libyal / libpff Goto Github PK

Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format

License: GNU Lesser General Public License v3.0

PowerShell 0.70% Shell 1.99% C 91.14% Makefile 0.87% C++ 0.18% Java 0.08% Python 0.54% M4 3.90% Roff 0.59%

libpff's Introduction

libpff is a library to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.

These format are used by Microsoft Outlook to store email, contacts and other data.

Project information:

* Status: alpha
* Licence: LGPLv3+

PFF/OFF is used in several file types:

* PAB (Personal Address Book)
* PST (Personal Storage Table)
* OST (Offline Storage Table)

Supported formats:

* 32-bit ANSI (string)
* 64-bit Unicode (string)
* 64-bit with 4k pages with DEFLATE compression (Compressed OST files) (as of version 20130722)

Additional features:

* item recovery
* handles corrupted encrypted PFF with encryption type none

Also see:

* PFF forensics - analyzing the horrible reference file format: https://github.com/libyal/documentation/blob/master/PFF%20Forensics%20-%20analyzing%20the%20horrible%20reference%20file%20format.pdf
* PFF forensics - e-mail and appointment falsification analysis: https://github.com/libyal/documentation/blob/master/PFF%20forensics%20-%20e-mail%20and%20appoinment%20falsification%20analysis.pdf
* MAPI definitions: https://github.com/libyal/libfmapi/blob/master/documentation/MAPI%20definitions.pdf

Planned:

* Multi-threading support
* The Java (JNI) bindings are not operational and are there as long-term work in progress.

For more information see:

* Project documentation: https://github.com/libyal/libpff/wiki/Home
* How to build from source: https://github.com/libyal/libpff/wiki/Building

libpff's People

Contributors

Stargazers

Watchers

libpff's Issues

Cygwin Python Bindings Problem

I'm a big fan of this project as it's allowing me to perform a few functions that I've wanted to for years - so thanks for the hard work.

I can utilise the Python bindings in Ubuntu without any problems whatsoever but I can't get beyond the './configure' stage with Cygwin. All of the prerequisite libraries and Python are present when I try and run it but when I run './configure' I get these messages, which appear to indicate that Python won't be happening:-

checking whether to enable build Python bindings... (cached) no
checking whether to use use to specify the Python directory (pythondir)... (cached) no
checking whether to enable build Python 2 bindings... (cached) no
checking whether to use use to specify the Python 2 directory (pythondir2)... (cached) no
checking whether to enable build Python 3 bindings... (cached) no
checking whether to use use to specify the Python 3 directory (pythondir3)... (cached) no

Features:
Multi-threading support: pthread
Wide character type support: no
pfftools are build as static executables: no
Java (jpff) support: no
Python (pypff) support: no
Python version 2 (pypff) support: no
Python version 3 (pypff) support: no
Verbose output: no
Debug output: no

When I 'make install' pffexport does not compile either. I don't know if this is linked?

Are you able to provide any advice please?

Accessing message header attributes using pypff

I am using pypff. I have a PST archive with 10,000 messages from a variety of senders. I want to be able to get the header information from each of the messages (the to/from/cc/bcc, the date, the thread-index, message id, etc). I can get the subject and body of the message using the message object, but I can't seem to access anything else. Is there an API for these other message properties?

stand-alone usage of libfdata raises implicit declaration warnings

GCC (gcc-5.4.0) with -Wall should give the same results:

 * Messages for package app-forensics/libpff-20161119:

 *            may exhibit random runtime failures.
 * libpff_data_array.c:924:6: warning: implicit declaration of function ‘libfdata_list_element_get_element_index’ [-Wimplicit-function-declaration]
 * libpff_descriptors_index.c:148:8: warning: implicit declaration of function ‘libfdata_tree_free’ [-Wimplicit-function-declaration]
 * libpff_descriptors_index.c:257:7: warning: implicit declaration of function ‘libfdata_tree_initialize’ [-Wimplicit-function-declaration]
 * libpff_descriptors_index.c:283:7: warning: implicit declaration of function ‘libfdata_tree_set_root_node’ [-Wimplicit-function-declaration]
 * libpff_index.c:347:7: warning: implicit declaration of function ‘libfdata_tree_node_resize_sub_nodes’ [-Wimplicit-function-declaration]
 * libpff_index.c:367:8: warning: implicit declaration of function ‘libfdata_tree_node_set_sub_node_by_index’ [-Wimplicit-function-declaration]
 * libpff_index.c:507:9: warning: implicit declaration of function ‘libfdata_tree_node_append_sub_node’ [-Wimplicit-function-declaration]
 * libpff_index.c:526:9: warning: implicit declaration of function ‘libfdata_tree_node_set_deleted_sub_node’ [-Wimplicit-function-declaration]
 * libpff_index.c:763:7: warning: implicit declaration of function ‘libfdata_tree_node_set_leaf’ [-Wimplicit-function-declaration]
 * libpff_index.c:798:12: warning: implicit declaration of function ‘libfdata_tree_node_sub_nodes_data_range_is_set’ [-Wimplicit-function-declaration]
 * libpff_index.c:815:8: warning: implicit declaration of function ‘libfdata_tree_node_set_sub_nodes_data_range’ [-Wimplicit-function-declaration]
 * libpff_index.c:906:11: warning: implicit declaration of function ‘libfdata_tree_node_is_root’ [-Wimplicit-function-declaration]
 * libpff_index.c:989:6: warning: implicit declaration of function ‘libfdata_tree_node_set_node_value’ [-Wimplicit-function-declaration]
 * libpff_index.c:1063:6: warning: implicit declaration of function ‘libfdata_tree_node_get_node_value’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:80:6: warning: implicit declaration of function ‘libfdata_tree_get_root_node’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:146:6: warning: implicit declaration of function ‘libfdata_tree_node_get_number_of_sub_nodes’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:167:7: warning: implicit declaration of function ‘libfdata_tree_node_get_sub_node_by_index’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:186:7: warning: implicit declaration of function ‘libfdata_tree_node_get_node_value’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:239:12: warning: implicit declaration of function ‘libfdata_tree_node_is_leaf’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:260:13: warning: implicit declaration of function ‘libfdata_tree_node_is_deleted’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:1305:7: warning: implicit declaration of function ‘libfdata_tree_node_split_sub_nodes’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:1341:6: warning: implicit declaration of function ‘libfdata_tree_node_insert_sub_node’ [-Wimplicit-function-declaration]
 * libpff_index_tree.c:1365:6: warning: implicit declaration of function ‘libfdata_tree_node_set_leaf_sub_node’ [-Wimplicit-function-decla * libpff_offsets_index.c:148:8: warning: implicit declaration of function ‘libfdata_tree_free’ [-Wimplicit-function-declaration]
 * libpff_offsets_index.c:257:7: warning: implicit declaration of function ‘libfdata_tree_initialize’ [-Wimplicit-function-declaration]
 * libpff_offsets_index.c:283:7: warning: implicit declaration of function ‘libfdata_tree_set_root_node’ [-Wimplicit-function-declaration]
 * libpff_recover.c:201:6: warning: implicit declaration of function ‘libfdata_tree_get_number_of_leaf_nodes’ [-Wimplicit-function-declaration]
 * libpff_recover.c:226:7: warning: implicit declaration of function ‘libfdata_tree_get_leaf_node_by_index’ [-Wimplicit-function-declaration]
 * libpff_recover.c:245:7: warning: implicit declaration of function ‘libfdata_tree_node_get_node_value’ [-Wimplicit-function-declaration]
 * libpff_recover.c:555:8: warning: implicit declaration of function ‘libfdata_tree_node_set_deleted’ [-Wimplicit-function-declaration]
 * libpff_recover.c:796:6: warning: implicit declaration of function ‘libfdata_tree_get_number_of_deleted_leaf_nodes’ [-Wimplicit-function-declaration]
 * libpff_recover.c:821:7: warning: implicit declaration of function ‘libfdata_tree_get_deleted_leaf_node_by_index’ [-Wimplicit-function-declaration]
 * libpff_recover.c:1006:7: warning: implicit declaration of function ‘libfdata_tree_node_get_data_range’ [-Wimplicit-function-declaration]
 * libpff_table.c:227:8: warning: implicit declaration of function ‘libfdata_tree_free’ [-Wimplicit-function-declaration]
 * libpff_table.c:421:7: warning: implicit declaration of function ‘libfdata_tree_clone’ [-Wimplicit-function-declaration]
 * export_handle.c:7527:13: warning: implicit declaration of function ‘libcpath_path_sanitize_filename’ [-Wimplicit-function-declaration]
 * Please do not file a Gentoo bug and instead report the above QA
 * issues directly to the upstream developers of this software.
 * Homepage: https://github.com/libyal/libpff
>>> Auto-cleaning packages...

