On Sat, Sep 17, 2011 at 04:14:31PM -0700, Alex Nelson wrote:

Dealing with "1601-01-01T00:00:00Z" is unnecessarily awkward, especially since the value only represents a 0 found in the data.

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu> --- xml/hivexml.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/xml/hivexml.c b/xml/hivexml.c index cf11676..5030c24 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -169,6 +169,10 @@ main (int argc, char *argv[]) * fiwalk.cpp. * * The caller should free the returned buffer. + * + * This function returns NULL on a 0 input. In the context of + * hives, which only have mtimes, 0 will always be a complete + * absence of data. */

#define WINDOWS_TICK 10000000LL @@ -182,6 +186,9 @@ filetime_to_8601 (int64_t windows_ticks) time_t t; struct tm *tm;

+ if (windows_ticks == 0LL) + return NULL; + t = windows_ticks / WINDOWS_TICK - SEC_TO_UNIX_EPOCH; tm = gmtime (&t); if (tm == NULL)

Thanks, ACKed and pushed. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones New in Fedora 11: Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 70 libraries supprt'd http://fedoraproject.org/wiki/MinGW http://www.annexia.org/fedora_mingw