Willy Tarreau 28c7411cdb char: lp: fix possible integer overflow in lp_setup() ...

commit 3e21f4af17 upstream.

The lp_setup() code doesn't apply any bounds checking when passing
"lp=none", and only in this case, resulting in an overflow of the
parport_nr[] array. All versions in Git history are affected.

Reported-By: Roee Hay <roee.hay@hcl.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-05-25 15:46:09 +02:00

26 KiB

Raw Blame History

View Raw