Skip to content

Commit

Permalink
s390/dcss: array index 'i' is used before limits check.
Browse files Browse the repository at this point in the history
Avoid out-of-bounds-read by checking count before indexing.

Signed-off-by : Ameen Ali <Ameenali023@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
  • Loading branch information
Ameen Ali authored and Martin Schwidefsky committed Feb 26, 2015
1 parent a13ccb0 commit 3a9f918
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/s390/block/dcssblk.c
Original file line number Diff line number Diff line change
Expand Up @@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
* parse input
*/
num_of_segments = 0;
for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
for (j = i; (buf[j] != ':') &&
(buf[j] != '\0') &&
(buf[j] != '\n') &&
Expand Down

0 comments on commit 3a9f918

Please sign in to comment.