From 14b8be0c9ab74257738cb36d7683386604c4bbac Mon Sep 17 00:00:00 2001 From: Colin Finck Date: Wed, 8 Dec 2021 20:15:37 +0100 Subject: Fix calculation in `NtfsAttribute::non_resident_value_data_and_position` The attribute length is relative to the attribute start, not to the data runs start! This 64 byte difference previously caused a panic when data run information filled the entire File Record, and `end` was outside the File Record boundaries. --- src/attribute.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/attribute.rs b/src/attribute.rs index a5abf11..e6c1fd2 100644 --- a/src/attribute.rs +++ b/src/attribute.rs @@ -220,7 +220,7 @@ impl<'n, 'f> NtfsAttribute<'n, 'f> { pub(crate) fn non_resident_value_data_and_position(&self) -> (&'f [u8], u64) { debug_assert!(!self.is_resident()); let start = self.offset + self.non_resident_value_data_runs_offset() as usize; - let end = start + self.attribute_length() as usize; + let end = self.offset + self.attribute_length() as usize; let data = &self.file.record_data()[start..end]; let position = self.file.position() + start as u64; -- cgit v1.2.3