scsi_id: prevent buffer overflow in check_fill_0x83_prespc3()

[elogind.git] / extras / scsi_id / scsi_serial.c

diff --git a/extras/scsi_id/scsi_serial.c b/extras/scsi_id/scsi_serial.c
index cbacf379fee8cff055b9d44d01792837eb222159..ab0ffd62aaa963c28dd542a3ee0e3b81d22f4f51 100644 (file)
--- a/extras/scsi_id/scsi_serial.c
+++ b/extras/scsi_id/scsi_serial.c
@@ -23,14 +23,15 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <syslog.h>
+#include <time.h>
 #include <inttypes.h>
 #include <scsi/scsi.h>
 #include <scsi/sg.h>
 #include <linux/types.h>
-/* #include <linux/bsg.h> */
-#include "bsg.h"
+#include <linux/bsg.h>
 
-#include "../../udev/udev.h"
+#include "libudev.h"
+#include "libudev-private.h"
 #include "scsi.h"
 #include "scsi_id.h"
 
@@ -168,7 +169,6 @@ static int scsi_dump_sense(struct udev *udev,
        int code;
        int sense_class;
        int sense_key;
-       int descriptor_format;
        int asc, ascq;
 #ifdef DUMP_SENSE
        char out_buffer[256];
@@ -208,7 +208,6 @@ static int scsi_dump_sense(struct udev *udev,
                        return -1;
                }
                if ((code == 0x0) || (code == 0x1)) {
-                       descriptor_format = 0;
                        sense_key = sense_buffer[2] & 0xf;
                        if (s < 14) {
                                /*
@@ -221,7 +220,6 @@ static int scsi_dump_sense(struct udev *udev,
                        asc = sense_buffer[12];
                        ascq = sense_buffer[13];
                } else if ((code == 0x2) || (code == 0x3)) {
-                       descriptor_format = 1;
                        sense_key = sense_buffer[1] & 0xf;
                        asc = sense_buffer[2];
                        ascq = sense_buffer[3];
@@ -456,11 +454,8 @@ static int prepend_vendor_model(struct udev *udev,
        int ind;
 
        strncpy(serial, dev_scsi->vendor, VENDOR_LENGTH);
-       ind = strlen(serial) - 1;
-
        strncat(serial, dev_scsi->model, MODEL_LENGTH);
-       ind = strlen(serial) - 1;
-       ind++;
+       ind = strlen(serial);
 
        /*
         * This is not a complete check, since we are using strncat/cpy
@@ -469,7 +464,7 @@ static int prepend_vendor_model(struct udev *udev,
        if (ind != (VENDOR_LENGTH + MODEL_LENGTH)) {
                info(udev, "%s: expected length %d, got length %d\n",
                     dev_scsi->kernel, (VENDOR_LENGTH + MODEL_LENGTH), ind);
-               return 1;
+               return -1;
        }
        return ind;
 }
@@ -583,11 +578,12 @@ static int check_fill_0x83_prespc3(struct udev *udev,
        /* serial has been memset to zero before */
        j = strlen(serial);     /* j = 1; */
 
-       for (i = 0; i < page_83[3]; ++i) {
+       for (i = 0; (i < page_83[3]) && (j < max_len-3); ++i) {
                serial[j++] = hex_str[(page_83[4+i] & 0xf0) >> 4];
                serial[j++] = hex_str[ page_83[4+i] & 0x0f];
        }
-       strcpy(serial_short, serial);
+       serial[max_len-1] = 0;
+       strncpy(serial_short, serial, max_len-1);
        return 0;
 }
 
@@ -614,7 +610,7 @@ static int do_scsi_page83_inquiry(struct udev *udev,
        
        /*
         * XXX Some devices (IBM 3542) return all spaces for an identifier if
-        * the LUN is not actually configured. This leads to identifers of
+        * the LUN is not actually configured. This leads to identifiers of
         * the form: "1            ".
         */
 
@@ -772,7 +768,7 @@ static int do_scsi_page80_inquiry(struct udev *udev,
        len = 1 + VENDOR_LENGTH + MODEL_LENGTH + buf[3];
        if (max_len < len) {
                info(udev, "%s: length %d too short - need %d\n",
-                   dev_scsi->kernel, max_len, len);
+                    dev_scsi->kernel, max_len, len);
                return 1;
        }
        /*
@@ -848,13 +844,15 @@ int scsi_get_serial(struct udev *udev,
        memset(dev_scsi->serial, 0, len);
        dbg(udev, "opening %s\n", devname);
        while (--cnt) {
+               const struct timespec duration = { 0, 500 * 1000 * 1000 };
+
                fd = open(devname, O_RDONLY | O_NONBLOCK);
                if (fd >= 0)
                        break;
                info(udev, "%s: cannot open %s: %s\n", dev_scsi->kernel, devname, strerror(errno));
                if (errno != EBUSY)
                        break;
-               usleep(500000 + (rand() % 100000) );
+               nanosleep(&duration, NULL);
        }
        if (fd < 0)
                return 1;