[Xen-devel] Re: Malformed image causing builder to crash

[Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>]

On 31 May 2006, at 18:53, Puthiyaparambil, Aravindh wrote:

> An image with VIRT_START and ELF_PADDR_OFFSET equal to 0 and its linker
> entry at 0xffffffff80000000 (Is this is an malformed image?) causes the
> builder to crash in loadelfimage() [line 235] because parray is going
> out of bounds. Output from the builder is show below. What seems to be
> happening is that in setup_guest(), the variable v_end is becoming zero
> after the "for ( nr_pt_pages = 2; ; nr_pt_pages++ )" loop. Also note
> that the value of nr_pt_pages is very large. The reason is that
> dsi->v_start is 0 which throws things off. But this is totally valid so
> I am not sure what checks need to be introduced to stop this from
> happening. Should the bounds check for the array be reintroduced?
The problem is almost certainly a wrap in 
xc_linux_build.c:setup_guest(). v_end is taken from parseelfimage() and 
then incremented to make room for initrd, page tables, etc. If that 
wraps round to zero then the size check will pass and things will 
generally be screwed.
We probably need to take care whenever we increment v_end to ensure 
that 'inc < -v_end'.
 -- Keir


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel