Re: [XEN PATCH v3 1/3] libxl: Fix nul-termination of the return value of libxl_xen_console_read_line()

[Jan Beulich <jbeulich@xxxxxxxx>]

On 02.09.2024 18:38, Javi Merino wrote:
> When built with ASAN, "xl dmesg" crashes in the "printf("%s", line)"
> call in main_dmesg().  ASAN reports a heap buffer overflow: an
> off-by-one access to cr->buffer.
> 
> The readconsole sysctl copies up to count characters into the buffer,
> but it does not add a null character at the end.  Despite the
> documentation of libxl_xen_console_read_line(), line_r is not
> nul-terminated if 16384 characters were copied to the buffer.
> 
> Fix this by asking xc_readconsolering() to fill the buffer up to size
> - 1.  As the number of characters in the buffer is only needed in
> libxl_xen_console_read_line(), make it a local variable there instead
> of part of the libxl__xen_console_reader struct.
> 
> Fixes: 4024bae739cc ("xl: Add subcommand 'xl dmesg'")
> Reported-by: Edwin Török <edwin.torok@xxxxxxxxx>
> Reviewed-by: Anthony PERARD <anthony.perard@xxxxxxxxxx>
> Signed-off-by: Javi Merino <javi.merino@xxxxxxxxx>

Please keep tags in chronological order. I almost overlooked the R-b,
which makes this eligible for committing.

Jan