[win-pv-devel] [PATCH 3/4] Fix potential buffer overflow

[Paul Durrant <pdurrant@xxxxxxxxx>]

The __min in XENFILT's FdoQueryDeviceRelations() should be a __max. The only
reason this mistake did not lead to an immediate buffer overflow was because
the allocation incorrectly used sizeof (DEVICE_OBJECT) rather than
sizeof (PDEVICE_OBJECT).

Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
---
 src/xenfilt/fdo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/xenfilt/fdo.c b/src/xenfilt/fdo.c
index 42a40e8..cff179b 100644
--- a/src/xenfilt/fdo.c
+++ b/src/xenfilt/fdo.c
@@ -1160,7 +1160,7 @@ FdoQueryDeviceRelations(
     }
 
     Size = FIELD_OFFSET(DEVICE_RELATIONS, Objects) +
-           (sizeof (DEVICE_OBJECT) * __min(Count, 1));
+           (sizeof (PDEVICE_OBJECT) * __max(Count, 1));
 
     Relations = __AllocatePoolWithTag(PagedPool, Size, 'TLIF');
 
-- 
2.1.1


_______________________________________________
win-pv-devel mailing list
win-pv-devel@xxxxxxxxxxxxxxxxxxxx
http://lists.xenproject.org/cgi-bin/mailman/listinfo/win-pv-devel