New: Buffer overrun in FlashPoint.c

http://bugzilla.kernel.org/show_bug.cgi?id=13547

Summary: Buffer overrun in FlashPoint.c
Product: SCSI Drivers
Version: 2.5
Kernel Version: 2.6.30
Platform: All
OS/Version: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: Other
AssignedTo: [email protected]
ReportedBy: [email protected]
Regression: No

Hi,

i detected a possible buffer overrun in File
linux-2.6.30/drivers/scsi/FlashPoint.c

I used the static code analysis tool cppcheck to detect this. It printed the following message:
[linux-2.6.30/drivers/scsi/FlashPoint.c:1222]: (all) Buffer overrun

Lets take a look at line 1222:

        // ...
    for (thisCard = 0; thisCard <= MAX_CARDS; thisCard++) {

        if (thisCard == MAX_CARDS) {

            return FAILURE;
        }

1222 if (FPT_BL_Card[thisCard].ioPort == ioport) {

            CurrCard = &FPT_BL_Card[thisCard];
            FPT_SccbMgrTableInitCard(CurrCard, thisCard);
            break;
        }

          // ...

The for loop terminates when thisCard <= MAX_CARDS. MAX_CARDS is defined as 8 in this file. Here there are 9 iterations made. This is one to much. A possible solution to avoid this:

    for (thisCard = 0; thisCard < MAX_CARDS; thisCard++) {

Best regards

Ettl Martin

Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

http://bugzilla.kernel.org/show_bug.cgi?id=13547

--- Comment #1 from Randy Dunlap <[email protected]> 2009-06-16 22:24:35 --- How about the if-block just above line 1222?
Won't it prevent line 1222 from being executed when thisCard == MAX_CARDS?

Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

http://bugzilla.kernel.org/show_bug.cgi?id=13547

--- Comment #2 from Martin Ettl <[email protected]> 2009-06-18 07:47:48 --- Yes i see. You can avoid the if-statement by using this:

for (thisCard = 0; thisCard < MAX_CARDS; thisCard++)

Regards

Martin

Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.