[Patch] fix checking strtab length in xc_core.c

[Patch] fix checking strtab length in xc_core.c

[Akio Takebe]

[-- Attachment #1: Mail message body --]
[-- Type: text/plain, Size: 666 bytes --]

Hi,

I don't understard the meaning of the following check in xc_core.c.
Is this correct patch?

Signed-off-by: Akio Takebe <takebe_akio@jp.fujitsu.com>

diff -r 9071521d4864 tools/libxc/xc_core.c
--- a/tools/libxc/xc_core.c	Fri Sep 07 11:39:10 2007 +0100
+++ b/tools/libxc/xc_core.c	Tue Sep 11 06:13:55 2007 +0900
@@ -107,7 +107,7 @@ xc_core_strtab_get(struct xc_core_strtab
     if ( strtab->current + len > strtab->max )
     {
         char *tmp;
-        if ( strtab->max * 2 < strtab->max )
+        if ( strtab->current + len > strtab->max * 2 )
         {
             PERROR("too long string table");
             errno = ENOMEM;

Best Regards,

Akio Takebe

[-- Attachment #2: fix_xc_core_strtab_len.patch --]
[-- Type: application/octet-stream, Size: 485 bytes --]

diff -r 9071521d4864 tools/libxc/xc_core.c
--- a/tools/libxc/xc_core.c	Fri Sep 07 11:39:10 2007 +0100
+++ b/tools/libxc/xc_core.c	Tue Sep 11 06:13:55 2007 +0900
@@ -107,7 +107,7 @@ xc_core_strtab_get(struct xc_core_strtab
     if ( strtab->current + len > strtab->max )
     {
         char *tmp;
-        if ( strtab->max * 2 < strtab->max )
+        if ( strtab->current + len > strtab->max * 2 )
         {
             PERROR("too long string table");
             errno = ENOMEM;

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [Patch] fix checking strtab length in xc_core.c

[Keir Fraser]

On 10/9/07 13:16, "Akio Takebe" <takebe_akio@jp.fujitsu.com> wrote:

> I don't understard the meaning of the following check in xc_core.c.
> Is this correct patch?
> 
> Signed-off-by: Akio Takebe <takebe_akio@jp.fujitsu.com>

It's to avoid overflowing a fixed-size integer.

 -- Keir

Re: [Patch] fix checking strtab length in xc_core.c

[Akio Takebe]

Hi, Keir

>It's to avoid overflowing a fixed-size integer.
>
> -- Keir

Thanks.

Best Regards,

Akio Takebe