diff options
| author | Xi Wang <xi.wang@gmail.com> | 2012-04-20 16:49:44 -0400 |
|---|---|---|
| committer | Alex Elder <elder@dreamhost.com> | 2012-05-14 13:12:41 -0400 |
| commit | 50f7c4c967d0b5acd8e7ba6ab654dc4a7ac869ac (patch) | |
| tree | a37aa5a2aad9e434bf6b77e0b65601b6e30589b2 /drivers/block/DAC960.h | |
| parent | f8ad495a8a0277b88c59bf38319e5e944aaf5a4a (diff) | |
rbd: fix integer overflow in rbd_header_from_disk()
ondisk->snap_count is read from disk via rbd_req_sync_read() and thus
needs validation. Otherwise, a bogus `snap_count' could overflow the
kmalloc() size, leading to memory corruption.
Also use `u32' consistently for `snap_count'.
[elder@dreamhost.com: changed to use UINT_MAX rather than ULONG_MAX]
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
Diffstat (limited to 'drivers/block/DAC960.h')
0 files changed, 0 insertions, 0 deletions