pypff add cygwin support

In pypff, at get _ * _ time, I fixed the error

hi, I am reminded that I have fixed an error in the get _ * _ time function call.
When calling the libpff_message_get _ "_ time function inside the get _ * _ time function, it seems that an error occurred because an invalid parameter was passed as follows.

...
 result = libpff_message_get_delivery_time(
                         pypff_item->record_set,
	                 &filetime,
	                 &error );
...

So I fixed it as follows and it worked normally. If you have resolved the bug, please check again.

...
 result = libpff_message_get_delivery_time(
                         pypff_item->item,
	                 &filetime,
	                 &error );
...

And I'm wondering how to use attachments object calls. Currently it says that it should be called with attachments or get_attachment (index).

Compiling fails because HAVE_UNLINK is undefined

Running ./synclibs.sh and ./autogen.sh results in the following error:

libcfile_support.c:742:2: error: #error Missing file remove function
 #error Missing file remove function
  ^
make[1]: *** [libcfile_support.lo] Error 1
make: *** [all-recursive] Error 1
Running: 'make' failed

Line 688 in libcfile/libcfile_support.c:

#elif defined( HAVE_UNLINK )

The libcfile source defines HAVE_UNLINK in common/config.h, which is not checked out by synclibs.sh, so the compiler fails on line 742.

Narrow string function being called instead of wide version

https://github.com/libyal/libpff/blob/master/pfftools/export_handle.c#L3376

Should be a call to libpff_record_entry_get_data_as_utf16_string instead of libpff_record_entry_get_data_as_utf8_string.

As it stands, a UTF8 (narrow) string will get concatenated to a UTF16 (wide) string to produce a folder name that looks like Chinese. Mixes wide and narrow characters.

libpff doesn't build with system libfmapi

The configure script detects it:
libfmapi support: yes

However, it fails later with the following:

/bin/sh ../libtool  --tag=CC   --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../common  -I../include -I../common    -march=native -O2 -pipe -Wall -c -o libpff_name_to_id_map.lo libpff_name_to_id_map.c
libtool: compile:  x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../common -I../include -I../common -march=native -O2 -pipe -Wall -c libpff_name_to_id_map.c  -fPIC -DPIC -o .libs/libpff_name_to_id_map.o
In file included from libpff_name_to_id_map.c:24:0:
libpff_name_to_id_map.c: In function ‘libpff_name_to_id_map_entry_read’:
libpff_name_to_id_map.c:687:8: error: ‘libfmapi_guid_public_strings’ undeclared (first use in this function)
        libfmapi_guid_public_strings,
        ^
../common/memory.h:109:41: note: in definition of macro ‘memory_copy’
  memcpy( (void *) destination, (void *) source, count )
                                         ^
libpff_name_to_id_map.c:687:8: note: each undeclared identifier is reported only once for each function it appears in
        libfmapi_guid_public_strings,
        ^
../common/memory.h:109:41: note: in definition of macro ‘memory_copy’
  memcpy( (void *) destination, (void *) source, count )
                                         ^
make[1]: *** [Makefile:902: libpff_name_to_id_map.lo] Error 1

The full log is here:
https://gist.github.com/blshkv/c560730f79e8773122d2d21ca716b39b

pypff segfaults when calling get_*_time() methods

Behavior:

pypff crashes with a segmentation fault when calling one of these message methods:

get_delivery_time()
get_modification_time()
get_creation_time()

Error messages:

The error on the console output is:
[1] 12403 segmentation fault (core dumped) python pstsearch.py

In dmesg, the following message is present:
[180718.625433] python[12403]: segfault at 9 ip 00007f9dab454e86 sp 00007fffaa5ef150 error 4 in pypff.so[7f9dab3a5000+19b000]

And when running the script with strace, I get the following:

fstat(5, {st_mode=S_IFREG|0644, st_size=2521, ...}) = 0
read(5, "\3\363\r\n\"2\335Wc\0\0\0\0\0\0\0\0\3\0\0\0@\0\0\0s\273\0\0\0d\0"..., 4096) = 2521
fstat(5, {st_mode=S_IFREG|0644, st_size=2521, ...}) = 0
read(5, "", 4096)                       = 0
close(5)                                = 0
close(4)                                = 0
brk(0x56548e34b000)                     = 0x56548e34b000
mmap(NULL, 385024, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6163241000
brk(0x56548e37a000)                     = 0x56548e37a000
brk(0x56548e363000)                     = 0x56548e363000
brk(0x56548e334000)                     = 0x56548e334000
mmap(NULL, 421888, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f61631da000
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x9} ---
+++ killed by SIGSEGV (core dumped) +++

Opening the coredump in GDB and displaying the backtrace gives:

#0  libpff_internal_item_get_entry_value_filetime (internal_item=0x1, entry_type=12295, filetime=0x7ffe9822fa40, error=0x7ffe9822fa38)
    at libpff/libpff_item.c:1379
1379		if( internal_item->internal_file == NULL )
(gdb) bt
#0  libpff_internal_item_get_entry_value_filetime (internal_item=0x1, entry_type=12295, filetime=0x7ffe9822fa40, error=0x7ffe9822fa38)
    at libpff/libpff_item.c:1379
#1  0x00007f4b920715f9 in libpff_message_get_creation_time (message=<optimized out>, filetime=<optimized out>, error=0x7ffe9822fa38)
    at libpff/libpff_message.c:776
#2  0x00007f4b92081750 in pypff_message_get_creation_time (pypff_item=0x7f4b93609f30, arguments=<optimized out>)
    at pypff/pypff_message.c:976
#3  0x000055f6d1b72b0f in ?? ()
#4  0x000055f6d1c8afea in ?? ()
#5  0x0000000000000000 in ?? ()

Environment:

OS: Ubuntu 16.10 (kernel 4.8.0-56-generic)
Architecture: x86_64
Python version: 2.7.12+
pypff version affected: 20161119 (from PyPI), and latest git revision (887db28)

Reading & Writing .msg files

Is reading & writing .msg files supported? If not, is that a possibility?

pypff: IOError for get_number_of_recovered_items()

I compile this file into the python libraries, import, but the import into, after open the PST files. But will not be able to use internal methods of the library. Don't know what's going on.

Use tags to alert Debian and other distros

Hi!

Please, use tags to create versions to allow the Debian and other distros can track new versions.

Thanks!

Cheers,

Eriberto

Wiki Broken Links

Your wiki page has broken links for every link accessing Google Drive.

Read folder tree on demand

Just tested pffexport and the library itself on PST with two folders, each of the folder contains about 250000 items. Waited for about 20 minutes on quad-core CPU (just to open the file) and killed the task. It looks like the library builds the entire node tree on file open and this process is extremely slow. Not sure why don't you build the tree partially by request (on get folder(s))...

Add Python bindings

Complete work on Python bindings

complete multi value
add name to id map entry object
add message store object
add tests

Tool chain does not work, properly, on OS X Sierra (10.12.5)

As an example, to correct errors such as the following, I have had to manually build all the dependencies rather than use the "synclibs.sh" script.

libtool: link: (cd ".libs" && rm -f "libpff.dylib" && ln -s "libpff.1.dylib" "libpff.dylib")
../libtool: line 5679: cd: /Users/seanmclinden/Cyfir/Murray/Exchange: No such file or directory
libtool: link: (cd .libs/libpff.lax/libcsplit.a && ar x "/Users/seanmclinden/Cyfir/Murray/Exchange Logs/libpff/libpff/../libcsplit/.libs/libcsplit.a")
../libtool: line 1720: cd: .libs/libpff.lax/libcsplit.a: No such file or directory

large memory consumption when keeping a file open for while

Using the C api, when parsing biggish files (~1GB) I experience huge memory bloat (~200mb) the longer I keep using the file, despite freeing individual items.

Closing the file seem to free all of the memory, so this isn't a leak, it's just using memory while it's open.

I was wondering if there was a way that lets you use less memory, maybe sacrificing speed/caching for it.

Building pffexport.exe fails on Cygwin

I'm trying to build libpff on Cygwin after pulling the latest commit and following the build instructions. Building on Linux works fine, but with Cygwin I get this:

/bin/sh ../libtool  --tag=CC   --mode=link gcc  -g -O2 -Wall   -o pffexport.exe export_handle.o item_file.o log_handle.o pffexport.o pffinput.o pffoutput.o ../libcsystem/libcsystem.la ../libfmapi/libfmapi.la ../libfvalue/libfvalue.la ../libfwnt/libfwnt.la ../libfguid/libfguid.la ../libfdatetime/libfdatetime.la ../libcpath/libcpath.la ../libcfile/libcfile.la ../libuna/libuna.la ../libcsplit/libcsplit.la ../libcdata/libcdata.la ../libpff/libpff.la ../libcnotify/libcnotify.la ../libclocale/libclocale.la ../libcerror/libcerror.la ../libcstring/libcstring.la -lintl
libtool: link: gcc -g -O2 -Wall -o .libs/pffexport.exe export_handle.o item_file.o log_handle.o pffexport.o pffinput.o pffoutput.o  ../libcsystem/.libs/libcsystem.a ../libfmapi/.libs/libfmapi.a ../libfvalue/.libs/libfvalue.a ../libfwnt/.libs/libfwnt.a ../libfguid/.libs/libfguid.a ../libfdatetime/.libs/libfdatetime.a ../libcpath/.libs/libcpath.a ../libcfile/.libs/libcfile.a ../libuna/.libs/libuna.a ../libcsplit/.libs/libcsplit.a ../libcdata/.libs/libcdata.a ../libpff/.libs/libpff.dll.a -lz -lpthread ../libcnotify/.libs/libcnotify.a ../libclocale/.libs/libclocale.a ../libcerror/.libs/libcerror.a ../libcstring/.libs/libcstring.a /usr/lib/libintl.dll.a /usr/lib/libiconv.dll.a -L/usr/local/lib
../libcnotify/.libs/libcnotify.a(libcnotify_verbose.o): In function `libcnotify_verbose_set':
/cygdrive/C/Users/XXXX/libpff/libpff/libcnotify/libcnotify_verbose.c:36: multiple definition of `libcnotify_verbose_set'
../libpff/.libs/libpff.dll.a(d000264.o):(.text+0x0): first defined here
collect2: error: ld returned 1 exit status
Makefile:766: recipe for target 'pffexport.exe' failed
make[1]: *** [pffexport.exe] Error 1
make[1]: Leaving directory '/cygdrive/C/Users/XXXX/libpff/libpff/pfftools'
Makefile:805: recipe for target 'all-recursive' failed

As an ugly workaround I deleted ../libcnotify/libcnotify.la \ from pffexport_LDADD in the pfftools Makefile, but that's just fixing a generated file. I was at least able to finish the build, though.

FYI:

$ cygcheck.exe -c cygwin && gcc --version
Cygwin Package Information
Package              Version        Status
cygwin               2.4.1-1        OK
gcc (GCC) 4.9.3
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

pffexport string encoding bug

I found a bug in pffexport.
If an item name includes wide character, then the item name get garbled.
Please fix it.

diff -u export_handle.c.orig export_handle.c
--- export_handle.c.orig	2017-09-27 14:29:05.987164221 +0900
+++ export_handle.c	2017-09-27 14:31:06.817794771 +0900
@@ -3374,7 +3374,7 @@
 			goto on_error;
 		}
 #if defined( HAVE_WIDE_SYSTEM_CHARACTER )
-		if( libpff_record_entry_get_data_as_utf8_string(
+		if( libpff_record_entry_get_data_as_utf16_string(
 		     record_entry,
 		     (uint16_t *) *value_string,
 		     *value_string_size,

libpff_multi_value_get_number_of_values() returns 0 for variable-sized multi-valued props

For LIBPFF_VALUE_TYPE_MULTI_VALUE_STRING_ASCII, LIBPFF_VALUE_TYPE_MULTI_VALUE_STRING_UNICODE and LIBPFF_VALUE_TYPE_MULTI_VALUE_BINARY_DATA value types libpff_multi_value_get_number_of_values() always returns 0.

Getting started for use libpff

I'm newbie, not python knowledge.

any good Getting started for use libpff ?
And a full sample for read OST (Offline Storage Table) ?
Powershell scripts in this project ? Powershell and OST?

Lib doesn't seem to work

So after successfully compiling and installing the lib onto my Ubuntu 16.04 machine, I now try to use the library with Python. But I'm having a hard time doing that:

>>> import pypff
>>> pff_file = pypff.file()
>>> pff_file.open("backup.pst")
>>> pff_file.get_number_of_items()
Traceback (most recent call last):
  File "<input>", line 1, in <module>
    pff_file.get_number_of_items()
AttributeError: 'pypff.file' object has no attribute 'get_number_of_items'
>>> pff_file.number_of_items
Traceback (most recent call last):
  File "<input>", line 1, in <module>
    pff_file.number_of_items
AttributeError: 'pypff.file' object has no attribute 'number_of_items'
>>> pff_file.get_item(0)
Traceback (most recent call last):
  File "<input>", line 1, in <module>
    pff_file.get_item(0)
AttributeError: 'pypff.file' object has no attribute 'get_item'
>>> pff_file.items
Traceback (most recent call last):
  File "<input>", line 1, in <module>
    pff_file.items
AttributeError: 'pypff.file' object has no attribute 'items'

Any idea what might be wrong here?

