lkml.org 
[lkml]   [2012]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH RESEND] ceph: fix length validation in parse_reply_info()
    Date
    "len" is read from network and thus needs validation.  Otherwise, given
    a bogus "len" value, p+len could be an out-of-bounds pointer, which is
    used in further parsing.

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    ---
    fs/ceph/mds_client.c | 2 ++
    1 files changed, 2 insertions(+), 0 deletions(-)

    diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
    index 23ab6a3..3cc9b0b 100644
    --- a/fs/ceph/mds_client.c
    +++ b/fs/ceph/mds_client.c
    @@ -262,6 +262,7 @@ static int parse_reply_info(struct ceph_msg *msg,
    /* trace */
    ceph_decode_32_safe(&p, end, len, bad);
    if (len > 0) {
    + ceph_decode_need(&p, end, len, bad);
    err = parse_reply_info_trace(&p, p+len, info, features);
    if (err < 0)
    goto out_bad;
    @@ -270,6 +271,7 @@ static int parse_reply_info(struct ceph_msg *msg,
    /* extra */
    ceph_decode_32_safe(&p, end, len, bad);
    if (len > 0) {
    + ceph_decode_need(&p, end, len, bad);
    err = parse_reply_info_extra(&p, p+len, info, features);
    if (err < 0)
    goto out_bad;
    --
    1.7.5.4


    \
     
     \ /
      Last update: 2012-01-15 04:29    [W:0.022 / U:58.956 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site