diff options
| author | Roel Kluin <roel.kluin@gmail.com> | 2009-12-09 01:08:59 +0300 |
|---|---|---|
| committer | James Bottomley <James.Bottomley@suse.de> | 2010-01-18 19:48:07 +0300 |
| commit | 4a02462af1f4c3498e6a330ffd5c063118309b31 (patch) | |
| tree | 17c1f3ecb569c73dc5c33d185ca5dc4858b14808 /drivers | |
| parent | 8fe79162a6807bf120140d64e96da54fc273b88b (diff) | |
| download | linux-4a02462af1f4c3498e6a330ffd5c063118309b31.tar.xz | |
[SCSI] u14-34f: fix buffer overflow
This allows i == MAX_INT_PARAM, which is out of range for ints[]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/u14-34f.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/u14-34f.c b/drivers/scsi/u14-34f.c index 54023d41fd15..26e8e0e6b8dd 100644 --- a/drivers/scsi/u14-34f.c +++ b/drivers/scsi/u14-34f.c @@ -1070,7 +1070,7 @@ static int option_setup(char *str) { char *cur = str; int i = 1; - while (cur && isdigit(*cur) && i <= MAX_INT_PARAM) { + while (cur && isdigit(*cur) && i < MAX_INT_PARAM) { ints[i++] = simple_strtoul(cur, NULL, 0); if ((cur = strchr(cur, ',')) != NULL) cur++; |