Maybe this helps to get some insight:

>>> for i in dir(pff_file): print i
...
__class__
__delattr__
__doc__
__format__
__getattribute__
__hash__
__init__
__new__
__reduce__
__reduce_ex__
__repr__
__setattr__
__sizeof__
__str__
__subclasshook__
ascii_codepage
close
get_ascii_codepage
get_number_of_recovered_items
get_root_folder
get_size
open
open_file_object
recover_items
set_ascii_codepage
signal_abort
size

Problems with libpff + MinGW on Windows

There are some issues in libcfile/libcfile_file.c. It looks like code was copied and pasted, but you forgot to change the variables in the body of the function to match the names of the variables in the function parameters.

For example, in libcfile_WriteFile() read_count read_size are used where it should be write_count and write_size.

This occurred in the ReadFile() routine too, and there was an issue in the GetOverlappedResult() routine where I think "buffer" in the body of the function should be replaced with "overlapped".

Also, I've had the hardest time getting libpff to build on Windows (with python enabled) using MingGW.

I had to modify the source code for MingGW's autopoint so that it I could run the autogen.sh script.
I had to find a hack for the "python-config" requirement. (python-config doesn't exist on Windows, apparently).

I appreciate that you are creating this wonderful library. I think it would be great if you could make platform independence as seamless as possible.

Question about libpff_folder_get_type

line 111, column 15
it's LIBPFF_ENTRY_TYPE_CONTAINER_CLASS ,
should be LIBPFF_ENTRY_TYPE_FOLDER_TYPE?

Generating pypff.dll Python module on Cygwin

I know the Python bindings are a work in progress. On Cygwin, after following the build instructions, only the static pypff.a module was installed. I was able to get what I needed using setup.py. I mention it here to help others who run into the same problem. It might be worth including something in the Building instructions.

$ python setup.py install
$ ...
build/temp.cygwin-2.4.1-i686-2.7/libpff/libpff_compression.o: In function `libpff_decompress_data':
/home/XXXX/libpff/libpff/libpff/libpff_compression.c:127: undefined reference to `uncompress'
collect2: error: ld returned 1 exit status
error: command 'gcc' failed with exit status 1

To get past this link error, I edited setup.py and added libz to the libraries argument for setup():

setup(
    name=project_information.package_name,
    # ...
    ext_modules=[
        Extension(
            project_information.module_name,
            # ...
            libraries=['z'],
            # ...
)

Now I get /usr/lib/python2.7/site-packages/pypff.dll installed, and I can import the module in python. I realize this is probably not the right way to fix it in general; I just needed something to get it working for me.

Thanks for making this library available, by the way.

Compilation issue since your last commit in libcerror

Since yesterday, it is impossible to compile libpff (and should be the same for most of libyal libraries). I did the usual following steps:

./synclibs.sh
./autogen.sh
./configure
make

and I'm getting the following errors:

libcerror_error.c:24:27: fatal error: narrow_string.h: No such file or directory
#include <narrow_string.h>

After digging a bit, I found you committed yesterday the following includes in libcerror_error.c

<narrow_string.h>
<system_string.h>
<wide_string.h>

located in common folder of libcerror but which are not available when doing synclibs.sh in libpff.

My current workaround is to rm -rf libcerror and clone from commit 78d9b41c9efacc169d9a259694e891e6257d23b2

Cheers!

libpff_name_to_id_map.c:687:8: error: use of undeclared identifier 'libfmapi_guid_public_strings'

Since the OS X toolchain wasn't working, I decided to build the required libraries manually. Compilation worked fine but when the latest libfmapi was added, libpff choked with the error, above.

complete record set/entry refactor

complete multi value

Extract .msg files from .pst

I successfully extracted the messages from my .pst but I wanted to keep the original format of the message (.msg). How can I keep the .msg format from the .pst and save to disk?
The help(pypff.message) doesn't expecify anything about.

import pypff
pst_file = './backup.pst'
opst = pypff.open(pst_file)
root = opst.get_root_folder()

for folder in root.sub_folders:
    for message in folder.sub_messages:
        print(message.subject)

Provide a new release

Hello Joachim,

Is it possible to provide a release for libpff? Indeed debian forensics maintainers rely on your release to package libyal packages. As you can see on their package overview page libpff package is based on 20120802-5 release when it was available through gdrive I guess...

Thanks

Add fallback inflate implementation

Add fallback inflate implementation when for when zlib is not available

Python Bindings Not Being Built

Specifying to build Python bindings as specified here. However, it's not working as expected.

This is on Fedora 24 with Linux 4.11.12-100.fc24.x86_64 x86_64 kernel.

$ ./configure --enable-python
...
checking whether to enable build static executables (binaries)... (cached) no
checking whether to enable enable verbose output... (cached) no
checking whether to enable enable debug output... (cached) no
checking whether to enable build Java bindings... (cached) no
checking whether to use use `python-config --prefix' to determine the prefix of pythondir instead of --prefix... (cached) no
checking whether to enable build Python bindings... (cached) yes
checking whether to use use to specify the Python directory (pythondir)... (cached) no
checking for python... python
checking for python2.7-config... python2.7-config
checking for Python includes... -I/usr/include/python2.7 -I/usr/include/python2.7
checking for Python libraries... -lpython2.7 -lpthread -ldl -lutil -lm -Xlinker -export-dynamic
checking Python.h usability... yes
checking Python.h presence... yes
checking for Python.h... yes
checking whether to enable build Python 2 bindings... (cached) no
checking whether to use use to specify the Python 2 directory (pythondir2)... (cached) no
checking whether to enable build Python 3 bindings... (cached) no
checking whether to use use to specify the Python 3 directory (pythondir3)... (cached) no
checking for stdarg.h... (cached) yes
checking for varargs.h... (cached) no
checking for dlfcn.h... (cached) yes
checking for fmemopen... yes
checking for dlsym in -ldl... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating include/Makefile
config.status: creating common/Makefile
config.status: creating libcerror/Makefile
config.status: creating libcthreads/Makefile
config.status: creating libcdata/Makefile
config.status: creating libclocale/Makefile
config.status: creating libcnotify/Makefile
config.status: creating libcsplit/Makefile
config.status: creating libuna/Makefile
config.status: creating libcfile/Makefile
config.status: creating libcpath/Makefile
config.status: creating libbfio/Makefile
config.status: creating libfcache/Makefile
config.status: creating libfdata/Makefile
config.status: creating libfdatetime/Makefile
config.status: creating libfguid/Makefile
config.status: creating libfvalue/Makefile
config.status: creating libfwnt/Makefile
config.status: creating libfmapi/Makefile
config.status: creating libpff/Makefile
config.status: creating libcsystem/Makefile
config.status: creating pfftools/Makefile
config.status: creating jpff/Makefile
config.status: creating pypff/Makefile
config.status: creating pypff-python2/Makefile
config.status: creating pypff-python3/Makefile
config.status: creating po/Makefile.in
config.status: creating po/Makevars
config.status: creating manuals/Makefile
config.status: creating tests/Makefile
config.status: creating msvscpp/Makefile
config.status: creating include/libpff.h
config.status: creating include/libpff/definitions.h
config.status: creating include/libpff/features.h
config.status: creating include/libpff/types.h
config.status: creating libpff/libpff_definitions.h
config.status: creating common/types.h
config.status: creating dpkg/changelog
config.status: creating dpkg/copyright
config.status: creating libpff/libpff.rc
config.status: creating libpff.pc
config.status: creating libpff.spec
config.status: creating common/config.h
config.status: common/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands
config.status: executing po-directories commands
config.status: creating po/POTFILES
config.status: creating po/Makefile
configure:
Building:
libcerror support: local
libcthreads support: local
libcdata support: local
libclocale support: local
libcnotify support: local
libcsplit support: local
libuna support: local
libcfile support: local
libcpath support: local
libbfio support: local
libfcache support: local
libfdata support: local
libfdatetime support: local
libfguid support: local
libfvalue support: local
libfwnt support: local
libfmapi support: local
DEFLATE compression support: zlib
libcsystem support: local
Features:
Multi-threading support: pthread
Wide character type support: no
pfftools are build as static executables: no
Java (jpff) support: no
Python (pypff) support: 2.7
Python version 2 (pypff) support: no
Python version 3 (pypff) support: no
Verbose output: no
Debug output: no

