librbd: does not crash if image header is too short

if something goes wrong with the object, and returns a chunk shorter than expected, don't panic Signed-off-by: Kefu Chai <kchai@redhat.com>
sunfch · Apr 27, 2016 · 7b52183 · 7b52183
1 parent ff18083
commit 7b52183
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/librbd/internal.cc b/src/librbd/internal.cc
@@ -523,7 +523,8 @@ int mirror_image_disable_internal(ImageCtx *ictx, bool force) {
       off += r;
     } while (r == READ_SIZE);
 
-    if (memcmp(RBD_HEADER_TEXT, header.c_str(), sizeof(RBD_HEADER_TEXT))) {
+    if (header.length() < sizeof(RBD_HEADER_TEXT) ||
+	memcmp(RBD_HEADER_TEXT, header.c_str(), sizeof(RBD_HEADER_TEXT))) {
       CephContext *cct = (CephContext *)io_ctx.cct();
       lderr(cct) << "unrecognized header format" << dendl;
       return -ENXIO;