[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH] console: avoid buffer overflow in guest_console_write()
The switch of guest_console_write()'s second parameter from plain to unsigned int has caused the function's main loop header to no longer guard the min_t() use within the function against effectively negative values, due to the casts hidden inside the macro. Replace by a plain min(), converting one of the arguments suitably without involving any cast. Fixes: ea601ec9995b ("xen/console: Rework HYPERCALL_console_io interface") Reported-by: Ilja Van Sprundel <ivansprundel@xxxxxxxxxxxx> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -538,7 +538,7 @@ static long guest_console_write(XEN_GUES __HYPERVISOR_console_io, "iih", CONSOLEIO_write, count, buffer); - kcount = min_t(int, count, sizeof(kbuf)-1); + kcount = min(count + sizeof(char[0]), sizeof(kbuf) - 1); if ( copy_from_guest(kbuf, buffer, kcount) ) return -EFAULT; _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxxx https://lists.xenproject.org/mailman/listinfo/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |