All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ilya Dryomov <idryomov@gmail.com>
To: ceph-devel@vger.kernel.org
Subject: [PATCH 4/5] libceph: validate blob_struct_v in process_one_ticket()
Date: Tue, 23 May 2017 18:33:57 +0200	[thread overview]
Message-ID: <1495557238-1077-5-git-send-email-idryomov@gmail.com> (raw)
In-Reply-To: <1495557238-1077-1-git-send-email-idryomov@gmail.com>

None of these are validated in userspace, but since we do validate
reply_struct_v in ceph_x_proc_ticket_reply(), tkt_struct_v (first) and
CephXServiceTicket struct_v (second) in process_one_ticket(), validate
CephXTicketBlob struct_v as well.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 net/ceph/auth_x.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 2034fb926670..d0126df33f1f 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -215,6 +215,9 @@ static int process_one_ticket(struct ceph_auth_client *ac,
 	dout(" ticket blob is %d bytes\n", dlen);
 	ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
 	blob_struct_v = ceph_decode_8(ptp);
+	if (blob_struct_v != 1)
+		goto bad;
+
 	new_secret_id = ceph_decode_64(ptp);
 	ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
 	if (ret)
-- 
2.4.3


  parent reply	other threads:[~2017-05-23 16:34 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-23 16:33 [PATCH 0/5] libceph: trivial warning fixes Ilya Dryomov
2017-05-23 16:33 ` [PATCH 1/5] libceph: use kbasename() and kill ceph_file_part() Ilya Dryomov
2017-05-23 17:39   ` Alex Elder
2017-05-23 16:33 ` [PATCH 2/5] libceph: make ceph_msg_data_advance() return void Ilya Dryomov
2017-05-23 17:41   ` Alex Elder
2017-05-23 16:33 ` [PATCH 3/5] libceph: drop version variable from ceph_monmap_decode() Ilya Dryomov
2017-05-23 17:42   ` Alex Elder
2017-05-23 16:33 ` Ilya Dryomov [this message]
2017-05-23 17:44   ` [PATCH 4/5] libceph: validate blob_struct_v in process_one_ticket() Alex Elder
2017-05-23 18:40     ` Ilya Dryomov
2017-05-23 16:33 ` [PATCH 5/5] libceph: fix error handling " Ilya Dryomov
2017-05-23 17:47   ` Alex Elder

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1495557238-1077-5-git-send-email-idryomov@gmail.com \
    --to=idryomov@gmail.com \
    --cc=ceph-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.