bugHddtemp - Bugs: bug #25673, String-overflow with long product...

 
 

bug #25673: String-overflow with long product identifiers

Submitter:  None
Submitted:  Sun 22 Feb 2009 11:27:46 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 22 Feb 2009 11:27:46 PM UTC, original submission:  

Hi!

I have a no-name USB multi-card reader, and found a string-overflow in hddtemp 0.3-beta15.
                                                                                           
  # hddtemp /dev/sdi
  /dev/sdi: Generic STORAGE DEVICE-A9727::::<@: S.M.A.R.T. not available
                                    ^^^^^^^^^^ overflow!!

(lsusb identifies the device as "ID 05e3:0716 Genesys Logic, Inc.")

When a device reports a full 16-byte Product ID, the string won't get zero-terminated.


A hex dump of the INQUIRY packet shows the following:

  dumping 36 bytes from 0x7fffd9847e50
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F    0123456789ABCDEF
  0000:  00-80 00-00 29-00 00-00 47-65 6E-65 72-69 63-20   ....)...Generic
  0010:  53-54 4F-52 41-47 45-20 44-45 56-49 43-45 2D-41   STORAGE DEVICE-A
  0020:  39-37 32-37   -     -     -     -     -     -     9727

According to SPC-2, the vendor is "Generic ", product "STORAGE DEVICE-A" and the revision level is "9727".


  I've uploaded a patch that moves scsi_fixstring() into scsi_model (where it belongs), and truncates the model string to 24 bytes (Vendor + Product ID).

greetings,
--
Thomas Kindler <mail+hddtemp@t-kindler.de>

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #17503:  long_product_id.patch added by None (2KiB - application/octet-stream - aah, sorry. here's the patch alone..)
file #17502:  hddtemp.txt added by None (3KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2009-02-22 None Attached File- Added long_product_id.patch, #17503
2009-02-22 None Attached File- Added hddtemp.txt, #17502

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code