bugHddtemp - Bugs: bug #25673, String-overflow with long product...

 
 

bug #25673: String-overflow with long product identifiers

Submitted by:  None
Submitted on:  Sun 22 Feb 2009 11:27:46 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 22 Feb 2009 11:27:46 PM UTC, original submission:

Hi!

I have a no-name USB multi-card reader, and found a string-overflow in hddtemp 0.3-beta15.

# hddtemp /dev/sdi
/dev/sdi: Generic STORAGE DEVICE-A9727::::<@: S.M.A.R.T. not available
^^^^^^^^^^ overflow!!

(lsusb identifies the device as "ID 05e3:0716 Genesys Logic, Inc.")

When a device reports a full 16-byte Product ID, the string won't get zero-terminated.

A hex dump of the INQUIRY packet shows the following:

dumping 36 bytes from 0x7fffd9847e50
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0000: 00-80 00-00 29-00 00-00 47-65 6E-65 72-69 63-20 ....)...Generic
0010: 53-54 4F-52 41-47 45-20 44-45 56-49 43-45 2D-41 STORAGE DEVICE-A
0020: 39-37 32-37 - - - - - - 9727

According to SPC-2, the vendor is "Generic ", product "STORAGE DEVICE-A" and the revision level is "9727".

I've uploaded a patch that moves scsi_fixstring() into scsi_model (where it belongs), and truncates the model string to 24 bytes (Vendor + Product ID).

greetings,
--
Thomas Kindler <mail+hddtemp@t-kindler.de>

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #17503:  long_product_id.patch added by None (2KiB - application/octet-stream - aah, sorry. here's the patch alone..)
file #17502:  hddtemp.txt added by None (3KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 22 Feb 2009 11:29:20 PM UTCNoneAttached File-=>Added long_product_id.patch, #17503
Sun 22 Feb 2009 11:27:46 PM UTCNoneAttached File-=>Added hddtemp.txt, #17502

Back to the top


Powered by Savane 3.1-cleanup1