lkml.org 
[lkml]   [2016]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] snic: correctly check for array overrun on overly long version number
From
Date
>>>>> "Colin" == Colin King <colin.king@canonical.com> writes:

Colin> The snic version number is expected to be 4 decimals in the form
Colin> like a netmask string with each number stored in an element in
Colin> array v. However, there is an off-by-one check on the number of
Colin> elements in v allowing one to pass a 5 decimal version number
Colin> causing v[4] to be referenced, causing a buffer overrun. Fix the
Colin> off-by-one error by comparing to i > 3 rather than 4.

Applied to 4.6/scsi-queue.

--
Martin K. Petersen Oracle Linux Engineering

\
 
 \ /
  Last update: 2016-03-02 02:41    [W:0.056 / U:1.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site