aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorStefan Hajnoczi <stefanha@redhat.com>2013-04-05 11:51:01 +0200
committerStefan Hajnoczi <stefanha@redhat.com>2013-04-15 10:18:05 +0200
commitaad64f3193cbdc3741d10afa0237b6833e46e94e (patch)
treefe368dda3f0c10160dc5c833c906dfa1b3bf9545 /hw
parentc09b437b5fab487edd924e09d1732062d7dcf093 (diff)
ide: refuse WIN_READ_NATIVE_MAX on empty device
What is the highest addressable sector on an empty CD-ROM? Nothing is addressable so produce an error. This patch prevents a divide-by-zero in ide_set_sector() since s->sectors and s->heads would be 0. Not to mention that a sector=-1 argument would be nonsense. Note that WIN_READ_NATIVE_MAX can be triggered using hdparm -N 1024 /dev/cdrom. The LBA bit will be set to 1 though, so the only easy way to go down the ide_set_sector() CHS code path which divides by zero is to comment out the s->select & 0x40 case for testing. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/ide/core.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 87d67b7bcb..c7a80413be 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1262,6 +1262,10 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
lba48 = 1;
/* fall through */
case WIN_READ_NATIVE_MAX:
+ /* Refuse if no sectors are addressable (e.g. medium not inserted) */
+ if (s->nb_sectors == 0) {
+ goto abort_cmd;
+ }
ide_cmd_lba48_transform(s, lba48);
ide_set_sector(s, s->nb_sectors - 1);
s->status = READY_STAT | SEEK_STAT;