From mboxrd@z Thu Jan 1 00:00:00 1970 From: Boris Ostrovsky Subject: [PATCH v2 1/2] libxc: Don't write terminating NULL character to command string Date: Tue, 5 Jan 2016 17:26:09 -0500 Message-ID: <1452032770-5642-2-git-send-email-boris.ostrovsky@oracle.com> References: <1452032770-5642-1-git-send-email-boris.ostrovsky@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1452032770-5642-1-git-send-email-boris.ostrovsky@oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: ian.jackson@eu.citrix.com, stefano.stabellini@eu.citrix.com, ian.campbell@citrix.com, wei.liu2@citrix.com Cc: jgross@suse.com, Boris Ostrovsky , roger.pau@citrix.com, xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org When copying boot command string for HVMlite guests we explicitly write '\0' at MAX_GUEST_CMDLINE offset. Unless the string is close to MAX_GUEST_CMDLINE in length this write will end up in the wrong place, beyond the end of the mapped range. Instead we should test string's length early and error out if it is too long. Signed-off-by: Boris Ostrovsky --- tools/libxc/xc_dom_x86.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/tools/libxc/xc_dom_x86.c b/tools/libxc/xc_dom_x86.c index 3960875..b696149 100644 --- a/tools/libxc/xc_dom_x86.c +++ b/tools/libxc/xc_dom_x86.c @@ -647,6 +647,11 @@ static int alloc_magic_pages_hvm(struct xc_dom_image *dom) if ( dom->cmdline ) { cmdline_size = ROUNDUP(strlen(dom->cmdline) + 1, 8); + if ( cmdline_size > MAX_GUEST_CMDLINE ) + { + DOMPRINTF("Boot command line is too long"); + goto error_out; + } start_info_size += cmdline_size; } @@ -676,8 +681,7 @@ static int alloc_magic_pages_hvm(struct xc_dom_image *dom) if ( dom->cmdline ) { - strncpy(cmdline, dom->cmdline, MAX_GUEST_CMDLINE); - cmdline[MAX_GUEST_CMDLINE - 1] = '\0'; + strcpy(cmdline, dom->cmdline); start_info->cmdline_paddr = (seg.pfn << PAGE_SHIFT) + ((uintptr_t)cmdline - (uintptr_t)start_info); } -- 1.7.1