From: Adam C. Emerson <aemerson@redhat.com>
Date: Mon, 24 Jul 2017 20:10:11 +0000 (-0400)
Subject: rgw: Fix use after free in IAM policy parser
X-Git-Tag: v12.1.3~30
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=39ae5560bb53e28ea8ad6cfcda1eb64d58603e1c;p=ceph.git

rgw: Fix use after free in IAM policy parser

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
(cherry picked from commit 8377ba6525de5ebfe33a7dda14f17d96e8ac4ef4)
---

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index 9320fd50d779..309b3bab5a36 100644
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -688,9 +688,10 @@ bool ParseState::key(const char* s, size_t l) {
 
   if (!k) {
     if (w->kind == TokenKind::cond_op) {
+      auto id = w->id;
       auto& t = pp->policy.statements.back();
       pp->s.emplace_back(pp, cond_key);
-      t.conditions.emplace_back(w->id, s, l, cond_ifexists);
+      t.conditions.emplace_back(id, s, l, cond_ifexists);
       return true;
     } else {
       return false;