TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)

Browse Source 
The code really means to mask off the high bits, not assign 0xff.

Reported by Marcus Meissner <meissner@suse.de>.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
This commit is contained in:
Jens Axboe
2006-08-18 21:42:43 +02:00
committed by Adrian Bunk
parent 3cfd644882
commit c1df7b7181
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/cdrom/cdrom.c
+1 -1
View File
@@ -1837,7 +1837,7 @@ static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s)
init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
cgc.cmd[7] = s->type;
cgc.cmd[9] = cgc.buflen = 0xff;
cgc.cmd[9] = cgc.buflen & 0xff;
if ((ret = cdo->generic_packet(cdi, &cgc)))
return ret;