Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1343555 > unrolled thread

[PATCH] snic: correctly check for array overrun on overly long version number

Back to article view | Back to linux.kernel

Contents

  [PATCH] snic: correctly check for array overrun on overly long version number Colin King <colin.king@canonical.com> - 2016-02-26 00:00 +0100
    RE: [PATCH] snic: correctly check for array overrun on overly long  version number "Seymour, Shane M" <shane.seymour@hpe.com> - 2016-03-01 06:40 +0100
    Re: [PATCH] snic: correctly check for array overrun on overly long  version number Ewan Milne <emilne@redhat.com> - 2016-03-01 18:30 +0100
    Re: [PATCH] snic: correctly check for array overrun on overly long version number "Martin K. Petersen" <martin.petersen@oracle.com> - 2016-03-02 02:20 +0100
    Re: [PATCH] snic: correctly check for array overrun on overly long  version number "Narsimhulu Musini (nmusini)" <nmusini@cisco.com> - 2016-03-02 10:10 +0100

#1343555 — [PATCH] snic: correctly check for array overrun on overly long version number

From: Colin Ian King <colin.king@canonical.com>

The snic version number is expected to be 4 decimals in the form like
a netmask string with each number stored in an element in array v.
However, there is an off-by-one check on the number of elements in v
allowing one to pass a 5 decimal version number causing v[4] to be
referenced, causing a buffer overrun.  Fix the off-by-one error by
comparing to i > 3 rather than 4.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/scsi/snic/snic_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
index aebe753..ab0e06b 100644
--- a/drivers/scsi/snic/snic_ctl.c
+++ b/drivers/scsi/snic/snic_ctl.c
@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
 			continue;
 		}
 
-		if (i > 4 || !isdigit(c))
+		if (i > 3 || !isdigit(c))
 			goto end;
 
 		v[i] = v[i] * 10 + (c - '0');
-- 
2.7.0

[toc] | [next] | [standalone]

#1346377 — RE: [PATCH] snic: correctly check for array overrun on overly long version number

Reviewed-by: Shane Seymour <shane.seymour@hpe.com>

[toc] | [prev] | [next] | [standalone]

#1346795 — Re: [PATCH] snic: correctly check for array overrun on overly long version number

On Thu, 2016-02-25 at 22:58 +0000, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> The snic version number is expected to be 4 decimals in the form like
> a netmask string with each number stored in an element in array v.
> However, there is an off-by-one check on the number of elements in v
> allowing one to pass a 5 decimal version number causing v[4] to be
> referenced, causing a buffer overrun.  Fix the off-by-one error by
> comparing to i > 3 rather than 4.
> 
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
>  drivers/scsi/snic/snic_ctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
> index aebe753..ab0e06b 100644
> --- a/drivers/scsi/snic/snic_ctl.c
> +++ b/drivers/scsi/snic/snic_ctl.c
> @@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
>  			continue;
>  		}
>  
> -		if (i > 4 || !isdigit(c))
> +		if (i > 3 || !isdigit(c))
>  			goto end;
>  
>  		v[i] = v[i] * 10 + (c - '0');

        int v[4] = {0};

So clearly the i > 4 test is wrong and should be i > 3.

Reviewed-by: Ewan D. Milne <emilne@redhat.com>

[toc] | [prev] | [next] | [standalone]

#1347435

>>>>> "Colin" == Colin King <colin.king@canonical.com> writes:

Colin> The snic version number is expected to be 4 decimals in the form
Colin> like a netmask string with each number stored in an element in
Colin> array v.  However, there is an off-by-one check on the number of
Colin> elements in v allowing one to pass a 5 decimal version number
Colin> causing v[4] to be referenced, causing a buffer overrun.  Fix the
Colin> off-by-one error by comparing to i > 3 rather than 4.

Applied to 4.6/scsi-queue.

-- 
Martin K. Petersen	Oracle Linux Engineering

[toc] | [prev] | [next] | [standalone]

#1347864 — Re: [PATCH] snic: correctly check for array overrun on overly long version number

On 26/02/16 4:28 am, "Colin King" <colin.king@canonical.com> wrote:

>From: Colin Ian King <colin.king@canonical.com>
>
>The snic version number is expected to be 4 decimals in the form like
>a netmask string with each number stored in an element in array v.
>However, there is an off-by-one check on the number of elements in v
>allowing one to pass a 5 decimal version number causing v[4] to be
>referenced, causing a buffer overrun.  Fix the off-by-one error by
>comparing to i > 3 rather than 4.
Acked-by: Narsimhulu Musini <nmusini@cisco.com>

>
>Signed-off-by: Colin Ian King <colin.king@canonical.com>
>---
> drivers/scsi/snic/snic_ctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
>index aebe753..ab0e06b 100644
>--- a/drivers/scsi/snic/snic_ctl.c
>+++ b/drivers/scsi/snic/snic_ctl.c
>@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
> 			continue;
> 		}
> 
>-		if (i > 4 || !isdigit(c))
>+		if (i > 3 || !isdigit(c))
> 			goto end;
> 
> 		v[i] = v[i] * 10 + (c - '0');
>-- 
>2.7.0
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web