zlib.error: Error -5 while decompressing data: incomplete or truncated stream

[tosiara]

Exctraction interrupts with an exception:

duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
duplicate inode use detected!!!
Traceback (most recent call last):
  File "/home/user/.local/bin/jefferson", line 501, in <module>
    main()
  File "/home/user/.local/bin/jefferson", line 473, in main
    fs_list = scan_fs(content, cstruct.BIG_ENDIAN, verbose=args.verbose)
  File "/home/user/.local/bin/jefferson", line 325, in scan_fs
    inode.unpack(content[0 + offset:])
  File "/home/user/.local/bin/jefferson", line 209, in unpack
    self.data = zlib.decompress(node_data)
zlib.error: Error -5 while decompressing data: incomplete or truncated stream

The result is empty directory, nothing gets extracted

If I add a try/except like this:

diff --git a/src/scripts/jefferson b/src/scripts/jefferson
index 891d0cc..42a7e7d 100755
--- a/src/scripts/jefferson
+++ b/src/scripts/jefferson
@@ -205,7 +205,11 @@ class Jffs2_raw_inode(cstruct.CStruct):
         elif self.compr == JFFS2_COMPR_ZERO:
             self.data = '\x00' * self.dsize
         elif self.compr == JFFS2_COMPR_ZLIB:
-            self.data = zlib.decompress(node_data)
+            try:
+                self.data = zlib.decompress(node_data)
+            except:
+                print 'zlib.decompress failed'
+                self.data = ""
         elif self.compr == JFFS2_COMPR_RTIME:
             self.data = rtime.decompress(node_data, self.dsize)
         elif self.compr == JFFS2_COMPR_LZMA:

I'm able to get at least partial results extracted

[sviehb]

Looks like you are dealing with a somehow malformed filesystem image. Can you provide a sample?

[tosiara]

Can I send you the example privately? The dump may contain third person's private data, so I would like not to expose it to everyone on the internet. Could you send me your PGP key?

[Hemi03]

It cold also be your zlib buffer is full.
It fixed the exeption for me, when i was handling a large file.
Try:
zobj = zlib.decompressobj()
self.data = zobj.decompress(node_data)

[qkaiser]

Jefferson now includes a check for decompression exception that will display the bad inode (see #36). Corruption at the node level can happen during firmware acquisition.