mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
EFI: don't leak heap contents through XEN_EFI_get_next_variable_name
Commit 1f4eb9d27d ("EFI: fix getting EFI variable list on some
systems") switched to using the caller provided size for the copy-out
without making sure the copied buffer is properly scrubbed.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
This commit is contained in:
1 parent
ad38db5852
commit
4783ee894f
1 file changed
+1
-1
@@ -571,7 +571,7 @@ int efi_runtime_call(struct xenpf_efi_runtime_call *op)
|
||||
return -EINVAL;
|
||||
|
||||
size = op->u.get_next_variable_name.size;
|
||||
name.raw = xmalloc_bytes(size);
|
||||
name.raw = xzalloc_bytes(size);
|
||||
if ( !name.raw )
|
||||
return -ENOMEM;
|
||||
if ( copy_from_guest(name.raw, op->u.get_next_variable_name.name,
|
||||
|
||||