[Xen-changelog] [linux-2.6.18-xen] properly bound buffer access when parsing cpu/*/availability

[Xen patchbot-linux-2.6.18-xen <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <jbeulich@xxxxxxxx>
# Date 1358509194 -3600
# Node ID cba2a1740833211cf5befca1fbe11a44ab911948
# Parent  c340a22a3a6339aadffc9a7d4d9eef10d52b7b94
properly bound buffer access when parsing cpu/*/availability

At the same time reduce the local buffers to 16 bytes each.

Reported-by: Matthew Daley <mattjd@xxxxxxxxx>
Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---


diff -r c340a22a3a63 -r cba2a1740833 drivers/xen/core/cpu_hotplug.c
--- a/drivers/xen/core/cpu_hotplug.c    Fri Dec 21 10:01:11 2012 +0100
+++ b/drivers/xen/core/cpu_hotplug.c    Fri Jan 18 12:39:54 2013 +0100
@@ -28,13 +28,13 @@ static int local_cpu_hotplug_request(voi
 static void vcpu_hotplug(unsigned int cpu, struct sys_device *dev)
 {
        int err;
-       char dir[32], state[32];
+       char dir[16], state[16];
 
        if ((cpu >= NR_CPUS) || !cpu_possible(cpu))
                return;
 
        sprintf(dir, "cpu/%u", cpu);
-       err = xenbus_scanf(XBT_NIL, dir, "availability", "%s", state);
+       err = xenbus_scanf(XBT_NIL, dir, "availability", "%15s", state);
        if (err != 1) {
                printk(KERN_ERR "XENBUS: Unable to read cpu state\n");
                return;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog