kernel/ATA: Fix buffer overflow in ATADevice::read() with small sizes and unaligned offsets

This commit is contained in:
apio 2023-06-17 00:48:53 +02:00
parent 27b26f389c
commit c2cdb861c9
Signed by: apio
GPG Key ID: B8A7D06E42258954

View File

@ -750,12 +750,17 @@ Result<u64> ATADevice::read(u8* buf, usize offset, usize size) const
ScopedKMutexLock<100>(m_drive->channel()->lock());
// FIXME: Don't always allocate this if we don't need it.
auto* temp = TRY(make_array<u8>(block_size));
auto guard = make_scope_guard([temp] { delete[] temp; });
if (offset % block_size)
{
// The size we need to read to round up to a block.
usize extra_size = block_size - (offset % block_size);
// Maybe we don't even want enough to get to the next block?
if (extra_size > size) extra_size = size;
TRY(m_drive->read_lba(offset / block_size, temp, 1));
memcpy(buf, temp + (offset % block_size), extra_size);
offset += extra_size;