Skip to content

Commit

Permalink
isci: possible buffer overflow in isci_parse_oem_parameters fixed
Browse files Browse the repository at this point in the history
scu_index is a parameter of isci_parse_eom_parameters and is an index
in controller table. There is a check: scu_index > SCI_MAX_CONTROLLERS
which is insufficient and should be: scu_index >= SCI_MAX_CONTROLLERS.
scu_index is used as an index in the table which size is
SCI_MAX_CONTROLLERS.

Signed-off-by: Maciej Patelczyk <maciej.patelczyk@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
  • Loading branch information
Maciej Patelczyk authored and Dan Williams committed Jul 3, 2011
1 parent 086a0da commit 7cafbf1
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/scsi/isci/probe_roms.c
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ enum sci_status isci_parse_oem_parameters(union scic_oem_parameters *oem_params,
struct isci_orom *orom, int scu_index)
{
/* check for valid inputs */
if (scu_index < 0 || scu_index > SCI_MAX_CONTROLLERS ||
if (scu_index < 0 || scu_index >= SCI_MAX_CONTROLLERS ||
scu_index > orom->hdr.num_elements || !oem_params)
return -EINVAL;

Expand Down

0 comments on commit 7cafbf1

Please sign in to comment.