_list

ChangeLog

@@ -1,4 +1,9 @@
 TODO
+* change ltree path segment separator
+* calculate the MD5 while incremental ltree read, use line reader instead?
+
+* escape unpaired surrogates in bodyfile
+
 * info_handle: move dfxml functions to seperate file
 * clean up libewf_chunk_group_correct_v1
 

acinclude.m4

@@ -1,6 +1,6 @@
 dnl Checks for required headers and functions
 dnl
-dnl Version: 20230212
+dnl Version: 20230704
 
 dnl Function to determine the host operating system
 AC_DEFUN([AX_LIBEWF_CHECK_HOST_OPERATING_SYSTEM],
@@ -44,8 +44,7 @@ AC_DEFUN([AX_LIBEWF_CHECK_LOCAL],
   AC_CHECK_HEADERS([sys/time.h])
 
   dnl Check for functions
-  dnl Date and time functions used in libewf/libewf_date_time.h
-  AC_CHECK_FUNCS([localtime localtime_r mktime])
+  AC_CHECK_FUNCS([localtime localtime_r memmove mktime])
 
   AS_IF(
     [test "x$ac_cv_func_localtime" != xyes && test "x$ac_cv_func_localtime_r" != xyes],
@@ -54,6 +53,13 @@ AC_DEFUN([AX_LIBEWF_CHECK_LOCAL],
       [1])
   ])
 
+  AS_IF(
+   [test "x$ac_cv_func_memmove" != xyes],
+   [AC_MSG_FAILURE(
+     [Missing function: memmove],
+     [1])
+  ])
+
   AS_IF(
     [test "x$ac_cv_func_mktime" != xyes],
     [AC_MSG_FAILURE(

appveyor.yml

@@ -233,7 +233,7 @@ install:
       .\builddokan.ps1 -Configuration ${Configuration} -Platform "Win32";
       .\builddokan.ps1 -Configuration ${Configuration} -Platform "x64"; }
     }
-- sh: if test ${BUILD_ENVIRONMENT} = "python-tox" || test ${BUILD_ENVIRONMENT} = "xcode"; then brew update -q; fi
+- sh: if test ${BUILD_ENVIRONMENT} = "python-tox" || test ${BUILD_ENVIRONMENT} = "xcode"; then brew update-reset && brew update -q; fi
 - sh: if test ${BUILD_ENVIRONMENT} = "python-tox" || test ${BUILD_ENVIRONMENT} = "xcode"; then brew install -q gettext gnu-sed || true; fi
 - sh: if test ${BUILD_ENVIRONMENT} = "python-tox"; then brew install -q python@${PYTHON_VERSION} tox twine-pypi || true; fi
 - cmd: if [%BUILD_ENVIRONMENT%]==[python] (

configure.ac

@@ -2,7 +2,7 @@ AC_PREREQ([2.71])
 
 AC_INIT(
  [libewf],
- [20230702],
+ [20230705],
  [[email protected]])
 
 AC_CONFIG_SRCDIR(

documentation/Expert Witness Compression Format (EWF).asciidoc

@@ -1794,7 +1794,7 @@ The ltree section consists of:
 
 ==== Ltree header
 
-The ltree header is 6 bytes of size and consists of:
+The ltree header is 48 bytes of size and consists of:
 
 [cols="1,1,1,5",options="header"]
 |===
@@ -1828,7 +1828,7 @@ See section: <<permissions_category3,Permissions category>>
 | ... | srce | Information about acquisition sources +
 See section: <<sources_category3,Sources category>>
 | ... | | (an empty line)
-|...22 | sub | Information about [yellow-background]*unknown* +
+| ... | sub | Information about [yellow-background]*unknown* +
 See section: <<subjects_category3,Subjects category>>
 | ... | | (an empty line)
 | ... | entry | Information about file entries +

ewftools/info_handle.c

@@ -1076,6 +1076,206 @@ int info_handle_posix_time_value_fprint(
 	return( -1 );
 }
 
+/* Prints a file entry or data stream name to a bodyfile
+ * Returns 1 if successful or -1 on error
+ */
+int info_handle_bodyfile_name_value_fprint(
+     info_handle_t *info_handle,
+     const system_character_t *value_string,
+     size_t value_string_length,
+     libcerror_error_t **error )
+{
+	system_character_t *escaped_value_string     = NULL;
+	static char *function                        = "info_handle_bodyfile_name_value_fprint";
+	libuna_unicode_character_t unicode_character = 0;
+	size_t escaped_value_string_index            = 0;
+	size_t escaped_value_string_size             = 0;
+	size_t value_string_index                    = 0;
+	int print_count                              = 0;
+	int result                                   = 0;
+
+	if( info_handle == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid info handle.",
+		 function );
+
+		return( -1 );
+	}
+	if( value_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
+		 "%s: invalid value string.",
+		 function );
+
+		return( -1 );
+	}
+	/* To ensure normalization in the escaped string is handled correctly
+	 * it stored in a temporary variable. Note that there is a worst-case of
+	 * a 1 to 4 ratio for each escaped character.
+	 */
+	if( value_string_length > (size_t) ( ( SSIZE_MAX - 1 ) / ( sizeof( system_character_t ) * 4 ) ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
+		 "%s: invalid value string length value exceeds maximum.",
+		 function );
+
+		return( -1 );
+	}
+	escaped_value_string_size = ( value_string_length * 4 ) + 1;
+
+	escaped_value_string = (system_character_t *) memory_allocate(
+	                                               sizeof( system_character_t ) * escaped_value_string_size );
+
+	if( escaped_value_string == NULL )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_MEMORY,
+		 LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
+		 "%s: unable to create escaped value string.",
+		 function );
+
+		goto on_error;
+	}
+	/* Using UCS-2 or RFC 2279 UTF-8 to support unpaired UTF-16 surrogates
+	 */
+	while( value_string_index < value_string_length )
+	{
+#if defined( HAVE_WIDE_SYSTEM_CHARACTER )
+		result = libuna_unicode_character_copy_from_ucs2(
+		          &unicode_character,
+		          (libuna_utf16_character_t *) value_string,
+		          value_string_length,
+		          &value_string_index,
+		          error );
+#else
+		result = libuna_unicode_character_copy_from_utf8_rfc2279(
+		          &unicode_character,
+		          (libuna_utf8_character_t *) value_string,
+		          value_string_length,
+		          &value_string_index,
+		          error );
+#endif
+		if( result != 1 )
+		{
+			libcerror_error_set(
+			 error,
+			 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+			 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+			 "%s: unable to copy Unicode character from value string.",
+			 function );
+
+			goto on_error;
+		}
+		/* Replace:
+		 *   Control characters ([U+0-U+1f, U+7f-U+9f]) by \x##
+		 */
+		if( ( unicode_character <= 0x1f )
+		 || ( ( unicode_character >= 0x7f )
+		  &&  ( unicode_character <= 0x9f ) ) )
+		{
+			print_count = system_string_sprintf(
+			               &( escaped_value_string[ escaped_value_string_index ] ),
+			               escaped_value_string_size - escaped_value_string_index,
+			               "\\x%02" PRIx32 "",
+			               unicode_character );
+
+			if( print_count < 0 )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+				 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+				 "%s: unable to copy escaped Unicode character to escaped value string.",
+				 function );
+
+				goto on_error;
+			}
+			escaped_value_string_index += print_count;
+		}
+		else if( ( unicode_character == '\\' )
+		      || ( unicode_character == '|' ) )
+		{
+			print_count = system_string_sprintf(
+			               &( escaped_value_string[ escaped_value_string_index ] ),
+			               escaped_value_string_size - escaped_value_string_index,
+			               "\\%c",
+			               unicode_character );
+
+			if( print_count < 0 )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+				 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+				 "%s: unable to copy escaped Unicode character to escaped value string.",
+				 function );
+
+				goto on_error;
+			}
+			escaped_value_string_index += print_count;
+		}
+		else
+		{
+#if defined( HAVE_WIDE_SYSTEM_CHARACTER )
+			result = libuna_unicode_character_copy_to_ucs2(
+			          unicode_character,
+			          (libuna_utf16_character_t *) escaped_value_string,
+			          escaped_value_string_size,
+			          &escaped_value_string_index,
+			          error );
+#else
+			result = libuna_unicode_character_copy_to_utf8_rfc2279(
+			          unicode_character,
+			          (libuna_utf8_character_t *) escaped_value_string,
+			          escaped_value_string_size,
+			          &escaped_value_string_index,
+			          error );
+#endif
+			if( result != 1 )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_CONVERSION,
+				 LIBCERROR_CONVERSION_ERROR_INPUT_FAILED,
+				 "%s: unable to copy Unicode character to escaped value string.",
+				 function );
+
+				goto on_error;
+			}
+		}
+	}
+	escaped_value_string[ escaped_value_string_index ] = 0;
+
+	fprintf(
+	 info_handle->bodyfile_stream,
+	 "%" PRIs_SYSTEM "",
+	 escaped_value_string );
+
+	memory_free(
+	 escaped_value_string );
+
+	return( 1 );
+
+on_error:
+	if( escaped_value_string != NULL )
+	{
+		memory_free(
+		 escaped_value_string );
+	}
+	return( -1 );
+}
+
 /* Prints a section header
  * Returns 1 if successful or -1 on error
  */
@@ -6181,17 +6381,39 @@ int info_handle_file_entry_value_fprint(
 
 		if( path != NULL )
 		{
-			fprintf(
-			 info_handle->bodyfile_stream,
-			 "%" PRIs_SYSTEM "",
-			 path );
+			if( info_handle_bodyfile_name_value_fprint(
+			     info_handle,
+			     path,
+			     path_length,
+			     error ) != 1 )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
+				 "%s: unable to print path string.",
+				 function );
+
+				goto on_error;
+			}
 		}
 		if( file_entry_name != NULL )
 		{
-			fprintf(
-			 info_handle->bodyfile_stream,
-			 "%" PRIs_SYSTEM "",
-			 file_entry_name );
+			if( info_handle_bodyfile_name_value_fprint(
+			     info_handle,
+			     file_entry_name,
+			     file_entry_name_size - 1,
+			     error ) != 1 )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,
+				 "%s: unable to print file entry name string.",
+				 function );
+
+				goto on_error;
+			}
 		}
 /* TODO print data stream name */
 /* TODO determine mode as string */

ewftools/info_handle.h

@@ -127,6 +127,12 @@ int info_handle_posix_time_value_fprint(
      int64_t value_64bit,
      libcerror_error_t **error );
 
+int info_handle_bodyfile_name_value_fprint(
+     info_handle_t *info_handle,
+     const system_character_t *value_string,
+     size_t value_string_length,
+     libcerror_error_t **error );
+
 int info_handle_section_header_fprint(
      info_handle_t *info_handle,
      const char *identifier,