Re: [Xen-devel] [PATCH] libxl: make sure buffer is null-terminated in libxl_read_file_contents

[Wei Liu <wei.liu2@xxxxxxxxxx>]

On Wed, Jun 27, 2018 at 09:13:11AM +0000, Robin Lee wrote:
> On XenServer 7.1.1, we start a vm with XAPI but attach a block device with xl.
> We create an empty json config for the vm with the content "{}\n" and then
> run 'xl block-attach':
> 
>   #  xl block-attach 1 phy:/dev/loop0 xvdz w
>   libxl: error: libxl_json.c:950:libxl__json_parse: yajl error: parse error: 
> trailing garbage
>                                       {} K]
>                        (right here) ------^
> 
>   libxl: error: libxl_json.c:1053:libxl__object_from_json: unable to generate 
> libxl__json_object from JSON representation of libxl_domain_config.
>   libxl: error: libxl.c:1995:device_addrm_aocomplete: unable to add device
>   libxl_device_disk_add failed.
> 
> After investigation, we found the buffer returned from 
> libxl_read_file_contents
> is not null-terminated. But later in libxl__object_from_json, the buffer is 
> expected to
> be null-terminated. So parsing may exceeded the end of file and get in to 
> uninisialized
> momery area.
> 
> Signed-off-by: Robin Lee <robinlee.sysu@xxxxxxxxx>

I can't seem to be able to reproduce this in upstream xen. Which version
of Xen does XenServer 7.1.1 have? You can get that from the output of
`xl info` -- look for xen_{major, minor, extra}.

BTW if you're using XenServer you probably should use XAPI to manipulate
guests instead.

Wei.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel