From 426c95e5b0b5555ed31e220df2e8d24354915b5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Sat, 9 Nov 2013 10:24:08 +0100 Subject: [PATCH] CID 1108333, 1108192, 1108443 * 1108333 Out-of-bounds access * 1108192 Operands don't affect result * 1108443 Uninitialized pointer field --- .../kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp b/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp index fef0ff84b1..6e489af6c2 100644 --- a/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp +++ b/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp @@ -13,6 +13,7 @@ VirtioSCSIRequest::VirtioSCSIRequest(bool hasLock) : fHasLock(hasLock), + fStatus(SCSI_REQ_CMP), fTimeout(0), fBytesLeft(0), fIsWrite(false), @@ -164,11 +165,12 @@ VirtioSCSIRequest::FillRequest(uint32 inCount, uint32 outCount, fRequest->tag = (addr_t)fCCB; fRequest->lun[0] = 1; fRequest->lun[1] = fCCB->target_id; - fRequest->lun[2] = 0x40 | ((fCCB->target_lun >> 8) & 0x3f); - fRequest->lun[3] = (fCCB->target_lun >> 8) & 0xff; + // we don't support lun >= 256 + fRequest->lun[2] = 0x40; + fRequest->lun[3] = fCCB->target_lun & 0xff; memcpy(fRequest->cdb, fCCB->cdb, min_c(fCCB->cdb_length, - sizeof(fRequest->cdb))); + min_c(sizeof(fRequest->cdb), sizeof(fCCB->cdb)))); get_memory_map(fBuffer, sizeof(struct virtio_scsi_cmd_req) + sizeof(struct virtio_scsi_cmd_resp), &entries[0], 1); @@ -225,4 +227,3 @@ VirtioSCSIRequest::_ResponseStatus() return status; } -