hfs_format.cpp

Go to the documentation of this file.

// hfs_format.cpp -- HFS+ / HFSX on-disk parsers.
//
// All parsers are pure: they read raw bytes and fill structs. They do
// NOT perform I/O. Sanity checks reject obviously wrong values
// (signature, block size, total blocks).
 
#include "hfs_format.hpp"
 
#include <algorithm>
 
namespace hfs {
 
bool parse_fork_data(const unsigned char* buf, ForkData& out) {
    if (buf == nullptr) return false;
    out = {};
    out.logical_size = be64(buf + 0x00);
    out.clump_size   = be32(buf + 0x08);
    out.total_blocks = be32(buf + 0x0C);
 
    // 8 extent descriptors, each 8 bytes (start_block + block_count)
    for (size_t i = 0; i < 8; ++i) {
        const unsigned char* p = buf + 0x10 + i * 8;
        out.extents[i].start_block = be32(p + 0);
        out.extents[i].block_count = be32(p + 4);
    }
    return true;
}
 
bool parse_volume_header(const unsigned char* buf, VolumeHeader& out) {
    if (buf == nullptr) return false;
 
    out = {};
    out.signature = be16(buf + 0x00);
    if (out.signature != HFSPLUS_SIGNATURE && out.signature != HFSX_SIGNATURE) {
        return false;
    }
    out.version = be16(buf + 0x02);
    // For HFS+ classic the version must be 4; for HFSX it must be 5.
    if (out.is_hfsplus() && out.version != HFSPLUS_VERSION) return false;
    if (out.is_hfsx()    && out.version != HFSX_VERSION)    return false;
 
    out.attributes           = be32(buf + 0x04);
    out.last_mounted_version = be32(buf + 0x08);
    out.journal_info_block   = be32(buf + 0x0C);
    out.create_date          = be32(buf + 0x10);
    out.modify_date          = be32(buf + 0x14);
    out.backup_date          = be32(buf + 0x18);
    out.checked_date         = be32(buf + 0x1C);
    out.file_count           = be32(buf + 0x20);
    out.folder_count         = be32(buf + 0x24);
    out.block_size           = be32(buf + 0x28);
    out.total_blocks         = be32(buf + 0x2C);
    out.free_blocks          = be32(buf + 0x30);
    out.next_allocation      = be32(buf + 0x34);
    out.rsrc_clump_size      = be32(buf + 0x38);
    out.data_clump_size      = be32(buf + 0x3C);
    out.next_catalog_id      = be32(buf + 0x40);
    out.write_count          = be32(buf + 0x44);
    out.encodings_bitmap     = be64(buf + 0x48);
 
    // finderInfo is 32 bytes at offset 0x50 (8 * uint32 in raw form, but
    // we treat it opaquely)
    std::copy(buf + 0x50, buf + 0x70, out.finder_info.begin());
 
    // Five fork-data structs, each 80 bytes, starting at offset 0x70:
    //   allocationFile  @ 0x070
    //   extentsFile     @ 0x0C0
    //   catalogFile     @ 0x110
    //   attributesFile  @ 0x160
    //   startupFile     @ 0x1B0
    // End: 0x1B0 + 0x50 = 0x200 (= 512 bytes total).
    if (!parse_fork_data(buf + 0x070, out.allocation_file)) return false;
    if (!parse_fork_data(buf + 0x0C0, out.extents_file))    return false;
    if (!parse_fork_data(buf + 0x110, out.catalog_file))    return false;
    if (!parse_fork_data(buf + 0x160, out.attributes_file)) return false;
    if (!parse_fork_data(buf + 0x1B0, out.startup_file))    return false;
 
    // Sanity checks
    // block_size must be a power of 2 in [512, 65536]
    if (out.block_size < 512 || out.block_size > 65536 ||
        (out.block_size & (out.block_size - 1)) != 0) {
        return false;
    }
    // total_blocks must be plausible: at least the volume header occupies
    // some blocks; reject zero. Also reject absurdly large values.
    if (out.total_blocks == 0) return false;
 
    // The catalog file must have a non-zero size (every HFS+ volume has
    // at least the root folder and root thread record).
    if (out.catalog_file.logical_size == 0) return false;
    if (out.catalog_file.total_blocks == 0) return false;
 
    // Sanity: the first extent of each special file must point INTO the
    // volume range. Extent start_block + block_count <= total_blocks.
    auto fork_in_range = [&](const ForkData& f) -> bool {
        for (const auto& e : f.extents) {
            if (e.block_count == 0) continue;
            // Defensive: prevent overflow
            if (e.start_block > out.total_blocks) return false;
            const uint64_t end = static_cast<uint64_t>(e.start_block)
                                + e.block_count;
            if (end > out.total_blocks) return false;
        }
        return true;
    };
    if (!fork_in_range(out.allocation_file)) return false;
    if (!fork_in_range(out.extents_file))    return false;
    if (!fork_in_range(out.catalog_file))    return false;
    if (!fork_in_range(out.attributes_file)) return false;
    if (!fork_in_range(out.startup_file))    return false;
 
    return true;
}
 
} // namespace hfs