rgw/copy-object: Fix overflow with bufferlist copy

This fixes the issue with bufferlist copy overflow in the `copy-object`
Op path.

Resolves: rhbz#2321269

Reviewed-by: Marcus Watts <mwatts@redhat.com>
Signed-off-by: Soumya Koduri <skoduri@redhat.com>
(cherry picked from commit 95ac4e63be73790474c03d3cd314fec7983f12e9)

diff --git a/src/rgw/rgw_compression.cc b/src/rgw/rgw_compression.cc
index 36c37886c03396ed13c7ebdc7f8658eae63ec17c..71b358598dcd5dd791ff344ba91ba20f4a3afd88 100644 (file)
--- a/src/rgw/rgw_compression.cc
+++ b/src/rgw/rgw_compression.cc
@@ -115,7 +115,7 @@ int RGWGetObj_Decompress::handle_data(bufferlist& bl, off_t bl_ofs, off_t bl_len
     return -EIO;
   }
   bufferlist out_bl, in_bl, temp_in_bl;
-  bl.begin(bl_ofs).copy(bl_len, temp_in_bl);
+  bl.begin().copy(bl_len, temp_in_bl);
   bl_ofs = 0;
   int r = 0;
   if (waiting.length() != 0) {

diff --git a/src/rgw/rgw_crypt.cc b/src/rgw/rgw_crypt.cc
index 3bcebd43e515fa73cb3c32966306580f7328791c..bb8ee8442532ef5468ca8568dd6a05150ab7f19c 100644 (file)
--- a/src/rgw/rgw_crypt.cc
+++ b/src/rgw/rgw_crypt.cc
@@ -772,7 +772,7 @@ int RGWGetObj_BlockDecrypt::process(bufferlist& in, size_t part_ofs, size_t size
 
 int RGWGetObj_BlockDecrypt::handle_data(bufferlist& bl, off_t bl_ofs, off_t bl_len) {
   ldpp_dout(this->dpp, 25) << "Decrypt " << bl_len << " bytes" << dendl;
-  bl.begin(bl_ofs).copy(bl_len, cache);
+  bl.begin().copy(bl_len, cache);
 
   int res = 0;
   size_t part_ofs = ofs;

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 66264abfbfe707c636f92973778b76b1fbf4c060..255dfd3370d8fdc001c7d5af1180ce73489c2ba2 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -5962,7 +5962,7 @@ public:
     }
     uint64_t read_len = bl_len;
     bufferlist copy;
-    bl.begin(bl_ofs).copy(bl_len, copy);
+    bl.begin().copy(read_len, copy);
     int ret = processor->process(std::move(copy), ofs);
     if (ret < 0) return ret;
     ofs += read_len;