cdrom_id: Don't read beyond "last track" in TOC

[elogind.git] / extras / cdrom_id / cdrom_id.c

diff --git a/extras/cdrom_id/cdrom_id.c b/extras/cdrom_id/cdrom_id.c
index f65f04f9dc1870e86f52111adfe916b548e9b33f..1b43fe43ae8decf378d7969a96bac5c470f61172 100644 (file)
--- a/extras/cdrom_id/cdrom_id.c
+++ b/extras/cdrom_id/cdrom_id.c
@@ -350,34 +350,6 @@ static int feature_profiles(struct udev *udev, const unsigned char *profiles, si
        return 0;
 }
 
-static int cd_profiles_broken_mmc(struct udev *udev, int fd)
-{
-       struct scsi_cmd sc;
-       unsigned char buffer[16 * 2048];
-       int err;
-
-       /* we land here if both the standard and the old MMC commands failed;
-        * this might happen on broken wanna-be-CD USB drives like the IronKey.
-        * As a last resort, try to read data to see whether it has a medium.
-        */
-       scsi_cmd_init(udev, &sc, buffer, sizeof(buffer));
-       scsi_cmd_set(udev, &sc, 0, 0x28);
-       scsi_cmd_set(udev, &sc, 5, 0);
-       scsi_cmd_set(udev, &sc, 8, 16);
-       scsi_cmd_set(udev, &sc, 9, 0);
-       err = scsi_cmd_run(udev, &sc, fd, buffer, sizeof(buffer));
-       if ((err != 0)) {
-           info(udev, "READ DATA failed, assuming no medium\n");
-           return -1;
-       }
-
-       /* that's all we can claim if we can read data */
-       info(udev, "READ DATA succeeded, assuming CD-ROM medium\n");
-       cd_media = 1;
-       cd_media_cd_rom = 1;
-       return 0;
-}
-
 static int cd_profiles_old_mmc(struct udev *udev, int fd)
 {
        struct scsi_cmd sc;
@@ -392,8 +364,14 @@ static int cd_profiles_old_mmc(struct udev *udev, int fd)
        err = scsi_cmd_run(udev, &sc, fd, header, sizeof(header));
        if ((err != 0)) {
                info_scsi_cmd_err(udev, "READ DISC INFORMATION", err);
-               info(udev, "no current profile, probing readability of medium\n");
-               return cd_profiles_broken_mmc(udev, fd);
+               if (cd_media == 1) {
+                       info(udev, "no current profile, but disc is present; assuming CD-ROM\n");
+                       cd_media_cd_rom = 1;
+                       return 0;
+               } else {
+                       info(udev, "no current profile, assuming no media\n");
+                       return -1;
+               }
        };
 
        cd_media = 1;
@@ -734,7 +712,7 @@ static int cd_media_toc(struct udev *udev, int fd)
        struct scsi_cmd sc;
        unsigned char header[12];
        unsigned char toc[2048];
-       unsigned int len, i;
+       unsigned int len, i, num_tracks;
        unsigned char *p;
        int err;
 
@@ -750,11 +728,13 @@ static int cd_media_toc(struct udev *udev, int fd)
        }
 
        len = (header[0] << 8 | header[1]) + 2;
-       info(udev, "READ TOC: len: %d\n", len);
+       info(udev, "READ TOC: len: %d, start track: %d, end track: %d\n", len, header[2], header[3]);
        if (len > sizeof(toc))
                return -1;
        if (len < 2)
                return -1;
+       /* 2: first track, 3: last track */
+       num_tracks = header[3] - header[2] + 1;
 
        /* empty media has no tracks */
        if (len < 8)
@@ -772,7 +752,10 @@ static int cd_media_toc(struct udev *udev, int fd)
                return -1;
        }
 
-       for (p = toc+4, i = 4; i < len-8; i += 8, p += 8) {
+       /* Take care to not iterate beyond the last valid track as specified in
+        * the TOC, but also avoid going beyond the TOC length, just in case
+        * the last track number is invalidly large */
+       for (p = toc+4, i = 4; i < len-8 && num_tracks > 0; i += 8, p += 8, --num_tracks) {
                unsigned int block;
                unsigned int is_data_track;