From 8fe79162a6807bf120140d64e96da54fc273b88b Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Tue, 8 Dec 2009 14:08:57 -0800 Subject: [SCSI] eata: fix buffer overflow Allows i == MAX_INT_PARAM, which is out of range. Signed-off-by: Roel Kluin Signed-off-by: Andrew Morton Signed-off-by: James Bottomley --- drivers/scsi/eata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/scsi/eata.c') diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c index c7076ce25e2..3c5abf7cd76 100644 --- a/drivers/scsi/eata.c +++ b/drivers/scsi/eata.c @@ -1509,7 +1509,7 @@ static int option_setup(char *str) char *cur = str; int i = 1; - while (cur && isdigit(*cur) && i <= MAX_INT_PARAM) { + while (cur && isdigit(*cur) && i < MAX_INT_PARAM) { ints[i++] = simple_strtoul(cur, NULL, 0); if ((cur = strchr(cur, ',')) != NULL) -- cgit v1.2.3-70-g09d2