diff options
author | Roel Kluin <roel.kluin@gmail.com> | 2009-12-08 17:08:59 -0500 |
---|---|---|
committer | James Bottomley <James.Bottomley@suse.de> | 2010-01-18 11:48:07 -0500 |
commit | 4a02462af1f4c3498e6a330ffd5c063118309b31 (patch) | |
tree | 17c1f3ecb569c73dc5c33d185ca5dc4858b14808 /drivers/scsi/u14-34f.c | |
parent | 8fe79162a6807bf120140d64e96da54fc273b88b (diff) |
[SCSI] u14-34f: fix buffer overflow
This allows i == MAX_INT_PARAM, which is out of range for ints[]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Diffstat (limited to 'drivers/scsi/u14-34f.c')
-rw-r--r-- | drivers/scsi/u14-34f.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/u14-34f.c b/drivers/scsi/u14-34f.c index 54023d41fd15..26e8e0e6b8dd 100644 --- a/drivers/scsi/u14-34f.c +++ b/drivers/scsi/u14-34f.c | |||
@@ -1070,7 +1070,7 @@ static int option_setup(char *str) { | |||
1070 | char *cur = str; | 1070 | char *cur = str; |
1071 | int i = 1; | 1071 | int i = 1; |
1072 | 1072 | ||
1073 | while (cur && isdigit(*cur) && i <= MAX_INT_PARAM) { | 1073 | while (cur && isdigit(*cur) && i < MAX_INT_PARAM) { |
1074 | ints[i++] = simple_strtoul(cur, NULL, 0); | 1074 | ints[i++] = simple_strtoul(cur, NULL, 0); |
1075 | 1075 | ||
1076 | if ((cur = strchr(cur, ',')) != NULL) cur++; | 1076 | if ((cur = strchr(cur, ',')) != NULL) cur++; |