[Xen-changelog] [xen stable-4.3] xenstore: sanity check incoming message body lengths

[patchbot@xxxxxxx]

commit 014f9219f1dca3ee92948f0cfcda8d1befa6cbcd
Author:     Matthew Daley <mattd@xxxxxxxxxxx>
AuthorDate: Sat Nov 30 13:20:04 2013 +1300
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Thu Jan 9 12:25:47 2014 +0000

    xenstore: sanity check incoming message body lengths
    
    This is for the client-side receiving messages from xenstored, so there
    is no security impact, unlike XSA-72.
    
    Coverity-ID: 1055449
    Coverity-ID: 1056028
    Signed-off-by: Matthew Daley <mattd@xxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    (cherry picked from commit 8da1ed9031341381c218b7e6eaab5b4f239a327b)
---
 tools/xenstore/xs.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
index 86ef6c7..d0966ac 100644
--- a/tools/xenstore/xs.c
+++ b/tools/xenstore/xs.c
@@ -1141,6 +1141,12 @@ static int read_message(struct xs_handle *h, int 
nonblocking)
                goto error_freemsg;
        }
 
+       /* Sanity check message body length. */
+       if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
+               saved_errno = E2BIG;
+               goto error_freemsg;
+       }
+
        /* Allocate and read the message body. */
        body = msg->body = malloc(msg->hdr.len + 1);
        if (body == NULL)
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog