sleuthkit
sleuthkit copied to clipboard
ext3: read blocks indefinitely on files larger than 8GB
Overview
On ext3 filesystems libtsk's tsk_fs_file_read() blocks indefinitely for files larger than 8gb.
Steps to reproduce
Tested on tsk v4.12.1 and v4.11.1 and reproduces on both.
On any Linux machine with an ext3 filesystem create a large file (8gb+, might reproduce from a smaller size) and call tsk_fs_file_read() on it, the call would block forever.
Hi. Can you provide instructions for making a test disk image and the exact sequence of commands that you are using?