rbd: Prevent Seg fault by checking read result in snap_read_header()

Signed-off-by: David Zafman <david.zafman@inktank.com>

diff --git a/src/cls/rbd/cls_rbd.cc b/src/cls/rbd/cls_rbd.cc
index 9348d5d7ad59a3acbed6f85f0766b20f7bac14f4..065d82f35f463d46d4d43e8a29d2d842b3cd81b7 100644 (file)
--- a/src/cls/rbd/cls_rbd.cc
+++ b/src/cls/rbd/cls_rbd.cc
@@ -115,7 +115,11 @@ static int snap_read_header(cls_method_context_t hctx, bufferlist& bl)
     if (rc < 0)
       return rc;
 
+    if (bl.length() < sizeof(*header))
+      return -EINVAL;
+
     header = (struct rbd_obj_header_ondisk *)bl.c_str();
+    assert(header);
 
     if ((snap_count != header->snap_count) ||
         (snap_names_len != header->snap_names_len)) {