Re: [Xen-devel] [PATCH] x86/monitor: Fixed CID 1412966: Memory - corruptions (OVERRUN)

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 21/06/17 15:33, Andrew Cooper wrote:
> On 21/06/17 15:28, Razvan Cojocaru wrote:
>> Fixed an issue where the maximum index allowed (31) goes beyond the
>> actual number of array elements (4) of ad->monitor.write_ctrlreg_mask.
>> Coverity-ID: 1412966
>>
>> Signed-off-by: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
>> ---
>>  xen/arch/x86/monitor.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c
>> index bedf13c..4620b15 100644
>> --- a/xen/arch/x86/monitor.c
>> +++ b/xen/arch/x86/monitor.c
>> @@ -133,7 +133,7 @@ int arch_monitor_domctl_event(struct domain *d,
>>          bool_t old_status;
>>  
>>          /* sanity check: avoid left-shift undefined behavior */
>> -        if ( unlikely(mop->u.mov_to_cr.index > 31) )
>> +        if ( unlikely(mop->u.mov_to_cr.index > 3) )
>> = ARRAY_SIZE(ad->monitor.write_ctrlreg_mask)
> ?

Sorry - that should be ">= ARRAY" when it doesn't get interpreted as an
email quotation.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel