From: Alex Nelson <ajnelson@cs.ucsc.edu>
Date: Sat, 17 Sep 2011 23:14:31 +0000 (-0700)
Subject: hivexml: Do not print null input times
X-Git-Tag: 1.3.2~2
X-Git-Url: http://git.annexia.org/?a=commitdiff_plain;h=2a1279607c3982114ae931a6670bc36d2cb2ec1d;p=hivex.git

hivexml: Do not print null input times

Dealing with "1601-01-01T00:00:00Z" is unnecessarily awkward, especially
since the value only represents a 0 found in the data.

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
---

diff --git a/xml/hivexml.c b/xml/hivexml.c
index cf11676..5030c24 100644
--- a/xml/hivexml.c
+++ b/xml/hivexml.c
@@ -169,6 +169,10 @@ main (int argc, char *argv[])
  * fiwalk.cpp.
  *
  * The caller should free the returned buffer.
+ *
+ * This function returns NULL on a 0 input.  In the context of
+ * hives, which only have mtimes, 0 will always be a complete
+ * absence of data.
  */
 
 #define WINDOWS_TICK 10000000LL
@@ -182,6 +186,9 @@ filetime_to_8601 (int64_t windows_ticks)
   time_t t;
   struct tm *tm;
 
+  if (windows_ticks == 0LL)
+    return NULL;
+
   t = windows_ticks / WINDOWS_TICK - SEC_TO_UNIX_EPOCH;
   tm = gmtime (&t);
   if (tm == NULL)