Searched hist:a5506049 (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/net/ceph/ |
| H A D | osdmap.c | a5506049 Wed Jun 06 19:35:55 CDT 2012 Xi Wang <xi.wang@gmail.com> libceph: fix overflow in osdmap_apply_incremental()
On 32-bit systems, a large `pglen' would overflow `pglen*sizeof(u32)'
and bypass the check ceph_decode_need(p, end, pglen*sizeof(u32), bad).
It would also overflow the subsequent kmalloc() size, leading to
out-of-bounds write.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>
a5506049 Wed Jun 06 19:35:55 CDT 2012 Xi Wang <xi.wang@gmail.com> libceph: fix overflow in osdmap_apply_incremental()
On 32-bit systems, a large `pglen' would overflow `pglen*sizeof(u32)'
and bypass the check ceph_decode_need(p, end, pglen*sizeof(u32), bad).
It would also overflow the subsequent kmalloc() size, leading to
out-of-bounds write.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>
|