Macintosh-HW/RASCSI
1
0
Fork 0
mirror of https://github.com/akuker/RASCSI.git synced 2025-01-03 01:33:14 +00:00
Code Issues Projects Releases Wiki Activity

Daynaport: Fixed potential buffer overflow and removed INQUIRY excess bytes (#123)

Browse Source 
* Fixed potential buffer overflow and removed INQUIRY excess bytes

* Daynaport: Report an error for LUNs > 0
This commit is contained in:
uweseimet 2021-07-16 02:52:01 +02:00 committed by GitHub
parent f3978e6bd2
commit 6136b29515
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/raspberrypi/devices/scsi_daynaport.cpp
View File

@ -117,10 +117,8 @@ BOOL FASTCALL SCSIDaynaPort::Open(const Filepath& path, BOOL attn)
// INQUIRY
//
//---------------------------------------------------------------------------
int FASTCALL SCSIDaynaPort::Inquiry(
const DWORD *cdb, BYTE *buffer, DWORD major, DWORD minor)
int FASTCALL SCSIDaynaPort::Inquiry(const DWORD *cdb, BYTE *buffer, DWORD major, DWORD minor)
{
DWORD allocation_length;
// scsi_cdb_6_byte_t command;
// memcpy(&command,cdb,sizeof(command));
@ -129,7 +127,7 @@ int FASTCALL SCSIDaynaPort::Inquiry(
ASSERT(cdb[0] == 0x12);
//allocation_length = command->length;
allocation_length = cdb[4] + (((DWORD)cdb[3]) << 8);
DWORD allocation_length = cdb[4] + (((DWORD)cdb[3]) << 8);
// if(allocation_length != command.length){
// LOGDEBUG("%s CDB: %02X %02X %02X %02X %02X %02X", __PRETTY_FUNCTION__, (unsigned int)cdb[0], (unsigned int)cdb[1], (unsigned int)cdb[2], (unsigned int)cdb[3], (unsigned int)cdb[4], (unsigned int)cdb[5] );
// LOGWARN(":::::::::: Expected allocation length %04X but found %04X", (unsigned int)allocation_length, (unsigned int)command.length);
@ -138,20 +136,25 @@ int FASTCALL SCSIDaynaPort::Inquiry(
LOGTRACE("%s Inquiry with major %ld, minor %ld. Allocation length: %d",__PRETTY_FUNCTION__, major, minor, (int)allocation_length);
if(cdb[1] & 0x3) {
LOGWARN("Tiny SCSI Emulator says this is an invalid request");
// Work-around in order to report an error for LUNs > 0
DWORD lun = (cdb[1] >> 5) & 0x07;
if (lun) {
disk.code = DISK_INVALIDLUN;
return -1;
}
if(cdb[1] & 0x1) {
LOGERROR("EVPD bit is not supported");
return -1;
}
if (allocation_length > 4){
// Copy the pre-canned response
memcpy(buffer, m_target_ethernet_inquiry_response, allocation_length);
// Set the size
//buffer[4] = (BYTE)((allocation_length - 7) & 0xFF);
// The inquiry response format only allows for a 1 byte 'additional size' field
if(allocation_length > 0xFF){
LOGWARN("%s The inquiry format only allows for a maximum of %d (0xFF + 4) bytes",\
__PRETTY_FUNCTION__, (int)0xFF + 4)
if (allocation_length > sizeof(m_daynaport_inquiry_response)) {
allocation_length = sizeof(m_daynaport_inquiry_response);
}
// Copy the pre-canned response
memcpy(buffer, m_daynaport_inquiry_response, allocation_length);
}
LOGTRACE("response size is %d", (int)allocation_length);

24
src/raspberrypi/devices/scsi_daynaport.h
View File

@ -153,40 +153,24 @@ private:
// Basic data
// buf[0] ... CD-ROM Device
// buf[1] ... Removable
// buf[0] ... Processor Device
// buf[1] ... Not removable
// buf[2] ... SCSI-2 compliant command system
// buf[3] ... SCSI-2 compliant Inquiry response
// buf[4] ... Inquiry additional data
//http://www.bitsavers.org/pdf/apple/scsi/dayna/daynaPORT/pocket_scsiLINK/pocketscsilink_inq.png
const uint8_t m_target_ethernet_inquiry_response[255] = {
const uint8_t m_daynaport_inquiry_response[44] = {
0x03, 0x00, 0x01, 0x00, // 4 bytes
0x1E, 0x00, 0x00, 0x00, // 4 bytes
// Vendor ID (8 Bytes)
'D','a','y','n','a',' ',' ',' ',
//'D','A','Y','N','A','T','R','N',
// Product ID (16 Bytes)
'S','C','S','I','/','L','i','n',
'k',' ',' ',' ',' ',' ',' ',' ',
// Revision Number (4 Bytes)
'1','.','4','a',
// Firmware Version (8 Bytes)
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
// Data
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x80,0x80,0xBA, //16 bytes
0x00,0x00,0xC0,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x81, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00, //16 bytes
0x00,0x00,0x00 //3 bytes
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};