]> git.ipfire.org Git - thirdparty/libvirt.git/commit
xen: don't let bogus packets trigger over-allocation and segfault
authorJim Meyering <meyering@redhat.com>
Wed, 3 Mar 2010 15:50:02 +0000 (16:50 +0100)
committerJim Meyering <meyering@redhat.com>
Fri, 5 Mar 2010 17:30:57 +0000 (18:30 +0100)
commitba918ac1b4159aedb0c209202de35390a1e9e0b9
treec7d7e88d4fa4c59307f10d658299de41dd3dba98
parent4697def66b05c16f781af99aaf9d88fd402067d7
xen: don't let bogus packets trigger over-allocation and segfault

* src/xen/proxy_internal.c (xenProxyDomainDumpXML): An invalid packet
could include a too-large "ans.len" value, which would make us allocate
too much memory and then copy data from beyond the end of "ans",
possibly evoking a segfault.  Ensure that the value we use is no
larger than the remaining portion of "ans".
Also, change unnecessary memmove to memcpy (src and dest obviously
do not overlap, so no need to use memmove).
(xenProxyDomainGetOSType): Likewise.
(xenProxyGetCapabilities): Likewise.
src/xen/proxy_internal.c