librbd: validate copy size against proper snapshot id

Fixes: #3383
Signed-off-by: Dan Mick <dan.mick@inktank.com>

diff --git a/src/librbd/internal.cc b/src/librbd/internal.cc
index 977d7d9ceb8edc5c045c901c2d7db4ae21272b06..982d147e69294c2813f66ef3c9356518a4de9708 100644 (file)
--- a/src/librbd/internal.cc
+++ b/src/librbd/internal.cc
@@ -1760,7 +1760,7 @@ reprotect_and_return_err:
 
     dest->md_lock.Lock();
     dest->snap_lock.Lock();
-    uint64_t dest_size = dest->get_image_size(src->snap_id);
+    uint64_t dest_size = dest->get_image_size(dest->snap_id);
     dest->snap_lock.Unlock();
     dest->md_lock.Unlock();