[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH] libxl: don't accept negative disk or partition indexes

  • To: "xen-devel" <xen-devel@xxxxxxxxxxxxx>
  • From: "Jan Beulich" <JBeulich@xxxxxxxx>
  • Date: Wed, 07 Mar 2012 11:01:59 +0000
  • Delivery-date: Wed, 07 Mar 2012 11:01:45 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xen.org>

When obtained via sscanf(), they were checked against an upper bound
only so far. By converting the local variables' types to "unsigned int"
those bounds checks become sufficient (as a consequence the helper
function's parameter types need to be adjusted too). It's not strictly
necessary to also convert libxl__device_disk_dev_number()'s parameter
types - the bounds checking done (now) guarantees that the values won't
run into the negative range of "int" values.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

--- a/tools/libxl/libxl_device.c
+++ b/tools/libxl/libxl_device.c
@@ -260,8 +260,10 @@ int libxl__device_physdisk_major_minor(c
 static int device_virtdisk_matches(const char *virtpath, const char *devtype,
-                                   int *index_r, int max_index,
-                                   int *partition_r, int max_partition) {
+                                   unsigned int *index_r,
+                                   unsigned int max_index,
+                                   unsigned int *partition_r,
+                                   unsigned int max_partition) {
     const char *p;
     char *ep;
     int tl, c;
@@ -310,13 +312,13 @@ static int device_virtdisk_matches(const
 int libxl__device_disk_dev_number(const char *virtpath, int *pdisk,
                                   int *ppartition)
-    int disk, partition;
+    unsigned int disk, partition;
     char *ep;
     unsigned long ul;
     int chrused;
     chrused = -1;
-    if ((sscanf(virtpath, "d%ip%i%n", &disk, &partition, &chrused)  >= 2
+    if ((sscanf(virtpath, "d%up%u%n", &disk, &partition, &chrused) >= 2
          && chrused == strlen(virtpath) && disk < (1<<20) && partition < 256)
         device_virtdisk_matches(virtpath, "xvd",

Attachment: libxl-block-unsigned-indices.patch
Description: Text document

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.