From: Sage Weil <sage@redhat.com>
Date: Mon, 7 Aug 2017 13:36:54 +0000 (-0400)
Subject: crush/CrushWrapper: fix out of bounds access
X-Git-Tag: v13.0.0~224^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F16869%2Fhead;p=ceph.git

crush/CrushWrapper: fix out of bounds access

Fixes: http://tracker.ceph.com/issues/20926
Signed-off-by: Sage Weil <sage@redhat.com>
---

diff --git a/src/crush/CrushWrapper.cc b/src/crush/CrushWrapper.cc
index 9c03358aad3c..05e031c86f5e 100644
--- a/src/crush/CrushWrapper.cc
+++ b/src/crush/CrushWrapper.cc
@@ -1916,7 +1916,7 @@ int CrushWrapper::device_class_clone(
     // pick a new shadow bucket id that is not used by the current map
     // *or* any previous shadow buckets.
     bno = -1;
-    while (crush->buckets[-1-bno] ||
+    while (((-1-bno) < crush->max_buckets && crush->buckets[-1-bno]) ||
 	   used_ids.count(bno)) {
       --bno;
     }