This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] [PATCH] Fix buffer overflow in xenconsoled

To: xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxx>
Subject: [Xen-devel] [PATCH] Fix buffer overflow in xenconsoled
From: Anthony Liguori <aliguori@xxxxxxxxxx>
Date: Tue, 30 Aug 2005 16:57:16 -0500
Delivery-date: Tue, 30 Aug 2005 21:55:57 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla Thunderbird 1.0.2 (X11/20050317)
Appears to be a typo.

Christian's watch changes threw me off a bit as I had been pursuing another route to fix the same problems. This bug is still valid though.


Anthony Liguori

Signed-off-by: Anthony Liguori
# HG changeset patch
# User Anthony Liguori <aliguori@xxxxxxxxxx>
# Node ID 444e4fa43bf1123873cddecff51d9fe593271eae
# Parent  fe6c5ecea53aabedc6b53988da25910e108eafe9
Fix overflow in reading from console

diff -r fe6c5ecea53a -r 444e4fa43bf1 tools/console/daemon/io.c
--- a/tools/console/daemon/io.c Tue Aug 30 22:01:01 2005
+++ b/tools/console/daemon/io.c Tue Aug 30 22:05:28 2005
@@ -353,7 +353,7 @@
                (struct ring_head *)(dom->page + PAGE_SIZE/2);
        int i;
-       len = read(dom->tty_fd, msg, MAX(XENCONS_SPACE(inring), sizeof(msg)));
+       len = read(dom->tty_fd, msg, MIN(XENCONS_SPACE(inring), sizeof(msg)));
        if (len < 1) {
                dom->tty_fd = -1;
Xen-devel mailing list
<Prev in Thread] Current Thread [Next in Thread>