Re: [Xen-devel] [PATCH 06/29] libxc: don't read uninitialized size value in xc_read_image

[Matthew Daley <mattjd@xxxxxxxxx>]

On Fri, Nov 1, 2013 at 10:22 AM, Ian Campbell <Ian.Campbell@xxxxxxxxxx> wrote:
> On Wed, 2013-10-30 at 20:51 +1300, Matthew Daley wrote:
>> This error case can only be triggered by gzread returning 0 (and having
>> not read anything), so move it there.
>>
>> Coverity-ID: 1056076
>
> Is this right? It seems to correspond to an issue in xc_hvm_build --
> which doesn't look related.

xc_hvm_build calls xc_read_image, which is where the issue itself lies
(click on "show details" on event 8.)

>
>> Signed-off-by: Matthew Daley <mattjd@xxxxxxxxx>
>> ---
>>  tools/libxc/xg_private.c |   14 +++++++-------
>>  1 file changed, 7 insertions(+), 7 deletions(-)
>>
>> diff --git a/tools/libxc/xg_private.c b/tools/libxc/xg_private.c
>> index 8fa068e..a914068 100644
>> --- a/tools/libxc/xg_private.c
>> +++ b/tools/libxc/xg_private.c
>> @@ -71,6 +71,12 @@ char *xc_read_image(xc_interface *xch,
>>              image = NULL;
>>              goto out;
>>          case 0: /* EOF */
>> +            if ( *size == 0 )
>> +            {
>> +                PERROR("Could not read kernel image");
>> +                free(image);
>> +                image = NULL;
>> +            }
>>              goto out;
>>          default:
>>              *size += bytes;
>> @@ -80,13 +86,7 @@ char *xc_read_image(xc_interface *xch,
>>  #undef CHUNK
>>
>>   out:
>> -    if ( *size == 0 )
>> -    {
>> -        PERROR("Could not read kernel image");
>> -        free(image);
>> -        image = NULL;
>> -    }
>> -    else if ( image )
>> +    if ( image )
>>      {
>>          /* Shrink allocation to fit image. */
>>          tmp = realloc(image, *size);
>
>

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel