Re: kern/47646: Test dev/scsipi/t_cd:noisyeject broken

[Martin Husemann <martin%duskware.de@localhost>]

The following reply was made to PR kern/47646; it has been noted by GNATS.

From: Martin Husemann <martin%duskware.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: Antti Kantee <pooka%NetBSD.org@localhost>, Manuel Bouyer 
<bouyer%NetBSD.org@localhost>
Subject: Re: kern/47646: Test dev/scsipi/t_cd:noisyeject broken
Date: Fri, 15 Mar 2013 12:08:53 +0100

 --pf9I7BMVVzbSWLtt
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 
 Is there some easy way (easier than allocating a temporary buf) to get
 the residual here? If so we should test that and make sure we got enough
 of an answer to be meaningfull.
 
 I propose the attached patch to fix this the issue in two, unrelated ways.
 
 Martin
 
 
 --pf9I7BMVVzbSWLtt
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: attachment; filename=patch
 
 Index: cd.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/scsipi/cd.c,v
 retrieving revision 1.309
 diff -u -r1.309 cd.c
 --- cd.c       6 May 2012 17:23:10 -0000       1.309
 +++ cd.c       15 Mar 2013 11:03:17 -0000
 @@ -3033,6 +3033,7 @@
                gc_cmd.opcode = GET_CONFIGURATION;
                _lto2b(last_feature, gc_cmd.start_at_feature);
                _lto2b(feat_tbl_len, gc_cmd.data_len);
 +              memset(gc, 0, feat_tbl_len);
  
                error = scsipi_command(periph,
                        (void *)&gc_cmd, sizeof(gc_cmd),
 @@ -3044,7 +3045,7 @@
                }
  
                features_len = _4btol(gc->data_len);
 -              if (features_len < 4)
 +              if (features_len < 4 || features_len > feat_tbl_len)
                        break;
  
                pos  = 0;
 
 --pf9I7BMVVzbSWLtt--