diff options
| author | Maciej Patelczyk <maciej.patelczyk@intel.com> | 2011-06-21 22:03:13 +0000 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2011-07-03 04:04:51 -0700 |
| commit | 7cafbf1bd56be44038148bb8f733ea6e6a6a2d53 (patch) | |
| tree | caf063a0640a33d37b198c3dd5c71ce04247a493 | |
| parent | 086a0dabc5bf154e13604a6d71e2d051207f9718 (diff) | |
| download | linux-stable-7cafbf1bd56be44038148bb8f733ea6e6a6a2d53.tar.gz linux-stable-7cafbf1bd56be44038148bb8f733ea6e6a6a2d53.tar.bz2 linux-stable-7cafbf1bd56be44038148bb8f733ea6e6a6a2d53.zip | |
isci: possible buffer overflow in isci_parse_oem_parameters fixed
scu_index is a parameter of isci_parse_eom_parameters and is an index
in controller table. There is a check: scu_index > SCI_MAX_CONTROLLERS
which is insufficient and should be: scu_index >= SCI_MAX_CONTROLLERS.
scu_index is used as an index in the table which size is
SCI_MAX_CONTROLLERS.
Signed-off-by: Maciej Patelczyk <maciej.patelczyk@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| -rw-r--r-- | drivers/scsi/isci/probe_roms.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/isci/probe_roms.c b/drivers/scsi/isci/probe_roms.c index bc52a6174070..99b13c191877 100644 --- a/drivers/scsi/isci/probe_roms.c +++ b/drivers/scsi/isci/probe_roms.c @@ -125,7 +125,7 @@ enum sci_status isci_parse_oem_parameters(union scic_oem_parameters *oem_params, struct isci_orom *orom, int scu_index) { /* check for valid inputs */ - if (scu_index < 0 || scu_index > SCI_MAX_CONTROLLERS || + if (scu_index < 0 || scu_index >= SCI_MAX_CONTROLLERS || scu_index > orom->hdr.num_elements || !oem_params) return -EINVAL; |