Re: [PATCH] store: Detect bad response from xenstored

[Owen Smith <owen.smith@xxxxxxxxxx>]

Reviewed-by: Owen Smith <owen.smith@xxxxxxxxxx>

________________________________________
From: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
Sent: 26 August 2026 10:23 AM
To: win-pv-devel@xxxxxxxxxxxxxxxxxxxx
Cc: Tu Dinh; Owen Smith
Subject: [PATCH] store: Detect bad response from xenstored

Detect when Header.len is larger than allowed, and fail the request.
A length of 0 is valid for some operations.
Also modify StoreVerifyHeader to fail on length > XENSTORE_PAYLOAD_MAX

Assisted-by: ClaudeCode:claude-opus-4.8
Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>

Ported from XenBus.

Signed-off-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
---
 src/xencrsh/store.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/xencrsh/store.c b/src/xencrsh/store.c
index 7c5e078..cc7cf8b 100644
--- a/src/xencrsh/store.c
+++ b/src/xencrsh/store.c
@@ -376,7 +376,7 @@ __StoreVerifyHeader(
         Valid = FALSE;
     }

-    if (Header->len >= XENSTORE_PAYLOAD_MAX) {
+    if (Header->len > XENSTORE_PAYLOAD_MAX) {
         LogError("ILLEGAL LENGTH 0x%08x\n", Header->len);
         Valid = FALSE;
     }
@@ -404,6 +404,10 @@ StoreReceiveResponse(
     if (Response->Header.len == 0)
         goto done;

+    status = STATUS_INVALID_BUFFER_SIZE;
+    if (Response->Header.len > XENSTORE_PAYLOAD_MAX)
+        goto done;
+
     Response->Segment[RESPONSE_PAYLOAD_SEGMENT].Length = Response->Header.len;
     Response->Segment[RESPONSE_PAYLOAD_SEGMENT].Data = 
AustereAllocate(Response->Segment[RESPONSE_PAYLOAD_SEGMENT].Length);
     ASSERT(Response->Segment[RESPONSE_PAYLOAD_SEGMENT].Data != NULL);
--
2.55.0.windows.3



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech