mirror of
https://github.com/akuker/RASCSI.git
synced 2026-10-25 12:02:59 +00:00
Daniel Markstedt
fec28e6795
READ TOC receives its allocation length from the initiator’s CDB and accepts values up to 65535 bytes. The controller’s transfer buffer is normally only 4096 bytes, so using that value directly could overrun the buffer and report more data than can be transferred. Clamp the response length to the available buffer size and clear only that bounded range before constructing the response. Also bound the start-track scan before dereferencing the track vector, allowing a lead-out (0xAA) request to safely produce its descriptor when no matching track exists. Add regression tests for the maximum allocation length and for READ TOC lead-out handling.