We updated flex output files in 4b314c89 ("libxl: update flex output
files") for DSA 3653-1 / CVE-2016-6354. But Debian security team
discovered the fix to flex was incomplete and issued DSA 3653-2. We need
to update our flex output files accordingly.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Libxl ships output files from flex (libxlu_*_l.{c,h}). We use the flex
shipped in Debian to generate those files. Debian just patched their
flex (DSA 3653-1) to fix CVE-2016-6354, which is a buffer overrun bug.
Note that libxl is _NOT_ vulnerable to that CVE. See below for Ian's
analysis to security@xen.
It would still be nice that we update our shipped flex output files to
avoid confusion.
===QUOTE===
The bug is that with input >16K[1] flex would usually fail to resize
the input buffer, and then overrun it.
I have read the code in libxlu_cfg_l.c to try to understand the
implications for libxl.
AFAICT
- libxl always does config file reading _from the file_ itself, and
provides flex with a string or buffer.
- so we always call whatever_yy_scan_bytes, not any other flex setup
function to set up a `buffer' (as flex calls it)
- yy_scan_bytes calls yy_scan_buffer to set up the buffer
- yy_scan_buffer sets b->yy_fill_buffer
- The effect of this is that yy_get_next_buffer will always
return early, rather than continuing on to the vulnerable code.
So I think libxl is not vulnerable, regardless of the contents of the
configuration file.
[1] the default buffer size, or whatever other buffer size is
configured (but we don't change it)
===ENDQUOTE===
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
This is the result of
$ find -name \*.l -exec touch {} \;
$ find -name \*.y -exec touch {} \;
and then rebuilding.
This avoids churn on the machine I use for committing which has been
updated, causing flex to go from 2.5.35-10.1 to 2.5.39-8.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Regenerate libxl_*_l.* with flex 2.5.35-10.1 as in current Debian
wheezy. The differences are trivial: addition of declarations of
xlu__cfg_yyget_column and xlu__cfg_yyset_column, but no code body
changes.
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
This undoes some systematic changes which were made to
libxlu_cfg_l.[ch] along with manually-edited files (eg, whitespace
changes, emacs local variables) and returns these two files to exactly
the output of flex (Debian squeeze 2.5.35-10 i386).
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Commit exactly the results of running
find \! -iname '*.txt' -type f -print0 | xargs -0 perl -p -i.bak -E 's/\s+\n/\n/'
Signed-off-by: Wei Liu <liuw@liuw.name>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed: Ian Jackson <ian.jackson@eu.citrix.com>
Copyright notices in libxlu_cfg_[ly].[ly] end up in the .[ch] files,
copied there by flex and bison. Regenerate those files (flex 2.5.35
and bison 2.3, from Debian lenny i386).
No manual edits in this patch.
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Committed-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
The scanner from c/s 22735:cb94dbe20f97 is buggy and crashes with a
segmentation fault. Rebuilding the sanner appears to fix the problem
so it appears that I somehow accidentally checked in a scanner which
doesn't correspond to the committed scanner source code.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
The characters - + . ( ) : are not legal in xl config files but are
valid Python and use of at least one of them is almost essential for
writing arbitrary Python in the config file.
So if we see one of these during lexing, note it, and then after the
parse is complete if it failed we print a special extra warning.
Currently this warning refers to the nonexistent wiki page
http://wiki.xen.org/xenwiki/PythonInXlConfig
which will have to be written (and/or given a better name) before the
actual 4.1 release.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
We are going to need to rerun flex to generate new lexer code. So
rerun it now to separate out the irrelevant from the relevant changes
to the generated files.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Support of cpu pools in libxl and xl:
library functions
xl cpupool-create
xl cpupool-list
xl cpupool-destroy
xl cpupool-cpu-add
xl cpupool-cpu-remove
xl cpupool-migrate
Renamed all cpu pool related names to *cpupool*
Signed-off-by: juergen.gross@ts.fujitsu.com
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Since the recent build error caused by mismatch of symbol types due to
missing declarations, build libxl with -Wmissing-declarations.
The patch is mostly straightforward, a one liner in the makefile enables
the flag, a lot of functions in xl_cmdimpl.c needed to be made static
and libxl_paths.c needed to include libxl.h.
The one wart on the patch-set is that flex has a bug where it emits code
with missing declarations for yy(set|get)_column. This can be worked
around by providing the declarations ourselves regardless.
Signed-off-by: Gianni Tedesco <gianni.tedesco@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Wei Liu
Ian Campbell
Ian Jackson
Wei Liu
Juergen Gross
Keir Fraser