Re: [Xen-devel] [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size()

[Dario Faggioli <dario.faggioli@xxxxxxxxxx>]

On Thu, 2016-02-11 at 10:11 +0000, Ian Campbell wrote:
> On Thu, 2016-02-11 at 11:03 +0100, Dario Faggioli wrote:
> > On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote:
> > > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote:
> > > > Â
> > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c
> > > > index 695939a..d96cc67 100644
> > > > --- a/tools/libxc/xc_tbuf.c
> > > > +++ b/tools/libxc/xc_tbuf.c
> > > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch,
> > > > unsigned long
> > > > *size)
> > > > ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂsysctl.u.tbuf_op.buffer_mfn);
> > > > Â
> > > > ÂÂÂÂÂif ( t_info == NULL || t_info->tbuf_size == 0 )
> > > > -ÂÂÂÂÂÂÂÂreturn -1;
> > > > +ÂÂÂÂÂÂÂÂrc = -1;
> > > > +ÂÂÂÂelse
> > > > +       *size = t_info->tbuf_size;
> > > > Â
> > > > -ÂÂÂÂ*size = t_info->tbuf_size;
> > > > +ÂÂÂÂxenforeignmemory_unmap(xch->fmem, t_info, *size);
> > > 
> > > *size could be uninitialised here (in the error path) and even in
> > > the
> > > success case I don't think t_info->tbus_size is the right
> > > argument
> > > here, it
> > > needs to be the size which was passed to the map function, i.e.
> > > sysctl.u.tbuf_op.size.
> > > 
> > And I think both are issues with the current code,
> 
> I don't think so, the xenforeignmemory_unmap using *size as an
> argument
> (where it is either uninitialised or the wrong value) is added by
> this
> patch.
> 
Ah, that one! Yes, you're right, I had overlooked this, and thought you
where referring to something else, sorry. I agree sysctl.u.tbuf_op.size
is what should be used.

Regards,
Dario
-- 
<<This happens because I choose it to happen!>> (Raistlin Majere)
-----------------------------------------------------------------
Dario Faggioli, Ph.D, http://about.me/dario.faggioli
Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel