mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Pawel Wieczorkiewicz
36c80e29e3
It is possible to send a zero-string message body to xenstore's XS_CONTROL handling function. Then the number of strings is used for an array allocation. This leads to a crash in strcmp() in a CONTROL sub-command invocation loop. The output of xs_count_string() should be verified and all 0 or negative values should be rejected with an EINVAL. At least the sub-command name must be specified. The xenstore crash can only be triggered from within dom0 (there is a check in do_control() rejecting all non-dom0 requests with an EACCES). Testing: reproduced with the following command: python -c 'print 16*"\x00"' | nc -U $XENSTORED_RUNDIR/socket Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de> Reviewed-by: Martin Pohlack <mpohlack@amazon.de> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Reviewed-by: Juergen Gross <jgross@suse.com> Acked-by: Wei Liu <wei.liu2@citrix.com> Release-acked-by: Julien Grall <julien.grall@linaro.org>