From 02c923b69c85f4a6459719678b0e30aa1fe26ace Mon Sep 17 00:00:00 2001
From: Christophe Grenier <grenier@cgsecurity.org>
Date: Sat, 26 Jul 2014 15:35:13 +0200
Subject: [PATCH] PhotoRec: stricter check .eCryptfs files

---
 src/file_ecryptfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/file_ecryptfs.c b/src/file_ecryptfs.c
index 9f18b147..8e19f185 100644
--- a/src/file_ecryptfs.c
+++ b/src/file_ecryptfs.c
@@ -74,6 +74,8 @@ static int header_check_ecryptfs(const unsigned char *buffer, const unsigned int
   const struct ecrypfs_header *e=(const struct ecrypfs_header *)buffer;
   if((be32(e->marker1) ^ be32(e->marker2)) != 0x3c81b7f5)
     return 0;
+  if(be64(e->unencrypted_file_size) < sizeof(struct ecrypfs_header))
+    return 0;
   reset_file_recovery(file_recovery_new);
 #ifdef DJGPP
   file_recovery_new->extension="ecr";