Ceph

FileStore::collection_list_partial calls readdir_r without actually allocating space for the dirent. A properly crafted filename will cause a buffer overflow.

It is safe to use readdir() in glibc as long as you don't share the directory file descriptor between multiple threads. Recommend creating a wrapper function that does this on glibc systems, and does the elaborate (and expensive) readdir_r workaround on non-glibc ones.

More information about the problem here: http://womble.decadent.org.uk/readdir_r-advisory.html