Module Name: src
Committed By: martin
Date: Fri Mar 15 16:16:12 UTC 2013
Modified Files:
src/sys/dev/scsipi: cd.c
Log Message:
Prompted by PR kern/47646, zero the value buffer before running the
GET_CONFIGURATION command and check for an unexpectedly large feature
length answer afterwards.
To generate a diff of this commit:
cvs rdiff -u -r1.309 -r1.310 src/sys/dev/scsipi/cd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/scsipi/cd.c
diff -u src/sys/dev/scsipi/cd.c:1.309 src/sys/dev/scsipi/cd.c:1.310
--- src/sys/dev/scsipi/cd.c:1.309 Sun May 6 17:23:10 2012
+++ src/sys/dev/scsipi/cd.c Fri Mar 15 16:16:12 2013
@@ -1,4 +1,4 @@
-/* $NetBSD: cd.c,v 1.309 2012/05/06 17:23:10 martin Exp $ */
+/* $NetBSD: cd.c,v 1.310 2013/03/15 16:16:12 martin Exp $ */
/*-
* Copyright (c) 1998, 2001, 2003, 2004, 2005, 2008 The NetBSD Foundation,
@@ -50,7 +50,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.309 2012/05/06 17:23:10 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.310 2013/03/15 16:16:12 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -3033,6 +3033,7 @@ mmc_getdiscinfo(struct scsipi_periph *pe
gc_cmd.opcode = GET_CONFIGURATION;
_lto2b(last_feature, gc_cmd.start_at_feature);
_lto2b(feat_tbl_len, gc_cmd.data_len);
+ memset(gc, 0, feat_tbl_len);
error = scsipi_command(periph,
(void *)&gc_cmd, sizeof(gc_cmd),
@@ -3044,7 +3045,7 @@ mmc_getdiscinfo(struct scsipi_periph *pe
}
features_len = _4btol(gc->data_len);
- if (features_len < 4)
+ if (features_len < 4 || features_len > feat_tbl_len)
break;
pos = 0;
