cdrkit-1.1.9-buffer_overflow.patch

   1 diff -ru origin-1.1.9/wodim/scsi_cdr.c master-1.1.9/wodim/scsi_cdr.c
   2 --- origin-1.1.9/wodim/scsi_cdr.c       2008-02-25 12:14:07.000000000 +0100
   3 +++ master-1.1.9/wodim/scsi_cdr.c       2009-07-16 12:01:29.000000000 +0200
   4 @@ -2181,26 +2181,30 @@
   5                 if (inq->add_len == 0) {
   6                         if (usalp->dev == DEV_UNKNOWN && got_inquiry) {
   7                                 usalp->dev = DEV_ACB5500;
   8 -                               strcpy(inq->vendor_info,
   9 -                                       "ADAPTEC ACB-5500        FAKE");
  10 +                               strncpy(inq->vendor_info, "ADAPTEC ", 8);
  11 +                               strncpy(inq->prod_ident,"ACB-5500        ", 16);
  12 +                               strncpy(inq->prod_revision, "FAKE", 4);
  13
  14                         } else switch (usalp->dev) {
  15 -
  16                                 case DEV_ACB40X0:
  17 -                                       strcpy(inq->vendor_info,
  18 -                                                       "ADAPTEC ACB-40X0        FAKE");
  19 +                                       strncpy(inq->vendor_info, "ADAPTEC ", 8);
  20 +                                       strncpy(inq->prod_ident, "ACB-40X0        ",16);
  21 +                                       strncpy(inq->prod_revision, "FAKE", 4);
  22                                         break;
  23                                 case DEV_ACB4000:
  24 -                                       strcpy(inq->vendor_info,
  25 -                                                       "ADAPTEC ACB-4000        FAKE");
  26 +                                       strncpy(inq->vendor_info, "ADAPTEC ",8);
  27 +                                       strncpy(inq->prod_ident, "ACB-4000        ",16);
  28 +                                       strncpy(inq->prod_revision, "FAKE",4);
  29                                         break;
  30                                 case DEV_ACB4010:
  31 -                                       strcpy(inq->vendor_info,
  32 -                                                       "ADAPTEC ACB-4010        FAKE");
  33 +                                       strncpy(inq->vendor_info, "ADAPTEC ",8);
  34 +                                       strncpy(inq->prod_ident, "ACB-4010        ",16);
  35 +                                       strncpy(inq->prod_revision, "FAKE",4);
  36                                         break;
  37                                 case DEV_ACB4070:
  38 -                                       strcpy(inq->vendor_info,
  39 -                                                       "ADAPTEC ACB-4070        FAKE");
  40 +                                       strncpy(inq->vendor_info,"ADAPTEC ",8);
  41 +                                       strncpy(inq->prod_ident, "ACB-4070        ", 16);
  42 +                                       strncpy(inq->prod_revision, "FAKE",4 );
  43                                         break;
  44                         }
  45                 } else if (inq->add_len < 31) {
  46 @@ -2230,14 +2234,16 @@
  47
  48         case INQ_SEQD:
  49                 if (usalp->dev == DEV_SC4000) {
  50 -                       strcpy(inq->vendor_info,
  51 -                               "SYSGEN  SC4000          FAKE");
  52 +                       strncpy(inq->vendor_info,"SYSGEN  ",8);
  53 +                       strncpy(inq->prod_ident, "SC4000          ",16);
  54 +                       strncpy(inq->prod_revision, "FAKE",4);
  55                 } else if (inq->add_len == 0 &&
  56                                         inq->removable &&
  57                                                 inq->ansi_version == 1) {
  58                         usalp->dev = DEV_MT02;
  59 -                       strcpy(inq->vendor_info,
  60 -                               "EMULEX  MT02            FAKE");
  61 +                       strncpy(inq->vendor_info,"EMULEX  ",8);
  62 +                       strncpy(inq->prod_ident, "MT02            ",16);
  63 +                       strncpy(inq->prod_revision, "FAKE",4);
  64                 }
  65                 break;
  66