[PATCH 10/18] xenvbd: Fix out-of-bounds read on empty StoreDirectory results

[Césaire Mounah <cesaire.mounah@xxxxxxxxxx>]

StoreDirectory returns a list of NUL-separated names ending with an
empty string, but only allocated one byte after the payload. For an
empty directory the result was a single NUL, so callers walking the
list (e.g. __Next in fdo.c) read one byte past the allocation.

Allocate two extra bytes (the allocation is zeroed) so the list is
always double-NUL terminated.

Assisted-by: Claude:Claude-opus-5.5
Signed-off-by: Césaire Mounah <cesaire.mounah@xxxxxxxxxx>
---
 src/xencrsh/store.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/xencrsh/store.c b/src/xencrsh/store.c
index 03c9e2c..ef92238 100644
--- a/src/xencrsh/store.c
+++ b/src/xencrsh/store.c
@@ -913,7 +913,7 @@ StoreDirectory(
         goto fail1;
 
     Length = __StorePayloadLength(Response);
-    Buffer = AustereAllocate(Length + sizeof (CHAR));
+    Buffer = AustereAllocate(Length + 2 *sizeof (CHAR));
 
     status = STATUS_NO_MEMORY;
     if (Buffer == NULL)
-- 
2.55.0.windows.5



--
Césaire Mounah | Vates Windows Guest Tools Engineer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech