[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH 2/8] store: Detect bad response from xenstored



Detect when Header.len is larger than allowed, and fail the request.

Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
---
 src/xenbus/store.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/xenbus/store.c b/src/xenbus/store.c
index 503144a..e2a0031 100644
--- a/src/xenbus/store.c
+++ b/src/xenbus/store.c
@@ -519,9 +519,13 @@ StoreReceiveResponse(
 
     ASSERT(StoreVerifyHeader(&Response->Header));
 
+    status = STATUS_INVALID_BUFFER_SIZE;
     if (Response->Header.len == 0)
         goto done;
 
+    if (Response->Header.len >= XENSTORE_PAYLOAD_MAX)
+        goto done;
+
     Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Length = 
Response->Header.len;
     Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Data = 
Response->Data;
 
-- 
2.51.2.windows.1




 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.