projects
/
platform
/
kernel
/
linux-rpi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
8fe7916
)
[SCSI] u14-34f: fix buffer overflow
author
Roel Kluin
<roel.kluin@gmail.com>
Tue, 8 Dec 2009 22:08:59 +0000
(14:08 -0800)
committer
James Bottomley
<James.Bottomley@suse.de>
Mon, 18 Jan 2010 16:48:07 +0000
(10:48 -0600)
This allows i == MAX_INT_PARAM, which is out of range for ints[]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
drivers/scsi/u14-34f.c
patch
|
blob
|
history
diff --git
a/drivers/scsi/u14-34f.c
b/drivers/scsi/u14-34f.c
index
54023d4
..
26e8e0e
100644
(file)
--- a/
drivers/scsi/u14-34f.c
+++ b/
drivers/scsi/u14-34f.c
@@
-1070,7
+1070,7
@@
static int option_setup(char *str) {
char *cur = str;
int i = 1;
- while (cur && isdigit(*cur) && i <
=
MAX_INT_PARAM) {
+ while (cur && isdigit(*cur) && i < MAX_INT_PARAM) {
ints[i++] = simple_strtoul(cur, NULL, 0);
if ((cur = strchr(cur, ',')) != NULL) cur++;