---

yaml --- r: 286517 b: refs/heads/master c: bc704fb h: refs/heads/master i: 286515: df46554 v: v3
git-mirror · Dec 14, 2011 · db37f61 · db37f61
1 parent c595154
commit db37f61
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8359cf43b9dccddeebb0d247146719a14ce6371a
+refs/heads/master: bc704fb58f507deea84a4c047a3a71351f0c55aa
diff --git a/trunk/drivers/target/iscsi/iscsi_target_auth.c b/trunk/drivers/target/iscsi/iscsi_target_auth.c
@@ -165,7 +165,8 @@ static int chap_server_compute_md5(
 	unsigned int *nr_out_len)
 {
 	char *endptr;
-	unsigned char id, digest[MD5_SIGNATURE_SIZE];
+	unsigned long id;
+	unsigned char digest[MD5_SIGNATURE_SIZE];
 	unsigned char type, response[MD5_SIGNATURE_SIZE * 2 + 2];
 	unsigned char identifier[10], *challenge = NULL;
 	unsigned char *challenge_binhex = NULL;
@@ -304,15 +305,18 @@ static int chap_server_compute_md5(
 		goto out;
 	}
 
-	/* FIXME: What happens when simple_strtoul() return 256, 257, etc.? */
 	if (type == HEX)
 		id = simple_strtoul(&identifier[2], &endptr, 0);
 	else
 		id = simple_strtoul(identifier, &endptr, 0);
+	if (id > 255) {
+		pr_err("chap identifier: %lu greater than 255\n", id);
+		goto out;
+	}
 	/*
 	 * RFC 1994 says Identifier is no more than octet (8 bits).
 	 */
-	pr_debug("[server] Got CHAP_I=%d\n", id);
+	pr_debug("[server] Got CHAP_I=%lu\n", id);
 	/*
 	 * Get CHAP_C.
 	 */