[sleuthkit-developers] [ sleuthkit-Bugs-2848162 ] tsk_fs_attr_read reads the wrong data

[SourceForge.net <no...@so...>]

Bugs item #2848162, was opened at 2009-08-31 22:43
Message generated for change (Tracker Item Submitted) made by mathewmonroe
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2848162&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Mathew Monroe (mathewmonroe)
Assigned to: Nobody/Anonymous (nobody)
Summary: tsk_fs_attr_read reads the wrong data

Initial Comment:
This bug existed in 3.0.1 and 3.0.2 but was temporarily fixed. However, when you refactored the function it seems to have crept back in.

Line 1084 of fs_attr.c needs to be:

if(data_run_cur->offset + data_run_cur->len <=

The < that is there now needs to be a <=. Without this change you will try to read 0 bytes from the datarun before the one you actually want to read. The side effect being that byteoffset_toread is set to 0, causing the read in the correct datarun to fail.

This is a critical bug because anyone using TSK to read not a block boundary can get invalid data.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2848162&group_id=55685