From 6c7bccae0cb8bff9416b666b035a8490950dbea4 Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Fri, 16 Sep 2011 20:23:12 +0000
Subject: [PATCH] Fix for 3406523 re: mactime sanity check on size from Joachim
Metz
---
NEWS.txt | 1 +
tools/timeline/mactime.base | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/NEWS.txt b/NEWS.txt
index 4d72e1dd4..c099f8712 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -19,6 +19,7 @@ New Features:
Bug Fixes:
- Added check to fatfs_open to compare first sectors of FAT if we used backup boot sector and verify it is FAT32.
- More checks to make sure that FAT short names are valid ASCII
+- 3406523: Mactime size sanity check
---------------- VERSION 3.2.2 --------------
diff --git a/tools/timeline/mactime.base b/tools/timeline/mactime.base
index 591299652..3c9dd87b1 100644
--- a/tools/timeline/mactime.base
+++ b/tools/timeline/mactime.base
@@ -300,7 +300,7 @@ sub read_body {
next unless ((defined $st_ino) && ($st_ino =~ /[\d-]+/));
next unless ((defined $st_uid) && ($st_uid =~ /\d+/));
next unless ((defined $st_gid) && ($st_gid =~ /\d+/));
- next unless ((defined $st_size) && ($st_gid =~ /\d+/));
+ next unless ((defined $st_size) && ($st_size =~ /\d+/));
next unless ((defined $st_mtime) && ($st_mtime =~ /\d+/));
next unless ((defined $st_atime) && ($st_atime =~ /\d+/));
next unless ((defined $st_ctime) && ($st_ctime =~ /\d+/));
--
GitLab