Re: [Xen-devel] [PATCH] x86/monitor: Fixed CID 1412966: Memory - corruptions (OVERRUN)

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 21/06/17 15:28, Razvan Cojocaru wrote:
> Fixed an issue where the maximum index allowed (31) goes beyond the
> actual number of array elements (4) of ad->monitor.write_ctrlreg_mask.
> Coverity-ID: 1412966
>
> Signed-off-by: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
> ---
>  xen/arch/x86/monitor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c
> index bedf13c..4620b15 100644
> --- a/xen/arch/x86/monitor.c
> +++ b/xen/arch/x86/monitor.c
> @@ -133,7 +133,7 @@ int arch_monitor_domctl_event(struct domain *d,
>          bool_t old_status;
>  
>          /* sanity check: avoid left-shift undefined behavior */
> -        if ( unlikely(mop->u.mov_to_cr.index > 31) )
> +        if ( unlikely(mop->u.mov_to_cr.index > 3) )

>= ARRAY_SIZE(ad->monitor.write_ctrlreg_mask)

?

~Andrew

>              return -EINVAL;
>  
>          if ( unlikely(mop->u.mov_to_cr.pad1 || mop->u.mov_to_cr.pad2) )


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel