[Xen-changelog] [xen master] libxc/restore: Fix data auditing in handle_x86_pv_vcpu_blob()

[patchbot@xxxxxxx]

commit 2a62c22715bf81c5695ae0511f89a940c7c6a492
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Dec 19 20:32:20 2019 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Fri Dec 20 12:12:00 2019 +0000

    libxc/restore: Fix data auditing in handle_x86_pv_vcpu_blob()
    
    The current logic only works by chance, in that XSAVE records also tend to 
be
    a multiple of 128.  Implement the missing logic for XSAVE.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---
 tools/libxc/xc_sr_restore_x86_pv.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/libxc/xc_sr_restore_x86_pv.c 
b/tools/libxc/xc_sr_restore_x86_pv.c
index 9e9ff32d47..c673b2670c 100644
--- a/tools/libxc/xc_sr_restore_x86_pv.c
+++ b/tools/libxc/xc_sr_restore_x86_pv.c
@@ -825,6 +825,15 @@ static int handle_x86_pv_vcpu_blob(struct xc_sr_context 
*ctx,
         break;
 
     case REC_TYPE_X86_PV_VCPU_XSAVE:
+        if ( blobsz < 128 )
+        {
+            ERROR("%s record too short: min %zu, got %u",
+                  rec_name, sizeof(*vhdr) + 128, rec->length);
+            goto out;
+        }
+        break;
+
+    case REC_TYPE_X86_PV_VCPU_MSRS:
         if ( blobsz % sizeof(xen_domctl_vcpu_msr_t) != 0 )
         {
             ERROR("%s record payload size %zu expected to be a multiple of 
%zu",
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog