From: Yehuda Sadeh <yehuda@redhat.com>
Date: Fri, 13 Apr 2018 02:23:19 +0000 (-0700)
Subject: json_formattable: fix out of bounds array entity removal
X-Git-Tag: v13.1.0~270^2~1
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=7809af7a91ba99f6cf6f71cc55198b15d94cccac;p=ceph.git

json_formattable: fix out of bounds array entity removal

Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>
---

diff --git a/src/common/ceph_json.cc b/src/common/ceph_json.cc
index 231eb0ee57e..f748bd290c4 100644
--- a/src/common/ceph_json.cc
+++ b/src/common/ceph_json.cc
@@ -809,7 +809,11 @@ int JSONFormattable::erase(const string& name)
     if (last_entity.is_obj) {
       parent->obj.erase(last_entity.name);
     } else {
-      parent->arr.erase(parent->arr.begin() + last_entity.index);
+      int index = (last_entity.index >= 0 ? last_entity.index : parent->arr.size() + last_entity.index);
+      if (index < 0 || (size_t)index >= parent->arr.size()) {
+        return 0;
+      }
+      parent->arr.erase(parent->arr.begin() + index);
     }
   }