From: Ruifeng Yang <149233652@qq.com>
Date: Sun, 2 Aug 2015 08:16:05 +0000 (+0800)
Subject: rgw:segmentation fault when rgw_gc_max_objs > HASH_PRIME
X-Git-Tag: v9.1.0~387^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=e3147b8ddcaafafde9ce2029f7af5062e22076d3;p=ceph.git

rgw:segmentation fault when rgw_gc_max_objs > HASH_PRIME

obj_names[] is index out of bounds when rgw_gc_max_objs > HASH_PRIME

Fixes: #12630
Signed-off-by: Ruifeng Yang <149233652@qq.com>
---

diff --git a/src/rgw/rgw_gc.cc b/src/rgw/rgw_gc.cc
index 70f5691d6d44..3a949b6821aa 100644
--- a/src/rgw/rgw_gc.cc
+++ b/src/rgw/rgw_gc.cc
@@ -95,7 +95,7 @@ int RGWGC::list(int *index, string& marker, uint32_t max, bool expired_only, std
 {
   result.clear();
 
-  for (; *index < cct->_conf->rgw_gc_max_objs && result.size() < max; (*index)++, marker.clear()) {
+  for (; *index < max_objs && result.size() < max; (*index)++, marker.clear()) {
     std::list<cls_rgw_gc_obj_info> entries;
     int ret = cls_rgw_gc_list(store->gc_pool_ctx, obj_names[*index], marker, max - result.size(), expired_only, entries, truncated);
     if (ret == -ENOENT)
@@ -108,7 +108,7 @@ int RGWGC::list(int *index, string& marker, uint32_t max, bool expired_only, std
       result.push_back(*iter);
     }
 
-    if (*index == cct->_conf->rgw_gc_max_objs - 1) {
+    if (*index == max_objs - 1) {
       /* we cut short here, truncated will hold the correct value */
       return 0;
     }
@@ -234,7 +234,6 @@ done:
 
 int RGWGC::process()
 {
-  int max_objs = cct->_conf->rgw_gc_max_objs;
   int max_secs = cct->_conf->rgw_gc_processor_max_time;
 
   unsigned start;