Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Dan Carpenter 188b9a3e87 libceph: NULL deref on crush_decode() error path ...

commit 293dffaad8 upstream.

If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation.  The current code
returns ERR_PTR(0) which is NULL.  The callers are not expecting that
and it results in a NULL dereference.

Fixes: f24e9980eb ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

2017-09-15 18:29:49 +01:00

1799 lines

40 KiB

Raw Permalink Blame History