Re: [win-pv-devel] [PATCH] Fix heap corruption in co-installer

[Fabio Fantoni <fabio.fantoni@xxxxxxx>]

Il 07/10/2014 16:57, Paul Durrant ha scritto:
> The co-installer was corrupting its heap by trying to free a pointer after
> incrementing it from its original value.
>
> Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
I saw that this patch is still not in repository, may have problems and 
should be tested before?
It should solves xenbus upgrade problem, right?

Thanks for any reply.

> ---
>   src/coinst/coinst.c | 10 ++++++----
>   src/xenbus.inf      |  2 +-
>   2 files changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/src/coinst/coinst.c b/src/coinst/coinst.c
> index 27d3211..59726f5 100644
> --- a/src/coinst/coinst.c
> +++ b/src/coinst/coinst.c
> @@ -1132,6 +1132,7 @@ MatchExistingDriver(
>       DWORD   MaxValueLength;
>       DWORD   DriverDescLength;
>       PTCHAR  DriverDesc = NULL;
> +    DWORD   ProductNameLength;
>       DWORD   Type;
>   
>       // Look for a legacy platform device
> @@ -1213,16 +1214,17 @@ found:
>           goto fail9;
>       }
>   
> +    ProductNameLength = (DWORD)strlen(PRODUCT_NAME_STR);
> +
>       if (strncmp(DriverDesc,
>                   PRODUCT_NAME_STR,
> -                strlen(PRODUCT_NAME_STR)) != 0) {
> +                ProductNameLength) != 0) {
>           SetLastError(ERROR_INSTALL_FAILURE);
>           goto fail10;
>       }
>   
> -    DriverDesc += strlen(PRODUCT_NAME_STR);
> -
> -    if (strcmp(DriverDesc, " PV Bus") != 0) {
> +    if (strcmp(DriverDesc + ProductNameLength,
> +               " PV Bus") != 0) {
>           SetLastError(ERROR_INSTALL_FAILURE);
>           goto fail11;
>       }
> diff --git a/src/xenbus.inf b/src/xenbus.inf
> index fe01c79..544bb2c 100644
> --- a/src/xenbus.inf
> +++ b/src/xenbus.inf
> @@ -72,8 +72,8 @@ 
> xenbus_coinst_@MAJOR_VERSION@_@MINOR_VERSION@_@MICRO_VERSION@_@BUILD_NUMBER@.dll
>   CopyFiles=XenBus_Copyfiles
>   
>   [XenBus_Inst.Services]
> -AddService=xenfilt,,XenFilt_Service,
>   AddService=xenbus,0x02,XenBus_Service,
> +AddService=xenfilt,,XenFilt_Service,
>   
>   [XenBus_Service]
>   DisplayName=%XenBusDesc%

_______________________________________________
win-pv-devel mailing list
win-pv-devel@xxxxxxxxxxxxxxxxxxxx
http://lists.xenproject.org/cgi-bin/mailman/listinfo/win-pv-devel