Hi!

I have a no-name USB multi-card reader, and found a string-overflow in hddtemp 0.3-beta15.
                                                                                           
  # hddtemp /dev/sdi
  /dev/sdi: Generic STORAGE DEVICE-A9727::::<@: S.M.A.R.T. not available
                                    ^^^^^^^^^^ overflow!!

(lsusb identifies the device as "ID 05e3:0716 Genesys Logic, Inc.")

When a device reports a full 16-byte Product ID, the string won't get zero-terminated.


A hex dump of the INQUIRY packet shows the following:

  dumping 36 bytes from 0x7fffd9847e50
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F    0123456789ABCDEF
  0000:  00-80 00-00 29-00 00-00 47-65 6E-65 72-69 63-20   ....)...Generic
  0010:  53-54 4F-52 41-47 45-20 44-45 56-49 43-45 2D-41   STORAGE DEVICE-A
  0020:  39-37 32-37   -     -     -     -     -     -     9727

According to SPC-2, the vendor is "Generic ", product "STORAGE DEVICE-A" and the revision level is "9727".


  I've uploaded a patch that moves scsi_fixstring() into scsi_model (where it belongs), and truncates the model string to 24 bytes (Vendor + Product ID).

greetings,
--
Thomas Kindler <mail+hddtemp@t-kindler.de>