[Xen-devel] [PATCH 22/22] libxc: check blob size before proceeding in xc_dom_check_gzip

[Ian Jackson <ian.jackson@xxxxxxxxxxxxx>]

From: Matthew Daley <mattjd@xxxxxxxxx>

This is part of the fix to a security issue, XSA-55.

Signed-off-by: Matthew Daley <mattjd@xxxxxxxxx>

v6: This patch is new in v6 of the series.
---
 tools/libxc/xc_dom_core.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
index 2a9c5a2..525b364 100644
--- a/tools/libxc/xc_dom_core.c
+++ b/tools/libxc/xc_dom_core.c
@@ -278,6 +278,10 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, 
size_t ziplen)
     unsigned char *gzlen;
     size_t unziplen;
 
+    if ( ziplen < 6 )
+        /* too small */
+        return 0;
+
     if ( strncmp(blob, "\037\213", 2) )
         /* not gzipped */
         return 0;
-- 
1.7.2.5


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel