Re: [Xen-devel] [PATCH 5/5] xenstat: Fix buffer over-run with new_domains being negative (again).

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Mon, 2013-11-25 at 12:00 -0500, Konrad Rzeszutek Wilk wrote:
> The git commit 1438d36f96e90d1116bebc6b3013634ca21c49c8
> "xenstat: Fix buffer over-run with new_domains being negative."
> fixed part of the problem, but it failed to do one more check.
> 
> That is the if we don't exit out of the loop if the
> xc_domain_getinfolist returns -1. This makes the check
> by casting the unsigned int value to int as otherwise
> the
>       if (new_domains < 0)
> 
> would never get executed (as unsigned int won't be negative).
> 
> Fixes CID 1055740.
> 
> CC: andrew.cooper3@xxxxxxxxxx
> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
> ---
>  tools/xenstat/libxenstat/src/xenstat.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/xenstat/libxenstat/src/xenstat.c 
> b/tools/xenstat/libxenstat/src/xenstat.c
> index e5facb8..27d8e22 100644
> --- a/tools/xenstat/libxenstat/src/xenstat.c
> +++ b/tools/xenstat/libxenstat/src/xenstat.c
> @@ -208,7 +208,7 @@ xenstat_node *xenstat_get_node(xenstat_handle * handle, 
> unsigned int flags)
>                                                   node->num_domains, 
>                                                   DOMAIN_CHUNK_SIZE, 
>                                                   domaininfo);
> -             if (new_domains < 0)
> +             if ((int)new_domains < 0)

I expect that the right fix is to make new_domains the correct (signed)
type, no?

Ian.


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel