[xen master] tools/xenstored: Check number of strings passed to do_control()

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[xen master] tools/xenstored: Check number of strings passed to do_control()

commit 36c80e29e36eee02f20f18e7f32267442b18c8bd
Author:     Pawel Wieczorkiewicz <[hidden email]>
AuthorDate: Fri Oct 27 16:32:15 2017 +0000
Commit:     Wei Liu <[hidden email]>
CommitDate: Tue Nov 14 13:58:16 2017 +0000

    tools/xenstored: Check number of strings passed to do_control()
    It is possible to send a zero-string message body to xenstore's
    XS_CONTROL handling function. Then the number of strings is used
    for an array allocation. This leads to a crash in strcmp() in a
    CONTROL sub-command invocation loop.
    The output of xs_count_string() should be verified and all 0 or
    negative values should be rejected with an EINVAL. At least the
    sub-command name must be specified.
    The xenstore crash can only be triggered from within dom0 (there
    is a check in do_control() rejecting all non-dom0 requests with
    an EACCES).
    Testing: reproduced with the following command:
    python -c 'print 16*"\x00"' | nc -U $XENSTORED_RUNDIR/socket
    Signed-off-by: Pawel Wieczorkiewicz <[hidden email]>
    Reviewed-by: Martin Pohlack <[hidden email]>
    Acked-by: Ian Jackson <[hidden email]>
    Reviewed-by: Juergen Gross <[hidden email]>
    Acked-by: Wei Liu <[hidden email]>
    Release-acked-by: Julien Grall <[hidden email]>
 tools/xenstore/xenstored_control.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index 7c14911..e4b8aa9 100644
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -184,6 +184,8 @@ int do_control(struct connection *conn, struct buffered_data *in)
  return EACCES;
  num = xs_count_strings(in->buffer, in->used);
+ if (num < 1)
+ return EINVAL;
  vec = talloc_array(in, char *, num);
  if (!vec)
  return ENOMEM;
generated by git-patchbot for /home/xen/git/xen.git#master

Xen-changelog mailing list
[hidden email]