diff options
author | Chen Gang <gang.chen@asianux.com> | 2013-05-29 22:35:34 -0400 |
---|---|---|
committer | Tony Luck <tony.luck@intel.com> | 2013-06-03 19:09:43 -0400 |
commit | 69cbc0464d87bfa38c0a4fe4d8bb751c1ec8cedf (patch) | |
tree | 7cffd82b2cc5f9429255df6785e5b890da8ba617 /arch/ia64/hp/sim | |
parent | d5e660ba801e333657e7c6d10cd806f277c438fb (diff) |
[IA64] hpsim: Fix check for overlong simscsi prefix.
When "strlen(s) > MAX_ROOT_LEN", it has already said to use the default
value, but in fact, it still use the input value.
If happens, next sprintf() for 'fname' in simscsi_queuecommand_lck()
may be memory overflow.
Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Diffstat (limited to 'arch/ia64/hp/sim')
-rw-r--r-- | arch/ia64/hp/sim/simscsi.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/ia64/hp/sim/simscsi.c b/arch/ia64/hp/sim/simscsi.c index 331de723c676..3a428f19a001 100644 --- a/arch/ia64/hp/sim/simscsi.c +++ b/arch/ia64/hp/sim/simscsi.c | |||
@@ -88,8 +88,8 @@ simscsi_setup (char *s) | |||
88 | if (strlen(s) > MAX_ROOT_LEN) { | 88 | if (strlen(s) > MAX_ROOT_LEN) { |
89 | printk(KERN_ERR "simscsi_setup: prefix too long---using default %s\n", | 89 | printk(KERN_ERR "simscsi_setup: prefix too long---using default %s\n", |
90 | simscsi_root); | 90 | simscsi_root); |
91 | } | 91 | } else |
92 | simscsi_root = s; | 92 | simscsi_root = s; |
93 | return 1; | 93 | return 1; |
94 | } | 94 | } |
95 | 95 | ||