[sleuthkit-developers] tsk_vs_part_read observation
Brought to you by:
carrier
From: Stuart M. <st...@ap...> - 2013-10-11 23:00:59
|
I am building against TSK 4.1 on Linux. If I call tsk_vs_part_read with the 4th parameter, the 'a_len' larger than the partition's size in bytes, the call hangs/spins. Of course it is easy to compute the maximum a_len that SHOULD be passed, thus: a_len = a_vs_part->len * a_vs_part->vs->block_size - a_off but I just wanted to point out what happens if that check is not done by the caller. Regards Stuart |