]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
libceph: do not hard code max auth ticket len
authorIlya Dryomov <ilya.dryomov@inktank.com>
Tue, 9 Sep 2014 15:39:15 +0000 (19:39 +0400)
committerJiri Slaby <jslaby@suse.cz>
Wed, 17 Sep 2014 15:06:53 +0000 (17:06 +0200)
commit0884f8d4139431deb0b98ba0d6fb2d17e2c25c84
treed6a8da0905a86e1f83f6dc8636a8543d55ad773a
parent113fde589ce46f4ea8d4947cec2e03f7bc3e3cdd
libceph: do not hard code max auth ticket len

commit c27a3e4d667fdcad3db7b104f75659478e0c68d8 upstream.

We hard code cephx auth ticket buffer size to 256 bytes.  This isn't
enough for any moderate setups and, in case tickets themselves are not
encrypted, leads to buffer overflows (ceph_x_decrypt() errors out, but
ceph_decode_copy() doesn't - it's just a memcpy() wrapper).  Since the
buffer is allocated dynamically anyway, allocated it a bit later, at
the point where we know how much is going to be needed.

Fixes: http://tracker.ceph.com/issues/8979
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
net/ceph/auth_x.c