From 757b42c2ba302c6c4e3a3e38b869325e89b4e5f1 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Sun, 2 Aug 2020 21:22:13 +0000 Subject: [PATCH] qla2x00t: Fix two buffer overflows git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@9091 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- qla2x00t/qla_attr.c | 2 +- qla2x00t/qla_init.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/qla2x00t/qla_attr.c b/qla2x00t/qla_attr.c index e7cc73cc1..35ec12e6a 100644 --- a/qla2x00t/qla_attr.c +++ b/qla2x00t/qla_attr.c @@ -1754,7 +1754,7 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr, { scsi_qla_host_t *vha = shost_priv(class_to_shost(dev)); int rval = QLA_FUNCTION_FAILED; - uint16_t state[5]; + uint16_t state[6]; if (qla2x00_reset_active(vha)) ql_log(ql_log_warn, vha, 0x707c, diff --git a/qla2x00t/qla_init.c b/qla2x00t/qla_init.c index 4e2b6f5a1..8b50a71fd 100644 --- a/qla2x00t/qla_init.c +++ b/qla2x00t/qla_init.c @@ -1922,7 +1922,7 @@ qla2x00_fw_ready(scsi_qla_host_t *vha) unsigned long wtime, mtime, cs84xx_time; uint16_t min_wait; /* Minimum wait time if loop is down */ uint16_t wait_time; /* Wait time if loop is coming ready */ - uint16_t state[5]; + uint16_t state[6]; struct qla_hw_data *ha = vha->hw; if (!qla_firmware_active(vha)) {