1 Star 0 Fork 78

xiexing/ceph

forked from src-openEuler/ceph 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
0014-fix-CVE-2022-3854.patch 1.94 KB
一键复制 编辑 原始数据 按行查看 历史
wangzengliang1 提交于 2023-01-30 10:54 . fix CVE-2022-3854
From ed7c2d0a58fb87201777fb4097d5a2b650593b31 Mon Sep 17 00:00:00 2001
From: Adam C. Emerson <aemerson@redhat.com>
Misplaced colons can result in radosgw thinking is has a bucket URL
but with no bucket name, leading to a crash later on.
Change-Id: 9746e8011ff1de6de7dba9c0041e28a16c8f6828
Change-Id: 95c6c2d209a877b934e05e727a181de8c68accd3
Fixes: https://tracker.ceph.com/issues/55765
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
(cherry picked from commit 3ee9a3b)
Fixes: https://tracker.ceph.com/issues/56586
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
src/rgw/rgw_common.cc | 5 +++++
src/rgw/rgw_sal.h | 6 +++++-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc
index b44d4bf..ce7b94c 100644
--- a/src/rgw/rgw_common.cc
+++ b/src/rgw/rgw_common.cc
@@ -1279,6 +1279,11 @@ bool verify_bucket_permission_no_policy(const DoutPrefixProvider* dpp, struct re
bool verify_bucket_permission(const DoutPrefixProvider* dpp, struct req_state * const s, const uint64_t op)
{
+ if (rgw::sal::RGWBucket::empty(s->bucket)) {
+ // request is missing a bucket name
+ return false;
+ }
+
perm_state_from_req_state ps(s);
return verify_bucket_permission(dpp,
diff --git a/src/rgw/rgw_sal.h b/src/rgw/rgw_sal.h
index 41da8bc..197f975 100644
--- a/src/rgw/rgw_sal.h
+++ b/src/rgw/rgw_sal.h
@@ -279,8 +279,12 @@ class RGWBucket {
void convert(cls_user_bucket_entry *b) const {
ent.convert(b);
}
+
+ /** Check if a Bucket pointer is empty */
+ static bool empty(const RGWBucket* b) { return (!b || b->empty()); }
+ /** Check if a Bucket unique pointer is empty */
+ static bool empty(const std::unique_ptr<RGWBucket>& b) { return (!b || b->empty()); }
- static bool empty(RGWBucket* b) { return (!b || b->empty()); }
virtual std::unique_ptr<RGWBucket> clone() = 0;
/* dang - This is temporary, until the API is completed */
--
2.13.0.windows.1
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/xiexing01/ceph.git
git@gitee.com:xiexing01/ceph.git
xiexing01
ceph
ceph
master

搜索帮助