xfs_dir.cpp

Go to the documentation of this file.

// xfs_dir.cpp -- shortform directory parser.
//
// All inode numbers in a shortform directory are either ALL 4 bytes or
// ALL 8 bytes; the choice is signalled by sf_hdr.i8count (0 -> 4-byte,
// non-zero -> 8-byte). The parent inode follows that same rule.
//
// The directory ends when we've consumed `count` entries; we DO NOT
// rely on data_len matching exactly because the data fork can have
// trailing zero padding.
 
#include "xfs_dir.hpp"
 
#include <algorithm>
#include <string>
 
namespace xfs {
 
namespace {
 
uint32_t read_u32_be(const unsigned char* p) {
    return be32(p);
}
 
uint64_t read_u64_be(const unsigned char* p) {
    return be64(p);
}
 
} // namespace
 
bool parse_shortform_dir(const unsigned char* data,
                         uint32_t data_len,
                         bool has_ftype,
                         ShortformDir& out) {
    if (data == nullptr || data_len < 4) return false;
    out = {};
 
    const uint8_t count   = data[0];
    const uint8_t i8count = data[1];
    const bool use_8byte = (i8count != 0);
    const uint32_t inumber_size = use_8byte ? 8u : 4u;
 
    // Parent comes right after the 2-byte header.
    uint32_t pos = 2;
    if (pos + inumber_size > data_len) return false;
    out.parent_ino = use_8byte ? read_u64_be(data + pos)
                                : read_u32_be(data + pos);
    pos += inumber_size;
 
    out.entries.reserve(count);
 
    for (uint8_t i = 0; i < count; ++i) {
        if (pos + 1 > data_len) return false;
        const uint8_t namelen = data[pos];
        ++pos;
 
        // 2 bytes of "offset" we skip
        if (pos + 2 > data_len) return false;
        pos += 2;
 
        // name
        if (pos + namelen > data_len) return false;
        DirEntry e;
        e.name.assign(reinterpret_cast<const char*>(data + pos), namelen);
        pos += namelen;
 
        // Sanity: refuse zero-length names and refuse '/' inside names
        // (they can never be legal on XFS but corrupted dirs sometimes
        // contain them).
        if (namelen == 0) return false;
        if (e.name.find('/') != std::string::npos) {
            // Replace any embedded '/' with underscore so the name
            // doesn't accidentally escape the export directory.
            std::replace(e.name.begin(), e.name.end(), '/', '_');
        }
 
        // V5 + FTYPE: 1-byte ftype before inumber
        if (has_ftype) {
            if (pos + 1 > data_len) return false;
            e.ftype = data[pos];
            e.ftype_valid = true;
            ++pos;
        }
 
        // inumber
        if (pos + inumber_size > data_len) return false;
        e.ino = use_8byte ? read_u64_be(data + pos)
                          : static_cast<uint64_t>(read_u32_be(data + pos));
        pos += inumber_size;
 
        // Skip "." and ".." which shouldn't appear in shortform but be
        // defensive against odd metadata.
        if (e.name == "." || e.name == "..") continue;
 
        out.entries.push_back(std::move(e));
    }
 
    return true;
}
 
// =============================================================================
//  Block / leaf data-block parser
// =============================================================================
 
namespace {
 
// Data-block header sizes (without the leaf tail at the end, which we
// don't parse). After this header start either data entries or unused
// (free) records.
//
// V4 xfs_dir2_data_hdr: __be32 magic + 3 * (be16 off + be16 len) = 16 bytes
// V5 xfs_dir3_data_hdr (= dir3_blk_hdr 48 bytes + 3 * 4 + 4 pad = 64 bytes)
//   dir3_blk_hdr: magic(4) + crc(4) + blkno(8) + lsn(8) + uuid(16) + owner(8) = 48
//   bestfree: 12, pad: 4
constexpr uint32_t DATA_HDR_SIZE_V4 = 16;
constexpr uint32_t DATA_HDR_SIZE_V5 = 64;
 
// Round up to next 8-byte boundary
constexpr uint32_t align8(uint32_t v) { return (v + 7u) & ~7u; }
 
