From 7bc1d5a6c2fe2e032a9dddb625af7963d9c79e6e Mon Sep 17 00:00:00 2001
From: Christophe Grenier <grenier@cgsecurity.org>
Date: Sat, 3 Sep 2016 18:23:13 +0200
Subject: [PATCH] PhotoRec: find the filesize for Adobe Brush .abr

---
 src/file_abr.c | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/src/file_abr.c b/src/file_abr.c
index 934eab4b..e95f2992 100644
--- a/src/file_abr.c
+++ b/src/file_abr.c
@@ -2,7 +2,7 @@
 
     File: file_abr.c
 
-    Copyright (C) 2012 Christophe GRENIER <grenier@cgsecurity.org>
+    Copyright (C) 2012,2016 Christophe GRENIER <grenier@cgsecurity.org>
   
     This software is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -29,22 +29,58 @@
 #include <stdio.h>
 #include "types.h"
 #include "filegen.h"
+#include "common.h"
 
 static void register_header_check_abr(file_stat_t *file_stat);
+struct abr_header
+{
+  char magic[4];
+  char info[4];
+  uint32_t size;
+} __attribute__ ((gcc_struct, __packed__));
 
 const file_hint_t file_hint_abr= {
   .extension="abr",
   .description="Adobe Brush",
-  .max_filesize=100*1024*1024,
+  .max_filesize=PHOTOREC_MAX_FILE_SIZE,
   .recover=1,
   .enable_by_default=1,
   .register_header_check=&register_header_check_abr
 };
 
+static data_check_t data_check_abr(const unsigned char *buffer, const unsigned int buffer_size, file_recovery_t *file_recovery)
+{
+  while(file_recovery->calculated_file_size + buffer_size/2  >= file_recovery->file_size &&
+      file_recovery->calculated_file_size + 12 < file_recovery->file_size + buffer_size/2)
+  {
+    const unsigned int i=file_recovery->calculated_file_size - file_recovery->file_size + buffer_size/2;
+    const struct abr_header *hdr=(const struct abr_header*)&buffer[i];
+    if(memcmp(hdr->magic, "8BIM", 4)!=0)
+      return DC_STOP;
+    file_recovery->calculated_file_size+=be32(hdr->size)+12;
+  }
+  return DC_CONTINUE;
+}
+
 static int header_check_abr(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
 {
+  const struct abr_header *hdr=(const struct abr_header*)&buffer[4];
+  unsigned int i=4;
+  while(i + 12 < buffer_size && i + 12 < 512)
+  {
+    const struct abr_header *h=(const struct abr_header*)&buffer[i];
+    if(memcmp(h->magic, "8BIM", 4)!=0)
+      return 0;
+    i+=be32(h->size)+12;
+  }
   reset_file_recovery(file_recovery_new);
   file_recovery_new->extension=file_hint_abr.extension;
+  file_recovery_new->min_filesize=4+12+be32(hdr->size);
+  file_recovery_new->calculated_file_size=4+12+be32(hdr->size);
+  if(file_recovery_new->blocksize < 12)
+    return 1;
+  file_recovery_new->data_check=&data_check_abr;
+  file_recovery_new->file_check=&file_check_size;
   return 1;
 }