[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 5/5] xeniface: Bound NumberPermissions before checking the input length
- To: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>, Césaire Mounah <cesaire.mounah@xxxxxxxxxx>, "win-pv-devel@xxxxxxxxxxxxxxxxxxxx" <win-pv-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Owen Smith <owen.smith@xxxxxxxxxx>
- Date: Wed, 21 Oct 2026 06:51:25 +0000
- Accept-language: en-GB, en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=G/9xPd+3BajkGD+XUaX/iBzoCLWzLcpF6JBJLdN9D4s=; b=LUurrm9Ic4umTYbYftuwwwKMBVo1ZlcyDYgNKAgyIg/4Rrw6yZE3JKCeT1NsXsKoGPuZl1KaIkXjCXi4whybwsNqWZj5TwrYTdW4zvxBfOowVMqjL12SckEH8hNsawx8YL5RLUobFHNjHSlFGrtWm8X/baAsfWt/hFDHl4E/NfxdHkz1fzIHDJhh2uYJE5FcmzZjqyRaSZnjM3eDv1wDMHBZBMh9MFYPPgBG07AegaNogVWWbkK505qw8hAN3eFzyhaD9ectlC/EYj3zUmh1XAfY4+x9TWFfcEZyP/vIGdeJeqQ+/916UxcQhJMbgiK5oJ8NpUCy0HqVfxHYJsJe5w==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=udXzPeRXiEONTKd26WyY34JPuhi8J1adbFpY1TQFMBStr33q5kuElMjRBFANoHddfgroxTFFj1PH8aPStvPZnHjXMXVS6BFGtWOIwf9kfMvRMSLUxB7OnHg3GJCmA6O0VEX0jc9OA3aXsE4ufuaQixL8tCn5Hp+dnYStK35cu9UtpOe7vK1sQV15Q/BZ6ahRkCZ1aM6iHWoXPgUlMgiTZbapRQMKFdlU/3Sc8fbC6WI4X/4KdrMMlMox+RevNYypg4ZACzMslQFrkgqx13eGOe2arO0BS2UOdKAoCrvjxZf/m/krCHgFBh1P3ZL5ADvE/R0Jw2qW5/OMerUAxipZHg==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Delivery-date: Wed, 21 Oct 2026 06:51:32 +0000
- List-id: Developer list for the Windows PV Drivers subproject <win-pv-devel.lists.xenproject.org>
- Msip_labels:
- Thread-index: AQHdYInwO11ITiWjP0iE8qp3V4LDSrcGWmIAgAE1Vfo=
- Thread-topic: [PATCH 5/5] xeniface: Bound NumberPermissions before checking the input length
>> src/xeniface/ioctl_store.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/src/xeniface/ioctl_store.c b/src/xeniface/ioctl_store.c
>> index 97bef75..cb9f2ff 100644
>> --- a/src/xeniface/ioctl_store.c
>> +++ b/src/xeniface/ioctl_store.c
>> @@ -417,6 +417,11 @@ IoctlStoreSetPermissions(
>> goto fail1;
>> }
>>
>> + status = STATUS_INVALID_PARAMETER;
>> + if (In->NumberPermissions > 255)
>> + goto fail2;
>> +
>
>I think the check in __ConvertPermissions can then be removed.
>
>> + status = STATUS_INVALID_BUFFER_SIZE;
>> if (InLen != (ULONG)FIELD_OFFSET(XENIFACE_STORE_SET_PERMISSIONS_IN,
>> Permissions[In->NumberPermissions]))
>> goto fail2;
>>
The subsequent "goto failX;" and "failX:" labels will need renumbering
Apart from that, this patch looks good
Owen
|
