|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH 2/8] store: Detect bad response from xenstored
Detect when Header.len is larger than allowed, and fail the request.
Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
---
src/xenbus/store.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/xenbus/store.c b/src/xenbus/store.c
index 503144a..e2a0031 100644
--- a/src/xenbus/store.c
+++ b/src/xenbus/store.c
@@ -519,9 +519,13 @@ StoreReceiveResponse(
ASSERT(StoreVerifyHeader(&Response->Header));
+ status = STATUS_INVALID_BUFFER_SIZE;
if (Response->Header.len == 0)
goto done;
+ if (Response->Header.len >= XENSTORE_PAYLOAD_MAX)
+ goto done;
+
Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Length =
Response->Header.len;
Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Data =
Response->Data;
--
2.51.2.windows.1
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |