Re: [Xen-devel] [PATCH v5 00/21] XSA55 libelf fixes for unstable

[Matthew Daley <mattjd@xxxxxxxxx>]

On Fri, Jun 7, 2013 at 6:51 AM, Ian Jackson <ian.jackson@xxxxxxxxxxxxx> wrote:
> This is version 5 of my to try to fix libelf and the domain loader.

Might want to add a proper length check to xc_dom_check_gzip like this
too while you're at it:

From 5dc67065fdc81408e2c9b49ab26ac2822437bd2f Mon Sep 17 00:00:00 2001
From: Matthew Daley <mattjd@xxxxxxxxx>
Date: Fri, 7 Jun 2013 20:08:49 +1200
Subject: [PATCH] libxc: check blob size before proceeding in
 xc_dom_check_gzip

Signed-off-by: Matthew Daley <mattjd@xxxxxxxxx>

diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
index 2a9c5a2..525b364 100644
--- a/tools/libxc/xc_dom_core.c
+++ b/tools/libxc/xc_dom_core.c
@@ -278,6 +278,10 @@ size_t xc_dom_check_gzip(xc_interface *xch, void
*blob, size_t ziplen)
     unsigned char *gzlen;
     size_t unziplen;

+    if ( ziplen < 6 )
+        /* too small */
+        return 0;
+
     if ( strncmp(blob, "\037\213", 2) )
         /* not gzipped */
         return 0;
--
1.7.10.4

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel