Re: [Xen-devel] [PATCH 2/4] arm: add bounds check on hypercall array

[Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>]

On Wed, 25 Jul 2012, Ian Campbell wrote:
> On Wed, 2012-07-25 at 16:16 +0100, Stefano Stabellini wrote:
> > On Wed, 25 Jul 2012, Ian Campbell wrote:
> > > Otherwise a guest can cause us to run off the end of the array.
> > > 
> > > Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
> > > ---
> > >  xen/arch/arm/traps.c |    6 ++++++
> > >  1 files changed, 6 insertions(+), 0 deletions(-)
> > > 
> > > diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c
> > > index f2c25b5..6201d38 100644
> > > --- a/xen/arch/arm/traps.c
> > > +++ b/xen/arch/arm/traps.c
> > > @@ -479,6 +479,12 @@ static void do_trap_hypercall(struct cpu_user_regs 
> > > *regs, unsigned long iss)
> > >          return;
> > >      }
> > >  
> > > +    if ( regs->r12 > ARRAY_SIZE(arm_hypercall_table) )
> > > +    {
> > > +        regs->r0 = -ENOSYS;
> > > +        return;
> > > +    }
> > 
> > shouldn't this be >=?
> 
> Er, yes, I suspect so.
> 
> Rather than repost how about you ack with the proviso that I fix it as I
> commit?

Yep, fine by me

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel