From b2f5d1876ef9e30449f8d95df8fe0b6fd277f01c Mon Sep 17 00:00:00 2001 From: Matt Benjamin Date: Tue, 12 May 2026 12:48:43 -0400 Subject: [PATCH] rgwlc: fix a likely null dereference in LCObjsLister::get_obj() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Found by Opus 4.6: In get_obj() (lines 417-446), when obj_iter == list_results.objs.end() and the listing is truncated, the code calls fetch() to get the next batch. fetch() sets obj_iter = list_results.objs.begin(). But if the new fetch returns zero objects (possible if objects were deleted between listing batches, or due to filtering/race conditions), then begin() == end() and the code falls through to line 437: if (obj_iter->key.name == pre_obj.key.name) { This dereferences end() — undefined behavior / crash. The return-value check at line 445 (return obj_iter != list_results.objs.end()) comes too late; the dereference already happened. Fixes: https://tracker.ceph.com/issues/76790 Signed-off-by: Matt Benjamin Assisted-by: Claude Code, Opus 4.6 1M --- src/rgw/rgw_lc.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/rgw/rgw_lc.cc b/src/rgw/rgw_lc.cc index fdfbbc5abf25..53ad1326c7a5 100644 --- a/src/rgw/rgw_lc.cc +++ b/src/rgw/rgw_lc.cc @@ -527,6 +527,9 @@ public: } } delay(dpp); + if (obj_iter == list_results.objs.end()) { + return false; + } } if (obj_iter->key.name == pre_obj.key.name) { @@ -537,7 +540,7 @@ public: /* returning address of entry in objs */ *obj = &(*obj_iter); - return obj_iter != list_results.objs.end(); + return true; } rgw_bucket_dir_entry get_prev_obj() { -- 2.47.3