[spice-gtk,v2,11/33] fixup! usb-redir: add files for SCSI and USB MSC implementation

Submitted by Frediano Ziglio on Aug. 9, 2019, 2:26 p.m.

Details

Message ID 20190809142651.2967-12-fziglio@redhat.com
State Superseded
Headers show
Series "CD emulation follow ups" ( rev: 1 ) in Spice

Not browsing as part of any series.

Commit Message

Frediano Ziglio Aug. 9, 2019, 2:26 p.m.
Filter cmd_len bits, specifications state it's a 5 bit field

Although higher bits of the byte are reserved and should be zero
filter them out.
Also accept 16 as length.
---
 src/cd-usb-bulk-msd.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Patch hide | download patch | download mbox

diff --git a/src/cd-usb-bulk-msd.c b/src/cd-usb-bulk-msd.c
index cb0ad91c..49e01eb6 100644
--- a/src/cd-usb-bulk-msd.c
+++ b/src/cd-usb-bulk-msd.c
@@ -271,8 +271,9 @@  static int parse_usb_msd_cmd(UsbCdBulkMsdDevice *cd, uint8_t *buf, uint32_t cbw_
         SPICE_ERROR("CMD: Bad CBW signature:%08x", le32toh(cbw->sig));
         return -1;
     }
-    if (cbw->cmd_len < 1 || cbw->cmd_len >= 16) {
-        SPICE_ERROR("CMD: Bad CBW command len:%08x", cbw->cmd_len);
+    const uint8_t cmd_len = cbw->cmd_len & 0x1F;
+    if (cmd_len < 1 || cmd_len > 16) {
+        SPICE_ERROR("CMD: Bad CBW command len:%08x", cmd_len);
         return -1;
     }
 
@@ -297,7 +298,7 @@  static int parse_usb_msd_cmd(UsbCdBulkMsdDevice *cd, uint8_t *buf, uint32_t cbw_
         scsi_req->buf_len = 0;
     }
 
-    scsi_req->cdb_len = cbw->cmd_len;
+    scsi_req->cdb_len = cmd_len;
     g_assert(scsi_req->cdb_len <= sizeof(scsi_req->cdb));
     memcpy(scsi_req->cdb, cbw->cmd, scsi_req->cdb_len);