Re: [Xen-devel] [PATCH 2/4] arm: add bounds check on hypercall array

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Wed, 2012-07-25 at 16:16 +0100, Stefano Stabellini wrote:
> On Wed, 25 Jul 2012, Ian Campbell wrote:
> > Otherwise a guest can cause us to run off the end of the array.
> > 
> > Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
> > ---
> >  xen/arch/arm/traps.c |    6 ++++++
> >  1 files changed, 6 insertions(+), 0 deletions(-)
> > 
> > diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c
> > index f2c25b5..6201d38 100644
> > --- a/xen/arch/arm/traps.c
> > +++ b/xen/arch/arm/traps.c
> > @@ -479,6 +479,12 @@ static void do_trap_hypercall(struct cpu_user_regs 
> > *regs, unsigned long iss)
> >          return;
> >      }
> >  
> > +    if ( regs->r12 > ARRAY_SIZE(arm_hypercall_table) )
> > +    {
> > +        regs->r0 = -ENOSYS;
> > +        return;
> > +    }
> 
> shouldn't this be >=?

Er, yes, I suspect so.

Rather than repost how about you ack with the proviso that I fix it as I
commit?

> 
> >      call = arm_hypercall_table[regs->r12].fn;
> >      if ( call == NULL )
> >      {
> > -- 
> > 1.7.9.1
> > 



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel