libxc: check failure of xc_dom_*_to_ptr, xc_map_foreign_range

The return values from xc_dom_*_to_ptr and xc_map_foreign_range are
sometimes dereferenced, or subjected to pointer arithmetic, without
checking whether the relevant function failed and returned NULL.

Add an appropriate error check at every call site.

This is part of the fix to a security issue, XSA-55.

Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

v8: Add a missing check in xc_offline_page.c:xc_exchange_page,
     which was in the next patch in v7 of the series.
     Also improve the message.
     I think in this particular error case it may be that the results
     are a broken guest, but turning this from a possible host tools
     crash into a guest problem seems to solve the potential security
     problem.

v7: Simplify an error DOMPRINTF to not use "load ? : ".
    Make DOMPRINTF allocation error messages consistent.
    Do not set elf->dest_pages in xc_dom_load_elf_kernel
     if xc_dom_seg_to_ptr_pages fails.

v5: This patch is new in this version of the series.

1 files changed, 6 insertions, 0 deletions

diff --git a/tools/libxc/xc_dom_binloader.c b/tools/libxc/xc_dom_binloader.c
index 6469a651cc..e1de5b5c21 100644
--- a/tools/libxc/xc_dom_binloader.c
+++ b/tools/libxc/xc_dom_binloader.c
@@ -277,6 +277,12 @@ static int xc_dom_load_bin_kernel(struct xc_dom_image *dom)
     DOMPRINTF("  bss_size:  0x%" PRIx32 "", bss_size);
 
     dest = xc_dom_vaddr_to_ptr(dom, dom->kernel_seg.vstart, &dest_size);
+    if ( dest == NULL )
+    {
+        DOMPRINTF("%s: xc_dom_vaddr_to_ptr(dom, dom->kernel_seg.vstart)"
+                  " => NULL", __FUNCTION__);
+        return -EINVAL;
+    }
 
     if ( dest_size < text_size ||
          dest_size - text_size < bss_size )