Cleanup and sanity-checking of OOB accesses and pointer-to-local issues (Coverity...

[palacios.git] / palacios / src / devices / ide.c

diff --git a/palacios/src/devices/ide.c b/palacios/src/devices/ide.c
index 45aaba7..e9a90a8 100644 (file)
--- a/palacios/src/devices/ide.c
+++ b/palacios/src/devices/ide.c
@@ -299,7 +299,12 @@ static inline int get_channel_index(ushort_t port) {
 
 static inline struct ide_channel * get_selected_channel(struct ide_internal * ide, ushort_t port) {
     int channel_idx = get_channel_index(port);    
-    return &(ide->channels[channel_idx]);
+    if (channel_idx >= 0) { 
+       return &(ide->channels[channel_idx]);
+    } else {
+       PrintError(VM_NONE,VCORE_NONE,"ide: Cannot Determine Selected Channel\n");
+       return 0;
+    }
 }
 
 static inline struct ide_drive * get_selected_drive(struct ide_channel * channel) {
@@ -507,7 +512,11 @@ static int dma_read(struct guest_info * core, struct ide_internal * ide, struct
                    cmd_ret = v3_write_gpa_memory(core, prd_entry.base_addr + prd_offset, 
                                                  bytes_to_write, drive->data_buf); 
 
-                   // check cmd_ret
+                   if (cmd_ret!=bytes_to_write) { 
+                       PrintError(core->vm_info, core, "Failed to write data to memory\n");
+                       return -1;
+                   }
+
 
 
                    bytes_to_write = 0;
@@ -1078,7 +1087,7 @@ static int read_hd_data(uint8_t * dst, uint64_t length, struct ide_internal * id
               drive->transfer_index, drive->transfer_length, 
               drive->hd_state.cur_sector_num);
 
-    if (drive->transfer_index >= drive->transfer_length) {
+    if (drive->transfer_index >= drive->transfer_length && drive->transfer_index>=DATA_BUFFER_SIZE) {
        PrintError(VM_NONE, VCORE_NONE, "Buffer overrun... (xfer_len=%llu) (cur_idx=%llu) (post_idx=%llu)\n",
                   drive->transfer_length, drive->transfer_index,
                   drive->transfer_index + length);
@@ -1220,7 +1229,7 @@ static int read_cd_data(uint8_t * dst, uint64_t length, struct ide_internal * id
 
     
 
-    if (drive->transfer_index >= drive->transfer_length) {
+    if (drive->transfer_index >= drive->transfer_length && drive->transfer_index>=DATA_BUFFER_SIZE) {
        PrintError(VM_NONE, VCORE_NONE, "Buffer Overrun... (xfer_len=%llu) (cur_idx=%llu) (post_idx=%llu)\n", 
                   drive->transfer_length, drive->transfer_index, 
                   drive->transfer_index + length);
@@ -1986,7 +1995,8 @@ static int connect_fn(struct v3_vm_info * vm,
     }
 
     if (model_str != NULL) {
-       strncpy(drive->model, model_str, sizeof(drive->model) - 1);
+       strncpy(drive->model, model_str, sizeof(drive->model));
+       drive->model[sizeof(drive->model)-1] = 0;
     }
 
     if (strcasecmp(type_str, "cdrom") == 0) {