Changeset 20287 in vbox

Timestamp:

Jun 4, 2009 2:19:57 PM (16 years ago)

Author:

vboxsync

Message:

Fixed buffer overflow for non-DMA floppy transfers.

File:

• trunk/src/VBox/Devices/Storage/fdc.c (modified) (3 diffs)

trunk/src/VBox/Devices/Storage/fdc.c

@@ -1597 +1597 @@
     fdrive_t *cur_drv;
     uint32_t retval = 0;
-    int pos, len;
+    unsigned pos, len;
 #ifdef VBOX
     int rc;
@@ -1619 +1619 @@
                 = cur_drv->Led.Actual.s.fReading = 1;
 
+            Assert(len <= sizeof(fdctrl->fifo));
             rc = cur_drv->pDrvBlock->pfnRead (
                 cur_drv->pDrvBlock,
                 fd_sector (cur_drv) * 512,
                 fdctrl->fifo,
-                len * 512
+                len
                 );
 
@@ -1782 +1783 @@
                 fd_sector (cur_drv) * 512,
                 fdctrl->fifo,
-                FD_SECTOR_LEN * 512
+                FD_SECTOR_LEN
                 );