[sleuthkit-developers] [ sleuthkit-Bugs-2778170 ] Incorrect read size of NTFS resident files

[SourceForge.net <no...@so...>]

Bugs item #2778170, was opened at 2009-04-21 19:02
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2778170&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Incorrect read size of NTFS resident files

Initial Comment:
fs_read_attr() for resident files relies on the buffer size and not the file size for calculating how much data to read.  It should use the file size. Patch supplied by Jamie Butler:

if (a_len + a_offset > a_fs_attr->rd.buf_size)
     read_len = a_fs_attr->rd.buf_size - (size_t) a_offset;
else
     read_len = a_len;

should be:
 
if (a_offset > a_fs_attr->size)
{
     return 0;
}
 
if (a_len + a_offset > a_fs_attr->size)
     read_len = a_fs_attr->size - a_offset;
else
     read_len = a_len;

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-04-21 19:16

Message:
Checked into root.

Sending        CHANGES.txt
Sending        tsk3/fs/fs_attr.c
Transmitting file data ..
Committed revision 78.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2778170&group_id=55685