$ cat Parse_Msg.py
import pypff
pypff.get_version()

$ python Parse_Msg.py
Traceback (most recent call last):
File "Parse_Msg.py", line 1, in
import pypff
ImportError: No module named pypff

Any ideas what's going wrong here?

No rule to make target 'dff/api/exceptions/breakpad/libbreakpad.a', needed by 'dff/api/libcrashreporter.so'

make[2]: Leaving directory '/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6'
make -f dff/api/crashreporter/CMakeFiles/crashreporter.dir/build.make dff/api/crashreporter/CMakeFiles/crashreporter.dir/build
make[2]: Entering directory '/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6'
[ 84%] Building CXX object dff/api/crashreporter/CMakeFiles/crashreporter.dir/handler.cpp.o
cd /var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/crashreporter && /usr/bin/x86_64-pc-linux-gnu-g++  -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -D__STDC_LIMIT_MACROS -Dcrashreporter_EXPORTS -I/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/crashreporter/breakpad -I/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/crashreporter/../include -I/usr/include/python2.7 -I/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/crashreporter -I/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/include -I/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/exceptions/breakpad   -DNDEBUG -march=native -O2 -pipe -fPIC   -O2 -fPIC -o CMakeFiles/crashreporter.dir/handler.cpp.o -c /var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6/dff/api/crashreporter/handler.cpp
make[2]: *** No rule to make target 'dff/api/exceptions/breakpad/libbreakpad.a', needed by 'dff/api/libcrashreporter.so'.  Stop.
make[2]: Leaving directory '/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6'
make[1]: *** [CMakeFiles/Makefile2:591: dff/api/crashreporter/CMakeFiles/crashreporter.dir/all] Error 2
make[1]: Leaving directory '/var/tmp/portage/app-forensics/dff-1.3.6/work/dff-1.3.6'
make: *** [Makefile:161: all] Error 2

Running pffexport [email protected] produces no exported items

I have verified that the emails are in fact there, since they show up when I open the OST with an evaluation copy of Kernel for OST to PST.

Neither pffexport 20120802 or the latest git revision are able to export any items.

Output from running pffexport -v [email protected] #(version 20120802):

Opening file.
Exporting items.
Unable to export file.
libpff_file_get_root_folder: invalid file - missing root folder item tree node.
export_handle_export_items: unable to retrieve root folder.
export_handle_export_file: unable to export items.

Output from running pffexport -v [email protected] #(version 20150106, latest from git):

Opening file.
Exporting items.
Export completed.

Output from running pffexport -v -m all [email protected] #(version 20150106, latest from git):

Opening file.
Recovering items.
Unable to export file.
libpff_index_read_node: index type mismatch (index: 0x81, node: 0x80).
libpff_index_read_sub_nodes: unable to read index node at offset: 3102077440.
libfdata_tree_read_sub_nodes: unable to read sub nodes at offset: 3102077440.
libfdata_tree_node_read_leaf_node_values: unable to read sub nodes.
libfdata_tree_node_get_number_of_deleted_leaf_nodes: unable to retrieve node value.
libfdata_tree_get_number_of_deleted_leaf_nodes: unable to retrieve number of deleted leaf nodes from root node.
libpff_recover_index_nodes: unable to retrieve number of deleted descriptor index values.
libpff_recover_items: unable to recover index nodes.
libpff_file_recover_items: unable to recover items.
export_handle_export_file: unable to recover items.

output from pffinfo -v [email protected] #(version 20150106, latest from git):

Personal Folder File information:
        File size:              8499790848 bytes
        File content type:      Offline Storage Tables (OST)
        File type:              64-bit
        Encryption type:        compressible

fatal error: 'pff_test_libcnotify.h' file not found

Hi @joachimmetz ,

I got an error by trying to install libpff-experimental-20161119.tar

MacOs Sierra, v10.12

What I did:

download 'libpff-experimental-20161119.tar'
tar xfv libpff-experimental-20161119.tar
cd libpff-20161119
CFLAGS="-isysroot /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.12.sdk -arch x86_64 -arch i386" \
LDFLAGS="-Wl,-syslibroot,/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.12.sdk -arch x86_64 -arch i386" \
./configure --enable-python
make
make install
cd tests
make check

=> Error:
pff_test_deflate.c:32:10: fatal error: 'pff_test_libcnotify.h' file not found
#include "pff_test_libcnotify.h"
^
1 error generated.
make[1]: *** [pff_test_deflate.o] Error 1
make: *** [check-am] Error 2

Is there another way to use the library or another source to use?
Thank you!

Runtime problems

I'm on OS X (10.10.2) with python2.7, and tried the alpha version which gave me a runtime error. I've now built/installed the development version, but it crashes python. Here is the crash report: http://pastebin.com/Q1m2vR18

I'm hoping to get this working and to possibly contribute to the python bindings. I'm new to c but may be able to contribute some.

Thanks for any help.

How to use pypff to extract email attachments?

I am using pypff library, found the methods of extracting email attachments without, only extract to the number of accessories, to help me, all the source code of the library.Where can I find to!

Python: pst.get_root_folder() error

Hi,
I just install the last version: libpff-experimental-20161119
MacOS Sierra 10.12
Python2.7 & Python 3.5

I took one file fromt the Enron Database to try http://info.nuix.com/EnronDownload2013.html?mkt_tok=eyJpIjoiTXpBNE16TXdObVl4WlRFNSIsInQiOiJjNlJkVlA3ZTlwQnBGT2hNSDRvS1lFZlp0QW9VSnV4WDA3b25vaGxFcWRVVUM4STV0d2RLNjFDY0ZyeisyYVwvYjY0bWR3ZHB4aHBQUGV1VnFcLzN6OXFiM2RtNHROU1FZYnMyOTh2NjBTZzlrPSJ9

Here my code:

pst_file = "email.pst"
pst = pypff.file()
pst.open(pst_file)

print "pst:", pst   
#Output: pst: <pypff.file object at 0x1005130b0>

print "Size:", pst.get_size()  
#Output: Size: 538649600

print "root:", pst.get_root_folder() 
#Output: root: <pypff.folder object at 0x10202e850>

print "type:", pst.get_content_type()   
#Output: type: 112

print "id", pst.get_name_to_id_map() 
#Output: id <pypff.folder object at 0x10202e850>

print "orphan:", pst.get_number_of_orphan_items() 
#Output: orphan: 0

Then when I try this, I got errors:

dir = pst.get_root_folder()
print "display:", unicode(dir.get_display_name()) 
#Output: dir has not element get_display_name()
print "sub mess:", dir.get_number_of_sub_messages()
#Output: dir has not element get_number_of_sub_messages()

Is it an installation issue or something else?

