From: Ilya Dryomov Date: Thu, 13 Mar 2014 14:36:14 +0000 (+0200) Subject: libceph: safely decode max_osd value in osdmap_decode() X-Git-Tag: v3.15-rc1~61^2~33 X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=3977058c468b872c6bc5e5273bf911d791848643;p=karo-tx-linux.git libceph: safely decode max_osd value in osdmap_decode() max_osd value is not covered by any ceph_decode_need(). Use a safe version of ceph_decode_* macro to decode it. Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder --- diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index 298d076eee89..ec06010657b3 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -687,9 +687,10 @@ static int osdmap_set_max_osd(struct ceph_osdmap *map, int max) static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map) { u16 version; - u32 len, max, i; u32 epoch = 0; void *start = *p; + u32 max; + u32 len, i; int err; struct ceph_pg_pool_info *pi; @@ -736,7 +737,8 @@ static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map) ceph_decode_32_safe(p, end, map->flags, e_inval); - max = ceph_decode_32(p); + /* max_osd */ + ceph_decode_32_safe(p, end, max, e_inval); /* (re)alloc osd arrays */ err = osdmap_set_max_osd(map, max);