Re: [PATCH 1/2] xenstore: sanity check incoming message body lengths

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 30/11/2013 00:20, Matthew Daley wrote:
> This is for the client-side receiving messages from xenstored, so there
> is no security impact, unlike XSA-72.
>
> Coverity-ID: 1055449
> Coverity-ID: 1056028
> Signed-off-by: Matthew Daley <mattd@bugfuzz.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

> ---
>  tools/xenstore/xs.c |    6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
> index 261b841..184886f 100644
> --- a/tools/xenstore/xs.c
> +++ b/tools/xenstore/xs.c
> @@ -1145,6 +1145,12 @@ static int read_message(struct xs_handle *h, int nonblocking)
>  		goto error_freemsg;
>  	}
>  
> +	/* Sanity check message body length. */
> +	if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
> +		saved_errno = E2BIG;
> +		goto error_freemsg;
> +	}
> +
>  	/* Allocate and read the message body. */
>  	body = msg->body = malloc(msg->hdr.len + 1);
>  	if (body == NULL)