[sleuthkit-developers] [ sleuthkit-Bugs-2848162 ] tsk_fs_attr_read reads the wrong data

[SourceForge.net <no...@so...>]

Bugs item #2848162, was opened at 2009-08-31 21:43
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2848162&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Mathew Monroe (mathewmonroe)
Assigned to: Nobody/Anonymous (nobody)
Summary: tsk_fs_attr_read reads the wrong data

Initial Comment:
This bug existed in 3.0.1 and 3.0.2 but was temporarily fixed. However, when you refactored the function it seems to have crept back in.

Line 1084 of fs_attr.c needs to be:

if(data_run_cur->offset + data_run_cur->len <=

The < that is there now needs to be a <=. Without this change you will try to read 0 bytes from the datarun before the one you actually want to read. The side effect being that byteoffset_toread is set to 0, causing the read in the correct datarun to fail.

This is a critical bug because anyone using TSK to read not a block boundary can get invalid data.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-10-28 16:40

Message:
Thanks.  Fixed.

Sending        trunk/CHANGES.txt
Sending        trunk/tsk3/fs/fs_attr.c
Transmitting file data ..
Committed revision 114.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2848162&group_id=55685