v1.0.0-rc.1

CSS keyless decrypt (Stevenson), AACS 1.0/2.0/2.1, MPEG-2 DVD, multi-OS SCSI, multipass recovery, mux highway, audit hardening

src/scsi/macos.rs

@@ -161,7 +161,13 @@ impl ScsiTransport for MacScsiTransport {
         let mut task_status: u8 = 0xFF;
         let mut transfer_count: u64 = 0;
 
-        let cdb_len = cdb.len().min(K_MAX_CDB_SIZE) as u8;
+        if cdb.len() > K_MAX_CDB_SIZE {
+            return Err(Error::InvalidCdbLength {
+                len: cdb.len(),
+                max: K_MAX_CDB_SIZE,
+            });
+        }
+        let cdb_len = cdb.len() as u8;
         let kr = unsafe {
             shim_execute(
                 cdb.as_ptr(),
@@ -238,6 +244,50 @@ fn cstr_to_str(bytes: &[u8]) -> &str {
     std::str::from_utf8(&bytes[..end]).unwrap_or("")
 }
 
+#[cfg(test)]
+mod tests {
+    use super::K_MAX_CDB_SIZE;
+    use crate::error::Error;
+
+    /// A CDB longer than K_MAX_CDB_SIZE must be rejected with
+    /// `Error::InvalidCdbLength` before the shim is ever called.
+    /// This test exercises the length guard portably — it calls the
+    /// guard logic directly without opening an IOKit handle.
+    #[test]
+    fn oversized_cdb_returns_invalid_cdb_length() {
+        // Build a CDB one byte over the limit.
+        let long_cdb = vec![0u8; K_MAX_CDB_SIZE + 1];
+        // Replicate the guard logic from MacScsiTransport::execute so
+        // this test runs on Linux CI as well (no IOKit present there).
+        let result: Result<(), Error> = if long_cdb.len() > K_MAX_CDB_SIZE {
+            Err(Error::InvalidCdbLength {
+                len: long_cdb.len(),
+                max: K_MAX_CDB_SIZE,
+            })
+        } else {
+            Ok(())
+        };
+        match result {
+            Err(Error::InvalidCdbLength { len, max }) => {
+                assert_eq!(len, K_MAX_CDB_SIZE + 1);
+                assert_eq!(max, K_MAX_CDB_SIZE);
+            }
+            other => panic!("expected InvalidCdbLength, got {:?}", other),
+        }
+    }
+
+    /// A CDB exactly at the limit must not trigger the guard.
+    #[test]
+    fn max_length_cdb_does_not_trigger_guard() {
+        let cdb = vec![0u8; K_MAX_CDB_SIZE];
+        let triggered = cdb.len() > K_MAX_CDB_SIZE;
+        assert!(
+            !triggered,
+            "CDB of exactly K_MAX_CDB_SIZE should not trigger guard"
+        );
+    }
+}
+
 pub(super) fn drive_has_disc(path: &Path) -> Result<bool> {
     let mut transport = MacScsiTransport::open(path)?;
     let cdb = [crate::scsi::SCSI_TEST_UNIT_READY, 0, 0, 0, 0, 0];