[sleuthkit-developers] [ sleuthkit-Bugs-2993804 ] tsk_fs_file_read() can go past end of file

[SourceForge.net <no...@so...>]

Bugs item #2993804, was opened at 2010-04-28 15:25
Message generated for change (Tracker Item Submitted) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2993804&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: tsk_fs_file_read() can go past end of file

Initial Comment:
- Add check if offset is past end of file

>From Michael Cohen to dev list:

Hi All,
 Im currently putting my finishing touches on the new tsk3.x python
bindings and i noticed some slightly weird behaviour.

When calling tsk_fs_file_read you can specify flags which are of type
enum TSK_FS_FILE_READ_FLAG_ENUM this enum can take on two values:

TSK_FS_FILE_READ_FLAG_SLACK 	Allow read access into slack space. (value 0x01)
TSK_FS_FILE_READ_FLAG_NOID 	Ignore the Id argument given in the API
(use only the type). (value 0x02)

A notable exception is the default case of actually reading the file
until the end of the file but not including the slack.

Indeed if i try to read past the end of the file it always gives me
the slack even if i specify 0 for flags (which is technically not a
valid value for this enum). I am currently working around this by
pulling the size of the file and making sure not to read past it and
into the slack.

This is the behabiour i can see (my file is 385865 bytes long):

1) tsk_fs_file_read( offset =0, length = 10m) -> 385865
2) tsk_fs_file_read( offset =385865, length = 10m) -> 7351 (which is the slack)
3) tsk_fs_file_read( offset =393216) -> -1

Should there be a default value for flags (say 0x00) which actually
stops reading at the end of the file? (in the above step 2 should
fail?)

Michael.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2993804&group_id=55685