Changeset 75772 in vbox for trunk/src/VBox/Devices/Storage

Timestamp:

Nov 27, 2018 1:13:16 PM (6 years ago)

Author:

vboxsync

Message:

DevATA: Don't assert when the guest tries to do an out of bounds read but return the proper error instead

File:

• trunk/src/VBox/Devices/Storage/DevATA.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Storage/DevATA.cpp

@@ -3345 +3345 @@
             iATAPILBA = scsiBE2H_U32(pbPacket + 2);
 
-            /* Check that the sector size is valid. */
-            VDREGIONDATAFORM enmDataForm = VDREGIONDATAFORM_INVALID;
-            int rc = s->pDrvMedia->pfnQueryRegionPropertiesForLba(s->pDrvMedia, iATAPILBA,
-                                                                  NULL, NULL, NULL, &enmDataForm);
-            AssertRC(rc);
-            if (   enmDataForm != VDREGIONDATAFORM_MODE1_2048
-                && enmDataForm != VDREGIONDATAFORM_MODE1_2352
-                && enmDataForm != VDREGIONDATAFORM_MODE2_2336
-                && enmDataForm != VDREGIONDATAFORM_MODE2_2352
-                && enmDataForm != VDREGIONDATAFORM_RAW)
-            {
-                uint8_t abATAPISense[ATAPI_SENSE_SIZE];
-                RT_ZERO(abATAPISense);
-
-                abATAPISense[0] = 0x70 | (1 << 7);
-                abATAPISense[2] = (SCSI_SENSE_ILLEGAL_REQUEST & 0x0f) | SCSI_SENSE_FLAG_ILI;
-                scsiH2BE_U32(&abATAPISense[3], iATAPILBA);
-                abATAPISense[7] = 10;
-                abATAPISense[12] = SCSI_ASC_ILLEGAL_MODE_FOR_THIS_TRACK;
-                atapiR3CmdError(s, &abATAPISense[0], sizeof(abATAPISense));
-                break;
-            }
-
             if (cSectors == 0)
             {
@@ -3373 +3350 @@
                 break;
             }
-            if ((uint64_t)iATAPILBA + cSectors > s->cTotalSectors)
+
+            /* Check that the sector size is valid. */
+            VDREGIONDATAFORM enmDataForm = VDREGIONDATAFORM_INVALID;
+            int rc = s->pDrvMedia->pfnQueryRegionPropertiesForLba(s->pDrvMedia, iATAPILBA,
+                                                                  NULL, NULL, NULL, &enmDataForm);
+            if (RT_UNLIKELY(   rc == VERR_NOT_FOUND
+                            || ((uint64_t)iATAPILBA + cSectors > s->cTotalSectors)))
             {
                 /* Rate limited logging, one log line per second. For
@@ -3386 +3369 @@
                 }
                 atapiR3CmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
+                break;
+            }
+            else if (   enmDataForm != VDREGIONDATAFORM_MODE1_2048
+                     && enmDataForm != VDREGIONDATAFORM_MODE1_2352
+                     && enmDataForm != VDREGIONDATAFORM_MODE2_2336
+                     && enmDataForm != VDREGIONDATAFORM_MODE2_2352
+                     && enmDataForm != VDREGIONDATAFORM_RAW)
+            {
+                uint8_t abATAPISense[ATAPI_SENSE_SIZE];
+                RT_ZERO(abATAPISense);
+
+                abATAPISense[0] = 0x70 | (1 << 7);
+                abATAPISense[2] = (SCSI_SENSE_ILLEGAL_REQUEST & 0x0f) | SCSI_SENSE_FLAG_ILI;
+                scsiH2BE_U32(&abATAPISense[3], iATAPILBA);
+                abATAPISense[7] = 10;
+                abATAPISense[12] = SCSI_ASC_ILLEGAL_MODE_FOR_THIS_TRACK;
+                atapiR3CmdError(s, &abATAPISense[0], sizeof(abATAPISense));
                 break;
             }