[sleuthkit-developers] [ sleuthkit-Bugs-2778170 ] Incorrect read size of NTFS resident files

[SourceForge.net <no...@so...>]

Bugs item #2778170, was opened at 2009-04-21 19:02
Message generated for change (Tracker Item Submitted) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2778170&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Incorrect read size of NTFS resident files

Initial Comment:
fs_read_attr() for resident files relies on the buffer size and not the file size for calculating how much data to read.  It should use the file size. Patch supplied by Jamie Butler:

if (a_len + a_offset > a_fs_attr->rd.buf_size)
     read_len = a_fs_attr->rd.buf_size - (size_t) a_offset;
else
     read_len = a_len;

should be:
 
if (a_offset > a_fs_attr->size)
{
     return 0;
}
 
if (a_len + a_offset > a_fs_attr->size)
     read_len = a_fs_attr->size - a_offset;
else
     read_len = a_len;

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2778170&group_id=55685