crush/CrushWrapper: fix out of bounds access

Fixes: http://tracker.ceph.com/issues/20926
Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/crush/CrushWrapper.cc b/src/crush/CrushWrapper.cc
index 9c03358aad3c87012e95e2d8d03bc226a8acab65..05e031c86f5e048c081e8d3f3a58b19215549fdd 100644 (file)
--- a/src/crush/CrushWrapper.cc
+++ b/src/crush/CrushWrapper.cc
@@ -1916,7 +1916,7 @@ int CrushWrapper::device_class_clone(
     // pick a new shadow bucket id that is not used by the current map
     // *or* any previous shadow buckets.
     bno = -1;
-    while (crush->buckets[-1-bno] ||
+    while (((-1-bno) < crush->max_buckets && crush->buckets[-1-bno]) ||
           used_ids.count(bno)) {
       --bno;
     }