From: Aleksei Gutikov <aleksey.gutikov@synesis.ru>
Date: Thu, 3 May 2018 16:20:40 +0000 (+0300)
Subject: librados: fix buffer overflow for aio_exec python binding
X-Git-Tag: v12.2.8~42^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=197c0d5bc5a25c93f74852733b1cb4539ec59bf1;p=ceph.git

librados: fix buffer overflow for aio_exec python binding

aio_exec returns ERANGE if provided buffer is not enough.

Fixes: https://tracker.ceph.com/issues/23964

Signed-off-by: Aleksei Gutikov <aleksey.gutikov@synesis.ru>
(cherry picked from commit 2ac2592e1d5548b40f7311840360968040614208)
---

diff --git a/src/librados/IoCtxImpl.cc b/src/librados/IoCtxImpl.cc
index dbd0818da615..b2a3f1701640 100644
--- a/src/librados/IoCtxImpl.cc
+++ b/src/librados/IoCtxImpl.cc
@@ -2017,9 +2017,11 @@ void librados::IoCtxImpl::C_aio_Complete::finish(int r)
   c->cond.Signal();
 
   if (r == 0 && c->blp && c->blp->length() > 0) {
-    if (c->out_buf && !c->blp->is_provided_buffer(c->out_buf))
-      c->blp->copy(0, c->blp->length(), c->out_buf);
-    c->rval = c->blp->length();
+    if (c->out_buf && !c->blp->is_contiguous()) {
+      c->rval = -ERANGE;
+    } else {
+      c->rval = c->blp->length();
+    }
   }
 
   if (c->callback_complete ||