[FREELDR] Fix AttributeList parsing on NTFS driver

Author: iLauncherDev

boot/freeldr/freeldr/lib/fs/ntfs.c

@@ -371,21 +371,113 @@ static ULONG NtfsReadAttribute(PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_CONTEXT Cont
     return AlreadyRead;
 }
 
-static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelper(PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_RECORD AttrRecord, PNTFS_ATTR_RECORD AttrRecordEnd, ULONG Type, const WCHAR *Name, ULONG NameLength)
+static BOOLEAN NtfsFixupRecord(PNTFS_VOLUME_INFO Volume, PNTFS_RECORD Record)
+{
+    USHORT *USA;
+    USHORT USANumber;
+    USHORT USACount;
+    USHORT *Block;
+
+    USA = (USHORT*)((PCHAR)Record + Record->USAOffset);
+    USANumber = *(USA++);
+    USACount = Record->USACount - 1; /* Exclude the USA Number. */
+    Block = (USHORT*)((PCHAR)Record + Volume->BootSector.BytesPerSector - 2);
+
+    while (USACount)
+    {
+        if (*Block != USANumber)
+            return FALSE;
+        *Block = *(USA++);
+        Block = (USHORT*)((PCHAR)Block + Volume->BootSector.BytesPerSector);
+        USACount--;
+    }
+
+    return TRUE;
+}
+
+static BOOLEAN NtfsReadMftRecord(PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, PNTFS_MFT_RECORD Buffer)
+{
+    ULONGLONG BytesRead;
+
+    BytesRead = NtfsReadAttribute(Volume, Volume->MFTContext, MFTIndex * Volume->MftRecordSize, (PCHAR)Buffer, Volume->MftRecordSize);
+    if (BytesRead != Volume->MftRecordSize)
+        return FALSE;
+
+    /* Apply update sequence array fixups. */
+    return NtfsFixupRecord(Volume, (PNTFS_RECORD)Buffer);
+}
+
+static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelper(PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_RECORD AttrRecord, PNTFS_ATTR_RECORD AttrRecordEnd, ULONG Type, const WCHAR *Name, ULONG NameLength, ULONG Recursion);
+
+static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelperList(PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_LIST_ATTR AttrListRecord, PNTFS_ATTR_LIST_ATTR AttrListRecordEnd, ULONG Type, const WCHAR *Name, ULONG NameLength, ULONG Recursion)
+{
+    PNTFS_MFT_RECORD MftRecord = FrLdrTempAlloc(Volume->MftRecordSize, TAG_NTFS_MFT);
+    if (!MftRecord)
+        return NULL;
+
+    while (AttrListRecord < AttrListRecordEnd)
+    {
+        ULONGLONG MftIndex = AttrListRecord->BaseFileRef & 0xFFFFFFFFFFFF;
+        ULONG AttrType = AttrListRecord->Type;
+
+        if (AttrType == NTFS_ATTR_TYPE_END)
+            break;
+
+        TRACE("Recursion = %u, AttrListRecord->Type = 0x%x\n", Recursion, AttrListRecord->Type);
+
+        if (AttrListRecord->Type == Type && AttrListRecord->NameLength == NameLength)
+        {
+            PWCHAR AttrListName;
+
+            AttrListName = (PWCHAR)((PCHAR)AttrListRecord + AttrListRecord->NameOffset);
+            if (RtlEqualMemory(AttrListName, Name, NameLength << 1))
+            {
+                PNTFS_ATTR_CONTEXT Context;
+                PNTFS_ATTR_RECORD AttrRecord;
+                PNTFS_ATTR_RECORD AttrRecordEnd;
+
+                if (!NtfsReadMftRecord(Volume, MftIndex, MftRecord))
+                    goto skip;
+
+                AttrRecord = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + MftRecord->AttributesOffset);
+                AttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + MftRecord->BytesInUse);
+
+                Context = NtfsFindAttributeHelper(Volume, AttrRecord, AttrRecordEnd, Type, Name, NameLength, Recursion + 1);
+                if (Context)
+                {
+                    FrLdrTempFree(MftRecord, TAG_NTFS_MFT);
+                    return Context;
+                }
+            }
+        }
+
+skip:
+        if (AttrListRecord->RecLength == 0)
+            break;
+        AttrListRecord = (PNTFS_ATTR_LIST_ATTR)((PCHAR)AttrListRecord + AttrListRecord->RecLength);
+    }
+
+    FrLdrTempFree(MftRecord, TAG_NTFS_MFT);
+    return NULL;
+}
+
+static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelper(PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_RECORD AttrRecord, PNTFS_ATTR_RECORD AttrRecordEnd, ULONG Type, const WCHAR *Name, ULONG NameLength, ULONG Recursion)
 {
     while (AttrRecord < AttrRecordEnd)
     {
         if (AttrRecord->Type == NTFS_ATTR_TYPE_END)
             break;
 
