Re: [PATCH] libxenlight: fix heap overflow when domid_to_name returns NULL

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

On 03/04/2011 05:02 AM, Ian Campbell wrote:
> On Thu, 2011-03-03 at 23:29 +0000, Eamon Walsh wrote:
>> The function flexarray_vappend() will stop at the first NULL
>> argument.  In libxl_device_vfb_add(), this has been observed
>> to result in keys being added to the backend array without
>> associated values in cases where the value can be NULL.
> If these values are NULL should we be writing them at all? e.g. for:
> 	flexarray_vappend(back, foo, bar);
> where bar may be NULL shouldn't it become:
> 	if (bar) 
> 		flexarray_vappend(back, foo, bar);
> or perhaps:
> 	flexarray_vappend(back, foo, bar ? bar : "");
> ?
>

If the value is NULL, the key is skipped and not written.  This is because of a patch I submitted to change the xs_writev() function, which was calling strlen(NULL) previously.  See:
http://lists.xensource.com/archives/html/xen-devel/2010-03/msg00703.html

However this behavior is not obvious.  Checking the value earlier and leaving it off the list makes sense.



-- 

Eamon Walsh 
National Security Agency