CDROM_PACKET_SIZE is added as an offset to the pointer to unsigned char cmd[16].
The adjusted pointer is then used as a destination address in a call to
memset(). However, when CDROM_PACKET_SIZE is added to the pointer, it is
automatically scaled by the size of cmd, which is 16. This results in the call
to memset() writing to unintended memory.
Signed-off-by: Roel Kluin <[EMAIL PROTECTED]>
---
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index a8130a4..548efcf 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -767,7 +767,7 @@ static int pkt_generic_packet(struct pktcdvd_device *pd,
struct packet_command *
rq->cmd_len = COMMAND_SIZE(cgc->cmd[0]);
memcpy(rq->cmd, cgc->cmd, CDROM_PACKET_SIZE);
if (sizeof(rq->cmd) > CDROM_PACKET_SIZE)
- memset(rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd) -
CDROM_PACKET_SIZE);
+ memset((char *)rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd)
- CDROM_PACKET_SIZE);
rq->timeout = 60*HZ;
rq->cmd_type = REQ_TYPE_BLOCK_PC;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
