func: static bool CVE_2014_2894_VULN_cmd_smart(IDEState *s, uint8_t cmd) int n ; if ( s -> hcyl != 0xc2 || s -> lcyl != 0x4f )  if ( ! s -> smart_enabled && s -> feature != SMART_ENABLE )  switch ( s -> feature )  switch ( s -> sector )  s -> smart_autosave = 0; s -> smart_autosave = 1; if ( ! s -> smart_errors )  s -> hcyl = 0x2c; s -> lcyl = 0xf4; memset ( s -> io_buffer , 0 , 0x200 ); s -> io_buffer [ 0 ] = 0x01; for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) s -> io_buffer [ 2 + 0 + ( n * 12 ) ] = smart_attributes [ n ] [ 0 ]; s -> io_buffer [ 2 + 1 + ( n * 12 ) ] = smart_attributes [ n ] [ 11 ]; for (n = 0; n < 511; n++) s -> io_buffer [ 511 ] += s -> io_buffer [ n ]; s -> io_buffer [ 511 ] = 0x100 - s -> io_buffer [ 511 ]; s -> status = READY_STAT | SEEK_STAT; memset ( s -> io_buffer , 0 , 0x200 ); s -> io_buffer [ 0 ] = 0x01; for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) int i ; for (i = 0; i < 11; i++) s -> io_buffer [ 2 + i + ( n * 12 ) ] = smart_attributes [ n ] [ i ]; s -> io_buffer [ 362 ] = 0x02 | ( s -> smart_autosave ? 0x80 : 0x00 ); if ( s -> smart_selftest_count == 0 )  s -> io_buffer [ 363 ] = s -> smart_selftest_data [ 3 + ( s -> smart_selftest_count - 1 ) * 24 ]; s -> io_buffer [ 364 ] = 0x20; s -> io_buffer [ 365 ] = 0x01; s -> io_buffer [ 367 ] = ( 1 << 4 | 1 << 3 | 1 ); s -> io_buffer [ 368 ] = 0x03; s -> io_buffer [ 369 ] = 0x00; s -> io_buffer [ 370 ] = 0x01; s -> io_buffer [ 372 ] = 0x02; s -> io_buffer [ 373 ] = 0x36; s -> io_buffer [ 374 ] = 0x01; for (n = 0; n < 511; n++) s -> io_buffer [ 511 ] += s -> io_buffer [ n ]; s -> io_buffer [ 511 ] = 0x100 - s -> io_buffer [ 511 ]; s -> status = READY_STAT | SEEK_STAT; switch ( s -> sector )  memset ( s -> io_buffer , 0 , 0x200 ); s -> io_buffer [ 0 ] = 0x01; s -> io_buffer [ 1 ] = 0x00; s -> io_buffer [ 452 ] = s -> smart_errors & 0xff; s -> io_buffer [ 453 ] = ( s -> smart_errors & 0xff00 ) >> 8; s -> io_buffer [ 511 ] += s -> io_buffer [ n ]; s -> io_buffer [ 511 ] = 0x100 - s -> io_buffer [ 511 ]; memset ( s -> io_buffer , 0 , 0x200 ); s -> io_buffer [ 0 ] = 0x01; if ( s -> smart_selftest_count == 0 )  s -> io_buffer [ 508 ] = 0; s -> io_buffer [ 511 ] += s -> io_buffer [ n ]; s -> io_buffer [ 511 ] = 0x100 - s -> io_buffer [ 511 ]; s -> status = READY_STAT | SEEK_STAT; ide_transfer_start ( s , s -> io_buffer , 0x200 , ide_transfer_stop ); ide_set_irq ( s -> bus ); switch ( s -> sector )  s -> smart_selftest_count ++; if ( s -> smart_selftest_count > 21 )  s -> smart_selftest_count = 0; n = 2 + ( s -> smart_selftest_count - 1 ) * 24; s -> smart_selftest_data [ n ] = s -> sector; s -> smart_selftest_data [ n + 1 ] = 0x00; s -> smart_selftest_data [ n + 2 ] = 0x34; s -> smart_selftest_data [ n + 3 ] = 0x12; ide_abort_command ( s ); 