From: Colin Ian King Date: Thu, 25 Feb 2016 22:58:25 +0000 (+0000) Subject: snic: correctly check for array overrun on overly long version number X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=bbb7bace0346d43da1bd27d809928f3d07bbd1e7;p=linux-beck.git snic: correctly check for array overrun on overly long version number The snic version number is expected to be 4 decimals in the form like a netmask string with each number stored in an element in array v. However, there is an off-by-one check on the number of elements in v allowing one to pass a 5 decimal version number causing v[4] to be referenced, causing a buffer overrun. Fix the off-by-one error by comparing to i > 3 rather than 4. Signed-off-by: Colin Ian King Reviewed-by: Shane Seymour Reviewed-by: Ewan Milne Signed-off-by: Martin K. Petersen --- diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c index aebe75320ed3..ab0e06b0b4ff 100644 --- a/drivers/scsi/snic/snic_ctl.c +++ b/drivers/scsi/snic/snic_ctl.c @@ -75,7 +75,7 @@ snic_ver_enc(const char *s) continue; } - if (i > 4 || !isdigit(c)) + if (i > 3 || !isdigit(c)) goto end; v[i] = v[i] * 10 + (c - '0');