Re: [Xen-devel] Bug in smpboot.c?

[Keir Fraser <keir@xxxxxxx>]

On 09/06/2011 16:49, "John McDermott (U.S. Navy Employee)"
<john.mcdermott@xxxxxxxxxxxx> wrote:

> Xen Developers,
> 
> In C function cpu_add(), in xen/arch/x86/smpboot.c, if acpi_id ==
> MAX_MADT_ENTRIES, won't this write past the end of array
> x86_acpiid_toapicid[MAX_MADT_ENTRIES]? I am looking at xen-unstable. It looks
> like the guard is not catching this 1 case?

Fixed in xen-unstable:23505. Fortunately this function is only accessible
from the TCB so it's not exploitable.

 Thanks,
 -- Keir

> Sincerely,
> 
> John McDermott
> ----
> What is the formal meaning of the one-line program
> #include "/dev/tty"
> 
> J.P. McDermott   building 12
> Code 5542   mcdermott@xxxxxxxxxxxxxxxx
> Naval Research Laboratory voice: +1 202.404.8301
> Washington, DC 20375, US fax:   +1 202.404.7942
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel