Given a large n, the bounds check (*p + n > end) can be bypassed due to pointer wraparound. A safer check is (n > end - *p). [elder@dreamhost.com: inverted test and renamed ceph_has_room()] Signed-off-by: Xi Wang <xi.wang@gmail.com> Reviewed-by: Alex Elder <elder@dreamhost.com> |
||
|---|---|---|
| .. | ||
| auth.h | ||
| buffer.h | ||
| ceph_debug.h | ||
| ceph_frag.h | ||
| ceph_fs.h | ||
| ceph_hash.h | ||
| debugfs.h | ||
| decode.h | ||
| libceph.h | ||
| mdsmap.h | ||
| messenger.h | ||
| mon_client.h | ||
| msgpool.h | ||
| msgr.h | ||
| osd_client.h | ||
| osdmap.h | ||
| pagelist.h | ||
| rados.h | ||
| types.h | ||