Thank you!

ImportError: pypff.so: undefined symbol: libpff_record_set_get_entry_by_index

Hey Joachim, hope all is well.

I decided to convert all my scripts using redemption to libpff for PST's. I compile fine using the compile guide and created the debs without issue, I have installed the debs per the guide, all went well.

Testing with a simple:
import pypff
pypff.get_version()

Produces:
/usr/bin/python2.7 /home/me/PycharmProjects/count_libpff/main.py
Traceback (most recent call last):
File "/home/me/PycharmProjects/count_libpff/main.py", line 1, in
import pypff
ImportError: /usr/lib/python2.7/dist-packages/pypff.so: undefined symbol: libpff_record_set_get_entry_by_index

Process finished with exit code 1

Any quick solution? See you at osdfcon, looking forward to the plaso class.

Complete Internet Headers not written after around 200 emails

In folder.export\Root - Mailbox\IPM_SUBTREE\Inbox, on opening messages after around 200, I can see that partial headers are present in Internet Headers text file. Why?

I'm running the program as: pffexport.exe -f all -m all -t folder file.ost

stack-overflow libpff_item_tree_create_node

If you're here about CVE-2018-20348 please read #66.

Note that the work done by Mitre-CVE and NIST-NVD for CVE-2018-20348 to provide security advise is incomplete and useless.

Tested Version

Lastest (cloned from github)

Command and argument

./pffexport ${POCfile}

Crash Information

The output of pffexport with address sanitizer enabled, it seems the program falls into an infinite loop.

./pffexport libpff-libpff_item_tree_create_node-798.crash 
pffexport 20171008

Opening file.
ASAN:SIGSEGV
=================================================================
==47345==ERROR: AddressSanitizer: stack-overflow on address 0x7fffd2c88f48 (pc 0x7f4bb8bce568 bp 0x7fffd2c89790 sp 0x7fffd2c88f30 T0)
    #0 0x7f4bb8bce567 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98567)
    #1 0x7f4bb861ee3a in libpff_item_descriptor_initialize /root/libpff-master/libpff/libpff_item_descriptor.c:66
    #2 0x7f4bb86208e9 in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:637
    #3 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #4 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #5 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #6 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #7 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #8 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #9 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #10 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #11 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #12 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #13 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #14 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #15 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #16 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #17 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #18 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #19 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #20 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #21 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #22 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #23 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #24 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #25 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #26 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #27 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #28 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #29 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #30 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #31 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #32 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #33 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #34 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #35 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #36 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #37 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #38 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #39 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #40 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #41 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #42 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #43 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #44 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #45 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #46 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #47 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #48 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #49 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #50 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #51 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #52 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #53 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #54 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #55 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #56 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #57 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #58 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #59 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #60 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #61 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #62 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #63 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #64 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #65 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #66 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #67 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #68 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #69 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #70 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #71 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #72 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #73 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #74 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #75 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #76 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #77 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #78 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #79 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #80 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #81 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #82 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #83 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #84 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #85 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #86 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #87 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #88 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #89 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #90 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #91 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #92 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #93 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #94 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #95 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #96 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #97 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #98 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #99 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #100 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #101 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #102 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #103 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #104 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #105 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #106 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #107 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #108 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #109 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #110 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #111 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #112 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #113 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #114 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #115 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #116 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #117 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #118 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #119 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #120 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #121 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #122 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #123 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #124 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #125 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #126 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #127 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #128 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #129 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #130 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #131 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #132 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #133 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #134 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #135 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #136 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #137 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #138 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #139 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #140 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #141 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #142 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #143 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #144 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #145 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #146 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #147 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #148 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #149 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #150 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #151 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #152 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #153 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #154 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #155 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #156 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #157 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #158 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #159 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #160 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #161 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #162 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #163 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #164 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #165 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #166 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #167 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #168 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #169 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #170 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #171 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #172 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #173 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #174 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #175 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #176 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #177 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #178 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #179 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #180 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #181 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #182 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #183 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #184 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #185 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #186 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #187 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #188 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #189 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #190 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #191 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #192 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #193 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #194 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #195 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #196 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #197 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #198 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #199 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #200 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #201 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #202 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #203 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #204 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #205 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #206 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #207 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #208 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #209 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #210 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #211 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #212 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #213 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #214 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #215 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #216 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #217 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #218 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #219 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #220 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #221 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #222 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #223 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #224 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #225 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #226 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #227 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #228 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #229 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #230 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #231 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #232 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #233 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #234 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #235 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #236 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #237 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #238 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #239 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #240 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #241 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #242 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #243 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #244 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #245 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #246 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #247 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #248 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #249 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #250 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798
    #251 0x7f4bb8620dbb in libpff_item_tree_create_node /root/libpff-master/libpff/libpff_item_tree.c:798

SUMMARY: AddressSanitizer: stack-overflow ??:0 malloc
==47345==ABORTING

gdb and backtrace

(gdb) run libpff-libpff_item_tree_create_node-798.crash 
Starting program: /opt/normal/bin/pffexport libpff-libpff_item_tree_create_node-798.crash
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
pffexport 20171008

Opening file.

