From 2a1279607c3982114ae931a6670bc36d2cb2ec1d Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Sat, 17 Sep 2011 16:14:31 -0700 Subject: [PATCH] hivexml: Do not print null input times Dealing with "1601-01-01T00:00:00Z" is unnecessarily awkward, especially since the value only represents a 0 found in the data. Signed-off-by: Alex Nelson --- xml/hivexml.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/xml/hivexml.c b/xml/hivexml.c index cf11676..5030c24 100644 --- a/xml/hivexml.c +++ b/xml/hivexml.c @@ -169,6 +169,10 @@ main (int argc, char *argv[]) * fiwalk.cpp. * * The caller should free the returned buffer. + * + * This function returns NULL on a 0 input. In the context of + * hives, which only have mtimes, 0 will always be a complete + * absence of data. */ #define WINDOWS_TICK 10000000LL @@ -182,6 +186,9 @@ filetime_to_8601 (int64_t windows_ticks) time_t t; struct tm *tm; + if (windows_ticks == 0LL) + return NULL; + t = windows_ticks / WINDOWS_TICK - SEC_TO_UNIX_EPOCH; tm = gmtime (&t); if (tm == NULL) -- 1.8.3.1