Re: [Xen-devel] [PATCH] x86/hvm: Fix boundary check in hvmemul_insn_fetch()

["Jan Beulich" <jbeulich@xxxxxxxx>]

>>> Andrew Cooper <andrew.cooper3@xxxxxxxxxx> 07/25/17 8:55 PM >>>
>--- a/xen/arch/x86/hvm/emulate.c
>+++ b/xen/arch/x86/hvm/emulate.c
>@@ -958,8 +958,8 @@ int hvmemul_insn_fetch(
>* Will we overflow insn_buf[]?  This shouldn't be able to happen,
>* which means something went wrong with instruction decoding...
>*/
>- if ( insn_off > sizeof(hvmemul_ctxt->insn_buf) ||
>-                 (insn_off + bytes) > sizeof(hvmemul_ctxt->insn_buf) )
>+            if ( insn_off >= sizeof(hvmemul_ctxt->insn_buf) ||
>+                 (insn_off + bytes) >= sizeof(hvmemul_ctxt->insn_buf) )

I agree with the change to the first line, but are you sure about the
second one? At the example of insn_off == 0, surely
bytes == sizeof() is fine?

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel