Re: [Xen-devel] [PATCH] libxenlight: fix heap overflow when domid_to_name returns NULL

[Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>]

On Fri, 4 Mar 2011, Ian Campbell wrote:
> On Thu, 2011-03-03 at 23:29 +0000, Eamon Walsh wrote:
> > The function flexarray_vappend() will stop at the first NULL
> > argument.  In libxl_device_vfb_add(), this has been observed
> > to result in keys being added to the backend array without
> > associated values in cases where the value can be NULL.
> 
> If these values are NULL should we be writing them at all? e.g. for:
>       flexarray_vappend(back, foo, bar);
> where bar may be NULL shouldn't it become:
>       if (bar) 
>               flexarray_vappend(back, foo, bar);
> or perhaps:
>       flexarray_vappend(back, foo, bar ? bar : "");
> ?
> 

This is actually a serious issue because it means that every time
flexarray_vappend is used and the argument is NULL the behaviour is
going to be different from what the coder expected.
Maybe flexarray_vappend should assume that the number of args is odd and
greater than 2?
At least in that case flexarray_vappend would only break if the user
misused the function.
Or we could use a terminator other than NULL...

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel