snic: correctly check for array overrun on overly long version number

Colin Ian King · martinkpetersen · commit bbb7bace0346 · 2016-03-01T20:08:49.000-05:00
The snic version number is expected to be 4 decimals in the form like a
netmask string with each number stored in an element in array v.
However, there is an off-by-one check on the number of elements in v
allowing one to pass a 5 decimal version number causing v[4] to be
referenced, causing a buffer overrun.  Fix the off-by-one error by
comparing to i &gt; 3 rather than 4.

Signed-off-by: Colin Ian King &lt;colin.king@canonical.com&gt;
Reviewed-by: Shane Seymour &lt;shane.seymour@hpe.com&gt;
Reviewed-by: Ewan Milne &lt;emilne@redhat.com&gt;
Signed-off-by: Martin K. Petersen &lt;martin.petersen@oracle.com&gt;
diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
 			continue;
 		}
 
-		if (i > 4 || !isdigit(c))
+		if (i > 3 || !isdigit(c))
 			goto end;
 
 		v[i] = v[i] * 10 + (c - '0');

Original file line number	Diff line number	Diff line change
`@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)`
`75`	`75`	`continue;`
`76`	`76`	`}`
`77`	`77`
`78`		`- if (i > 4 \|\| !isdigit(c))`
	`78`	`+ if (i > 3 \|\| !isdigit(c))`
`79`	`79`	`goto end;`
`80`	`80`
`81`	`81`	`v[i] = v[i] * 10 + (c - '0');`