From: Aleksei Gutikov <aleksey.gutikov@synesis.ru>
Date: Thu, 3 May 2018 16:20:40 +0000 (+0300)
Subject: librados: fix buffer overflow for aio_exec python binding
X-Git-Tag: v13.2.1~82^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=646b31075f5447b02a1e8985d231ef697c8aa7ba;p=ceph.git

librados: fix buffer overflow for aio_exec python binding

aio_exec returns ERANGE if provided buffer is not enough.

Fixes: https://tracker.ceph.com/issues/23964

Signed-off-by: Aleksei Gutikov <aleksey.gutikov@synesis.ru>
(cherry picked from commit 2ac2592e1d5548b40f7311840360968040614208)
---

diff --git a/src/librados/IoCtxImpl.cc b/src/librados/IoCtxImpl.cc
index cc8d7a27ead3..3dbc8235bbe4 100644
--- a/src/librados/IoCtxImpl.cc
+++ b/src/librados/IoCtxImpl.cc
@@ -2017,9 +2017,11 @@ void librados::IoCtxImpl::C_aio_Complete::finish(int r)
   c->cond.Signal();
 
   if (r == 0 && c->blp && c->blp->length() > 0) {
-    if (c->out_buf && !c->blp->is_provided_buffer(c->out_buf))
-      c->blp->copy(0, c->blp->length(), c->out_buf);
-    c->rval = c->blp->length();
+    if (c->out_buf && !c->blp->is_contiguous()) {
+      c->rval = -ERANGE;
+    } else {
+      c->rval = c->blp->length();
+    }
   }
 
   if (c->callback_complete ||