d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't generate EINVAL for data_len too big in READTOCENTRYS, it

Browse Source 
reduces automatically to reasonable value in the code below
This commit is contained in:
ache 1996-01-30 12:07:15 +00:00
parent edbc3e1baf
commit 757048e121
3 changed files with 7 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/dev/mcd/mcd.c
View File

@ -40,7 +40,7 @@
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
* $Id: mcd.c,v 1.59 1996/01/23 22:55:08 joerg Exp $
* $Id: mcd.c,v 1.60 1996/01/30 10:31:06 ache Exp $
*/
static char COPYRIGHT[] = "mcd-driver (C)1993 by H.Veit & B.Moore";
@ -1433,9 +1433,8 @@ mcd_toc_entrys(int unit, struct ioc_read_toc_entry *te)
struct ioc_toc_header th;
int rc, n, trk, len = te->data_len;
if ( len > sizeof(entries)
|| len < sizeof(struct cd_toc_entry)
|| (len % sizeof(struct cd_toc_entry)) != 0
if ( len < sizeof(entries[0])
|| (len % sizeof(entries[0])) != 0
)
return EINVAL;
if (te->address_format != CD_MSF_FORMAT &&

7
sys/i386/isa/mcd.c
View File

@ -40,7 +40,7 @@
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
* $Id: mcd.c,v 1.59 1996/01/23 22:55:08 joerg Exp $
* $Id: mcd.c,v 1.60 1996/01/30 10:31:06 ache Exp $
*/
static char COPYRIGHT[] = "mcd-driver (C)1993 by H.Veit & B.Moore";
@ -1433,9 +1433,8 @@ mcd_toc_entrys(int unit, struct ioc_read_toc_entry *te)
struct ioc_toc_header th;
int rc, n, trk, len = te->data_len;
if ( len > sizeof(entries)
|| len < sizeof(struct cd_toc_entry)
|| (len % sizeof(struct cd_toc_entry)) != 0
if ( len < sizeof(entries[0])
|| (len % sizeof(entries[0])) != 0
)
return EINVAL;
if (te->address_format != CD_MSF_FORMAT &&

3
sys/i386/isa/wcd.c
View File

@ -765,8 +765,7 @@ int wcdioctl (dev_t dev, int cmd, caddr_t addr, int flag, struct proc *p)
if (! t->toc.hdr.ending_track)
return (EIO);
if ( te->data_len > sizeof(toc->tab)
|| te->data_len < sizeof(toc->tab[0])
if ( te->data_len < sizeof(toc->tab[0])
|| (te->data_len % sizeof(toc->tab[0])) != 0
)
return EINVAL;