From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: [PATCH for-4.5 2/3] python/xc: Fix multiple issues in pyxc_readconsolering() Date: Tue, 2 Dec 2014 13:50:37 +0000 Message-ID: <1417528237.24320.34.camel@citrix.com> References: <1417091674-8163-1-git-send-email-andrew.cooper3@citrix.com> <1417091674-8163-3-git-send-email-andrew.cooper3@citrix.com> <1417174732.23604.13.camel@citrix.com> <20141201211456.GH22021@laptop.dumpdata.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20141201211456.GH22021@laptop.dumpdata.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Konrad Rzeszutek Wilk Cc: Andrew Cooper , Wei Liu , Ian Jackson , Xen Coverity Team , Xen-devel List-Id: xen-devel@lists.xenproject.org On Mon, 2014-12-01 at 16:14 -0500, Konrad Rzeszutek Wilk wrote: > On Fri, Nov 28, 2014 at 11:38:52AM +0000, Ian Campbell wrote: > > On Thu, 2014-11-27 at 12:34 +0000, Andrew Cooper wrote: > > > Don't leak a 16k allocation if PyArg_ParseTupleAndKeywords() or the first > > > xc_readconsolering() fail. It is trivial to run throught the processes memory > > > by repeatedly passing junk parameters to this function. > > > > > > In the case that the call to xc_readconsolering() in the while loop fails, > > > reinstate str before breaking out, and passing a spurious pointer to free(). > > > > > > Signed-off-by: Andrew Cooper > > > Coverity-IDs: 1054984 1055906 > > > CC: Ian Campbell > > > CC: Ian Jackson > > > CC: Wei Liu > > > CC: Xen Coverity Team > > > > Acked-by: Ian Campbell > > Release-Acked-by: Konrad Rzeszutek Wilk Did you intend to also ack patch #1? (or have I missed a mail?)