Xi Wang
a550604950
libceph: fix overflow in osdmap_apply_incremental() ...
On 32-bit systems, a large `pglen' would overflow `pglen*sizeof(u32)'
and bypass the check ceph_decode_need(p, end, pglen*sizeof(u32), bad).
It would also overflow the subsequent kmalloc() size, leading to
out-of-bounds write.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>
2012-06-07 08:28:16 -05:00
2012-01-12 15:44:42 +10:30
2011-10-31 19:30:30 -04:00
2011-12-14 02:39:30 -05:00
2011-10-31 19:30:30 -04:00
2012-02-22 02:23:25 -05:00
2011-12-28 14:08:08 -05:00
2011-12-16 15:07:28 -05:00
2012-02-15 13:09:26 +02:00
2012-03-08 00:25:25 -08:00
2012-02-02 14:35:12 -05:00
2011-10-17 19:22:46 -04:00
2012-06-07 08:28:16 -05:00
2012-03-04 22:02:55 -05:00
2011-10-31 19:30:30 -04:00
2012-01-11 12:56:06 -08:00
2012-01-14 18:36:33 -08:00
2011-11-29 00:21:36 -05:00
2011-11-18 14:37:09 -05:00
2011-09-15 14:49:44 -04:00
2011-11-18 14:37:09 -05:00
2012-03-11 15:52:12 -07:00
2012-03-16 21:56:42 -07:00
2011-10-31 19:30:30 -04:00
2011-12-21 15:46:22 -05:00
2011-12-20 14:05:03 -05:00
2011-12-11 18:25:16 -05:00
2012-01-25 21:45:00 -05:00
2011-09-16 19:20:20 -04:00
2012-01-24 15:33:19 -05:00
2012-02-21 14:45:27 -05:00
2012-03-17 01:47:08 -07:00
2012-01-12 12:26:56 -08:00
2012-01-14 18:36:33 -08:00
2011-12-28 14:08:08 -05:00
2012-01-04 14:30:43 -05:00
2012-03-07 14:36:57 -08:00
2011-12-30 13:04:14 -05:00
2012-01-12 12:26:56 -08:00
2012-01-24 17:03:44 -05:00
2012-01-05 10:13:24 -05:00
2011-10-31 19:30:30 -04:00
2012-02-14 14:41:55 -05:00
2012-03-16 01:55:25 -07:00
2012-01-08 13:21:22 -08:00
2012-01-23 14:03:46 -08:00
2011-12-29 21:53:30 -05:00
2012-01-30 12:45:07 -05:00
2011-11-07 13:27:30 -05:00
2011-10-31 19:30:30 -04:00
2012-01-11 15:14:50 -05:00
2011-12-16 15:49:52 -05:00
2012-01-14 18:36:33 -08:00
2011-10-31 19:30:30 -04:00
2011-12-03 09:35:17 -08:00
2011-12-03 09:35:17 -08:00
2012-01-12 12:26:56 -08:00
2011-10-31 19:30:30 -04:00
a550604950