[Xen-changelog] [xen stable-4.2] xenstore: sanity check incoming message body lengths

[patchbot@xxxxxxx]

commit c25ce50180afa0c703edcb156a644266a48edf9b
Author:     Matthew Daley <mattd@xxxxxxxxxxx>
AuthorDate: Sat Nov 30 13:20:04 2013 +1300
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Thu Jan 9 12:41:52 2014 +0000

    xenstore: sanity check incoming message body lengths
    
    This is for the client-side receiving messages from xenstored, so there
    is no security impact, unlike XSA-72.
    
    Coverity-ID: 1055449
    Coverity-ID: 1056028
    Signed-off-by: Matthew Daley <mattd@xxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    (cherry picked from commit 8da1ed9031341381c218b7e6eaab5b4f239a327b)
    (cherry picked from commit 014f9219f1dca3ee92948f0cfcda8d1befa6cbcd)
---
 tools/xenstore/xs.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
index b951015..ef8890e 100644
--- a/tools/xenstore/xs.c
+++ b/tools/xenstore/xs.c
@@ -1073,6 +1073,12 @@ static int read_message(struct xs_handle *h, int 
nonblocking)
                goto error_freemsg;
        }
 
+       /* Sanity check message body length. */
+       if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
+               saved_errno = E2BIG;
+               goto error_freemsg;
+       }
+
        /* Allocate and read the message body. */
        body = msg->body = malloc(msg->hdr.len + 1);
        if (body == NULL)
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.2

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog