diff options
| author | Matthew Daley <mattjd@gmail.com> | 2013-06-14 16:43:19 +0100 |
|---|---|---|
| committer | Ian Jackson <Ian.Jackson@eu.citrix.com> | 2013-06-14 16:43:19 +0100 |
| commit | 2a548e22915535ac13694eb38222903bca7245e3 (patch) | |
| tree | 156070581670446afae20241ce4bd2a7e85156ff | |
| parent | 052a689aa526ca51fd70528d4b0f83dfb2de99c1 (diff) | |
| download | xen-2a548e22915535ac13694eb38222903bca7245e3.tar.gz xen-2a548e22915535ac13694eb38222903bca7245e3.tar.bz2 xen-2a548e22915535ac13694eb38222903bca7245e3.zip | |
libxc: check blob size before proceeding in xc_dom_check_gzip
This is part of the fix to a security issue, XSA-55.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
| -rw-r--r-- | tools/libxc/xc_dom_core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c index 3cbf9f791e..f8d1b08ba8 100644 --- a/tools/libxc/xc_dom_core.c +++ b/tools/libxc/xc_dom_core.c @@ -284,6 +284,11 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, size_t ziplen) unsigned char *gzlen; size_t unziplen; + if ( ziplen < 6 ) + /* Too small. We need (i.e. the subsequent code relies on) + * 2 bytes for the magic number plus 4 bytes length. */ + return 0; + if ( strncmp(blob, "\037\213", 2) ) /* not gzipped */ return 0; |