-        if (AttrRecord->Type == NTFS_ATTR_TYPE_ATTRIBUTE_LIST)
+        TRACE("Recursion = %u, AttrRecord->Type = 0x%x\n", Recursion, AttrRecord->Type);
+
+        if (AttrRecord->Type == NTFS_ATTR_TYPE_ATTRIBUTE_LIST && Recursion < 8)
         {
             PNTFS_ATTR_CONTEXT Context;
             PNTFS_ATTR_CONTEXT ListContext;
             PVOID ListBuffer;
             ULONGLONG ListSize;
-            PNTFS_ATTR_RECORD ListAttrRecord;
-            PNTFS_ATTR_RECORD ListAttrRecordEnd;
+            PNTFS_ATTR_LIST_ATTR ListAttrRecord;
+            PNTFS_ATTR_LIST_ATTR ListAttrRecordEnd;
 
             ListContext = NtfsPrepareAttributeContext(AttrRecord);
 
@@ -401,13 +493,13 @@ static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelper(PNTFS_VOLUME_INFO Volume, PNTF
                 continue;
             }
 
-            ListAttrRecord = (PNTFS_ATTR_RECORD)ListBuffer;
-            ListAttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)ListBuffer + ListSize);
+            ListAttrRecord = (PNTFS_ATTR_LIST_ATTR)ListBuffer;
+            ListAttrRecordEnd = (PNTFS_ATTR_LIST_ATTR)((PCHAR)ListBuffer + ListSize);
 
             if (NtfsReadAttribute(Volume, ListContext, 0, ListBuffer, (ULONG)ListSize) == ListSize)
             {
-                Context = NtfsFindAttributeHelper(Volume, ListAttrRecord, ListAttrRecordEnd,
-                                                  Type, Name, NameLength);
+                Context = NtfsFindAttributeHelperList(Volume, ListAttrRecord, ListAttrRecordEnd,
+                                                          Type, Name, NameLength, Recursion + 1);
 
                 NtfsReleaseAttributeContext(ListContext);
                 FrLdrTempFree(ListBuffer, TAG_NTFS_LIST);
@@ -419,7 +511,7 @@ static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelper(PNTFS_VOLUME_INFO Volume, PNTF
 
         if (AttrRecord->Type == Type)
         {
-            if (AttrRecord->NameLength == NameLength)
+            if (AttrRecord->NameLength == NameLength && NtfsGetAttributeSize(AttrRecord) != 0)
             {
                 PWCHAR AttrName;
 
@@ -433,7 +525,7 @@ static PNTFS_ATTR_CONTEXT NtfsFindAttributeHelper(PNTFS_VOLUME_INFO Volume, PNTF
         }
 
         if (AttrRecord->Length == 0)
-            return NULL;
+            break;
         AttrRecord = (PNTFS_ATTR_RECORD)((PCHAR)AttrRecord + AttrRecord->Length);
     }
 
@@ -447,47 +539,11 @@ static PNTFS_ATTR_CONTEXT NtfsFindAttribute(PNTFS_VOLUME_INFO Volume, PNTFS_MFT_
     ULONG NameLength;
 
     AttrRecord = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + MftRecord->AttributesOffset);
-    AttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + Volume->MftRecordSize);
+    AttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + MftRecord->BytesInUse);
     for (NameLength = 0; Name[NameLength] != 0; NameLength++)
         ;
 
-    return NtfsFindAttributeHelper(Volume, AttrRecord, AttrRecordEnd, Type, Name, NameLength);
-}
-
-static BOOLEAN NtfsFixupRecord(PNTFS_VOLUME_INFO Volume, PNTFS_RECORD Record)
-{
-    USHORT *USA;
-    USHORT USANumber;
-    USHORT USACount;
-    USHORT *Block;
-
-    USA = (USHORT*)((PCHAR)Record + Record->USAOffset);
-    USANumber = *(USA++);
-    USACount = Record->USACount - 1; /* Exclude the USA Number. */
-    Block = (USHORT*)((PCHAR)Record + Volume->BootSector.BytesPerSector - 2);
-
-    while (USACount)
-    {
-        if (*Block != USANumber)
-            return FALSE;
-        *Block = *(USA++);
-        Block = (USHORT*)((PCHAR)Block + Volume->BootSector.BytesPerSector);
-        USACount--;
-    }
-
-    return TRUE;
-}
-
-static BOOLEAN NtfsReadMftRecord(PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, PNTFS_MFT_RECORD Buffer)
-{
-    ULONGLONG BytesRead;
-
-    BytesRead = NtfsReadAttribute(Volume, Volume->MFTContext, MFTIndex * Volume->MftRecordSize, (PCHAR)Buffer, Volume->MftRecordSize);
-    if (BytesRead != Volume->MftRecordSize)
-        return FALSE;
-
-    /* Apply update sequence array fixups. */
-    return NtfsFixupRecord(Volume, (PNTFS_RECORD)Buffer);
+    return NtfsFindAttributeHelper(Volume, AttrRecord, AttrRecordEnd, Type, Name, NameLength, 0);
 }
 
 #if DBG
@@ -592,6 +648,7 @@ static BOOLEAN NtfsFindMftRecord(PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, P
         while (IndexEntry < IndexEntryEnd &&
                !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
         {
+            TRACE("%s ", FileName);
             if (NtfsCompareFileName(FileName, IndexEntry))
             {
                 *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
@@ -675,6 +732,7 @@ static BOOLEAN NtfsFindMftRecord(PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, P
                 while (IndexEntry < IndexEntryEnd &&
                        !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
                 {
+                    TRACE("%s ", FileName);
                     if (NtfsCompareFileName(FileName, IndexEntry))
                     {
                         TRACE("File found\n");