Changeset 46819 in vbox

Timestamp:

Jun 27, 2013 7:52:59 AM (12 years ago)

Author:

vboxsync

Message:

Storage/AHCI: Fix crash when guest uses READ(10) with a 2352 byte sector size

File:

• trunk/src/VBox/Devices/Storage/DevAHCI.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Storage/DevAHCI.cpp

@@ -4080 +4080 @@
     uint8_t *pbBufDst;
     uint8_t *pbBufSrc  = (uint8_t *)pAhciReq->u.Io.DataSeg.pvSeg;
-
-    pbBuf = (uint8_t *)RTMemAlloc(pAhciReq->cbTransfer);
+    size_t cbAlloc = pAhciReq->cbTransfer + cSectors * (1 + 11 + 3 + 1 + 288); /* Per sector data like ECC. */
+
+    pbBuf = (uint8_t *)RTMemAlloc(cbAlloc);
     if (RT_UNLIKELY(!pbBuf))
         return VERR_NO_MEMORY;
@@ -4107 +4108 @@
 
     *ppvProc = pbBuf;
-    *pcbProc = pAhciReq->cbTransfer;
+    *pcbProc = cbAlloc;
 
     return VINF_SUCCESS;
@@ -5360 +5361 @@
             if (RT_SUCCESS(rc))
             {
-                ahciCopyToPrdtl(pDevIns, pAhciReq, pv, cb);
+                pAhciReq->cbTransfer = ahciCopyToPrdtl(pDevIns, pAhciReq, pv, cb);
                 RTMemFree(pv);
             }