From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752539AbcBYW6e (ORCPT ); Thu, 25 Feb 2016 17:58:34 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:41013 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752344AbcBYW6c (ORCPT ); Thu, 25 Feb 2016 17:58:32 -0500 From: Colin King To: Narsimhulu Musini , Sesidhar Baddela , "James E . J . Bottomley" , "Martin K . Petersen" , linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] snic: correctly check for array overrun on overly long version number Date: Thu, 25 Feb 2016 22:58:25 +0000 Message-Id: <1456441105-19042-1-git-send-email-colin.king@canonical.com> X-Mailer: git-send-email 2.7.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The snic version number is expected to be 4 decimals in the form like a netmask string with each number stored in an element in array v. However, there is an off-by-one check on the number of elements in v allowing one to pass a 5 decimal version number causing v[4] to be referenced, causing a buffer overrun. Fix the off-by-one error by comparing to i > 3 rather than 4. Signed-off-by: Colin Ian King --- drivers/scsi/snic/snic_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c index aebe753..ab0e06b 100644 --- a/drivers/scsi/snic/snic_ctl.c +++ b/drivers/scsi/snic/snic_ctl.c @@ -75,7 +75,7 @@ snic_ver_enc(const char *s) continue; } - if (i > 4 || !isdigit(c)) + if (i > 3 || !isdigit(c)) goto end; v[i] = v[i] * 10 + (c - '0'); -- 2.7.0