snic: correctly check for array overrun on overly long version number
The snic version number is expected to be 4 decimals in the form like a netmask string with each number stored in an element in array v. However, there is an off-by-one check on the number of elements in v allowing one to pass a 5 decimal version number causing v[4] to be referenced, causing a buffer overrun. Fix the off-by-one error by comparing to i > 3 rather than 4. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Shane Seymour <shane.seymour@hpe.com> Reviewed-by: Ewan Milne <emilne@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
a6d24143fc
commit
bbb7bace03
|
@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
|
|||
continue;
|
||||
}
|
||||
|
||||
if (i > 4 || !isdigit(c))
|
||||
if (i > 3 || !isdigit(c))
|
||||
goto end;
|
||||
|
||||
v[i] = v[i] * 10 + (c - '0');
|
||||
|
|
Loading…
Reference in a new issue