Program received signal SIGSEGV, Segmentation fault.
libfdata_tree_get_node_value (tree=0x7056e0, file_io_handle=file_io_handle@entry=0x6e5260, cache=cache@entry=0x705890, node=node@entry=0x70ac70, 
    node_value=node_value@entry=0x7fffff7ff100, read_flags=read_flags@entry=0 '\000', error=0x7fffffffe378) at libfdata_tree.c:438
438     {
(gdb) bt
#0  libfdata_tree_get_node_value (tree=0x7056e0, file_io_handle=file_io_handle@entry=0x6e5260, cache=cache@entry=0x705890, node=node@entry=0x70ac70, 
    node_value=node_value@entry=0x7fffff7ff100, read_flags=read_flags@entry=0 '\000', error=0x7fffffffe378) at libfdata_tree.c:438
#1  0x00007ffff7b1d1c9 in libfdata_tree_node_get_node_value (node=0x70ac70, file_io_handle=file_io_handle@entry=0x6e5260, cache=cache@entry=0x705890, 
    node_value=node_value@entry=0x7fffff7ff100, read_flags=read_flags@entry=0 '\000', error=error@entry=0x7fffffffe378) at libfdata_tree_node.c:848
#2  0x00007ffff7aada15 in libpff_index_tree_node_get_leaf_node_by_identifier (index_tree_node=0x706010, file_io_handle=file_io_handle@entry=0x6e5260, cache=cache@entry=0x705890, 
    identifier=identifier@entry=1094795585, leaf_node_index=leaf_node_index@entry=0x7fffff7ff290, leaf_index_tree_node=leaf_index_tree_node@entry=0x7fffff7ff2a8, 
    error=0x7fffffffe378) at libpff_index_tree.c:530
#3  0x00007ffff7aadb4d in libpff_index_tree_node_get_leaf_node_by_identifier (index_tree_node=0x705730, file_io_handle=file_io_handle@entry=0x6e5260, cache=cache@entry=0x705890, 
    identifier=identifier@entry=1094795585, leaf_node_index=leaf_node_index@entry=0x7fffff7ff290, leaf_index_tree_node=leaf_index_tree_node@entry=0x7fffff7ff2a8, 
    error=0x7fffffffe378) at libpff_index_tree.c:726
#4  0x00007ffff7aaddba in libpff_index_tree_get_leaf_node_by_identifier (index_tree=index_tree@entry=0x7056e0, file_io_handle=file_io_handle@entry=0x6e5260, 
    cache=cache@entry=0x705890, identifier=1094795585, leaf_node_index=leaf_node_index@entry=0x7fffff7ff290, leaf_index_tree_node=leaf_index_tree_node@entry=0x7fffff7ff2a8, 
    error=0x7fffffffe378) at libpff_index_tree.c:436
#5  0x00007ffff7ab3403 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:772
#6  0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#7  0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#8  0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#9  0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#10 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#11 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#12 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#13 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#14 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#15 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#16 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#17 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#18 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#19 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#20 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
    descriptor_index_tree=descriptor_index_tree@entry=0x7056e0, descriptor_index_tree_node=<optimized out>, index_tree_cache=index_tree_cache@entry=0x705890, 
    orphan_node_list=orphan_node_list@entry=0x705b20, root_folder_item_tree_node=0x6e5170, error=0x7fffffffe378) at libpff_item_tree.c:798
#21 0x00007ffff7ab3581 in libpff_item_tree_create_node (item_tree_root_node=item_tree_root_node@entry=0x705b70, file_io_handle=file_io_handle@entry=0x6e5260, 
---Type <return> to continue, or q <return> to quit---q
descriptor_index_treeQuit
(gdb) l
433          libfcache_cache_t *cache,
434          libfdata_tree_node_t *node,
435          intptr_t **node_value,
436          uint8_t read_flags,
437          libcerror_error_t **error )
438     {
439             libfcache_cache_value_t *cache_value    = NULL;
440             libfdata_internal_tree_t *internal_tree = NULL;
441             static char *function                   = "libfdata_tree_get_node_value";
442             off64_t cache_value_offset              = (off64_t) -1;

POC file

libpff-libpff_item_tree_create_node-798.zip

CREDIT

Zhao Liang, Huawei Weiran Labs

Error in exporting Outlook 'pst' file

Thank you for your effort in developing this library. And I would like to inform you some problems I faced. I had built the experimental release in visual studio 2015 with no errors. And I ran the pffexport.exe from Release folder in command prompt and gave 'Sample.pst' file as argument. But It results following errors.

folder item 3 out of 10.
Exporting folder item 4 out of 10.
Exporting folder item 5 out of 10.
Exporting folder item 6 out of 10.
Skipped item 1 out of 1 of type: IPM.Microsoft.ScheduleData.FreeBusy.
Exporting folder item 7 out of 10.
Exporting folder item 8 out of 10.
Exporting folder item 9 out of 10.
Exporting folder item 10 out of 10.

Exporting recovered items.
Exporting folder item 1 out of 17.
Exporting folder item 2 out of 17.
Unable to retrieve type of item 3 out of 17.
libpff_table_read: unsupported table signature: 0x00.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_item_determine_type: unable to retrieve record entry: 0x04I32x.
libpff_item_get_type: unable to determine item type.
export_handle_export_item: unable to retrieve item type.
Unable to retrieve type of item 4 out of 17.
libpff_data_block_read: mismatch in data size ( 16705 != 1568 ).
libpff_io_handle_read_descriptor_data_list: unable to read data block at offset:
320576.
libpff_table_read: unable to read descriptor: 641 data: 8316 list.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_item_determine_type: unable to retrieve record entry: 0x04I32x.
libpff_item_get_type: unable to determine item type.
export_handle_export_item: unable to retrieve item type.
Unable to retrieve type of item 5 out of 17.
libpff_table_read: unsupported table signature: 0x00.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_item_determine_type: unable to retrieve record entry: 0x04I32x.
libpff_item_get_type: unable to determine item type.
export_handle_export_item: unable to retrieve item type.
Unable to retrieve type of item 6 out of 17.
libpff_table_read: unsupported table signature: 0x00.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_item_determine_type: unable to retrieve record entry: 0x04I32x.
libpff_item_get_type: unable to determine item type.
export_handle_export_item: unable to retrieve item type.
Unable to retrieve type of item 7 out of 17.
libpff_table_read: unsupported table signature: 0x00.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_item_determine_type: unable to retrieve record entry: 0x04I32x.
libpff_item_get_type: unable to determine item type.
export_handle_export_item: unable to retrieve item type.
Exporting folder item 8 out of 17.
Unable to export sub messages.
libpff_folder_get_sub_message: unable to retrieve sub message tree node.
export_handle_export_sub_messages: unable to retrieve sub message: 1 out of 1.
export_handle_export_folder: unable to export sub messages.
Exporting folder item 9 out of 17.
Unable to export sub messages.
libpff_folder_get_sub_message: unable to retrieve sub message tree node.
export_handle_export_sub_messages: unable to retrieve sub message: 1 out of 1.
export_handle_export_folder: unable to export sub messages.
Exporting email item 10 out of 17.
Exporting folder item 11 out of 17.
Unable to retrieve type of item 12 out of 17.
libpff_data_block_read: mismatch in data size ( 324 != 216 ).
libpff_io_handle_read_descriptor_data_list: unable to read data block at offset:
325120.
libpff_table_read: unable to read descriptor: 524419 data: 8000 list.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_item_determine_type: unable to retrieve record entry: 0x04I32x.
libpff_item_get_type: unable to determine item type.
export_handle_export_item: unable to retrieve item type.
Exporting folder item 13 out of 17.
Skipped item 14 out of 17 of type: IPM.MessageManager.
Skipped item 15 out of 17 of type: IPM.MessageManager.
Exporting email item 16 out of 17.
libpff_message_get_html_body_size: missing value data.
libpff_offsets_index_get_index_value_by_identifier: no recovered offsets index v
alues for identifier: 6516.
libpff_io_handle_read_descriptor_data_list: unable to find offset index value id
entifier: 6516.
libpff_table_read: unable to read descriptor: 1682 data: 6516 list.
libpff_item_values_read: unable to read table.
libpff_message_initialize_sub_item_recipients: unable to read recipients local d
escriptor identifier: 1682.
libpff_message_determine_recipients: unable to create sub item recipients.
libpff_message_get_recipients: unable to determine recipients.
export_handle_export_recipients: unable to retrieve recipients.
libpff_message_get_html_body_size: missing value data.
Exporting attachment 1 out of 1.
libpff_offsets_index_get_index_value_by_identifier: no recovered offsets index v
alues for identifier: 7202.
libpff_local_descriptors_tree_read: unable to retrieve offset index value identi
fier: 7202.
libpff_table_read: unable to read local descriptors tree with identifier: 7202.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_internal_item_get_entry_value_32bit_integer: unable to retrieve record en
try: 0x04I32x 0x3705.
libpff_attachment_get_type: unable to retrieve attachment method.
export_handle_export_attachment: unable to retrieve attachment type.
Exporting email item 17 out of 17.
libpff_message_get_html_body_size: missing value data.
libpff_offsets_index_get_index_value_by_identifier: no recovered offsets index v
alues for identifier: 8032.
libpff_io_handle_read_descriptor_data_list: unable to find offset index value id
entifier: 8032.
libpff_table_read: unable to read descriptor: 1682 data: 8032 list.
libpff_item_values_read: unable to read table.
libpff_message_initialize_sub_item_recipients: unable to read recipients local d
escriptor identifier: 1682.
libpff_message_determine_recipients: unable to create sub item recipients.
libpff_message_get_recipients: unable to determine recipients.
export_handle_export_recipients: unable to retrieve recipients.
libpff_message_get_html_body_size: missing value data.
Exporting attachment 1 out of 2.
libpff_offsets_index_get_index_value_by_identifier: no recovered offsets index v
alues for identifier: 8090.
libpff_local_descriptors_tree_read: unable to retrieve offset index value identi
fier: 8090.
libpff_table_read: unable to read local descriptors tree with identifier: 8090.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_internal_item_get_entry_value_32bit_integer: unable to retrieve record en
try: 0x04I32x 0x3705.
libpff_attachment_get_type: unable to retrieve attachment method.
export_handle_export_attachment: unable to retrieve attachment type.
Exporting attachment 2 out of 2.
libpff_offsets_index_get_index_value_by_identifier: no recovered offsets index v
alues for identifier: 8250.
libpff_local_descriptors_tree_read: unable to retrieve offset index value identi
fier: 8250.
libpff_table_read: unable to read local descriptors tree with identifier: 8250.
libpff_item_values_read: unable to read table.
libpff_item_values_get_record_entry_by_type: unable to read item values.
libpff_internal_item_get_entry_value_32bit_integer: unable to retrieve record en
try: 0x04I32x 0x3705.
libpff_attachment_get_type: unable to retrieve attachment method.
export_handle_export_attachment: unable to retrieve attachment type.

