|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] Bug in smpboot.c?
Keir, Thanks; yes, we see no way to unravel it. I'm just paranoid. Sincerely, John On Jun 10, 2011, at 3:30 AM, Keir Fraser wrote: > On 09/06/2011 16:49, "John McDermott (U.S. Navy Employee)" > <john.mcdermott@xxxxxxxxxxxx> wrote: > >> Xen Developers, >> >> In C function cpu_add(), in xen/arch/x86/smpboot.c, if acpi_id == >> MAX_MADT_ENTRIES, won't this write past the end of array >> x86_acpiid_toapicid[MAX_MADT_ENTRIES]? I am looking at xen-unstable. It looks >> like the guard is not catching this 1 case? > > Fixed in xen-unstable:23505. Fortunately this function is only accessible > from the TCB so it's not exploitable. > > Thanks, > -- Keir > >> Sincerely, >> >> John McDermott >> ---- >> What is the formal meaning of the one-line program >> #include "/dev/tty" >> >> J.P. McDermott building 12 >> Code 5542 mcdermott@xxxxxxxxxxxxxxxx >> Naval Research Laboratory voice: +1 202.404.8301 >> Washington, DC 20375, US fax: +1 202.404.7942 >> >> >> >> >> >> >> >> >> >> >> _______________________________________________ >> Xen-devel mailing list >> Xen-devel@xxxxxxxxxxxxxxxxxxx >> http://lists.xensource.com/xen-devel > ---- What is the formal meaning of the one-line program #include "/dev/tty" J.P. McDermott building 12 Code 5542 mcdermott@xxxxxxxxxxxxxxxx Naval Research Laboratory voice: +1 202.404.8301 Washington, DC 20375, US fax: +1 202.404.7942 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |