Re: [Xen-devel] [PATCH 1/2] xenstore: sanity check incoming message body lengths

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 30/11/2013 00:20, Matthew Daley wrote:
> This is for the client-side receiving messages from xenstored, so there
> is no security impact, unlike XSA-72.
>
> Coverity-ID: 1055449
> Coverity-ID: 1056028
> Signed-off-by: Matthew Daley <mattd@xxxxxxxxxxx>

Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

> ---
>  tools/xenstore/xs.c |    6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
> index 261b841..184886f 100644
> --- a/tools/xenstore/xs.c
> +++ b/tools/xenstore/xs.c
> @@ -1145,6 +1145,12 @@ static int read_message(struct xs_handle *h, int 
> nonblocking)
>               goto error_freemsg;
>       }
>  
> +     /* Sanity check message body length. */
> +     if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
> +             saved_errno = E2BIG;
> +             goto error_freemsg;
> +     }
> +
>       /* Allocate and read the message body. */
>       body = msg->body = malloc(msg->hdr.len + 1);
>       if (body == NULL)


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel