[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] libxl: make sure buffer is null-terminated in libxl_read_file_contents

On Wed, Jun 27, 2018 at 6:58 PM, Wei Liu <wei.liu2@xxxxxxxxxx> wrote:
> On Wed, Jun 27, 2018 at 09:13:11AM +0000, Robin Lee wrote:
>> On XenServer 7.1.1, we start a vm with XAPI but attach a block device with 
>> xl.
>> We create an empty json config for the vm with the content "{}\n" and then
>> run 'xl block-attach':
>>   #  xl block-attach 1 phy:/dev/loop0 xvdz w
>>   libxl: error: libxl_json.c:950:libxl__json_parse: yajl error: parse error: 
>> trailing garbage
>>                                       {} K]
>>                        (right here) ------^
>>   libxl: error: libxl_json.c:1053:libxl__object_from_json: unable to 
>> generate libxl__json_object from JSON representation of libxl_domain_config.
>>   libxl: error: libxl.c:1995:device_addrm_aocomplete: unable to add device
>>   libxl_device_disk_add failed.
>> After investigation, we found the buffer returned from 
>> libxl_read_file_contents
>> is not null-terminated. But later in libxl__object_from_json, the buffer is 
>> expected to
>> be null-terminated. So parsing may exceeded the end of file and get in to 
>> uninisialized
>> momery area.
>> Signed-off-by: Robin Lee <robinlee.sysu@xxxxxxxxx>
> I can't seem to be able to reproduce this in upstream xen. Which version
> of Xen does XenServer 7.1.1 have? You can get that from the output of
> `xl info` -- look for xen_{major, minor, extra}.
I also met a strange case. We didn't see this problem with Xen 4.7.1
that released with
XenServer 7.1.1. But since a recently hotfix from XenServer that upgraded Xen to
4.7.4, this problem then shows up.

The version of yajl (yajl-2.0.4-4.el7.x86_64)  never changed.
> BTW if you're using XenServer you probably should use XAPI to manipulate
> guests instead.
> Wei.

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.