bbb7bace03
The snic version number is expected to be 4 decimals in the form like a netmask string with each number stored in an element in array v. However, there is an off-by-one check on the number of elements in v allowing one to pass a 5 decimal version number causing v[4] to be referenced, causing a buffer overrun. Fix the off-by-one error by comparing to i > 3 rather than 4. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Shane Seymour <shane.seymour@hpe.com> Reviewed-by: Ewan Milne <emilne@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| cq_desc.h | ||
| cq_enet_desc.h | ||
| snic.h | ||
| snic_attrs.c | ||
| snic_ctl.c | ||
| snic_debugfs.c | ||
| snic_disc.c | ||
| snic_disc.h | ||
| snic_fwint.h | ||
| snic_io.c | ||
| snic_io.h | ||
| snic_isr.c | ||
| snic_main.c | ||
| snic_res.c | ||
| snic_res.h | ||
| snic_scsi.c | ||
| snic_stats.h | ||
| snic_trc.c | ||
| snic_trc.h | ||
| vnic_cq.c | ||
| vnic_cq.h | ||
| vnic_cq_fw.h | ||
| vnic_dev.c | ||
| vnic_dev.h | ||
| vnic_devcmd.h | ||
| vnic_intr.c | ||
| vnic_intr.h | ||
| vnic_resource.h | ||
| vnic_snic.h | ||
| vnic_stats.h | ||
| vnic_wq.c | ||
| vnic_wq.h | ||
| wq_enet_desc.h | ||