Messages in this thread Patch in this message | | | Date | Tue, 06 Nov 2007 23:43:12 +0100 | From | Roel Kluin <> | Subject | [PATCH] fix writing to unintended memory in pkt_generic_packet(); drivers/block/pktcdvd.c |
| |
CDROM_PACKET_SIZE is added as an offset to the pointer to unsigned char cmd[16]. The adjusted pointer is then used as a destination address in a call to memset(). However, when CDROM_PACKET_SIZE is added to the pointer, it is automatically scaled by the size of cmd, which is 16. This results in the call to memset() writing to unintended memory.
Signed-off-by: Roel Kluin <12o3l@tiscali.nl> --- diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c index a8130a4..548efcf 100644 --- a/drivers/block/pktcdvd.c +++ b/drivers/block/pktcdvd.c @@ -767,7 +767,7 @@ static int pkt_generic_packet(struct pktcdvd_device *pd, struct packet_command * rq->cmd_len = COMMAND_SIZE(cgc->cmd[0]); memcpy(rq->cmd, cgc->cmd, CDROM_PACKET_SIZE); if (sizeof(rq->cmd) > CDROM_PACKET_SIZE) - memset(rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd) - CDROM_PACKET_SIZE); + memset((char *)rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd) - CDROM_PACKET_SIZE); rq->timeout = 60*HZ; rq->cmd_type = REQ_TYPE_BLOCK_PC; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |