Re: [Xen-devel] Ping: [PATCH 4/5] HVM: prevent leaking heap data from hvm_save_one()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 17/12/13 09:16, Jan Beulich wrote:
>>>> On 10.12.13 at 16:48, "Jan Beulich" <JBeulich@xxxxxxxx> wrote:
>> When one or more of the vCPU-s of a guest are offline, no data may be
>> put into the allocated space for them and, due to another bug, such
>> uninitialized data may be passed back to the caller.
>>
>> Signed-off-by: Don Slutz <dslutz@xxxxxxxxxxx>
>> Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
>> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
> Keir?

This issue is completely fixed by the latest patch is it not?

With the latest patch, we always copy out of the written subset of
ctxt.data, even if ctxt.size is larger.

~Andrew

>
>> --- a/xen/common/hvm/save.c
>> +++ b/xen/common/hvm/save.c
>> @@ -102,7 +102,7 @@ int hvm_save_one(struct domain *d, uint1
>>          return -EINVAL;
>>  
>>      ctxt.size = sz;
>> -    ctxt.data = xmalloc_bytes(sz);
>> +    ctxt.data = xzalloc_bytes(sz);
>>      if ( !ctxt.data )
>>          return -ENOMEM;
>>  
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel