Xi Wang 76aa542fb9
ceph: fix bounds check in ceph_decode_need and ceph_encode_need ...
Given a large n, the bounds check (*p + n > end) can be bypassed due to
pointer wraparound. A safer check is (n > end - *p).
[elder@dreamhost.com: inverted test and renamed ceph_has_room()]
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
2012-05-14 12:12:27 -05:00
2012-02-23 22:07:55 +00:00
2012-05-14 12:12:27 -05:00
2012-05-07 15:39:35 -07:00
2012-02-13 20:39:05 -05:00
2012-02-21 13:29:06 +01:00
2012-02-10 14:24:31 -08:00
2012-02-06 15:15:20 -08:00
2012-02-18 15:24:05 -08:00
2012-02-07 07:51:30 +01:00
2012-02-08 20:03:14 +01:00
2012-02-26 09:44:55 -08:00
2012-03-04 15:51:42 -08:00
2012-02-20 19:46:36 +11:00
2012-02-08 09:19:42 +01:00
2012-02-13 20:45:38 -05:00
2012-03-02 10:38:33 +01:00
2012-02-21 16:56:45 -05:00
2012-02-15 09:45:53 +01:00
2012-03-05 15:49:42 -08:00
2012-03-05 15:49:43 -08:00
2012-02-15 13:10:15 -07:00
2012-03-04 09:34:15 -08:00
2012-03-02 11:38:15 -08:00
2012-02-21 16:56:45 -05:00
2012-03-05 15:49:42 -08:00
2012-02-24 11:42:50 -08:00
2012-02-23 16:50:45 -05:00
2012-02-21 17:24:20 -08:00
2012-02-28 15:06:33 -05:00
2012-03-02 10:51:00 +01:00
76aa542fb9