On 26/02/16 4:28 am, "Colin King" <[email protected]> wrote:
>From: Colin Ian King <[email protected]>
>
>The snic version number is expected to be 4 decimals in the form like
>a netmask string with each number stored in an element in array v.
>However, there is an off-by-one check on the number of elements in v
>allowing one to pass a 5 decimal version number causing v[4] to be
>referenced, causing a buffer overrun. Fix the off-by-one error by
>comparing to i > 3 rather than 4.
Acked-by: Narsimhulu Musini <[email protected]>
>
>Signed-off-by: Colin Ian King <[email protected]>
>---
> drivers/scsi/snic/snic_ctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
>index aebe753..ab0e06b 100644
>--- a/drivers/scsi/snic/snic_ctl.c
>+++ b/drivers/scsi/snic/snic_ctl.c
>@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
> continue;
> }
>
>- if (i > 4 || !isdigit(c))
>+ if (i > 3 || !isdigit(c))
> goto end;
>
> v[i] = v[i] * 10 + (c - '0');
>--
>2.7.0
>