[Xen-changelog] [xen master] libxc: check blob size before proceeding in xc_dom_check_gzip

[patchbot@xxxxxxx]

commit 966070058d02cce9684e30073b61d6465e4b351c
Author:     Matthew Daley <mattjd@xxxxxxxxx>
AuthorDate: Fri Jun 14 16:39:38 2013 +0100
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Fri Jun 14 16:39:38 2013 +0100

    libxc: check blob size before proceeding in xc_dom_check_gzip
    
    This is part of the fix to a security issue, XSA-55.
    
    Signed-off-by: Matthew Daley <mattjd@xxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    Signed-off-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    
    v8: Add a comment explaining where the number 6 comes from.
    
    v6: This patch is new in v6 of the series.
---
 tools/libxc/xc_dom_core.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
index 1a14d3c..5f188c1 100644
--- a/tools/libxc/xc_dom_core.c
+++ b/tools/libxc/xc_dom_core.c
@@ -284,6 +284,11 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, 
size_t ziplen)
     unsigned char *gzlen;
     size_t unziplen;
 
+    if ( ziplen < 6 )
+        /* Too small.  We need (i.e. the subsequent code relies on)
+         * 2 bytes for the magic number plus 4 bytes length. */
+        return 0;
+
     if ( strncmp(blob, "\037\213", 2) )
         /* not gzipped */
         return 0;
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog