On Saturday, 8 October 2016 18:27:21 CEST Matteo Cafasso wrote:
Patch ready for merging.
v4:
- check return code of tsk_fs_attr_walk
- pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to
tsk_fs_attr_walk
After discussing with TSK authors the behaviour is clear. [1]
Thanks, this improves the situation a bit.
In case of COMPRESSED blocks, the callback will be called for all
the
attributes no matter whether they are on disk or not (sparse). In
such cases, the block address will be 0. [2]
Note that the API docs say:
For compressed and sparse attributes, the address *may* be zero.
(emphasis is mine)
My concern is that, if the address in such cases is "unspecified", then
the comparisons in "attrwalk_callback" are done against a
random/unitialized value (which would be bad).
Also, if the block address would be zero, what's the point of having it
among the blocks tsk_fs_attr_walk() iterates over?
Thanks,
--
Pino Toscano