Export completed.
////////////////////////////////////////////////////////////////////////////////
The Sample.pst.export folder contains :

The Sample.pst.recovered folder contains

///////////////////////////////////////////////////////////////////////////////
Am I doing it in wrong way ? please help.

one line typo in new attachment code

The pypff_item for the attachment is being created as a pypff_message_type_object. It should be pypff_attachment_type_object.

Here's the fix:

      1 diff --git a/pypff/pypff_message.c b/pypff/pypff_message.c
      2 index 5d5a412..4154204 100644
      3 --- a/pypff/pypff_message.c
      4 +++ b/pypff/pypff_message.c
      5 @@ -1771,7 +1771,7 @@ PyObject *pypff_message_get_attachment_by_index(
      6                 goto on_error;
      7         }
      8         sub_item_object = pypff_item_new(
      9 -                          &pypff_message_type_object,
     10 +                          &pypff_attachment_type_object,
     11                            sub_item,
     12                            (PyObject *) ( (pypff_item_t *) pypff_item )->parent_object );
     13

Compiles, but not exporting

I've managed to compile in MinGW using libpff-experimental-20131028.tar.gz
My build command was:
CPPFLAGS=-DWINVER=0x0501 ./configure --prefix=/mingw --enable-verbose-output --enable-static-executables

make -j4

When exporting, all I get is a lot of folder structure, no files output. I'm using the Enron Dataset as a test.

pffexport.exe -f rtf -m all c:\Users\xxx\Downloads\EnronDataOrg_AED_Mailbox-PSTs_20090122\allen-p.pst

I'm happy to attach or supply anything you want. I had one hiccup compiling in C++ 2010 I couldn't get past but that is a different issue "The POSIX name for this item is deprecated. Instead, use the ISO C++ conformant name: _close"

Does it support x64? My test program crashed in x64.

Hello Joachim,
I used it in Visual Studio 2008,my test program parsed PST file successfully in x86. However,it crashed in x64.
It seems to occured at internal_record_entry = (libpff_internal_record_entry_t *) record_entry; in libpff_record_entry_get_value_utf8_string_size().

Looking forward to your replay.

Sample Program

share a sample program to convert PST to eml files,I checked sample c/c++ development example,Its unable to open/read PST.

share the steps and program to convert PST to EML.

libpff.h has wrong libpff_record_entry_get_value_utf16_string() prototype

First argument has to be:
libpff_record_entry_t *record_entry

HTML export img src links do not link to Attachments folder

Not sure if this is appropriate for an issue, but when I use LibPFF to explode a PST file specifying the "HTML" format, when viewing the 'Message.html' file, none of the inline image links (linking to the ./Attachments folder for the message) are written to actually incorporate these attachments, instead being prefixed by "cid:" and postfixed by a random identifier. Example:
<img src="cid:[email protected]">
when the matching file attachment is in "./Attachments/image007.jpg". In order to get the HTML to render properly I have to manually rewrite the img src= link to read:
<img src="Attachments/image007.jpg">.

Can't build source on OSX

I'm trying to build libpff on OSX from the latest sources. As far as I know I've got all dependencies installed correctly, but I now get an error when running make:

$ make
Making all in include
make[1]: Nothing to be done for `all'.
Making all in common
/Applications/Xcode.app/Contents/Developer/usr/bin/make  all-am
make[2]: Nothing to be done for `all-am'.
Making all in libcstring
/bin/sh ../libtool  --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I../common  -I../include -I../common -I/usr/local/include  -g -O2 -Wall -MT libcstring_support.lo -MD -MP -MF .deps/libcstring_support.Tpo -c -o libcstring_support.lo libcstring_support.c
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I../common -I../include -I../common -I/usr/local/include -g -O2 -Wall -MT libcstring_support.lo -MD -MP -MF .deps/libcstring_support.Tpo -c libcstring_support.c  -fno-common -DPIC -o .libs/libcstring_support.o
In file included from libcstring_support.c:25:
./libcstring_definitions.h:48:37: warning: missing terminating '"' character [-Winvalid-pp-token]
#define LIBCSTRING_VERSION_STRING                       " [20160425],
                                                        ^
./libcstring_definitions.h:49:1: warning: missing terminating '"' character [-Winvalid-pp-token]
"
^
./libcstring_definitions.h:49:1: error: expected identifier or '('
2 warnings and 1 error generated.
make[1]: *** [libcstring_support.lo] Error 1
make: *** [all-recursive] Error 1

A paste of the full output for ./configure is here: http://pastebin.com/Q4QGV2ga

Does anybody know what could possibly be wrong here? All tips are welcome!

Questions about the library

Hello -- I've built the Python bindings per documentation and have been familiarizing myself with pypff capabilities. I cannot find a way to do some tasks I'd like to and I'm not sure if it is because the library does not support the specific operations or because I am unfamiliar with it.

Specifically, I'd like to read the unique ID for every message in a PST (the 'StoreID') and identify the names or, better yet, metadata of any message attachments. Thank you for any information you can share regarding these questions.