fix(processors): Slice NTFS data buffer

rabbitstack · rabbitstack · commit 095f0dcd2bd8 · 2024-10-16T20:45:50.000+02:00
Slice the data buffered returned by NTFS
parser read operation.
diff --git a/internal/etw/processors/processor.go b/internal/etw/processors/processor.go
@@ -98,11 +98,15 @@ func parseImageFileCharacteristics(e *kevent.Kevent) error {
 		// read file data blob from raw device
 		// if the regular file access fails
 		ntfs := libntfs.NewFS()
-		data, _, err = ntfs.Read(filename, 0, int64(os.Getpagesize()))
+		var n int
+		data, n, err = ntfs.Read(filename, 0, int64(os.Getpagesize()))
 		defer ntfs.Close()
 		if err != nil {
 			return err
 		}
+		if n > 0 {
+			data = data[:n]
+		}
 		goto parsePe
 	}
 	defer f.Close()
