osd: Even in objects_read_sync() case don't read past oi.size

Fixes: #11511
Signed-off-by: David Zafman <dzafman@redhat.com>

diff --git a/src/osd/ReplicatedPG.cc b/src/osd/ReplicatedPG.cc
index 6fbf139f6964247952209801c98f92965a31d401..5e0d5771f57cbf4046388a08247a505cf9175caa 100644 (file)
--- a/src/osd/ReplicatedPG.cc
+++ b/src/osd/ReplicatedPG.cc
@@ -6059,13 +6059,14 @@ int ReplicatedPG::fill_in_copy_get(
   bufferlist& bl = reply_obj.data;
   if (left > 0 && !cursor.data_complete) {
     if (cursor.data_offset < oi.size) {
+      left = MIN(oi.size - cursor.data_offset, (uint64_t)left);
       if (cb) {
        async_read_started = true;
        ctx->pending_async_reads.push_back(
          make_pair(
            boost::make_tuple(cursor.data_offset, left, osd_op.op.flags),
            make_pair(&bl, cb)));
-       result = MIN(oi.size - cursor.data_offset, (uint64_t)left);
+        result = left;
        cb->len = result;
       } else {
        result = pgbackend->objects_read_sync(