libceph: fix overflow in __decode_pool_names()
authorXi Wang <xi.wang@gmail.com>
Thu, 7 Jun 2012 00:35:55 +0000 (19:35 -0500)
committerAlex Elder <elder@dreamhost.com>
Thu, 7 Jun 2012 13:28:04 +0000 (08:28 -0500)
commitad3b904c07dfa88603689bf9a67bffbb9b99beb5
tree20a5127aaa57f0b727c45ce780993b850ae6b36d
parent43643528cce60ca184fe8197efa8e8da7c89a037
libceph: fix overflow in __decode_pool_names()

`len' is read from network and thus needs validation.  Otherwise a
large `len' would cause out-of-bounds access via the memcpy() call.
In addition, len = 0xffffffff would overflow the kmalloc() size,
leading to out-of-bounds write.

This patch adds a check of `len' via ceph_decode_need().  Also use
kstrndup rather than kmalloc/memcpy.

[elder@inktank.com: added -ENOMEM return for null kstrndup() result]

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>
net/ceph/osdmap.c