} // namespace
 
bool parse_dir_data_block(const unsigned char* block_buf,
                          uint32_t block_size,
                          bool is_v5,
                          bool has_ftype,
                          bool accept_block_magic,
                          bool accept_data_magic,
                          std::vector<DirEntry>& out) {
    if (block_buf == nullptr || block_size < 64) return false;
 
    const uint32_t magic = be32(block_buf + 0x00);
    bool magic_ok = false;
    if (is_v5) {
        if (accept_block_magic && magic == XFS_DIR3_BLOCK_MAGIC) magic_ok = true;
        if (accept_data_magic  && magic == XFS_DIR3_DATA_MAGIC)  magic_ok = true;
    } else {
        if (accept_block_magic && magic == XFS_DIR2_BLOCK_MAGIC) magic_ok = true;
        if (accept_data_magic  && magic == XFS_DIR2_DATA_MAGIC)  magic_ok = true;
    }
    if (!magic_ok) return false;
 
    const uint32_t header_size = is_v5 ? DATA_HDR_SIZE_V5 : DATA_HDR_SIZE_V4;
    if (block_size <= header_size) return false;
 
    // Compute the "stop" offset. For BLOCK-format dirs there is a
    // trailing leaf table whose start we should not enter. The leaf
    // tail offset lives in the LAST 8 bytes of the block (v4 dir2_block_tail
    // = u32 count + u32 stale; the leaf table itself is at end - count*8).
    //
    // For DATA-format blocks (in leaf-format dirs) there is no tail, so
    // we iterate to the end of the block.
    //
    // Heuristic: for block-format, we trust the block_tail at the end;
    // when corrupted we still bound by block_size - 8 to be safe.
    uint32_t stop_offset = block_size;
    if ((is_v5 && magic == XFS_DIR3_BLOCK_MAGIC) ||
        (!is_v5 && magic == XFS_DIR2_BLOCK_MAGIC)) {
        // Block tail at end: u32 count + u32 stale. Leaf table size =
        // count * 8. Leaf table starts at block_size - 8 - count*8.
        if (block_size >= 8) {
            const uint32_t bt_count = be32(block_buf + block_size - 8);
            const uint32_t leaf_table_bytes = bt_count * 8u;
            if (8u + leaf_table_bytes <= block_size) {
                stop_offset = block_size - 8u - leaf_table_bytes;
            } else {
                stop_offset = block_size > 8u ? block_size - 8u : 0u;
            }
        }
    }
    if (stop_offset <= header_size) return false;
 
    uint32_t pos = header_size;
    while (pos + 4 <= stop_offset) {
        // Peek at the first 2 bytes -- a valid entry's first 2 bytes are
        // the high two bytes of the 64-bit inumber, which CANNOT both be
        // 0xFF (no inode is 0xFFFF...). The free-record sentinel is
        // 0xFFFF in those exact 2 bytes.
        const uint16_t first_word = be16(block_buf + pos);
        if (first_word == XFS_DIR2_DATA_FREE_TAG) {
            // Unused record: skip. Length is at +2.
            if (pos + 6 > stop_offset) break;
            const uint16_t freelen = be16(block_buf + pos + 2);
            if (freelen < 16 || pos + freelen > stop_offset) {
                // Corrupted free-record header -- bail out instead of
                // looping forever.
                return !out.empty();
            }
            pos += freelen;
            continue;
        }
 
        // It's a data entry: __be64 inumber, __u8 namelen, name[], (ftype),
        // __be16 tag, then alignment to 8.
        if (pos + 8 + 1 > stop_offset) break;  // need inumber + namelen
        const uint64_t inumber = be64(block_buf + pos);
        const uint8_t  namelen = block_buf[pos + 8];
        if (namelen == 0) {
            return !out.empty();  // malformed -- stop, keep what we got
        }
        // entry length: 8 (inumber) + 1 (namelen) + namelen + (has_ftype ? 1 : 0)
        //               + 2 (tag), padded to 8-byte boundary.
        const uint32_t raw_entry_len = 8u + 1u + namelen +
                                        (has_ftype ? 1u : 0u) + 2u;
        const uint32_t entry_len = align8(raw_entry_len);
        if (pos + entry_len > stop_offset) {
            // Truncated trailing entry; keep what we already read.
            break;
        }
 
        DirEntry e;
        e.name.assign(reinterpret_cast<const char*>(block_buf + pos + 9), namelen);
        // Reject embedded slashes (corrupt or malicious).
        if (e.name.find('/') != std::string::npos) {
            std::replace(e.name.begin(), e.name.end(), '/', '_');
        }
 
        if (has_ftype) {
            e.ftype = block_buf[pos + 9 + namelen];
            e.ftype_valid = true;
        }
        e.ino = inumber;
 
        // Skip "." and ".." (recovery does not export them; the parent
        // is exported separately, and "." is the directory itself).
        if (e.name != "." && e.name != "..") {
            out.push_back(std::move(e));
        }
 
        pos += entry_len;
    }
 
    return true;
}
 
} // namespace xfs