|
@@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info *cdi, dvd_struct *s,
|
|
goto out;
|
|
goto out;
|
|
|
|
|
|
s->manufact.len = buf[0] << 8 | buf[1];
|
|
s->manufact.len = buf[0] << 8 | buf[1];
|
|
- if (s->manufact.len < 0 || s->manufact.len > 2048) {
|
|
|
|
|
|
+ if (s->manufact.len < 0) {
|
|
cdinfo(CD_WARNING, "Received invalid manufacture info length"
|
|
cdinfo(CD_WARNING, "Received invalid manufacture info length"
|
|
" (%d)\n", s->manufact.len);
|
|
" (%d)\n", s->manufact.len);
|
|
ret = -EIO;
|
|
ret = -EIO;
|
|
} else {
|
|
} else {
|
|
|
|
+ if (s->manufact.len > 2048) {
|
|
|
|
+ cdinfo(CD_WARNING, "Received invalid manufacture info "
|
|
|
|
+ "length (%d): truncating to 2048\n",
|
|
|
|
+ s->manufact.len);
|
|
|
|
+ s->manufact.len = 2048;
|
|
|
|
+ }
|
|
memcpy(s->manufact.value, &buf[4], s->manufact.len);
|
|
memcpy(s->manufact.value, &buf[4], s->manufact.len);
|
|
}
|
|
}
|
|
|
|
|