Re: [PATCH 2/8] store: Detect bad response from xenstored

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 14/08/2026 12:05, Tu Dinh wrote:
> On 14/08/2026 09:30, Owen Smith wrote:
>> Detect when Header.len is larger than allowed, and fail the request.
>>
>> Assisted-by: ClaudeCode:claude-opus-4.8
>> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
> 
> Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
> 
> NB: xencrsh/store.c would likely benefit from the same change.
> 
>> ---
>>    src/xenbus/store.c | 4 ++++
>>    1 file changed, 4 insertions(+)
>>
>> diff --git a/src/xenbus/store.c b/src/xenbus/store.c
>> index 503144a..e2a0031 100644
>> --- a/src/xenbus/store.c
>> +++ b/src/xenbus/store.c
>> @@ -519,9 +519,13 @@ StoreReceiveResponse(
>>    
>>        ASSERT(StoreVerifyHeader(&Response->Header));
>>    
>> +    status = STATUS_INVALID_BUFFER_SIZE;
>>        if (Response->Header.len == 0)
>>            goto done;
>>    
>> +    if (Response->Header.len >= XENSTORE_PAYLOAD_MAX)

Never mind, shouldn't this be Response->Header.len > XENSTORE_PAYLOAD_MAX?

>> +        goto done;
>> +
>>        Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Length = 
>> Response->Header.len;
>>        Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Data = 
>> Response->Data;
>>    
> 
> 
> 



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech