Re: [Xen-devel] [PATCH] libxenlight: fix heap overflow when domid_to_name returns NULL

[Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>]

On Mon, 7 Mar 2011, Eamon Walsh wrote:
> On 03/04/2011 05:02 AM, Ian Campbell wrote:
> > On Thu, 2011-03-03 at 23:29 +0000, Eamon Walsh wrote:
> >> The function flexarray_vappend() will stop at the first NULL
> >> argument.  In libxl_device_vfb_add(), this has been observed
> >> to result in keys being added to the backend array without
> >> associated values in cases where the value can be NULL.
> > If these values are NULL should we be writing them at all? e.g. for:
> >     flexarray_vappend(back, foo, bar);
> > where bar may be NULL shouldn't it become:
> >     if (bar) 
> >             flexarray_vappend(back, foo, bar);
> > or perhaps:
> >     flexarray_vappend(back, foo, bar ? bar : "");
> > ?
> >
> 
> If the value is NULL, the key is skipped and not written.  This is because of 
> a patch I submitted to change the xs_writev() function, which was calling 
> strlen(NULL) previously.  See:
> http://lists.xensource.com/archives/html/xen-devel/2010-03/msg00703.html
> 
> However this behavior is not obvious.  Checking the value earlier and leaving 
> it off the list makes sense.

I think me and Ian reached an agreement on the introduction of
flexarray_append_pair that would be very similar to flexarray_append but
takes two ptr arguments.
flexarray_append_pair would be used instead of flexarray_vappend in
libxl_device_vfb_add.
What do you think? Would you be up for writing the patch?

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel