Re: [PATCH v2 2/8] store: Detect bad response from xenstored

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 17/08/2026 14:41, Owen Smith wrote:
> Detect when Header.len is larger than allowed, and fail the request.
> A length of 0 is valid for some operations.
> 
> Assisted-by: ClaudeCode:claude-opus-4.8
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
> ---
>   src/xenbus/store.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/src/xenbus/store.c b/src/xenbus/store.c
> index 503144a..b40ef3c 100644
> --- a/src/xenbus/store.c
> +++ b/src/xenbus/store.c
> @@ -522,6 +522,10 @@ StoreReceiveResponse(
>       if (Response->Header.len == 0)
>           goto done;
>   
> +    status = STATUS_INVALID_BUFFER_SIZE;
> +    if (Response->Header.len > XENSTORE_PAYLOAD_MAX)
> +        goto done;
> +
>       Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Length = 
> Response->Header.len;
>       Response->Segment[XENBUS_STORE_RESPONSE_PAYLOAD_SEGMENT].Data = 
> Response->Data;
>   

The comparison to XENSTORE_PAYLOAD_MAX in StoreVerifyHeader should be 
adjusted as well.


--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech