Commit 7cafbf1b authored by Maciej Patelczyk's avatar Maciej Patelczyk Committed by Dan Williams

isci: possible buffer overflow in isci_parse_oem_parameters fixed

scu_index is a parameter of isci_parse_eom_parameters and is an index
in controller table. There is a check: scu_index > SCI_MAX_CONTROLLERS
which is insufficient and should be: scu_index >= SCI_MAX_CONTROLLERS.
scu_index is used as an index in the table which size is
SCI_MAX_CONTROLLERS.
Signed-off-by: default avatarMaciej Patelczyk <maciej.patelczyk@intel.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent 086a0dab
...@@ -125,7 +125,7 @@ enum sci_status isci_parse_oem_parameters(union scic_oem_parameters *oem_params, ...@@ -125,7 +125,7 @@ enum sci_status isci_parse_oem_parameters(union scic_oem_parameters *oem_params,
struct isci_orom *orom, int scu_index) struct isci_orom *orom, int scu_index)
{ {
/* check for valid inputs */ /* check for valid inputs */
if (scu_index < 0 || scu_index > SCI_MAX_CONTROLLERS || if (scu_index < 0 || scu_index >= SCI_MAX_CONTROLLERS ||
scu_index > orom->hdr.num_elements || !oem_params) scu_index > orom->hdr.num_elements || !oem_params)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment