From c501c643f7d54b0f3959a788281913435144aa5b Mon Sep 17 00:00:00 2001 From: Roberto Larcher Date: Tue, 1 Sep 2015 16:51:03 +0200 Subject: [PATCH 1/2] NegativeArraySizeException patch This excepion is raised when the attachment size is a multiple of 8176 (the buffer size). InputStream read methos return -1 if there is no more data because the end of the stream has been reached A simple check if result != -1 is added refs: http://forum.sleuthkit.org/viewtopic.php?f=6&t=2563 http://docs.oracle.com/javase/7/docs/api/java/io/InputStream.html#read() --- .../autopsy/thunderbirdparser/PstParser.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index af3c55bf8f..05f313fd7e 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -258,9 +258,14 @@ class PstParser { out.write(buffer); count = attachmentStream.read(buffer); } - byte[] endBuffer = new byte[count]; - System.arraycopy(buffer, 0, endBuffer, 0, count); - out.write(endBuffer); + if(count != -1){ + byte[] endBuffer = new byte[count]; + System.arraycopy(buffer, 0, endBuffer, 0, count); + out.write(endBuffer); + } + else { + System.err.println(attach.toString()); + } } } From 3c0a34d1b2721ebb2b1da12a2587249477fb690e Mon Sep 17 00:00:00 2001 From: Roberto Larcher Date: Fri, 4 Sep 2015 11:23:24 +0200 Subject: [PATCH 2/2] Further analysis The problem seems to be in java-libpst. Sometimes getFileInputStream() returns an InputStream, but at the first InputStream.read(buffer) the method returns -1. Further analysis is needed to isolate the problem in java-libpst. To patch this an IOException is thrown --- .../autopsy/thunderbirdparser/PstParser.java | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index 05f313fd7e..350ee6df6a 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -254,18 +254,19 @@ class PstParser { int bufferSize = 8176; byte[] buffer = new byte[bufferSize]; int count = attachmentStream.read(buffer); + + if(count == -1) { + throw new IOException("attachmentStream invalid (read() fails). File "+attach.getLongFilename()+ " skipped"); + } + while (count == bufferSize) { out.write(buffer); count = attachmentStream.read(buffer); } - if(count != -1){ - byte[] endBuffer = new byte[count]; - System.arraycopy(buffer, 0, endBuffer, 0, count); - out.write(endBuffer); - } - else { - System.err.println(attach.toString()); - } + + byte[] endBuffer = new byte[count]; + System.arraycopy(buffer, 0, endBuffer, 0, count); + out.write(endBuffer); } }