Xi Wang 76aa542fb9 ceph: fix bounds check in ceph_decode_need and ceph_encode_need
Given a large n, the bounds check (*p + n > end) can be bypassed due to
pointer wraparound.  A safer check is (n > end - *p).

[elder@dreamhost.com: inverted test and renamed ceph_has_room()]

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
2012-05-14 12:12:27 -05:00
..
2012-01-17 22:39:40 -06:00
2012-03-08 00:30:32 -08:00
2012-01-04 09:17:45 -08:00
2012-02-07 15:54:02 -08:00