From 9fcfd1910fe016af76b66178d8004816aebb4ec8 Mon Sep 17 00:00:00 2001
From: Christophe Grenier <grenier@cgsecurity.org>
Date: Wed, 27 Jun 2012 08:56:19 +0200
Subject: [PATCH] PhotoRec: update csectDir checks

---
 src/file_doc.c | 14 ++++++++------
 src/ole.h      |  8 ++++----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/file_doc.c b/src/file_doc.c
index 00ea8165..67e4f821 100644
--- a/src/file_doc.c
+++ b/src/file_doc.c
@@ -302,15 +302,17 @@ static int header_check_doc(const unsigned char *buffer, const unsigned int buff
     const struct OLE_HDR *header=(const struct OLE_HDR *)buffer;
     if(le16(header->reserved)!=0 || le32(header->reserved1)!=0)
       return 0;
-    /* max file have reserved2=1
-     * qbb file have reserved2=4 */
-    if(le32(header->reserved2)!=0 && le32(header->reserved2)!=1 && le32(header->reserved2)!=4)
-      return 0;
     if(le16(header->uMiniSectorShift)!=6)
       return 0;
     /* max and qbb file have uSectorShift=12 */
     if(le16(header->uSectorShift)!=9 && le16(header->uSectorShift)!=12)
       return 0;
+    if(le16(header->uSectorShift)==9 && le32(header->csectDir)!=0)
+      return 0;
+    /* max file have csectDir=1
+     * qbb file have csectDir=4 */
+    if(le16(header->uSectorShift)==12 && le32(header->csectDir)==0)
+      return 0;
     /*
        num_FAT_blocks=109+num_extra_FAT_blocks*(512-1);
        maximum file size is 512+(num_FAT_blocks*128)*512, about 1.6GB
@@ -501,7 +503,7 @@ static uint32_t *OLE_load_MiniFAT(FILE *IN, const struct OLE_HDR *header, const
     return NULL;
   minifat=(uint32_t*)MALLOC(le32(header->csectMiniFat) << le16(header->uSectorShift));
   minifat_pos=(unsigned char*)minifat;
-  block=le32(header->dir_flag);
+  block=le32(header->MiniFat_block);
   for(i=0; i < le32(header->csectMiniFat) && block < fat_entries; i++)
   {
     if(fseek(IN, ((uint64_t)block << le16(header->uSectorShift)) + 512, SEEK_SET) < 0)
@@ -751,7 +753,7 @@ static void file_rename_doc(const char *old_filename)
   if(le16(header->uSectorShift)==12)
   {
     fclose(file);
-    if(le32(header->reserved2)==1)
+    if(le32(header->csectDir)==1)
       file_rename(old_filename, NULL, 0, 0, "max", 1);
     else
       file_rename(old_filename, NULL, 0, 0, "qbb", 1);
diff --git a/src/ole.h b/src/ole.h
index a7811ca6..5f12569c 100644
--- a/src/ole.h
+++ b/src/ole.h
@@ -35,8 +35,8 @@
 
 struct OLE_HDR
 {
-	char			magic[8];				/*0*/
-	char			clsid[16];				/*8*/
+	char		magic[8];				/*0*/
+	char		clsid[16];				/*8*/
 	uint16_t	uMinorVersion;			/*24*/
 	uint16_t	uDllVersion;			/*26*/
 	uint16_t	uByteOrder;				/*28*/
@@ -44,12 +44,12 @@ struct OLE_HDR
 	uint16_t	uMiniSectorShift;		/*32*/
 	uint16_t	reserved;				/*34*/
 	uint32_t	reserved1;				/*36*/
-	uint32_t	reserved2;				/*40*/
+	uint32_t	csectDir;			/*40 Number of sectors in directory chains for 4KB sectors */
 	uint32_t	num_FAT_blocks;			/*44*/
 	uint32_t	root_start_block;		/*48*/
 	uint32_t	dfsignature;			/*52*/
 	uint32_t	miniSectorCutoff;		/*56*/
-	uint32_t	dir_flag;				/*60 first sec in the mini fat chain*/
+	uint32_t	MiniFat_block;			/*60 first sec in the mini fat chain*/
 	uint32_t	csectMiniFat;			/*64 number of sectors in the minifat */
 	uint32_t	FAT_next_block;			/*68*/
 	uint32_t	num_extra_FAT_blocks;	/*72*/