configure probes the libewf 2 API without `-lewf`, so EWF support silently falls back to functions libewf 2 removed

[bryanchow]

Summary

configure tests for libewf_handle_read_buffer_at_offset / libewf_handle_write_buffer_at_offset at a point where -lewf is no longer in LIBS. The probes therefore fail to link and report "no" on every system, regardless of which libewf is installed. src/ewf.c then compiles its fallback branch, which calls libewf_handle_read_random() / libewf_handle_write_random(), functions that libewf 2 removed.

Verified on master (4f4cb66); also reproduces with the 7.2 release tarball.

Details

Inside the EWF block, -lewf is added to LIBS only temporarily. configure.ac:818:

  OLDLIBS="$LIBS"
  LIBS="$OLDLIBS $photorec_LDADD"

and restored at configure.ac:841:

  LIBS="$OLDLIBS"

But the probes for the libewf 2 functions don't run until configure.ac:895, well after that restore:

AC_CHECK_FUNCS([ atexit atoll ... libewf_handle_read_buffer_at_offset libewf_handle_write_buffer_at_offset ... ])

With -lewf absent, each conftest fails to link:

Undefined symbols for architecture arm64:
  "_libewf_handle_read_buffer_at_offset", referenced from:
      _main in conftest-19fd5a.o
ld: symbol(s) not found for architecture arm64

so config.h ends up with:

/* #undef HAVE_LIBEWF_HANDLE_READ_BUFFER_AT_OFFSET */
/* #undef HAVE_LIBEWF_HANDLE_WRITE_BUFFER_AT_OFFSET */

fewf_pread() (src/ewf.c:512) and fewf_pwrite() (src/ewf.c:552) then select the fallback:

#if defined( HAVE_LIBEWF_HANDLE_READ_BUFFER_AT_OFFSET )
  taille = libewf_handle_read_buffer_at_offset( ... );
#else
  taille = libewf_handle_read_random( ... );
#endif

Impact

libewf_handle_read_random / libewf_handle_write_random are gone in libewf 2. They are neither declared in libewf.h nor exported by the library (checked against libewf 20230212).

What you see depends only on compiler strictness, not on the platform:

• clang 16+ / GCC 14+, where implicit function declarations are errors, produce a hard build failure:

  ewf.c:520:12: error: call to undeclared function 'libewf_handle_read_random'; ISO C99 and later do not support implicit function declarations
  ewf.c:560:12: error: call to undeclared function 'libewf_handle_write_random'
  

• Older or looser toolchains compile with a warning and then fail at link, or leave the EWF read/write path quietly broken.

Reproduction

With libewf 2 installed:

./configure
grep AT_OFFSET config.h    # both #undef, even though the library has them
make                       # fails in ewf.c on clang 16+

In config.log, the conftest link line for libewf_handle_read_buffer_at_offset has no -lewf.

Passing LIBS=-lewf to configure confirms the diagnosis: both macros get defined and the build completes cleanly.

Suggested fix

configure.ac already handles exactly this situation correctly for reiserfs, a few lines below at configure.ac:915:

#reiserfs_fs_open_fast may not been detected because of lack of -ldal
OLDLIBS="$LIBS"
LIBS="$OLDLIBS $testdisk_LDADD -ldal"
AC_CHECK_FUNCS([reiserfs_fs_open_fast])
LIBS="$OLDLIBS"

Applying the same pattern would fix it: pull libewf_handle_read_buffer_at_offset and libewf_handle_write_buffer_at_offset out of the general AC_CHECK_FUNCS list at configure.ac:895 into their own check with -lewf in LIBS, or run them inside the EWF block before LIBS is restored.

Environment

• testdisk master (4f4cb66) and the 7.2 release tarball
• libewf 20230212
• macOS 26.5 arm64, Apple clang (Xcode 26.6)

Found while fixing the MacPorts port: macports/macports-ports#34088

Thank you for all your great work on TestDisk and PhotoRec 🙏

[cgsecurity]

Can you confirm it solves the problem ?

[bryanchow]

Thank you! Confirmed, 40e1b8d fixes it.

I built the parent commit (16bbccc) and the fix (40e1b8d) with identical configure arguments, so the change itself is the only variable. macOS 26.5 arm64, Apple clang (Xcode 26.6), libewf 20230212.

Before (16bbccc)

$ grep AT_OFFSET config.h
/* #undef HAVE_LIBEWF_HANDLE_READ_BUFFER_AT_OFFSET */
/* #undef HAVE_LIBEWF_HANDLE_WRITE_BUFFER_AT_OFFSET */
$ make
ewf.c:520:12: error: call to undeclared function 'libewf_handle_read_random'
ewf.c:560:12: error: call to undeclared function 'libewf_handle_write_random'

After (40e1b8d)

$ grep AT_OFFSET config.h
#define HAVE_LIBEWF_HANDLE_READ_BUFFER_AT_OFFSET 1
#define HAVE_LIBEWF_HANDLE_WRITE_BUFFER_AT_OFFSET 1
$ make          # completes cleanly, no LIBS=-lewf workaround needed
$ nm -u src/photorec | grep libewf_handle
_libewf_handle_read_buffer_at_offset
_libewf_handle_write_buffer_at_offset

Neither binary references libewf_handle_read_random / libewf_handle_write_random any more.

I also checked the EWF path at runtime rather than only at link time, against an E01 made with ewfacquire -f encase6 from a 16 MB image with a JPEG embedded at offset 1 MB:

• photorec /d out /cmd disk.E01 wholespace,fileopt,everything,disable,jpg,enable,search recovers the file byte-for-byte, with a SHA-256 identical to the original.
• testdisk /list disk.E01 opens the image and reports the correct media size and sector size.