Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9902e682 authored by Ilya Dryomov's avatar Ilya Dryomov Committed by Sage Weil
Browse files

libceph: fix crush_decode() call site in osdmap_decode() 



The size of the memory area feeded to crush_decode() should be limited
not only by osdmap end, but also by the crush map length.  Also, drop
unnecessary dout() (dout() in crush_decode() conveys the same info) and
step past crush map only if it is decoded successfully.

Signed-off-by: default avatarIlya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: default avatarAlex Elder <elder@linaro.org>
parent 2d88b2e0

net/ceph/osdmap.c

+2 −5
Original line number Original line Diff line number Diff line
@@ -802,16 +802,13 @@ static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map) 




	/* crush */

	/* crush */

	ceph_decode_32_safe(p, end, len, e_inval);

	ceph_decode_32_safe(p, end, len, e_inval);

	dout("osdmap_decode crush len %d from off 0x%x\n", len,

	map->crush = crush_decode(*p, min(*p + len, end));

	     (int)(*p - start));

	ceph_decode_need(p, end, len, e_inval);

	map->crush = crush_decode(*p, end);

	*p += len;

	if (IS_ERR(map->crush)) {

	if (IS_ERR(map->crush)) {

		err = PTR_ERR(map->crush);

		err = PTR_ERR(map->crush);

		map->crush = NULL;

		map->crush = NULL;

		goto bad;

		goto bad;

	}

	}

	*p += len;





	/* ignore the rest */

	/* ignore the rest */

	*p = end;

	*p = end;