ivampiresp/Spdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

blob: Verify parsing does not run off end of page

Browse Source 
Change-Id: I2663e0518705ffd23afbb69c7ae5bf5aff001c85
Signed-off-by: Ben Walker <benjamin.walker@intel.com>
This commit is contained in:
Ben Walker 2017-03-28 16:17:54 -07:00
parent 0b89cff2ea
commit 97b3efa349
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/blob/blobstore.c
View File

@ -249,8 +249,11 @@ _spdk_blob_parse_page(const struct spdk_blob_md_page *page, struct spdk_blob *bl
} }
/* Advance to the next descriptor */ /* Advance to the next descriptor */
desc = (struct spdk_blob_md_descriptor *)((uintptr_t)desc + sizeof(*desc) + desc->length);
cur_desc += sizeof(*desc) + desc->length; cur_desc += sizeof(*desc) + desc->length;
if (cur_desc + sizeof(*desc) > sizeof(page->descriptors)) {
break;
}
desc = (struct spdk_blob_md_descriptor *)((uintptr_t)page->descriptors + cur_desc);
} }
} }

2
lib/blob/blobstore.h
View File

@ -217,7 +217,7 @@ struct spdk_blob_md_page {
uint32_t reserved0; uint32_t reserved0;
/* Descriptors here */ /* Descriptors here */
uint64_t descriptors[509]; uint8_t descriptors[4072];
uint32_t next; uint32_t next;
uint32_t crc; uint32_t crc;