diff options
author | ache <ache@FreeBSD.org> | 1996-01-30 12:07:15 +0000 |
---|---|---|
committer | ache <ache@FreeBSD.org> | 1996-01-30 12:07:15 +0000 |
commit | 757048e121f077a2e481e0c3d1710728682372d5 (patch) | |
tree | 4144e7e121b4a56956c5617317d1376d4403c8ef /sys | |
parent | edbc3e1bafac9162c3debd04decc99ea37ee3516 (diff) | |
download | FreeBSD-src-757048e121f077a2e481e0c3d1710728682372d5.zip FreeBSD-src-757048e121f077a2e481e0c3d1710728682372d5.tar.gz |
Don't generate EINVAL for data_len too big in READTOCENTRYS, it
reduces automatically to reasonable value in the code below
Diffstat (limited to 'sys')
-rw-r--r-- | sys/dev/mcd/mcd.c | 7 | ||||
-rw-r--r-- | sys/i386/isa/mcd.c | 7 | ||||
-rw-r--r-- | sys/i386/isa/wcd.c | 3 |
3 files changed, 7 insertions, 10 deletions
diff --git a/sys/dev/mcd/mcd.c b/sys/dev/mcd/mcd.c index 81e7e14..b77b2ec 100644 --- a/sys/dev/mcd/mcd.c +++ b/sys/dev/mcd/mcd.c @@ -40,7 +40,7 @@ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * - * $Id: mcd.c,v 1.59 1996/01/23 22:55:08 joerg Exp $ + * $Id: mcd.c,v 1.60 1996/01/30 10:31:06 ache Exp $ */ static char COPYRIGHT[] = "mcd-driver (C)1993 by H.Veit & B.Moore"; @@ -1433,9 +1433,8 @@ mcd_toc_entrys(int unit, struct ioc_read_toc_entry *te) struct ioc_toc_header th; int rc, n, trk, len = te->data_len; - if ( len > sizeof(entries) - || len < sizeof(struct cd_toc_entry) - || (len % sizeof(struct cd_toc_entry)) != 0 + if ( len < sizeof(entries[0]) + || (len % sizeof(entries[0])) != 0 ) return EINVAL; if (te->address_format != CD_MSF_FORMAT && diff --git a/sys/i386/isa/mcd.c b/sys/i386/isa/mcd.c index 81e7e14..b77b2ec 100644 --- a/sys/i386/isa/mcd.c +++ b/sys/i386/isa/mcd.c @@ -40,7 +40,7 @@ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * - * $Id: mcd.c,v 1.59 1996/01/23 22:55:08 joerg Exp $ + * $Id: mcd.c,v 1.60 1996/01/30 10:31:06 ache Exp $ */ static char COPYRIGHT[] = "mcd-driver (C)1993 by H.Veit & B.Moore"; @@ -1433,9 +1433,8 @@ mcd_toc_entrys(int unit, struct ioc_read_toc_entry *te) struct ioc_toc_header th; int rc, n, trk, len = te->data_len; - if ( len > sizeof(entries) - || len < sizeof(struct cd_toc_entry) - || (len % sizeof(struct cd_toc_entry)) != 0 + if ( len < sizeof(entries[0]) + || (len % sizeof(entries[0])) != 0 ) return EINVAL; if (te->address_format != CD_MSF_FORMAT && diff --git a/sys/i386/isa/wcd.c b/sys/i386/isa/wcd.c index bfb018d..3821b1c 100644 --- a/sys/i386/isa/wcd.c +++ b/sys/i386/isa/wcd.c @@ -765,8 +765,7 @@ int wcdioctl (dev_t dev, int cmd, caddr_t addr, int flag, struct proc *p) if (! t->toc.hdr.ending_track) return (EIO); - if ( te->data_len > sizeof(toc->tab) - || te->data_len < sizeof(toc->tab[0]) + if ( te->data_len < sizeof(toc->tab[0]) || (te->data_len % sizeof(toc->tab[0])) != 0 ) return EINVAL; |