[PATCH 6/7] ntdll: IOCTL_DVD_READ_STRUCTURE rejects odd sized output buffers

[Dan Kegel]

Change since yesterday: 
- Split this little change out into its own patch.

---
 dlls/kernel32/tests/cdrom.c |   43 +++++++++++++++++++++++++++++++++++++++++++
 dlls/ntdll/cdrom.c          |    1 +
 2 files changed, 44 insertions(+), 0 deletions(-)

diff --git a/dlls/kernel32/tests/cdrom.c b/dlls/kernel32/tests/cdrom.c
index ed9abbe..3b997f5 100644
--- a/dlls/kernel32/tests/cdrom.c
+++ b/dlls/kernel32/tests/cdrom.c
@@ -80,6 +80,48 @@ static void test_readStruct_input(HANDLE hdevice)
     }
 }
 
+/* Try IOCTL_DVD_READ_STRUCTURE.DvdPhysicalDescriptor
+ * with various size output buffers
+ */
+
+static void test_readStruct_layer(HANDLE hdevice)
+{
+    static struct {
+        int olen;
+        BOOL ret;
+        DWORD err;
+    } cases[] = {
+       {3,                               FALSE, ERROR_INSUFFICIENT_BUFFER },
+       {sizeof(xDVD_LAYER_DESCRIPTOR),   TRUE,  0                         },
+       {sizeof(xDVD_LAYER_DESCRIPTOR)+1, FALSE, ERROR_INVALID_PARAMETER   },
+       {0}
+    };
+    DVD_READ_STRUCTURE ibuf;
+    int i;
+
+    ZeroMemory(&ibuf, sizeof(ibuf));
+    ibuf.Format = DvdPhysicalDescriptor;
+
+    for (i=0; cases[i].olen; i++) {
+        char obuf[HUGEBUF];
+        DWORD bytes_read = 0;
+        BOOL bResult;
+
+        bResult = DeviceIoControl(hdevice, IOCTL_DVD_READ_STRUCTURE,
+                                  &ibuf, sizeof(ibuf),
+                                  obuf, cases[i].olen, &bytes_read, 0);
+        ok(bResult == cases[i].ret,
+           "case %d: DeviceIoControl returned %d, expected %d\n",
+           i, bResult, cases[i].ret);
+        if (cases[i].err) {
+            DWORD err = GetLastError();
+            ok(err == cases[i].err,
+               "case %d: Last error was %d, expected %d\n",
+               i, err, cases[i].err);
+        }
+    }
+}
+
 /* Backdoor way to do the same thing as IOCTL_DVD_READ_STRUCTURE */
 DWORD read_discStructure(HANDLE device, int format, void *obuf, int obuflen)
 {
@@ -190,6 +232,7 @@ START_TEST(cdrom)
     } else {
         /* DVD tests */
         test_readStruct_input(hdevice);
+        test_readStruct_layer(hdevice);
         test_readStruct_layer_vs_passthrough(hdevice);
     }
     CloseHandle(hdevice);
diff --git a/dlls/ntdll/cdrom.c b/dlls/ntdll/cdrom.c
index b151983..61c7db9 100644
--- a/dlls/ntdll/cdrom.c
+++ b/dlls/ntdll/cdrom.c
@@ -3101,6 +3101,7 @@ NTSTATUS CDROM_DeviceIoControl(HANDLE hDevice,
         sz = sizeof(DVD_LAYER_DESCRIPTOR);
         if (lpInBuffer == NULL || nInBufferSize < sizeof(DVD_READ_STRUCTURE)) status = STATUS_INVALID_PARAMETER;
         else if (nOutBufferSize < sz) status = STATUS_BUFFER_TOO_SMALL;
+        else if (nOutBufferSize & 1) status = STATUS_INVALID_PARAMETER;
         else
         {
             TRACE("doing DVD_READ_STRUCTURE\n");
-- 
1.7.9