Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 18:15:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

- Fixed a buffer overflow, if a atapi device returns more bytes as requested.

Browse source 
svn path=/trunk/; revision=5405
This commit is contained in:
Hartmut Birr 2003-08-04 08:32:48 +00:00
parent 0fe3e63201
commit afa27c2690
1 changed files with 18 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
reactos/drivers/storage/atapi/atapi.c
View file

@ -16,7 +16,7 @@
* along with this program; if not, write to the Free Software * along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/ */
/* $Id: atapi.c,v 1.42 2003/07/12 19:18:31 ekohl Exp $ /* $Id: atapi.c,v 1.43 2003/08/04 08:32:48 hbirr Exp $
* *
* COPYRIGHT: See COPYING in the top level directory * COPYRIGHT: See COPYING in the top level directory
* PROJECT: ReactOS ATAPI miniport driver * PROJECT: ReactOS ATAPI miniport driver
@ -909,6 +909,7 @@ AtapiInterrupt(IN PVOID DeviceExtension)
ULONG Retries; ULONG Retries;
PUCHAR TargetAddress; PUCHAR TargetAddress;
ULONG TransferSize; ULONG TransferSize;
ULONG tmpTransferSize;
DPRINT("AtapiInterrupt() called!\n"); DPRINT("AtapiInterrupt() called!\n");
@ -979,10 +980,11 @@ AtapiInterrupt(IN PVOID DeviceExtension)
if (DevExt->DataTransferLength <= TransferSize) if (DevExt->DataTransferLength <= TransferSize)
{ {
if (!IsAtapi) if (IsAtapi)
{ {
TransferSize = DevExt->DataTransferLength; tmpTransferSize = TransferSize - DevExt->DataTransferLength;
} }
TransferSize = DevExt->DataTransferLength;
DevExt->DataTransferLength = 0; DevExt->DataTransferLength = 0;
IsLastBlock = TRUE; IsLastBlock = TRUE;
} }
@ -1019,6 +1021,17 @@ AtapiInterrupt(IN PVOID DeviceExtension)
/* check DRQ */ /* check DRQ */
if (IsLastBlock) if (IsLastBlock)
{ {
if (IsAtapi)
{
USHORT u;
while (tmpTransferSize > 0)
{
IDEReadBlock(CommandPortBase,
&u,
2);
tmpTransferSize -= 2;
}
}
for (Retries = 0; Retries < IDE_MAX_BUSY_RETRIES && for (Retries = 0; Retries < IDE_MAX_BUSY_RETRIES &&
(IDEReadStatus(CommandPortBase) & IDE_SR_BUSY); (IDEReadStatus(CommandPortBase) & IDE_SR_BUSY);
Retries++) Retries++)