Re: [PATCH 2/8] store: Detect bad response from xenstored

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 14/08/2026 09:30, Owen Smith wrote:
> Detect when Header.len is larger than allowed, and fail the request.
> 
> Assisted-by: ClaudeCode:claude-opus-4.8
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>

Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

NB: xencrsh/store.c would likely benefit from the same change.

> ---
>   src/xenbus/store.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/src/xenbus/store.c b/src/xenbus/store.c
> index 503144a..e2a0031 100644
> --- a/src/xenbus/store.c
> +++ b/src/xenbus/store.c
> @@ -519,9 +519,13 @@ StoreReceiveResponse(
>   
>       ASSERT(StoreVerifyHeader(&Response->Header));
>   
> +    status = STATUS_INVALID_BUFFER_SIZE;
>       if (Response->Header.len == 0)
>           goto done;
>   
> +    if (Response->Header.len >= XENSTORE_PAYLOAD_MAX)
> +        goto done;
> +
>       Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Length = 
> Response->Header.len;
>       Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Data = 
> Response->Data;
>   



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech