From 938c41a1aa06935d078d33f52564bb17f5747626 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Wed, 12 Nov 2014 16:22:48 +0100 Subject: [PATCH] cdda: fix possible buffer overrun If the requested read was more than 32 frames, and reading them all at once failed, we would try to read by chunk of 8 frames. But if the original frame count was not a multiple of 8 we would not adjust the count for the last read. Unfortunately I could still panic the system after fixing this, so it is not *the* cdda bug. --- src/add-ons/kernel/file_systems/cdda/cdda.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/add-ons/kernel/file_systems/cdda/cdda.cpp b/src/add-ons/kernel/file_systems/cdda/cdda.cpp index 7875c6337b..81a008df0d 100644 --- a/src/add-ons/kernel/file_systems/cdda/cdda.cpp +++ b/src/add-ons/kernel/file_systems/cdda/cdda.cpp @@ -9,6 +9,7 @@ #include #include +#include #include #include #include @@ -460,6 +461,12 @@ read_frames(int fd, off_t firstFrame, uint8 *buffer, size_t count) size_t framesLeft = count; while (framesLeft > 0) { + // If the initial count was >= 32, and not a multiple of 8, and the + // ioctl fails, we switch to reading 8 frames at a time. However the + // last read can read between 1 and 7 frames only, to not overflow + // the buffer. + count = std::min(count, framesLeft); + scsi_read_cd read; read.start_m = firstFrame / kFramesPerMinute; read.start_s = (firstFrame / kFramesPerSecond) % 60; @@ -482,6 +489,7 @@ read_frames(int fd, off_t firstFrame, uint8 *buffer, size_t count) count = 8; else count = 1; + continue; }