resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…

…60 directory holes

NEWS.txt

@@ -1,6 +1,13 @@
 Numbers refer to SourceForge.net tracker IDs:
     http://sourceforge.net/tracker/?group_id=55685
 
+---------------- VERSION 3.2.2 --------------
+Bug Fixes
+- 3213886: ISO9660 directory hole not advancing
+
+New Features:
+- 3213888: RAW CD format
+
 ---------------- VERSION 3.2.1 --------------
 Bug Fixes
 - 3108272: fls arguments for -d and -u

tsk3/fs/fs_io.c

@@ -60,7 +60,15 @@ tsk_fs_read(TSK_FS_INFO * a_fs, TSK_OFF_T a_off, char *a_buf, size_t a_len)
         return -1;
     }
 
-    off = a_off + a_fs->offset;
+    off = a_off + a_fs->offset; 
+    if (((a_fs->block_pre_size) || (a_fs->block_post_size)) && (a_fs->block_size)) {
+        TSK_DADDR_T blk = a_off / a_fs->block_size;
+        if (a_fs->block_pre_size)
+            off += ((blk+1) * a_fs->block_pre_size);
+        if (a_fs->block_post_size) 
+            off += (blk * a_fs->block_post_size);
+    }
+
     return tsk_img_read(a_fs->img_info, off, a_buf, a_len);
 }
 
@@ -82,6 +90,8 @@ ssize_t
 tsk_fs_read_block(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr, char *a_buf,
     size_t a_len)
 {
+    TSK_OFF_T off = 0;
+
     if (a_len % a_fs->block_size) {
         tsk_error_reset();
         tsk_errno = TSK_ERR_FS_READ;
@@ -105,7 +115,11 @@ tsk_fs_read_block(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr, char *a_buf,
         return -1;
     }
 
-    return tsk_img_read(a_fs->img_info,
-        a_fs->offset + (TSK_OFF_T) a_addr * a_fs->block_size, a_buf,
-        a_len);
+    off = a_fs->offset + (TSK_OFF_T) a_addr * a_fs->block_size;
+    if (a_fs->block_pre_size)
+        off += ((a_addr+1) * a_fs->block_pre_size);
+    if (a_fs->block_post_size) 
+        off += (a_addr * a_fs->block_post_size);
+
+    return tsk_img_read(a_fs->img_info, off, a_buf, a_len);
 }

tsk3/fs/iso9660.c

@@ -2097,10 +2097,11 @@ load_vol_desc(TSK_FS_INFO * fs)
     ssize_t cnt;
     iso9660_pvd_node *p;
     iso9660_svd_node *s;
+    uint8_t magic_seen = 0;
 
     iso->pvd = NULL;
     iso->svd = NULL;
-    fs->block_size = 0;
+    //fs->block_size = 0;
     fs->dev_bsize = fs->img_info->sector_size;
 
 #if 0
@@ -2122,6 +2123,8 @@ load_vol_desc(TSK_FS_INFO * fs)
             return -1;
         }
 
+ISO_RETRY_MAGIC:
+
         // read the full descriptor
         cnt = tsk_fs_read(fs, offs, (char *) vd, sizeof(iso9660_gvd));
         if (cnt != sizeof(iso9660_gvd)) {
@@ -2138,11 +2141,28 @@ load_vol_desc(TSK_FS_INFO * fs)
         // verify the magic value
         if (strncmp(vd->magic, ISO9660_MAGIC, 5)) {
             if (tsk_verbose)
-                tsk_fprintf(stderr, "%s: Bad volume descriptor: \
-                         Magic number is not CD001\n", myname);
+                tsk_fprintf(stderr, "%s: Bad volume descriptor: Magic number is not CD001\n",
+                        myname);
+
+            // see if we have a RAW image
+            if (magic_seen == 0) {
+                if (fs->block_pre_size == 0) {
+                    if (tsk_verbose) 
+                        tsk_fprintf(stderr, "Trying RAW ISO9660 with 16-byte pre-block size\n");
+                    fs->block_pre_size = 16;
+                    // 304 = 2352 - 2048
+                    fs->block_post_size = 304 - fs->block_pre_size;
+                    goto ISO_RETRY_MAGIC;
+                }
+                else {
+                    fs->block_pre_size = 0;
+                    fs->block_post_size = 0;
+                }
+            }
             free(vd);
             return -1;
         }
+        magic_seen = 1;
 
         // see if we are done
         if (vd->type == ISO9660_VOL_DESC_SET_TERM)
@@ -2332,6 +2352,9 @@ iso9660_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
     tmpguess[3] = 1;
     tsk_fs_guessu32(fs, tmpguess, 1);
 
+    // we need a value here to test for RAW images. So, start with 2048
+    fs->block_size = 2048;
+
     /* load_vol_descs checks magic value */
     if (load_vol_desc(fs) == -1) {
         fs->tag = 0;

tsk3/fs/iso9660_dent.c

@@ -180,6 +180,7 @@ iso9660_proc_dir(TSK_FS_INFO * a_fs, TSK_FS_DIR * a_fs_dir, char *buf,
          * directory.  The contents are  block aligned. So, we 
          * scan ahead until we get either a non-zero entry or the block boundary */
         else {
+            buf_idx++;
             for (; buf_idx < a_length - sizeof(iso9660_dentry); buf_idx++) {
                 if (buf[buf_idx] != 0) {
                     dd = (iso9660_dentry *) & buf[buf_idx];

tsk3/fs/tsk_fs.h

@@ -830,6 +830,13 @@ extern "C" {
         unsigned int block_size;        ///< Size of each block (in bytes)
         unsigned int dev_bsize; ///< Size of device block (typically always 512)
 
+        /* The following are used for really RAW images that contain data
+           before and after the actual user sector. For example, a raw cd
+           image may have 16 bytes before the start of each sector.
+         */
+        unsigned int block_pre_size;    ///< Number of bytes that preceed each block (currently only used for RAW CDs)
+        unsigned int block_post_size;    ///< Number of bytes that follow each block (currently only used for RAW CDs)
+
         /* Journal */
         TSK_INUM_T journ_inum;  ///< Address of journal inode