Sun 22 Feb 2009 11:27:46 PM UTC, original submission:
Hi!
I have a no-name USB multi-card reader, and found a string-overflow in hddtemp 0.3-beta15.
# hddtemp /dev/sdi
/dev/sdi: Generic STORAGE DEVICE-A9727::::<@: S.M.A.R.T. not available
^^^^^^^^^^ overflow!!
(lsusb identifies the device as "ID 05e3:0716 Genesys Logic, Inc.")
When a device reports a full 16-byte Product ID, the string won't get zero-terminated.
A hex dump of the INQUIRY packet shows the following:
dumping 36 bytes from 0x7fffd9847e50
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0000: 00-80 00-00 29-00 00-00 47-65 6E-65 72-69 63-20 ....)...Generic
0010: 53-54 4F-52 41-47 45-20 44-45 56-49 43-45 2D-41 STORAGE DEVICE-A
0020: 39-37 32-37 - - - - - - 9727
According to SPC-2, the vendor is "Generic ", product "STORAGE DEVICE-A" and the revision level is "9727".
I've uploaded a patch that moves scsi_fixstring() into scsi_model (where it belongs), and truncates the model string to 24 bytes (Vendor + Product ID).
greetings,
--
Thomas Kindler <mail+hddtemp@t-kindler.de>
|