dfvfs
dfvfs copied to clipboard
gzip file with trailing 0-byte values raises dfvfs.lib.errors.FileFormatError: Unsupported signature: 0x0000
Traceback (most recent call last):
File "tools/log2timeline.py", line 94, in <module>
if not Main():
File "tools/log2timeline.py", line 69, in Main
tool.ExtractEventsFromSources()
File "plaso/cli/log2timeline_tool.py", line 404, in ExtractEventsFromSources
is_archive = self._IsArchiveFile(self._source_path_specs[0])
File "plaso/cli/extraction_tool.py", line 249, in _IsArchiveFile
type_indicators = dfvfs_analyzer.Analyzer.GetArchiveTypeIndicators(
File "/usr/lib/python3.9/site-packages/dfvfs/analyzer/analyzer.py", line 245, in GetArchiveTypeIndicators
return cls._GetTypeIndicators(
File "/usr/lib/python3.9/site-packages/dfvfs/analyzer/analyzer.py", line 180, in _GetTypeIndicators
file_object = resolver.Resolver.OpenFileObject(
File "/usr/lib/python3.9/site-packages/dfvfs/resolver/resolver.py", line 109, in OpenFileObject
file_object.Open()
File "/usr/lib/python3.9/site-packages/dfvfs/file_io/file_io.py", line 89, in Open
self._Open(mode=mode)
File "/usr/lib/python3.9/site-packages/dfvfs/file_io/file_object_io.py", line 43, in _Open
self._file_object = self._OpenFileObject(self._path_spec)
File "/usr/lib/python3.9/site-packages/dfvfs/file_io/gzip_file_io.py", line 58, in _OpenFileObject
gzip_compressed_stream.Open(file_object)
File "/usr/lib/python3.9/site-packages/dfvfs/lib/gzipfile.py", line 485, in Open
member = GzipMember(
File "/usr/lib/python3.9/site-packages/dfvfs/lib/gzipfile.py", line 164, in __init__
self._ReadMemberHeader(file_object)
File "/usr/lib/python3.9/site-packages/dfvfs/lib/gzipfile.py", line 243, in _ReadMemberHeader
raise errors.FileFormatError(
dfvfs.lib.errors.FileFormatError: Unsupported signature: 0x0000.
00000000 1f 8b 08 00 9d d5 7f 5d 00 03 ed 7d 79 40 14 47 |.......]...}[email protected]|
...
00003250 ff 01 5f 8b 14 7a 00 f0 00 00 00 00 00 00 00 00 |.._..z..........|
00003260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00005000
Both gunzip and Python gzip module seems to ignore the 0-byte values
import gzip
f = gzip.GzipFile('files/851412.anon_system_stats', 'r')
b = f.read()
len(b) => 61440
gunzip seems to check for anything other than 0-byte values:
gzip: /tmp/851412.anon_system_stats.gz: decompression OK, trailing garbage ignored
Python gzip module seems to not check for anything other than 0-byte values