Re: [Xen-devel] [PATCH 04/28] libxl: fix libxl_string_list_length and its only caller

[Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>]

On 09/17/2013 11:37 PM, Matthew Daley wrote:
> The wrong amount of indirections were being taken in
> libxl_string_list_length, and its only caller was miscounting the amount
> of initial non-list arguments, seemingly since the initial commit
> (599c784).
>
> This has been seen and reported in the wild (##xen):
> < Trixboxer> Hi, any idea why would I get
> < Trixboxer> xl: libxl_bootloader.c:42: bootloader_arg: Assertion `bl->nargs < 
> bl->argsspace' failed.
> < Trixboxer> 4.2.2-23.el6
>
> Coverity-ID: 1054954
> Signed-off-by: Matthew Daley<mattjd@xxxxxxxxx>
> ---
>   tools/libxl/libxl.c            |    2 +-
>   tools/libxl/libxl_bootloader.c |    2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
> index 0879f23..ca24ca3 100644
> --- a/tools/libxl/libxl.c
> +++ b/tools/libxl/libxl.c
> @@ -202,7 +202,7 @@ int libxl_string_list_length(const libxl_string_list *psl)
>   {
>       if (!psl) return 0;
This should be
    if (!psl || !(*psl)) return 0;

We segfault otherwise at the changed line below if no arguments are 
passed to the bootloader (as is the case with pvgrub).
>       int i = 0;
> -    while (*psl++) i++;
> +    while ((*psl)[i]) i++;
>       return i;
>   }
(I am surprised Coverity didn't flag this)

-boris

>   
> diff --git a/tools/libxl/libxl_bootloader.c b/tools/libxl/libxl_bootloader.c
> index ed12b2c..3287bf7 100644
> --- a/tools/libxl/libxl_bootloader.c
> +++ b/tools/libxl/libxl_bootloader.c
> @@ -48,7 +48,7 @@ static void make_bootloader_args(libxl__gc *gc, 
> libxl__bootloader_state *bl,
>   {
>       const libxl_domain_build_info *info = bl->info;
>   
> -    bl->argsspace = 7 + libxl_string_list_length(&info->u.pv.bootloader_args);
> +    bl->argsspace = 9 + libxl_string_list_length(&info->u.pv.bootloader_args);
>   
>       GCNEW_ARRAY(bl->args, bl->argsspace);
>   

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel