Re: [PATCH RESEND] libxl: Avoid realloc(, 0) when libxl__xs_directory returns empty list

[Ian Campbell <Ian.Campbell@citrix.com>]

On Tue, 2013-11-12 at 17:23 +0000, Ian Jackson wrote:
> Ian Jackson writes ("Re: [Xen-devel] xl network-attach SEGV in 4.2 and 4.1"):
> > Thanks for pointing this out.  The root cause is the expectation that
> > libxl__xs_directory won't return a non-null list but set *nb to 0.
> > 
> > I found some occurrences of this bug in (xen-unstable) staging.
> > See patch below, which should probably go into 4.1 and 4.2.
> 
> Ping.

I could have sworn this went in...

> 
> Ian.
> 
> From ea275c0e29299a2399aa7814116d68bfdaeb21c1 Mon Sep 17 00:00:00 2001
> From: Ian Jackson <ian.jackson@eu.citrix.com>
> Date: Thu, 18 Apr 2013 16:27:46 +0100
> Subject: [PATCH] libxl: Avoid realloc(,0) when libxl__xs_directory returns
>  empty list
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
> 
> If the named path is a leaf node, libxl__xs_directory can succeed,
> returning non-null, but set *nb to 0.
> 
> In three places in libxl this may result in a zero size argument being
> passed to malloc() or realloc(), which is not adviseable.

I thought it was strictly speaking fine, but I can see why it would be
best to avoid.

> Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
> Acked-by: Roger Pau Monné <roger.pau@citrix.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>

> ---
>  tools/libxl/libxl.c |    6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
> index 0f0f56c..887e0ca 100644
> --- a/tools/libxl/libxl.c
> +++ b/tools/libxl/libxl.c
> @@ -1864,7 +1864,7 @@ libxl_device_vtpm *libxl_device_vtpm_list(libxl_ctx *ctx, uint32_t domid, int *n
>  
>      fe_path = libxl__sprintf(gc, "%s/device/vtpm", libxl__xs_get_dompath(gc, domid));
>      dir = libxl__xs_directory(gc, XBT_NULL, fe_path, &ndirs);
> -    if(dir) {
> +    if (dir && ndirs) {
>         vtpms = malloc(sizeof(*vtpms) * ndirs);
>         libxl_device_vtpm* vtpm;
>         libxl_device_vtpm* end = vtpms + ndirs;
> @@ -2371,7 +2371,7 @@ static int libxl__append_disk_list_of_type(libxl__gc *gc,
>      be_path = libxl__sprintf(gc, "%s/backend/%s/%d",
>                               libxl__xs_get_dompath(gc, 0), type, domid);
>      dir = libxl__xs_directory(gc, XBT_NULL, be_path, &n);
> -    if (dir) {
> +    if (dir && n) {
>          libxl_device_disk *tmp;
>          tmp = realloc(*disks, sizeof (libxl_device_disk) * (*ndisks + n));
>          if (tmp == NULL)
> @@ -3060,7 +3060,7 @@ static int libxl__append_nic_list_of_type(libxl__gc *gc,
>      be_path = libxl__sprintf(gc, "%s/backend/%s/%d",
>                               libxl__xs_get_dompath(gc, 0), type, domid);
>      dir = libxl__xs_directory(gc, XBT_NULL, be_path, &n);
> -    if (dir) {
> +    if (dir && n) {
>          libxl_device_nic *tmp;
>          tmp = realloc(*nics, sizeof (libxl_device_nic) * (*nnics + n));
>          if (tmp == NULL)



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel