lkml.org 
[lkml]   [2016]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] snic: correctly check for array overrun on overly long version number
Date
From: Colin Ian King <colin.king@canonical.com>

The snic version number is expected to be 4 decimals in the form like
a netmask string with each number stored in an element in array v.
However, there is an off-by-one check on the number of elements in v
allowing one to pass a 5 decimal version number causing v[4] to be
referenced, causing a buffer overrun. Fix the off-by-one error by
comparing to i > 3 rather than 4.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/scsi/snic/snic_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
index aebe753..ab0e06b 100644
--- a/drivers/scsi/snic/snic_ctl.c
+++ b/drivers/scsi/snic/snic_ctl.c
@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
continue;
}

- if (i > 4 || !isdigit(c))
+ if (i > 3 || !isdigit(c))
goto end;

v[i] = v[i] * 10 + (c - '0');
--
2.7.0
\
 
 \ /
  Last update: 2016-02-26 00:41    [W:0.091 / U:5.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site