drivers/cdrom/cdrom.c: relax check on dvd manufacturer value (aec9f377) · Commits · 戴 / test

The report has an ISO which has a very long manufacturer ID. It seems that Linux is wrong, not the ISO maker. Relax the check for the length of this field: emit a warning and truncate the incoming data to 2048 bytes rather than rejecting the entire thing. dvd_manufact.value isn't null-terminated. I'm not even sure if it's a string. The kernel doesn't apepar to use it anyway. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=39062 Reported-by:

<ale.goujon@gmail.com> Tested-by:

<ale.goujon@gmail.com> Cc: Jens Axboe <axboe@kernel.dk> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Jens Axboe <jaxboe@fusionio.com>

drivers/cdrom/cdrom.c

+7 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info cdi, dvd_struct s,
	goto out;		goto out;

	s->manufact.len = buf[0] << 8 \| buf[1];		s->manufact.len = buf[0] << 8 \| buf[1];
	if (s->manufact.len < 0 \|\| s->manufact.len > 2048) {		if (s->manufact.len < 0) {
	cdinfo(CD_WARNING, "Received invalid manufacture info length"		cdinfo(CD_WARNING, "Received invalid manufacture info length"
	" (%d)\n", s->manufact.len);		" (%d)\n", s->manufact.len);
	ret = -EIO;		ret = -EIO;
	} else {		} else {
			if (s->manufact.len > 2048) {
			cdinfo(CD_WARNING, "Received invalid manufacture info "
			"length (%d): truncating to 2048\n",
			s->manufact.len);
			s->manufact.len = 2048;
			}
	memcpy(s->manufact.value, &buf[4], s->manufact.len);		memcpy(s->manufact.value, &buf[4], s->manufact.len);
	}		}

Admin message