OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

snic: correctly check for array overrun on overly long version number 

The snic version number is expected to be 4 decimals in the form like a
netmask string with each number stored in an element in array v.
However, there is an off-by-one check on the number of elements in v
allowing one to pass a 5 decimal version number causing v[4] to be
referenced, causing a buffer overrun.  Fix the off-by-one error by
comparing to i > 3 rather than 4.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Shane Seymour <shane.seymour@hpe.com>
Reviewed-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Colin Ian King 2016-02-25 22:58:25 +00:00 committed by Martin K. Petersen
parent a6d24143fc
commit bbb7bace03
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/scsi/snic/snic_ctl.c
View File

@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
continue;
}
if (i > 4 || !isdigit(c))
if (i > 3 || !isdigit(c))
goto end;
v[i] = v[i] * 10 + (c - '0');