diff --git a/CHANGES.txt b/CHANGES.txt index 894289fed49db464d43d6c791df2e3c580cbb12e..6d52807a3e1e4f8df02fc95b6d6f38641ebbb965 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -44,6 +44,9 @@ adjustment of attribute FILLER offset. Reported by Andy Bontoft. doing text-based sorting on dates of different lengths (fix was to pad with 0s). Fix by Bruce Nikkel. +3/23/09: Bug Fix: Fixed bug 2708195, for long reads in fragmented +attributes. Reported and patch by Jamie Butler (Mandiant). + ---------------- VERSION 3.0.0 -------------- 0/00/00: Update: Many, many, many API changes. diff --git a/tsk3/fs/fs_attr.c b/tsk3/fs/fs_attr.c index d4ebd84309d816762fe8f72d9db153d0dc101dd2..3048ddd1c7d17dc69eee467ce1509a6c3c7ae784 100644 --- a/tsk3/fs/fs_attr.c +++ b/tsk3/fs/fs_attr.c @@ -1109,7 +1109,10 @@ tsk_fs_attr_read(const TSK_FS_ATTR * a_fs_attr, TSK_OFF_T a_offset, continue; // block offset into this run - run_offset = blkoffset - data_run_cur->offset; + if (data_run_cur->offset <= blkoffset) + run_offset = blkoffset - data_run_cur->offset; + else + run_offset = 0; // see if we need to read the rest of this run and into the next or if it is all here if (fs->block_size * (data_run_cur->len - run_offset) >=