From c1df7b7181ae16b4ec44a0b1e1bdf67f5a06f17e Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Fri, 18 Aug 2006 21:42:43 +0200 Subject: [PATCH] cdrom: fix bad cgc.buflen assignment (CVE-2006-2935) The code really means to mask off the high bits, not assign 0xff. Reported by Marcus Meissner . Signed-off-by: Jens Axboe Signed-off-by: Adrian Bunk --- drivers/cdrom/cdrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 879bbc26ce9..e866df084a5 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -1837,7 +1837,7 @@ static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s) init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ); cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE; cgc.cmd[7] = s->type; - cgc.cmd[9] = cgc.buflen = 0xff; + cgc.cmd[9] = cgc.buflen & 0xff; if ((ret = cdo->generic_packet(cdi, &cgc))) return ret; -- 2.11.4.GIT