Commit aec9f377 authored Aug 02, 2011 by Andrew Morton Committed by Jens Axboe Aug 02, 2011

drivers/cdrom/cdrom.c: relax check on dvd manufacturer value

The report has an ISO which has a very long manufacturer ID.  It seems
that Linux is wrong, not the ISO maker.

Relax the check for the length of this field: emit a warning and truncate
the incoming data to 2048 bytes rather than rejecting the entire thing.

dvd_manufact.value isn't null-terminated.  I'm not even sure if it's a
string.  The kernel doesn't apepar to use it anyway.

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=39062



Reported-by:  <ale.goujon@gmail.com>
Tested-by:  <ale.goujon@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

parent ddad9ef5

drivers/cdrom/cdrom.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info cdi, dvd_struct s,
		goto out;

		s->manufact.len = buf[0] << 8 \| buf[1];
		if (s->manufact.len < 0 \|\| s->manufact.len > 2048) {
		if (s->manufact.len < 0) {
		cdinfo(CD_WARNING, "Received invalid manufacture info length"
		" (%d)\n", s->manufact.len);
		ret = -EIO;
		} else {
		if (s->manufact.len > 2048) {
		cdinfo(CD_WARNING, "Received invalid manufacture info "
		"length (%d): truncating to 2048\n",
		s->manufact.len);
		s->manufact.len = 2048;
		}
		memcpy(s->manufact.value, &buf[4], s->manufact.len);
		}