From: Jens Axboe <axboe@suse.de>
Date: Fri, 18 Aug 2006 19:42:43 +0000 (+0200)
Subject: cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)
X-Git-Tag: v2.6.16.28-rc2~2
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=c1df7b7181ae16b4ec44a0b1e1bdf67f5a06f17e;p=karo-tx-linux.git

cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)

The code really means to mask off the high bits, not assign 0xff.

Reported by Marcus Meissner <meissner@suse.de>.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
---

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 879bbc26ce96..e866df084a56 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1837,7 +1837,7 @@ static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s)
 	init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
 	cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
 	cgc.cmd[7] = s->type;
-	cgc.cmd[9] = cgc.buflen = 0xff;
+	cgc.cmd[9] = cgc.buflen & 0xff;
 
 	if ((ret = cdo->generic_packet(cdi, &cgc)))
 		return ret;