[win-pv-devel] [PATCH] Fix 0xD6 bugcheck found with verifier

[Paul Durrant <paul.durrant@xxxxxxxxxx>]

PdoAddRevision() reads beyond the end of an allocation when copying the old
revision table to the new one. This is becaause it is incorrectly using the
Count stack variable rather then the Count field in the Pdo structure. This
patch fixes the problem.

Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
---
 src/xenbus/pdo.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/xenbus/pdo.c b/src/xenbus/pdo.c
index 65f63e5..aa9e5bc 100644
--- a/src/xenbus/pdo.c
+++ b/src/xenbus/pdo.c
@@ -316,7 +316,9 @@ PdoAddRevision(
         goto fail1;
 
     if (Pdo->Revision != NULL) {
-        RtlCopyMemory(Revision, Pdo->Revision, sizeof (ULONG) * Count);
+        RtlCopyMemory(Revision,
+                      Pdo->Revision,
+                      sizeof (ULONG) * Pdo->Count);
         __PdoFree(Pdo->Revision);
     }
 
-- 
2.1.1


_______________________________________________
win-pv-devel mailing list
win-pv-devel@xxxxxxxxxxxxxxxxxxxx
http://lists.xenproject.org/cgi-bin/mailman/listinfo/win-pv-devel