[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[win-pv-devel] [PATCH for 8.1] Fix hash table overflow

There is a flaw in HashTableHash() which means that, for example, an Array
value of 0xff added to an Accumulator value of 0xff will lead to more than
4 bits of Overflow. The 5th bit is missed by the mask and is hence not
folded back into the lower order bits of the Accumulator. The upshot of the
this is an ASSERTion failure for a debug build or an array overflow in the
caller for a non-debug build.
This patch fixes this issue by increasing the overflow mask to 8 bits
instead of 4 (although 5 bit would actually be sufficient).

Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
 src/xenbus/hash_table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/xenbus/hash_table.c b/src/xenbus/hash_table.c
index a9c1b79..c7c6101 100644
--- a/src/xenbus/hash_table.c
+++ b/src/xenbus/hash_table.c
@@ -90,7 +90,7 @@ HashTableHash(
         Accumulator = (Accumulator << 4) + Array[Index];
-        Overflow = Accumulator & 0x00000f00;
+        Overflow = Accumulator & 0x0000ff00;
         if (Overflow != 0) {
             Accumulator ^= Overflow >> 8;
             Accumulator ^= Overflow;

win-pv-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.