tree e0229258f8f389c790f29af687cf5c13911c9bf3
parent e91a9b639a691e0982088b5954eaafb5a25c8f1c
author Xi Wang <xi.wang@gmail.com> 1339029355 -0500
committer Alex Elder <elder@dreamhost.com> 1339075696 -0500

libceph: fix overflow in osdmap_apply_incremental()

On 32-bit systems, a large `pglen' would overflow `pglen*sizeof(u32)'
and bypass the check ceph_decode_need(p, end, pglen*sizeof(u32), bad).
It would also overflow the subsequent kmalloc() size, leading to
out-of-bounds write.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>