Skip to content

Commit

Permalink
ATAPI: Ensure transfer count is an even number
Browse files Browse the repository at this point in the history
Since we are transferring words we need to ensure that byte_count is an even number
This fixes a bug whereby atapi_packet would overrun the buffer when doing a mode_sense in WinUAE
  • Loading branch information
LIV2 committed Aug 14, 2023
1 parent ca74b26 commit cf1085a
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions atapi.c
Original file line number Diff line number Diff line change
Expand Up @@ -252,8 +252,8 @@ BYTE atapi_translate(APTR io_Data, ULONG lba, ULONG count, ULONG *io_Actual, str
*/
BYTE atapi_packet(struct SCSICmd *cmd, struct IDEUnit *unit) {
Trace("atapi_packet\n");
ULONG byte_count;
ULONG remaining;
LONG byte_count;
LONG remaining;
UWORD data;
UBYTE senseKey;
UBYTE operation = ((struct SCSI_CDB_10 *)cmd->scsi_Command)->operation;
Expand Down Expand Up @@ -347,7 +347,8 @@ BYTE atapi_packet(struct SCSICmd *cmd, struct IDEUnit *unit) {
if ((*unit->drive->sectorCount & 0x01) != 0x00) break; // CoD doesn't indicate further data transfer

byte_count = *unit->drive->lbaHigh << 8 | *unit->drive->lbaMid;

byte_count += (byte_count & 0x01); // Ensure that the byte count is always an even number

while (byte_count > 0) {
remaining = cmd->scsi_Length - cmd->scsi_Actual;

Expand Down Expand Up @@ -607,7 +608,7 @@ BYTE atapi_mode_sense(struct IDEUnit *unit, BYTE page_code, UWORD *buffer, UWORD
cdb[7] = length >> 8;
cdb[8] = length & 0xFF;

cmd->scsi_CmdLength = 12;
cmd->scsi_CmdLength = sizeof(struct SCSI_CDB_10);
cmd->scsi_CmdActual = 0;
cmd->scsi_Command = (UBYTE *)cdb;
cmd->scsi_Flags = SCSIF_READ;
Expand Down

0 comments on commit cf1085a

Please sign in to comment.