Re: [Xen-devel] [PATCH V2] xen/hvm: fix hypervisor crash with hvm_save_one()

[Tim Deegan <tim@xxxxxxx>]

At 10:15 +0100 on 03 May (1493806508), Tim Deegan wrote:
> At 00:31 -0600 on 03 May (1493771502), Jan Beulich wrote:
> > +    else if ( ctxt.cur > sizeof(*desc) )
> >      {
> >          uint32_t off;
> > -        const struct hvm_save_descriptor *desc;
> >  
> > -        rv = -ENOENT;
> >          for ( off = 0; off < (ctxt.cur - sizeof(*desc)); off += 
> > desc->length )

It occurs to me that as well as underflowing, this test is off by one.
It ought to be "off + sizeof(*desc) <= ctxt.cur" to allow for a
zero-length record.  AFAIK we don't actually have any of those, so
it's academic, but we might want to represent the presence of some
feature without having any feature-specific state to save.

Tim.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel