Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14118df4 authored by Ilya Dryomov's avatar Ilya Dryomov Committed by Greg Kroah-Hartman
Browse files

libceph: weaken sizeof check in ceph_x_verify_authorizer_reply() 



commit f1d10e04 upstream.

Allow for extending ceph_x_authorize_reply in the future.

Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Reviewed-by: default avatarSage Weil <sage@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fd6cc33d

net/ceph/auth_x.c

+4 −2
Original line number Diff line number Diff line
@@ -737,8 +737,10 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac, 
	ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN);

	if (ret < 0)

		return ret;

	if (ret != sizeof(*reply))

		return -EPERM;

	if (ret < sizeof(*reply)) {

		pr_err("bad size %d for ceph_x_authorize_reply\n", ret);

		return -EINVAL;

	}



	if (au->nonce + 1 != le64_to_cpu(reply->nonce_plus_one))

		ret = -EPERM;