i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CID 1108333, 1108192, 1108443

Browse Source 
* 1108333 Out-of-bounds access
* 1108192 Operands don't affect result
* 1108443 Uninitialized pointer field
This commit is contained in:
Jérôme Duval
2013-11-09 13:08:57 +01:00
parent 1149fa6ece
commit 426c95e5b0
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp
+5 -4
View File
@@ -13,6 +13,7 @@
VirtioSCSIRequest::VirtioSCSIRequest(bool hasLock) VirtioSCSIRequest::VirtioSCSIRequest(bool hasLock)
: :
fHasLock(hasLock), fHasLock(hasLock),
fStatus(SCSI_REQ_CMP),
fTimeout(0), fTimeout(0),
fBytesLeft(0), fBytesLeft(0),
fIsWrite(false), fIsWrite(false),
@@ -164,11 +165,12 @@ VirtioSCSIRequest::FillRequest(uint32 inCount, uint32 outCount,
fRequest->tag = (addr_t)fCCB; fRequest->tag = (addr_t)fCCB;
fRequest->lun[0] = 1; fRequest->lun[0] = 1;
fRequest->lun[1] = fCCB->target_id; fRequest->lun[1] = fCCB->target_id;
fRequest->lun[2] = 0x40 | ((fCCB->target_lun >> 8) & 0x3f); // we don't support lun >= 256
fRequest->lun[3] = (fCCB->target_lun >> 8) & 0xff; fRequest->lun[2] = 0x40;
fRequest->lun[3] = fCCB->target_lun & 0xff;
memcpy(fRequest->cdb, fCCB->cdb, min_c(fCCB->cdb_length, memcpy(fRequest->cdb, fCCB->cdb, min_c(fCCB->cdb_length,
sizeof(fRequest->cdb))); min_c(sizeof(fRequest->cdb), sizeof(fCCB->cdb))));
get_memory_map(fBuffer, sizeof(struct virtio_scsi_cmd_req) get_memory_map(fBuffer, sizeof(struct virtio_scsi_cmd_req)
+ sizeof(struct virtio_scsi_cmd_resp), &entries[0], 1); + sizeof(struct virtio_scsi_cmd_resp), &entries[0], 1);
@@ -225,4 +227,3 @@ VirtioSCSIRequest::_ResponseStatus()
return status; return status;
} }