[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [win-pv-devel] [PATCH for 8.1] Fix hash table overflow



> -----Original Message-----
> From: Paul Durrant
> Sent: 09 September 2015 13:48
> To: 'Paul Durrant'; win-pv-devel@xxxxxxxxxxxxxxxxxxxx
> Subject: RE: [win-pv-devel] [PATCH for 8.1] Fix hash table overflow
> 
> > -----Original Message-----
> > From: win-pv-devel-bounces@xxxxxxxxxxxxxxxxxxxx [mailto:win-pv-devel-
> > bounces@xxxxxxxxxxxxxxxxxxxx] On Behalf Of Paul Durrant
> > Sent: 09 September 2015 13:46
> > To: win-pv-devel@xxxxxxxxxxxxxxxxxxxx
> > Cc: Paul Durrant
> > Subject: [win-pv-devel] [PATCH for 8.1] Fix hash table overflow
> >
> > There is a flaw in HashTableHash() which means that, for example, an Array
> > value of 0xff added to an Accumulator value of 0xff will lead to more than
> > 4 bits of Overflow. The 5th bit is missed by the mask and is hence not
> > folded back into the lower order bits of the Accumulator. The upshot of the
> > this is an ASSERTion failure for a debug build or an array overflow in the
> > caller for a non-debug build.
> > This patch fixes this issue by increasing the overflow mask to 8 bits
> > instead of 4 (although 5 bit would actually be sufficient).
> >
> > Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
> 
> Sorry, that should also be:
> 
> Reported-by: Rafał Wojdyła <omeg@xxxxxxxxxxxxxxxxxxxxxx>

... and indeed

Tested-by: Rafał Wojdyła <omeg@xxxxxxxxxxxxxxxxxxxxxx>

> 
> > ---
> >  src/xenbus/hash_table.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/xenbus/hash_table.c b/src/xenbus/hash_table.c
> > index a9c1b79..c7c6101 100644
> > --- a/src/xenbus/hash_table.c
> > +++ b/src/xenbus/hash_table.c
> > @@ -90,7 +90,7 @@ HashTableHash(
> >
> >          Accumulator = (Accumulator << 4) + Array[Index];
> >
> > -        Overflow = Accumulator & 0x00000f00;
> > +        Overflow = Accumulator & 0x0000ff00;
> >          if (Overflow != 0) {
> >              Accumulator ^= Overflow >> 8;
> >              Accumulator ^= Overflow;
> > --
> > 2.1.1
> >
> >
> > _______________________________________________
> > win-pv-devel mailing list
> > win-pv-devel@xxxxxxxxxxxxxxxxxxxx
> > http://lists.xenproject.org/cgi-bin/mailman/listinfo/win-pv-devel

_______________________________________________
win-pv-devel mailing list
win-pv-devel@xxxxxxxxxxxxxxxxxxxx
http://lists.xenproject.org/cgi-bin/mailman/listinfo/win-pv-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.