From 834a6e72238a508c81ed013fc3a7392019d9f52c Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Tue, 24 Mar 2009 03:47:46 +0000
Subject: [PATCH] 2708195 long reads in fragmented attribute fix
---
CHANGES.txt | 3 +++
tsk3/fs/fs_attr.c | 5 ++++-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/CHANGES.txt b/CHANGES.txt
index 894289fed..6d52807a3 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -44,6 +44,9 @@ adjustment of attribute FILLER offset. Reported by Andy Bontoft.
doing text-based sorting on dates of different lengths (fix was to
pad with 0s). Fix by Bruce Nikkel.
+3/23/09: Bug Fix: Fixed bug 2708195, for long reads in fragmented
+attributes. Reported and patch by Jamie Butler (Mandiant).
+
---------------- VERSION 3.0.0 --------------
0/00/00: Update: Many, many, many API changes.
diff --git a/tsk3/fs/fs_attr.c b/tsk3/fs/fs_attr.c
index d4ebd8430..3048ddd1c 100644
--- a/tsk3/fs/fs_attr.c
+++ b/tsk3/fs/fs_attr.c
@@ -1109,7 +1109,10 @@ tsk_fs_attr_read(const TSK_FS_ATTR * a_fs_attr, TSK_OFF_T a_offset,
continue;
// block offset into this run
- run_offset = blkoffset - data_run_cur->offset;
+ if (data_run_cur->offset <= blkoffset)
+ run_offset = blkoffset - data_run_cur->offset;
+ else
+ run_offset = 0;
// see if we need to read the rest of this run and into the next or if it is all here
if (fs->block_size * (data_run_cur->len - run_offset) >=
--
GitLab