aaru-dps/Aaru.Server
1
0
Fork 0
mirror of https://github.com/aaru-dps/Aaru.Server.git synced 2025-12-16 19:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add several out of bounds and null protections against rogue MMC firmwares.

Browse Source
This commit is contained in:
Natalia Portillo
2018-06-19 21:35:23 +01:00
parent bdaece414e
commit 414262f574
3 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
DiscImageChef.Decoders/SCSI/Modes/Mode10.cs
View File

@@ -64,6 +64,8 @@ namespace DiscImageChef.Decoders.SCSI
header.BlockDescriptors = new BlockDescriptor[blockDescLength / 16];
for(int i = 0; i < header.BlockDescriptors.Length; i++)
{
if(12 + i * 16 + 8 >= modeResponse.Length) break;
header.BlockDescriptors[i] = new BlockDescriptor {Density = DensityType.Default};
byte[] temp = new byte[8];
temp[0] = modeResponse[7 + i * 16 + 8];
@@ -86,6 +88,8 @@ namespace DiscImageChef.Decoders.SCSI
header.BlockDescriptors = new BlockDescriptor[blockDescLength / 8];
for(int i = 0; i < header.BlockDescriptors.Length; i++)
{
if(7 + i * 8 + 8 >= modeResponse.Length) break;
header.BlockDescriptors[i] = new BlockDescriptor();
if(deviceType != PeripheralDeviceTypes.DirectAccess)
header.BlockDescriptors[i].Density = (DensityType)modeResponse[0 + i * 8 + 8];

2
DiscImageChef.Devices/Device/ScsiCommands/MMC.cs
View File

@@ -400,6 +400,8 @@ namespace DiscImageChef.Devices
Error = LastError != 0;
uint strctLength = (uint)((tmpBuffer[0] << 8) + tmpBuffer[1] + 2);
if(strctLength > tmpBuffer.Length) strctLength = (uint)tmpBuffer.Length;
buffer = new byte[strctLength];
Array.Copy(tmpBuffer, 0, buffer, 0, buffer.Length);

3
DiscImageChef/Commands/MediaInfo.cs
View File

@@ -228,10 +228,13 @@ namespace DiscImageChef.Commands
if(decMode.Value.Header.BlockDescriptors != null && decMode.Value.Header.BlockDescriptors.Length >= 1)
scsiDensityCode = (byte)decMode.Value.Header.BlockDescriptors[0].Density;
if(decMode.Value.Pages != null)
{
containsFloppyPage =
decMode.Value.Pages.Aggregate(containsFloppyPage,
(current, modePage) => current | (modePage.Page == 0x05));
}
}
switch(dev.ScsiType)
{