From: Ameen Ali <ameenali023@gmail.com>
Date: Tue, 24 Feb 2015 16:41:50 +0000 (+0200)
Subject: s390/dcss: array index 'i' is used before limits check.
X-Git-Tag: v4.0-rc4~26^2~6
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3a9f9183bdd341a25c7805d96bbd78a31d559381;p=platform%2Fkernel%2Flinux-exynos.git

s390/dcss: array index 'i' is used before limits check.

Avoid out-of-bounds-read by checking count before indexing.

Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---

diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 96128cb..da21281 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
 	 * parse input
 	 */
 	num_of_segments = 0;
-	for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
+	for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
 		for (j = i; (buf[j] != ':') &&
 			(buf[j] != '\0') &&
 			(buf[j] != '\n') &&