From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Daley Subject: [PATCH 1/2] xenstore: sanity check incoming message body lengths Date: Sat, 30 Nov 2013 13:20:04 +1300 Message-ID: <1385770805-1929-2-git-send-email-mattd@bugfuzz.com> References: <1385770805-1929-1-git-send-email-mattd@bugfuzz.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1385770805-1929-1-git-send-email-mattd@bugfuzz.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Matthew Daley , Ian Jackson , Ian Campbell , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org This is for the client-side receiving messages from xenstored, so there is no security impact, unlike XSA-72. Coverity-ID: 1055449 Coverity-ID: 1056028 Signed-off-by: Matthew Daley --- tools/xenstore/xs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c index 261b841..184886f 100644 --- a/tools/xenstore/xs.c +++ b/tools/xenstore/xs.c @@ -1145,6 +1145,12 @@ static int read_message(struct xs_handle *h, int nonblocking) goto error_freemsg; } + /* Sanity check message body length. */ + if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) { + saved_errno = E2BIG; + goto error_freemsg; + } + /* Allocate and read the message body. */ body = msg->body = malloc(msg->hdr.len + 1); if (body == NULL) -- 1.7.10.4