Integer overflow in HFS in Apple Mac OS X before 10.6.7 allows local users to read arbitrary (1) HFS, (2) HFS+, or (3) HFS+J files via a crafted F_READBOOTSTRAP ioctl call.
http://support.apple.com/kb/HT4581
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html