[Xen-devel] [PATCH 1/2] xenstore: sanity check incoming message body lengths

[Matthew Daley <mattd@xxxxxxxxxxx>]

This is for the client-side receiving messages from xenstored, so there
is no security impact, unlike XSA-72.

Coverity-ID: 1055449
Coverity-ID: 1056028
Signed-off-by: Matthew Daley <mattd@xxxxxxxxxxx>
---
 tools/xenstore/xs.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
index 261b841..184886f 100644
--- a/tools/xenstore/xs.c
+++ b/tools/xenstore/xs.c
@@ -1145,6 +1145,12 @@ static int read_message(struct xs_handle *h, int 
nonblocking)
                goto error_freemsg;
        }
 
+       /* Sanity check message body length. */
+       if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
+               saved_errno = E2BIG;
+               goto error_freemsg;
+       }
+
        /* Allocate and read the message body. */
        body = msg->body = malloc(msg->hdr.len + 1);
        if (body == NULL)
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel