This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] [PATCH] libxenlight: fix heap overflow when domid_to_name re

To: Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxx>
Subject: [Xen-devel] [PATCH] libxenlight: fix heap overflow when domid_to_name returns NULL
From: Eamon Walsh <ewalsh@xxxxxxxxxxxxx>
Date: Thu, 03 Mar 2011 18:29:44 -0500
Cc: stefano.stabellini@xxxxxxxxxxxxx
Delivery-date: Thu, 03 Mar 2011 15:31:15 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20101209 Fedora/3.1.7-0.35.b3pre.fc14 Thunderbird/3.1.7
The function flexarray_vappend() will stop at the first NULL
argument.  In libxl_device_vfb_add(), this has been observed
to result in keys being added to the backend array without
associated values in cases where the value can be NULL.
This causes libxl__xs_kvs_of_flexarray(), which expects an even
number of array elements, to write past the end of the array.

Fix by manually appending two values.

Signed-off-by: Eamon Walsh <ewalsh@xxxxxxxxxxxxx>

diff -r c5d121fd35c0 tools/libxl/libxl.c
--- a/tools/libxl/libxl.c       Mon Feb 28 16:55:20 2011 +0000
+++ b/tools/libxl/libxl.c       Thu Mar 03 18:32:10 2011 -0500
@@ -1890,9 +1890,11 @@
     flexarray_vappend(back, "frontend-id", libxl__sprintf(&gc, "%d", 
vfb->domid), NULL);
     flexarray_vappend(back, "online", "1", NULL);
     flexarray_vappend(back, "state", libxl__sprintf(&gc, "%d", 1), NULL);
-    flexarray_vappend(back, "domain", libxl__domid_to_name(&gc, domid), NULL);
+    flexarray_append(back, "domain");
+    flexarray_append(back, libxl__domid_to_name(&gc, domid));
     flexarray_vappend(back, "vnc", libxl__sprintf(&gc, "%d", vfb->vnc), NULL);
-    flexarray_vappend(back, "vnclisten", vfb->vnclisten, NULL);
+    flexarray_append(back, "vnclisten");
+    flexarray_append(back, vfb->vnclisten);
     flexarray_append(back, "vncpasswd");
     flexarray_append(back, vfb->vncpasswd);
     flexarray_vappend(back, "vncdisplay", libxl__sprintf(&gc, "%d", 
vfb->vncdisplay), NULL);


Eamon Walsh 
National Security Agency

Xen-devel mailing list