brasero r2214 - in branches/gnome-2-26: . libbrasero-media

[philippr svn gnome org]

Author: philippr
Date: Mon Apr  6 13:57:45 2009
New Revision: 2214
URL: http://svn.gnome.org/viewvc/brasero?rev=2214&view=rev

Log:
2009-04-01  Philippe Rouquier  <bonfire-app wanadoo fr>

	Fix 573929 â Comment #9
	Attempt at fixing crash

	* libbrasero-media/brasero-medium.c




Modified:
   branches/gnome-2-26/ChangeLog
   branches/gnome-2-26/libbrasero-media/brasero-medium.c

Modified: branches/gnome-2-26/libbrasero-media/brasero-medium.c
==============================================================================
--- branches/gnome-2-26/libbrasero-media/brasero-medium.c	(original)
+++ branches/gnome-2-26/libbrasero-media/brasero-medium.c	Mon Apr  6 13:57:45 2009
@@ -1275,7 +1275,7 @@
 			       BraseroDeviceHandle *handle,
 			       BraseroScsiErrCode *code)
 {
-	int size;
+	int size = 0;
 	int num_desc, i;
 	gint max_rd, max_wrt;
 	BraseroScsiResult result;
@@ -1298,10 +1298,13 @@
 		return BRASERO_BURN_ERR;
 	}
 
-	num_desc = (size - sizeof (BraseroScsiGetPerfHdr)) /
-		    sizeof (BraseroScsiWrtSpdDesc);
+	/* choose the smallest value for size */
+	size = MIN (size, BRASERO_GET_32 (wrt_perf->hdr.len) + sizeof (wrt_perf->hdr.len));
 
-	if (num_desc <=  0)
+	/* calculate the number of descriptors */
+	num_desc = (size - sizeof (BraseroScsiGetPerfHdr)) / sizeof (BraseroScsiWrtSpdDesc);
+
+	if (num_desc <= 0)
 		goto end; 
 
 	priv->rd_speeds = g_new0 (gint, num_desc + 1);
@@ -1311,9 +1314,9 @@
 	max_wrt = 0;
 
 	desc = (BraseroScsiWrtSpdDesc*) &wrt_perf->data;
-	for (i = 0; i < num_desc; i ++, desc ++) {
-		priv->rd_speeds [i] = BRASERO_GET_32 (desc->rd_speed);
-		priv->wr_speeds [i] = BRASERO_GET_32 (desc->wr_speed);
+	for (i = 0; i < num_desc; i ++) {
+		priv->rd_speeds [i] = BRASERO_GET_32 (desc [i].rd_speed);
+		priv->wr_speeds [i] = BRASERO_GET_32 (desc [i].wr_speed);
 
 		max_rd = MAX (max_rd, priv->rd_speeds [i]);
 		max_wrt = MAX (max_wrt, priv->wr_speeds [i]);
@@ -1368,6 +1371,8 @@
 	page_2A = (BraseroScsiStatusPage *) &data->page;
 
 	/* Reminder: size = sizeof (BraseroScsiStatusPage) + sizeof (BraseroScsiModeHdr) */
+ 	size = MIN (size, sizeof (data->hdr.len) + BRASERO_GET_16 (data->hdr.len));
+
 	if (size < (G_STRUCT_OFFSET (BraseroScsiStatusPage, copy_mngt_rev) +
 		    sizeof (BraseroScsiModeHdr))) {
 		g_free (data);