Fixed parsing of 32KiB page ESE databases from Windows Server 2025

[takker-hero-se]

Fixes #78

Summary

Windows Server 2025 introduced optional 32KiB ESE database pages for Active Directory (NTDS.dit). This PR fixes two issues that prevented libesedb from parsing such databases.

Changes

1. Page tag count mask (libesedb_page_header.c, +9 lines)

In the 32KiB page format, the available_page_tag field (uint16) uses a new layout:

• Upper 4 bits: ctagReserved (reserved, must be masked out)
• Lower 12 bits: actual number of page tags

Without masking, libesedb reads all 16 bits as the tag count, inflating the value and causing out-of-bounds page tag reads.

Fix: page_header->available_page_tag &= 0x0fff when io_handle->page_size >= 32768.

2. Leaf page validation in B-tree walk (libesedb_page_tree.c, +45 lines)

The backward walk in libesedb_page_tree_get_get_first_leaf_page_number() and forward walk in libesedb_page_tree_get_number_of_leaf_values() did not check whether each page in the leaf chain is actually a leaf page. In 32KiB databases, some pages referenced in the chain may be zeroed or non-leaf pages, causing errors or incorrect record counts.

Fix: Check LIBESEDB_PAGE_FLAG_IS_LEAF before processing each page. Added proper libcerror_error_set() error handling for the libesedb_page_get_flags() calls.

Testing

Tested with real Active Directory NTDS.dit databases:

	8KiB pages (WS2019)	32KiB pages (WS2025)
Tables	14	14
datatable records	7,008	7,029
link_table records	13,904	485
Errors/crashes	None	None

No regression on 8KiB page databases.

References

• Microsoft: Database 32k pages for Active Directory

[takker-hero-se]

CI failure analysis

The 2 failed jobs (macOS x64 gcc python and mingw-w64-gcc-python) are unrelated to this PR's changes.

Both fail with:

import pyesedb
ImportError: No such file or directory

This is a shared library path issue in the CI environment, not an API incompatibility. This PR only modifies internal page parsing logic in libesedb_page_header.c and libesedb_page_tree.c — no public API changes.

Additionally, mingw-w64-gcc-python also fails on the current main branch with the same error, confirming it is a pre-existing CI environment issue.

The remaining 21/23 jobs (including all C compilation and test jobs) pass successfully.