ibmmca: Buffer overflow

PATCH New Roel Kluin 1 participant 1 message Jul 25, 2009 SCSI

lore

Share & tools

lore

Roel Kluin

author

2009-07-25 23:00 UTC #0 lore raw

PATCH 1/1 ibmmca: Buffer overflow

allows i == IM_MAX_HOSTS, which is out of range

Signed-off-by Roel Kluin <[email protected]>

---

drivers/scsi/ibmmca.c +1 -1

index 9c1e6a5..9a4b69d 100644
@@ -2336,7 +2336,7 @@ static int option_setup(char *str)
 	char *cur = str;
 	int i = 1;
 
-	while (cur && isdigit(*cur) && i <= IM_MAX_HOSTS) {
+	while (cur && isdigit(*cur) && i < IM_MAX_HOSTS) {
 		ints[i++] = simple_strtoul(cur, NULL, 0);
 		if ((cur = strchr(cur, ',')) != NULL)
 			cur++;