eata: Buffer overflow

PATCH New Roel Kluin 1 participant 1 message Jul 25, 2009 SCSI

lore

Share & tools

lore

Roel Kluin

author

2009-07-25 23:02 UTC #0 lore raw

PATCH 1/1 eata: Buffer overflow

allows i == MAX_INT_PARAM, which is out of range

Signed-off-by Roel Kluin <[email protected]>

---

drivers/scsi/eata.c +1 -1

index c7076ce..3c5abf7 100644
@@ -1509,7 +1509,7 @@ static int option_setup(char *str)
 	char *cur = str;
 	int i = 1;
 
-	while (cur && isdigit(*cur) && i <= MAX_INT_PARAM) {
+	while (cur && isdigit(*cur) && i < MAX_INT_PARAM) {
 		ints[i++] = simple_strtoul(cur, NULL, 0);
 
 		if ((cur = strchr(cur, ',')) != NULL)