Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't fetch data beyond end of inquiry buffer, which, here, is not 

NUL-terminated.

Reduce target buffer to needed size (product name + NUL terminator).
This commit is contained in:
mlelstv 2022-08-28 10:26:37 +00:00
parent c6dcfc105b
commit ddea52491e
2 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/dev/scsipi/sd.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: sd.c,v 1.334 2022/03/28 12:39:46 riastradh Exp $ */
/* $NetBSD: sd.c,v 1.335 2022/08/28 10:26:37 mlelstv Exp $ */
/*-
* Copyright (c) 1998, 2003, 2004 The NetBSD Foundation, Inc.
@ -47,7 +47,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sd.c,v 1.334 2022/03/28 12:39:46 riastradh Exp $");
__KERNEL_RCSID(0, "$NetBSD: sd.c,v 1.335 2022/08/28 10:26:37 mlelstv Exp $");
#ifdef _KERNEL_OPT
#include "opt_scsi.h"
@ -258,9 +258,8 @@ sdattach(device_t parent, device_t self, void *aux)
SC_DEBUG(periph, SCSIPI_DB2, ("sdattach: "));
sd->type = (sa->sa_inqbuf.type & SID_TYPE);
strncpy(sd->name, sa->sa_inqbuf.product, sizeof(sd->name));
strncpy(sd->typename, sa->sa_inqbuf.product, sizeof(sd->typename));
memcpy(sd->name, sa->sa_inqbuf.product, uimin(16, sizeof(sd->name)));
memcpy(sd->typename, sa->sa_inqbuf.product, uimin(16, sizeof(sd->typename)));
if (sd->type == T_SIMPLE_DIRECT)
periph->periph_quirks |= PQUIRK_ONLYBIG | PQUIRK_NOBIGMODESENSE;

4
sys/dev/scsipi/sdvar.h
View File

@ -1,4 +1,4 @@
/* $NetBSD: sdvar.h,v 1.39 2019/03/19 06:59:40 mlelstv Exp $ */
/* $NetBSD: sdvar.h,v 1.40 2022/08/28 10:26:37 mlelstv Exp $ */
/*-
* Copyright (c) 1998, 2004 The NetBSD Foundation, Inc.
@ -88,7 +88,7 @@ struct sd_softc {
callout_t sc_callout;
u_int8_t type;
char name[16]; /* product name, for default disklabel */
char typename[128+4+1]; /* stored in disk info */
char typename[16+1]; /* stored in disk info */
};
#define SDGP_RESULT_OK 0 /* parameters obtained */