From f692f27569a4fdb5a6ee0c8e1eb0035268eeadfd Mon Sep 17 00:00:00 2001 From: Richard Jones Date: Mon, 29 Mar 2010 22:51:12 +0100 Subject: [PATCH] Zero all new block allocations. Make sure all new block allocations (from allocate_block) are zeroed. It can happen that junk from previous hive pages can end up in new block allocations, if the hive previously shrank. (Thanks to Marko Myllynen for finding an example where this happened). --- lib/hivex.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/hivex.c b/lib/hivex.c index ef3cba7..74a7f55 100644 --- a/lib/hivex.c +++ b/lib/hivex.c @@ -1860,6 +1860,8 @@ allocate_block (hive_h *h, size_t seg_len, const char id[2]) struct ntreg_hbin_block *blockhdr = (struct ntreg_hbin_block *) (h->addr + offset); + memset (blockhdr, 0, seg_len); + blockhdr->seg_len = htole32 (- (int32_t) seg_len); if (id[0] && id[1] && seg_len >= sizeof (struct ntreg_hbin_block)) { blockhdr->id[0] = id[0]; -- 1.8.3.1