tree 20a5127aaa57f0b727c45ce780993b850ae6b36d
parent 43643528cce60ca184fe8197efa8e8da7c89a037
author Xi Wang <xi.wang@gmail.com> 1339029355 -0500
committer Alex Elder <elder@dreamhost.com> 1339075684 -0500

libceph: fix overflow in __decode_pool_names()

`len' is read from network and thus needs validation.  Otherwise a
large `len' would cause out-of-bounds access via the memcpy() call.
In addition, len = 0xffffffff would overflow the kmalloc() size,
leading to out-of-bounds write.

This patch adds a check of `len' via ceph_decode_need().  Also use
kstrndup rather than kmalloc/memcpy.

[elder@inktank.com: added -ENOMEM return for null kstrndup() result]

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@inktank.com>