From 7223646c5de3a761378de897e45dff93e866506c Mon Sep 17 00:00:00 2001 From: Sage Weil Date: Tue, 13 Oct 2015 09:55:01 -0400 Subject: [PATCH] crush/mapper: ensure take bucket value is valid Ensure that the take argument is a valid bucket ID before indexing the buckets array. Signed-off-by: Sage Weil (cherry picked from commit 93ec538e8a667699876b72459b8ad78966d89c61) (cherry picked from commit a52f7cb372339dffbeed7dae8ce2680586760754) --- src/crush/mapper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/crush/mapper.c b/src/crush/mapper.c index 3faf6f5804037..22ee5b93dcab9 100644 --- a/src/crush/mapper.c +++ b/src/crush/mapper.c @@ -841,7 +841,8 @@ int crush_do_rule(const struct crush_map *map, case CRUSH_RULE_TAKE: if ((curstep->arg1 >= 0 && curstep->arg1 < map->max_devices) || - (-1-curstep->arg1 < map->max_buckets && + (-1-curstep->arg1 >= 0 && + -1-curstep->arg1 < map->max_buckets && map->buckets[-1-curstep->arg1])) { w[0] = curstep->arg1; wsize = 1; -- 2.39.5