mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
xenstat: Fix buffer over-run with new_domains being negative.
Coverity identified this as: CID 1055740 Out-of-bounds read - "In xenstat_get_node: Out-of-bounds read from a buffer (CWE-125)" And sure enough, if xc_domain_getinfolist returns us -1, we will try to use it later on in the for (i = 0; i < new_domains; ..) loop. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
This commit is contained in:
1 parent
ae763e4224
commit
1438d36f96
1 file changed
+9
-5
@@ -208,15 +208,15 @@ xenstat_node *xenstat_get_node(xenstat_handle * handle, unsigned int flags)
|
||||
node->num_domains,
|
||||
DOMAIN_CHUNK_SIZE,
|
||||
domaininfo);
|
||||
if (new_domains < 0)
|
||||
goto err;
|
||||
|
||||
tmp = realloc(node->domains,
|
||||
(node->num_domains + new_domains)
|
||||
* sizeof(xenstat_domain));
|
||||
if (tmp == NULL) {
|
||||
free(node->domains);
|
||||
free(node);
|
||||
return NULL;
|
||||
}
|
||||
if (tmp == NULL)
|
||||
goto err;
|
||||
|
||||
node->domains = tmp;
|
||||
|
||||
domain = node->domains + node->num_domains;
|
||||
@@ -280,6 +280,10 @@ xenstat_node *xenstat_get_node(xenstat_handle * handle, unsigned int flags)
|
||||
}
|
||||
|
||||
return node;
|
||||
err:
|
||||
free(node->domains);
|
||||
free(node);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
void xenstat_free_node(xenstat_node * node)
|
||||
|
||||