From: Dan Carpenter <error27@gmail.com>
To: Eric Moore <Eric.Moore@lsi.com>
Cc: support@lsi.com, DL-MPTFusionLinux@lsi.com, linux-scsi@vger.kernel.org
Subject: bug report: fusion: odd range check in mptbase
Date: Sun, 28 Mar 2010 14:26:56 +0300 [thread overview]
Message-ID: <20100328112656.GN5069@bicker> (raw)
Hi, I'm just going through some Smatch results and couldn't figure out
what to do with this:
drivers/message/fusion/mptbase.c +7850 mpt_sas_log_info() 'originator_str' 3 <= 3
7846 if ((sas_loginfo.dw.bus_type != 3 /*SAS*/) &&
7847 (sas_loginfo.dw.originator < ARRAY_SIZE(originator_str)))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7848 return;
7849
7850 originator_desc = originator_str[sas_loginfo.dw.originator];
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If sas_loginfo.dw.originator is == ARRAY_SIZE(originator_str) that would
be a buffer overflow on line 7850.
regards,
dan carpenter
next reply other threads:[~2010-03-28 11:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-28 11:26 Dan Carpenter [this message]
2010-03-31 12:48 ` bug report: fusion: odd range check in mptbase Desai, Kashyap
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100328112656.GN5069@bicker \
--to=error27@gmail.com \
--cc=DL-MPTFusionLinux@lsi.com \
--cc=Eric.Moore@lsi.com \
--cc=linux-scsi@vger.kernel.org \
--cc=support@lsi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox