[Xen-changelog] [xen-4.1-testing] tmem: check the pool_id is valid when destroying a tmem pool

[Xen patchbot-4.1-testing <patchbot@xxxxxxx>]

# HG changeset patch
# User Ian Campbell <ian.campbell@xxxxxxxxxx>
# Date 1348568697 -7200
# Node ID 6f61607a074b407b0f6303b6bd09382c0e27576c
# Parent  805f0ba5e11b54067b0782b920fd8bc6421adfb1
tmem: check the pool_id is valid when destroying a tmem pool

This is part of XSA-15 / CVE-2012-3497.

Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
Acked-by: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>
Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
xen-unstable changeset: 25852:d189d99ef00c
xen-unstable date: Tue Sep 11 12:06:54 UTC 2012
---


diff -r 805f0ba5e11b -r 6f61607a074b xen/common/tmem.c
--- a/xen/common/tmem.c Tue Sep 25 12:24:37 2012 +0200
+++ b/xen/common/tmem.c Tue Sep 25 12:24:57 2012 +0200
@@ -1873,6 +1873,8 @@ static NOINLINE int do_tmem_destroy_pool
 
     if ( client->pools == NULL )
         return 0;
+    if ( pool_id >= MAX_POOLS_PER_DOMAIN )
+        return 0;
     if ( (pool = client->pools[pool_id]) == NULL )
         return 0;
     client->pools[pool_id] = NULL;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog