diff options
| author | Andrew Morton <akpm@linux-foundation.org> | 2011-08-02 12:43:50 +0200 |
|---|---|---|
| committer | Jens Axboe <jaxboe@fusionio.com> | 2011-08-02 12:43:50 +0200 |
| commit | aec9f377e4f235c47e27fd8a429555dfa2dda342 (patch) | |
| tree | 5efa73cf8d0a150a69a66f01e40fb130b35a2bc4 /drivers/cdrom | |
| parent | ddad9ef5826efdfbbdb67b13b46f30e43e46ec3e (diff) | |
| download | linux-3.10-aec9f377e4f235c47e27fd8a429555dfa2dda342.tar.gz linux-3.10-aec9f377e4f235c47e27fd8a429555dfa2dda342.tar.bz2 linux-3.10-aec9f377e4f235c47e27fd8a429555dfa2dda342.zip | |
drivers/cdrom/cdrom.c: relax check on dvd manufacturer value
The report has an ISO which has a very long manufacturer ID. It seems
that Linux is wrong, not the ISO maker.
Relax the check for the length of this field: emit a warning and truncate
the incoming data to 2048 bytes rather than rejecting the entire thing.
dvd_manufact.value isn't null-terminated. I'm not even sure if it's a
string. The kernel doesn't apepar to use it anyway.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=39062
Reported-by: <ale.goujon@gmail.com>
Tested-by: <ale.goujon@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Diffstat (limited to 'drivers/cdrom')
| -rw-r--r-- | drivers/cdrom/cdrom.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 75fb965b8f7..f997c27d79e 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info *cdi, dvd_struct *s, goto out; s->manufact.len = buf[0] << 8 | buf[1]; - if (s->manufact.len < 0 || s->manufact.len > 2048) { + if (s->manufact.len < 0) { cdinfo(CD_WARNING, "Received invalid manufacture info length" " (%d)\n", s->manufact.len); ret = -EIO; } else { + if (s->manufact.len > 2048) { + cdinfo(CD_WARNING, "Received invalid manufacture info " + "length (%d): truncating to 2048\n", + s->manufact.len); + s->manufact.len = 2048; + } memcpy(s->manufact.value, &buf[4], s->manufact.len); } |