From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julien Grall Subject: Re: [RFC 02/19] xen: guestcopy: Provide an helper to copy string from guest Date: Tue, 17 Jun 2014 10:09:00 +0100 Message-ID: <53A005AC.3060306@linaro.org> References: <1402935486-29136-1-git-send-email-julien.grall@linaro.org> <1402935486-29136-3-git-send-email-julien.grall@linaro.org> <53A011E4020000780001ADF4@mail.emea.novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1WwpO6-0002Kz-GO for xen-devel@lists.xenproject.org; Tue, 17 Jun 2014 09:09:06 +0000 Received: by mail-wg0-f41.google.com with SMTP id a1so6845606wgh.24 for ; Tue, 17 Jun 2014 02:09:03 -0700 (PDT) In-Reply-To: <53A011E4020000780001ADF4@mail.emea.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Jan Beulich Cc: Keir Fraser , ian.campbell@citrix.com, tim@xen.org, Ian Jackson , stefano.stabellini@citrix.com, xen-devel@lists.xenproject.org, Daniel De Graaf List-Id: xen-devel@lists.xenproject.org Hi Jan, On 17/06/14 09:01, Jan Beulich wrote: >>>> On 16.06.14 at 18:17, wrote: > > While generally I'm okay with adding such a helper, it should be done > a little more cleanly I think: > >> --- /dev/null >> +++ b/xen/common/guestcopy.c >> @@ -0,0 +1,28 @@ >> +#include >> +#include >> +#include >> + >> +int copy_string_from_guest(XEN_GUEST_HANDLE(char) u_buf, char **buf, >> + unsigned long size, unsigned long max_size) > 't > Both of these ought to be size_t (as it was in the flask original). Hrrmmm... I'm not sure why I made this change. I though the hypercall uses unsigned long but it uses uint32_t. I will use size_t in the next version. >> +{ >> + char *tmp; >> + >> + if ( size > max_size ) >> + return -ENOENT; > > ENOBUFS would seem the better error code here. Ok. >> + >> + /* Add an extra +1 to append \0. We can't assume the guest will >> + * provide a valid string */ > > Now this is the case for flask, but for a generic string copying > routine I don't think this is desirable. It seems especially wrong to > aid the guest with putting a NUL where none was. If you really > want this, I guess you would be better off adding two variants: > One which demands the string to be NUL-terminated (in which > case passing in a size is sort of bogus), and one which takes a > size and inserts a NUL. A malicious guest could pass a big buffer without a NUL-terminated. If we don't limit the size and check the NUL-terminated character the guest could respectively exhaust Xen memory and exploit it. Therefore we can't rely on the guest to provide a valid string. This solution will avoid to check in every caller that the string is correctly terminated. Regards, -- Julien Grall