From 973e292101bef17a329b6861c32d830eebc98ec2 Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Wed, 22 Apr 2009 00:15:43 +0000
Subject: [PATCH] fixed 2778170 re: read size of resident files

---
 CHANGES.txt       | 3 +++
 tsk3/fs/fs_attr.c | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 77d1b2be6..586d604e5 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -71,6 +71,9 @@ by Rob Joyce.
 4/11/09: Bug Fix: Fixed issue 2662168 re: warning messages on macs
 when reading the raw character device.  patch by Rob Joyce. 
 
+4/21/09: Bug Fix. Fixed issue 2778170 re: incorrect read size on resident
+attributes.  Patch by Jamie Butler. 
+
 ---------------- VERSION 3.0.0 -------------- 
 0/00/00: Update: Many, many, many API changes.
 
diff --git a/tsk3/fs/fs_attr.c b/tsk3/fs/fs_attr.c
index 3048ddd1c..6ced0f2af 100644
--- a/tsk3/fs/fs_attr.c
+++ b/tsk3/fs/fs_attr.c
@@ -1032,12 +1032,12 @@ tsk_fs_attr_read(const TSK_FS_ATTR * a_fs_attr, TSK_OFF_T a_offset,
     else if (a_fs_attr->flags & TSK_FS_ATTR_RES) {
         size_t read_len;
 
-        if (a_offset > a_fs_attr->rd.buf_size) {
+        if (a_offset > a_fs_attr->size) {
             return 0;
         }
 
-        if (a_len + a_offset > a_fs_attr->rd.buf_size)
-            read_len = a_fs_attr->rd.buf_size - (size_t) a_offset;
+        if (a_offset + a_len > a_fs_attr->size)
+            read_len = a_fs_attr->size - (size_t) a_offset;
         else
             read_len = a_len;
 
-- 
GitLab