libxc: Don't write terminating NULL character to command string

When copying boot command string for HVMlite guests we explicitly write
'\0' at MAX_GUEST_CMDLINE offset. Unless the string is close to
MAX_GUEST_CMDLINE in length this write will end up in the wrong place,
beyond the end of the mapped range.

We don't need to limit the size of command string to some arbitrary
number. Any size that can be successfully allocated and mapped is valid
and so the string is guaranteed to be NULL-terminated (since we use
strlen, which needs terminating '\0', to calculate allocation size).

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
This commit is contained in:
Boris Ostrovsky authored and Ian Campbell committed 2016-01-07 12:51:06 +00:00
1 parent dc6d609371
commit 8345512feb
1 file changed
+1 -2
+1 -2
View File
@@ -676,8 +676,7 @@ static int alloc_magic_pages_hvm(struct xc_dom_image *dom)
if ( dom->cmdline )
{
strncpy(cmdline, dom->cmdline, MAX_GUEST_CMDLINE);
cmdline[MAX_GUEST_CMDLINE - 1] = '\0';
strncpy(cmdline, dom->cmdline, cmdline_size);
start_info->cmdline_paddr = (seg.pfn << PAGE_SHIFT) +
((uintptr_t)cmdline - (uintptr_t)start_info);
}
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.