crush/CrushWrapper: fix out of bounds access

Fixes: http://tracker.ceph.com/issues/20926
Signed-off-by: Sage Weil <sage@redhat.com>
(cherry picked from commit bf494e94556f9a4a27e17347f428abe8acda6e05)

diff --git a/src/crush/CrushWrapper.cc b/src/crush/CrushWrapper.cc
index 770c472c49a67beb440f503ec806a343c22aca98..8f2d63e77c8cc3d637f8e481c3f3fd14386eb58a 100644 (file)
--- a/src/crush/CrushWrapper.cc
+++ b/src/crush/CrushWrapper.cc
@@ -1869,7 +1869,7 @@ int CrushWrapper::device_class_clone(
     // pick a new shadow bucket id that is not used by the current map
     // *or* any previous shadow buckets.
     bno = -1;
-    while (crush->buckets[-1-bno] ||
+    while (((-1-bno) < crush->max_buckets && crush->buckets[-1-bno]) ||
           used_ids.count(bno)) {
       --bno;
     }