libceph: do not hard code max auth ticket len
authorIlya Dryomov <ilya.dryomov@inktank.com>
Tue, 9 Sep 2014 15:39:15 +0000 (19:39 +0400)
committerBen Hutchings <ben@decadent.org.uk>
Wed, 5 Nov 2014 20:27:42 +0000 (20:27 +0000)
commit3ab3b3b67868458de3b047e199c0efe8119ef0de
tree3bd0e1c38a614f5a5e200f42e8aecf840fc9ee91
parent7e8155c14784ed219a23b2ba01eedf946b27cb00
libceph: do not hard code max auth ticket len

commit c27a3e4d667fdcad3db7b104f75659478e0c68d8 upstream.

We hard code cephx auth ticket buffer size to 256 bytes.  This isn't
enough for any moderate setups and, in case tickets themselves are not
encrypted, leads to buffer overflows (ceph_x_decrypt() errors out, but
ceph_decode_copy() doesn't - it's just a memcpy() wrapper).  Since the
buffer is allocated dynamically anyway, allocated it a bit later, at
the point where we know how much is going to be needed.

Fixes: http://tracker.ceph.com/issues/8979

Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/ceph/auth_x.c