76aa542fb9
Given a large n, the bounds check (*p + n > end) can be bypassed due to pointer wraparound. A safer check is (n > end - *p). [elder@dreamhost.com: inverted test and renamed ceph_has_room()] Signed-off-by: Xi Wang <xi.wang@gmail.com> Reviewed-by: Alex Elder <elder@dreamhost.com> |
||
---|---|---|
.. | ||
auth.h | ||
buffer.h | ||
ceph_debug.h | ||
ceph_frag.h | ||
ceph_fs.h | ||
ceph_hash.h | ||
debugfs.h | ||
decode.h | ||
libceph.h | ||
mdsmap.h | ||
messenger.h | ||
mon_client.h | ||
msgpool.h | ||
msgr.h | ||
osd_client.h | ||
osdmap.h | ||
pagelist.h | ||
rados.h | ||
types.h |