Searched hist:a5506049 (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/net/ceph/ |
H A D | osdmap.c | a5506049 Wed Jun 06 19:35:55 CDT 2012 Xi Wang <xi.wang@gmail.com> libceph: fix overflow in osdmap_apply_incremental()
On 32-bit systems, a large `pglen' would overflow `pglen*sizeof(u32)' and bypass the check ceph_decode_need(p, end, pglen*sizeof(u32), bad). It would also overflow the subsequent kmalloc() size, leading to out-of-bounds write.
Signed-off-by: Xi Wang <xi.wang@gmail.com> Reviewed-by: Alex Elder <elder@inktank.com> a5506049 Wed Jun 06 19:35:55 CDT 2012 Xi Wang <xi.wang@gmail.com> libceph: fix overflow in osdmap_apply_incremental() On 32-bit systems, a large `pglen' would overflow `pglen*sizeof(u32)' and bypass the check ceph_decode_need(p, end, pglen*sizeof(u32), bad). It would also overflow the subsequent kmalloc() size, leading to out-of-bounds write. Signed-off-by: Xi Wang <xi.wang@gmail.com> Reviewed-by: Alex Elder <elder@inktank.com>
|