Re: [Xen-devel] [PATCH 18/22] libxc: Add range checking to xc_dom_binloader

[Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>]

Andrew Cooper writes ("Re: [PATCH 18/22] libxc: Add range checking to 
xc_dom_binloader"):
> On 07/06/13 19:27, Ian Jackson wrote:
> > @@ -123,9 +123,12 @@ static struct xen_bin_image_table *find_table(struct 
> > xc_dom_image *dom)
> >      uint32_t *probe_ptr;
> >      uint32_t *probe_end;
> >  
> > +    if ( dom->kernel_size < sizeof(*table) )
> > +        return NULL;
> >      probe_ptr = dom->kernel_blob;
> >      probe_end = dom->kernel_blob + dom->kernel_size - sizeof(*table);
> > -    if ( (void*)probe_end > (dom->kernel_blob + 8192) )
> > +    if ( dom->kernel_size >= 8192 &&
> > +         (void*)probe_end > (dom->kernel_blob + 8192) )
> >          probe_end = dom->kernel_blob + 8192;
> 
> More void pointer arithmetic.

As discussed I intend to leave that alone.  It has defined (and the
desired) behaviour.

> If I am reading the above correctly, it appears to be a glorified
> 
> probe_end = dom->kernel_blob + (uintptr_t)min(dom->kernel_size -
> sizeof(*table), 8192);
> 
> which looks to be a more simple representation?

Surely I shouldn't be changing this unnecessarily ?

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel