snic: correctly check for array overrun on overly long version number
authorColin Ian King <colin.king@canonical.com>
Thu, 25 Feb 2016 22:58:25 +0000 (22:58 +0000)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 2 Mar 2016 01:08:49 +0000 (20:08 -0500)
commitbbb7bace0346d43da1bd27d809928f3d07bbd1e7
tree84328303e952487f72ec89aae0a5bca6d1ffd3cf
parenta6d24143fca421c836f78538705c8e5b3ef04e3d
snic: correctly check for array overrun on overly long version number

The snic version number is expected to be 4 decimals in the form like a
netmask string with each number stored in an element in array v.
However, there is an off-by-one check on the number of elements in v
allowing one to pass a 5 decimal version number causing v[4] to be
referenced, causing a buffer overrun.  Fix the off-by-one error by
comparing to i > 3 rather than 4.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Shane Seymour <shane.seymour@hpe.com>
Reviewed-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/snic/snic_ctl.c