cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)

The code really means to mask off the high bits, not assign 0xff.

Reported by Marcus Meissner <meissner@suse.de>.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 879bbc26ce96241aa4622234db66f627d95c486a..e866df084a56754d577b35c706cec7795e99e0d4 100644 (file)
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1837,7 +1837,7 @@ static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s)
        init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
        cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
        cgc.cmd[7] = s->type;
-       cgc.cmd[9] = cgc.buflen = 0xff;
+       cgc.cmd[9] = cgc.buflen & 0xff;
 
        if ((ret = cdo->generic_packet(cdi, &cgc)))
                return ret;